Accessibility Compliance
The European Accessibility Act and EN 301 549: A Guide for Non-EU Businesses
The European Accessibility Act (EAA) is the EU's harmonised accessibility law for products and services offered to consumers in the European Union. Its reach is what surprises people: it applies based on where you sell, not where you are incorporated. A SaaS company in Bengaluru, London or Austin selling to EU consumers can be in scope. This guide explains what is covered, how the technical standard works, and what to actually do about it.
Why non-EU companies are caught by it
The EAA regulates products and services placed on the EU market. If you offer a covered service to consumers in an EU member state, the obligations attach regardless of where your company or your servers sit.
This is the same extraterritorial logic that made GDPR a global concern rather than a European one. Companies that assumed 'we are not an EU company' spent 2018 discovering otherwise, and the pattern is repeating with accessibility.
What is in scope
The Act lists specific product and service categories rather than applying to everything. The service categories are where most software businesses find themselves.
- E-commerce - consumer-facing online sales of goods or services
- Consumer banking services, including online and mobile banking
- E-books and dedicated reading software
- Electronic communications services
- Elements of air, bus, rail and waterborne passenger transport services
- Access to audiovisual media services
- Hardware including computers, smartphones, ATMs, ticketing and check-in machines, and payment terminals
How EN 301 549 and WCAG fit together
The EAA sets out functional accessibility requirements in fairly general legal language. EN 301 549 is the European harmonised standard that translates those requirements into testable technical criteria, and for web content and mobile applications it incorporates WCAG success criteria directly.
The practical consequence is reassuring: if you have already done rigorous WCAG 2.1/2.2 Level AA work, you have covered the large majority of what EN 301 549 asks of your digital channels. EN 301 549 does go further in places - documentation, support services and hardware requirements have no WCAG equivalent - so it is not a pure superset, but WCAG conformance is the bulk of the effort.
Exemptions, and their limits
Two relief mechanisms exist, and both are narrower than businesses hope.
Microenterprises providing services - broadly, fewer than 10 staff and under €2 million annual turnover - are exempt from the service obligations. Note this relief is for service providers; it does not extend in the same way to manufacturers of covered products.
There is also a 'disproportionate burden' provision, but it is not a self-declared opt-out. It requires a documented assessment weighing cost against benefit, has to be reassessed periodically, and must be produced to authorities on request. An undocumented assumption of disproportionate burden is simply non-compliance.
What to put in place
- Determine scope honestly - which of your services are consumer-facing in the EU, and are you actually within the microenterprise threshold?
- Audit digital channels against WCAG 2.2 AA with real assistive-technology testing, then close the EN 301 549 specific gaps (documentation, support channels, and hardware if relevant).
- Produce an accessibility statement describing conformance status, known limitations and a feedback route - EU users expect a way to report barriers.
- Make accessibility a procurement condition for third-party components in the customer journey, especially payment and identity providers.
- Build it into the release process. Point-in-time conformance decays with every sprint that has no accessibility acceptance criteria.
Enforcement is national, which cuts both ways
The EAA is a directive transposed into national law by each member state, so enforcement bodies, penalties and complaint procedures vary across the EU. There is no single European regulator issuing uniform fines.
That fragmentation is not good news for a multi-market business. If you sell across the EU you are potentially answerable to several national authorities with different procedures, which makes a single, well-documented conformance position far more efficient than country-by-country firefighting.
Need help with this in practice?
A5 Cyber Nexus audits, remediates and certifies against these frameworks.
Frequently asked questions
Does the EAA apply to companies outside the EU?
Yes. It applies to products and services placed on the EU market, so a company based in India, the UK or the US that offers covered consumer services in the EU can be in scope regardless of where it is incorporated.
Is EN 301 549 the same as WCAG?
Not identical. EN 301 549 incorporates WCAG success criteria for web and mobile, but also covers documentation, support services and hardware, which WCAG does not address. WCAG 2.2 AA conformance covers most, not all, of EN 301 549.
Which businesses are exempt from the EAA?
Microenterprises providing services - broadly under 10 employees and under €2 million turnover - are exempt from the service obligations. A 'disproportionate burden' exemption also exists but requires a documented, periodically reviewed assessment; it is not a self-declared opt-out.
What is an accessibility statement and do we need one?
It is a published page describing your conformance status, known limitations, the standard applied and how users can report barriers. It is expected practice for covered services in the EU, and it is the first thing many regulators and users look for.
We already conform to WCAG 2.2 AA. Are we compliant with the EAA?
You are most of the way there for digital channels. Remaining work typically involves accessible documentation and support channels, an accessibility statement, and hardware requirements if you supply covered devices.
Related on A5 Cyber Nexus
Make it accessible.
Make it attack-ready.
Prove both before launch.
Bring us your app, audit deadline, or security concern. We'll map the fastest path to WCAG conformance, VAPT coverage, and regulator-ready evidence.
