European Accessibility Act: who it applies to and what an e-commerce site must do

Since 28 June 2025 the European Accessibility Act applies to e-commerce. A lot of what circulates about it is imprecise: that it covers every website, that a widget is enough, that there’s time until 2030. This article sets out what the directive, the Italian implementing decree and the guidelines of AgID (Italy’s digital agency and EAA regulator for services) actually say, with a link to the source for each point.

The directive is the same across the EU; enforcement, fines and national guidance below are Italy’s. It isn’t legal advice: for your specific case you need a lawyer. It’s the technical framework an accessibility audit starts from, checked against the sources on 28 October 2026.

In short

• It covers anyone selling online to consumers. A shop only for businesses is out; a shop open to both consumers and businesses is fully in.
• Micro-enterprises providing services are exempt: fewer than 10 persons employed and annual turnover or balance sheet total not above €2 million.
• What’s required is accessibility information about the service, placed in the general terms and conditions or an equivalent document. In Italy, the old public-sector-style “accessibility statement” no longer applies to EAA services.
• The technical reference used by Italy’s regulator AgID is EN 301 549 v3.2.1, which for web pages means WCAG 2.1 level AA.
• In Italy AgID enforces it. Fines range from €5,000 to €40,000 for breaching the requirements.
• 2030 is not a general extension for existing websites.

Is your shop in scope?

The directive defines e-commerce services as services provided at a distance, through websites and mobile apps, “at the individual request of a consumer with a view to concluding a consumer contract” (Directive 2019/882, art. 3(30)). Italy’s decree uses the same definition (D.Lgs. 82/2022, art. 2(1)(hh)). It applies to the online sale of any product or service (recital 43).

Three common cases:

1. B2B-only shops. A consumer is a natural person acting outside their trade or profession (art. 3(22)). AgID therefore excludes services offered only to businesses. If the shop is also open to private buyers, AgID says the whole service must comply (AgID guidelines, §8.1).
2. Brochure sites with no online sales. No official source addresses this explicitly. But if nothing can be bought through the site, the “with a view to concluding a consumer contract” element is missing. That’s a reading of the text, not an AgID position.
3. Online bookings (hotels, events, paid services). If the booking concludes a distance contract with a consumer, it fits the definition. Again a reading of the text; there’s no dedicated official FAQ. Passenger transport tickets are a separate category (art. 2(2)(c)).

The obligation also applies to providers based outside the EU who sell to EU consumers (AgID FAQ N_82/22_03).

Micro-enterprises are exempt, if they genuinely are micro-enterprises

A micro-enterprise is one “which employs fewer than 10 persons and which has an annual turnover not exceeding EUR 2 million or an annual balance sheet total not exceeding EUR 2 million” (art. 3(23)). Both conditions must be met. Many articles write “or” where the text says “and”, which changes the result considerably.

The exemption covers only enterprises providing services (art. 4(5)), and the enterprise must genuinely meet the criteria of Recommendation 2003/361/EC (recital 53). That recommendation has rules on partner and linked enterprises: if you’re part of a group, check how staff and turnover are counted before treating yourself as exempt. SMEs in general are not exempt.

What the rules ask for in practice

The requirements are in Annex I. The general ones ask for websites and apps that are “perceivable, operable, understandable and robust”, information about how the service works available through more than one sensory channel, in text formats and with alternatives to non-text content. If there’s customer support, it must provide information on accessibility in accessible ways (Annex I, section III).

For e-commerce there are three specific requirements (Annex I, section IV(g)):

1. provide the accessibility information about products and services being sold, when the responsible economic operator (for example the manufacturer) supplies it;
2. make identification, security and payment functions accessible when they’re part of the service;
3. offer identification methods, electronic signatures and payment services that are perceivable, operable, understandable and robust.

In everyday terms, login, cart and checkout are where the risk concentrates. Typical examples are a checkout that can’t be completed by keyboard, a payment error shown only as a red border, a CAPTCHA with no alternative.

There’s also a process side that’s easy to forget (art. 13; D.Lgs. art. 12). Providers must have procedures to keep the service compliant over time. If they find a non-conformity, they must fix it and inform the authority immediately, stating what’s wrong and what they’re doing about it. Fixing the site once isn’t enough.

