The European Accessibility Act: what SaaS founders must fix (and the €100k risk)

On June 28, 2025, the grace period for the European Accessibility Act (Directive (EU) 2019/882, commonly known as the EAA) officially expired. From that date onward, digital accessibility ceased to be an idealistic design philosophy or a specialized public-sector procurement requirement. It became binding statutory law across all 27 European Union member states.

For years, software founders operated under the comforting assumption that web accessibility was someone else’s problem. They assumed accessibility laws only targeted government agencies, public transit authorities, and massive hospital networks under the earlier Web Accessibility Directive (EU 2016/2102). In venture-backed tech and bootstrapped SaaS circles, accessibility was routinely demoted to a "nice-to-have" ticket lingering in the backlog behind the next AI feature or growth experiment.

That era is over. The European Accessibility Act is explicitly modeled on the single-market harmonization principle: its mandate applies directly to commercial digital products and consumer-facing services operating in the EU. If your software enables European users to browse products, subscribe to software, transact through a checkout flow, read digital content, or manage an account, you are in the regulatory crosshairs.

The financial and operational exposure is severe. In Germany alone, non-compliance carries statutory administrative fines of up to €100,000 per violation, paired with powers that allow market surveillance authorities to order non-compliant platforms to halt service. In Spain, penalties can reach €1,000,000 for systemic violations. In Ireland, non-compliance carries potential criminal liability for corporate officers.

In this comprehensive guide, we examine the legal boundaries of the EAA, dissect the fine ranges across major EU member states, break down the five most frequent code failures discovered in real audits, debunk the myth of "one-line accessibility overlay widgets," and provide a step-by-step roadmap to audit and remediate your SaaS platform today.

Does the EAA apply to my SaaS? Who’s in, who’s out, and the micro-enterprise exemption

To understand whether your SaaS falls within the scope of Directive (EU) 2019/882, you must examine three criteria: the nature of your service, your geographic audience, and your organizational headcount and balance sheet.

1. What digital services are covered?

Under Article 2 of the Directive, the EAA covers a wide array of digital services that interface with consumers. Most notably for software companies, this includes:

• E-commerce services: The law defines e-commerce as any digital service allowing consumers to conclude a contract at a distance. If your SaaS features a public pricing page, a self-serve checkout flow, a Stripe billing integration, or a paid subscription portal accessible to individual consumers, your checkout and onboarding flows qualify as e-commerce services.
• Consumer banking and financial software: Fintech platforms, investment apps, personal finance trackers, and payment gateways.
• Electronic communication services: Messaging platforms, video conferencing tools, VoIP services, and webmail applications.
• Digital media and e-books: Digital publishing platforms, e-book readers, documentation software, and audiovisual media portals.

2. The Extraterritorial Reach: Are US and UK founders liable?

Just like the GDPR, the European Accessibility Act is extraterritorial. The law does not care where your corporate entity is headquartered. If your company is registered in Delaware, London, Singapore, or Sydney, but your website or SaaS application is actively offered to consumers residing in the European Union (e.g. accepting payments in Euros, providing localized European language options, or marketing to EU citizens), you are legally bound by the EAA.

3. The Micro-Enterprise Exemption (and Its Hidden Traps)

Article 4(5) of Directive 2019/882 provides an exemption for "micro-enterprises." A micro-enterprise is formally defined as an enterprise that meets BOTH of the following conditions:

• • Employs fewer than 10 persons (full-time equivalents), AND
• • Has an annual turnover OR annual balance sheet total not exceeding €2 million.

If you exceed EITHER threshold—for example, if you are a team of 12 engineers doing €800k ARR, or a team of 4 founders doing €2.4M ARR—you are disqualified from the micro-enterprise exemption. You must comply.

