The European Accessibility Act has applied since 28 June 2025, and enforcement started for real: a French court gave Carrefour six months to fix its site and app under a daily penalty, German shops are receiving Abmahnungen, and Sweden’s regulator opened its first cases. The technical benchmark resolves to WCAG — and the same agencies that absorbed cookie compliance are about to absorb this too.
If you run compliance for client websites, you have seen this movie. A European regulation applies to far more companies than anyone expects, nobody budgets for it, and then the first enforcement wave turns it into a line item overnight. GDPR in 2018, and now the European Accessibility Act (Directive (EU) 2019/882).
Enforcement stopped being hypothetical in 2026
Three data points from the first enforcement year:
- France: in June 2026 a court ordered Carrefour to make its e-commerce site and mobile app fully accessible within six months — with a penalty payment for every day of delay. A top-tier retailer, not an obscure test case.
- Germany: within weeks of the BFSG taking effect, online shops began receiving formal warning letters (Abmahnungen) citing accessibility violations. Fines under the BFSG reach €100,000 — but the Abmahnung machine is the faster risk, exactly as it was for cookie banners.
- Sweden: the telecom regulator PTS opened its first e-commerce enforcement cases after 124 public complaints.
For scale: in the US, where web accessibility litigation matured a decade earlier, plaintiffs filed 5,114 digital accessibility lawsuits in 2025 alone — 70% of them against e-commerce. The EU is at the start of that same curve.
The standard is WCAG, same as your consent work touches
The EAA itself contains no technical checklist. The harmonised standard EN 301 549 does, and for websites it points at WCAG level AA. If your agency already audits client sites for consent and trackers, the muscle is transferable: crawl, test against a rulebook, prioritize, fix, monitor for regressions.
And the failure surface is embarrassingly repetitive. The WebAIM Million analysis (February 2026, top one million homepages) found 96% of all detected accessibility errors fall into just six machine-detectable categories — low contrast text (83.9% of homepages), missing alt text (53.1%), unlabeled form fields (51%), empty links (46.3%) among them.
Who is actually in scope
Businesses selling products or services to consumers in the EU — e-commerce, banking, transport, e-books, telecoms — regardless of where the company is based. Microenterprises providing services (under 10 employees and €2M turnover) are exempt. Your agency probably qualifies for the exemption; your clients mostly will not. That asymmetry is why agencies and law firms feel this first: the exposure sits across their whole portfolio.
For the full breakdown of deadlines, national transpositions and what to do first, see the EAA compliance guide for websites we published on WCAG Inspector — a new accessibility audit tool from the same team behind CookieInspector, currently in early access.
What to do this quarter
- Inventory which clients sell B2C into the EU — that is the in-scope list.
- Run automated WCAG scans across the portfolio to find the six common failure categories. This is the cheap, fast half of the problem.
- Fix machine-detectable failures, document the work (it matters if a letter arrives), and schedule human review for the criteria automation cannot judge.
- Put monitoring in place — sites regress with every deploy, and the second Abmahnung is not cheaper than the first.
Accessibility and consent are converging into the same client conversation: what does this site load, what does it show, and can every visitor use it. CookieInspector’s agency tools cover the consent half today; WCAG Inspector is the accessibility half — join the waitlist for early access and founding pricing.