Accessibility information, not a “statement”

What the EAA requires is the information in Annex V of the directive (Annex IV of the Italian decree): a description of the service in accessible formats, an explanation of how it works and of how it meets the requirements. It goes in the general terms and conditions or an equivalent document, made public in written and oral form and kept for as long as the service runs (art. 13(2) and Annex V).

In Italy the accessibility statement required by the public-sector law (Legge Stanca) no longer applies to EAA services (D.Lgs. art. 25(3); AgID FAQ N_82/22_11). AgID adds one specific point: the information must state that the service doesn’t use tracking techniques (cookies, fingerprinting) from which a disability could be inferred (AgID guidelines, §5.1). I found no mandatory AgID template, and no duty to send the document to AgID.

Which technical standard

Presumption of conformity only comes with harmonised standards cited in the EU Official Journal under the EAA (art. 15). As of today no version of EN 301 549 appears to be cited on that basis; version 3.2.1 is cited under the public-sector web directive (Decision 2021/1339).

In practice this changes little. AgID names EN 301 549 v3.2.1 as the reference for EAA services, and for web pages its clauses match WCAG 2.1 level AA (AgID guidelines, §7.1 and §8.5). Version 4.1.1 was adopted on 24 August 2026, aligned with WCAG 2.2 and with an annex mapping it to the EAA requirements (ETSI EN 301 549 V4.1.1). It will give presumption of conformity only if and when it’s cited in the EU Official Journal. If you’re rebuilding your site now, designing for WCAG 2.2 usually costs little extra and saves a second round.

Enforcement and fines in Italy

AgID supervises services: it handles complaints and can also check compliance on its own initiative (D.Lgs. art. 21). Proceedings can start from a complaint on AgID’s platform. The Digital Ombudsman asks for fixes; if they don’t arrive in time, injunctive measures and sanction proceedings follow, with a formal warning and a decision within 90 days. The case is closed if you comply within the warning period (AgID regulation, arts. 3-9). Among the possible measures, if the requested fixes aren’t made, AgID can set a deadline to take the service offline or remove the app from the store; these are lifted once the service complies (D.Lgs. art. 21(1)).

Fines (D.Lgs. art. 24):

Breach	Fine
Accessibility requirements or provider obligations	€5,000 to €40,000
Ignoring AgID’s measures or failing to cooperate	€2,500 to €30,000
Companies with average turnover above €500 million	up to 5% of turnover

So the “5% of turnover” you often read about only applies to very large companies.

Disproportionate burden isn’t a loophole

A requirement can be set aside if it would fundamentally alter the service or impose a disproportionate burden (art. 14; D.Lgs. art. 13). But the assessment must follow the criteria in Annex VI of the directive (Annex V of the Italian decree), be documented, kept for at least five years and renewed at least every five years or whenever the service changes. It must also be notified to the authority (micro-enterprises are excluded from this duty). And it covers only the requirements that are genuinely disproportionate; the others still apply (recital 66).

2030 isn’t an extension for websites

The 28 June 2030 date covers two things: products (hardware, terminals) already in use for similar services, and service contracts agreed before 28 June 2025, which may continue unchanged until they expire but no longer than five years (art. 32(1)). According to AgID, once the service is changed the transitional regime no longer applies (AgID guidelines, §8.1). The site itself has had to comply since 28 June 2025: the transitional regime covers only products already in use and consumer contracts concluded before that date, as long as they stay unchanged.

Overlays aren’t enough

Widgets added with one line of code promise compliance. AgID states plainly that an overlay does not automatically guarantee compliance (AgID FAQ N_82/22_12). The widget doesn’t change the checkout code, the form labels or the navigation order, which are the things that matter.

Where to start

If you run a consumer-facing shop and you’re not a micro-enterprise, this is the order I recommend:

1. List the flows: search, product page, cart, sign-up and login, checkout, payment, customer area, support.
2. Have those flows tested with keyboard, screen reader and automated tools against WCAG 2.1 AA. Automated tools alone find only part of the problems.
3. Fix login, checkout and payment first, where the rules are most explicit and where a problem blocks the sale.
4. Write the accessibility information, put it in the terms and conditions or a linked page, and plan how to provide it orally too, for example through customer support.
5. Build testing into your release process, so new features don’t reopen problems you’ve already closed.

For a technical review of your shop, see the accessibility audit.