Furthermore, SaaS founders must beware of two critical hidden traps regarding this exemption:

• Trap A: The B2B Enterprise Supply Chain Flow-Down: Even if your startup is a 3-person micro-enterprise, if you sell software to mid-market or enterprise clients in the EU (such as banks, retail brands, telecom operators, or public bodies), those enterprise buyers are legally mandated to comply with the EAA. Their procurement, legal, and risk teams are now requiring all software vendors—regardless of vendor headcount—to certify WCAG 2.1 AA conformance and deliver a formal Accessibility Statement (VPAT). If your app is not accessible, you will be disqualified during enterprise security reviews.
• Trap B: Services vs. Products: The micro-enterprise exemption applies only to service providers. If you manufacture or distribute hardware terminals, consumer devices, or software bundled with physical products placed on the EU market, the exemption does not apply.

What are the fines? Ranges by country, including the €100k figure

Because the EAA is an EU Directive rather than a single unified Regulation (like the GDPR), it required individual transposition into the domestic laws of each of the 27 EU member states. Consequently, enforcement mechanisms, market surveillance bodies, and penalty structures vary across borders.

Here are the fact-checked statutory penalties established in major European jurisdictions:

• Germany (Barrierefreiheitsstärkungsgesetz - BFSG): Germany’s transposition is one of the most aggressive in Europe. Under § 37 BFSG, administrative fines of up to €100,000 can be levied for intentional or negligent failure to comply with accessibility requirements or for failing to cooperate with market surveillance authorities. Crucially, the BFSG grants market surveillance authorities the statutory power to order the complete prohibition of the non-compliant digital service or force remediation under strict deadlines.
• France (Law No. 2023-171): In France, administrative sanctions reach up to €50,000 for legal entities, with fines doubling up to €100,000 for repeat offenses. In addition to monetary penalties, French authorities enforce public "name and shame" sanctions, publishing formal non-compliance orders on government portals.
• Ireland (S.I. No. 636/2023): The European Union (Accessibility of Products and Services) Regulations 2023 establish both civil and criminal penalties. On summary conviction, fines reach up to €5,000 or imprisonment for up to 6 months. On conviction on indictment, fines can reach up to €60,000 and up to 18 months imprisonment for corporate directors and officers who consented to or facilitated non-compliance.
• Spain (Ley 11/2023): Spain implemented a tiered penalty model scaling from minor infractions (€301 to €30,000), to serious infractions (€30,001 to €90,000), up to €1,000,000 for very serious, systemic violations that intentionally discriminate against persons with disabilities.
• Italy (Legislative Decree 82/2022): Fines range between €2,500 and €40,000, with escalation provisions up to 5% of annual global turnover for systemic, un-remediated commercial non-compliance.

Beyond state administrative fines, there is an equally dangerous risk: competitor injunctions and consumer litigation. Under EU consumer protection directives, certified consumer advocacy associations (such as Germany’s *Verbraucherzentralen*) are empowered to issue cease-and-desist warnings (*Abmahnungen*) with statutory legal fees, freezing marketing campaigns until full compliance is proven.

What fails most often? Contrast, missing labels, keyboard traps, images without alt text, vague link text

The harmonized European technical standard under the EAA is EN 301 549, which directly maps to WCAG 2.1 Level AA. When we conduct comprehensive code-level audits on modern SaaS platforms and marketing sites, we find that over 85% of accessibility violations stem from five recurring patterns:

• 1. Contrast Ratio Failures (WCAG 1.4.3): Modern dark-mode and minimal grey-on-white designs are notorious offenders. The standard mandates a contrast ratio of at least 4.5:1 for regular text and 3.0:1 for large text (18pt or 14pt bold). Designers frequently use subtle muted greys (like `#94a3b8` on `#0f172a` or `#a1a1aa` on `#ffffff`) that drop to 2.8:1. For visitors with low vision, aging eyes, or anyone viewing a phone screen in outdoor sunlight, your content becomes completely unreadable.
• 2. Missing or Inaccessible Form Labels (WCAG 1.3.1 & 4.1.2): A classic frontend mistake: building an input with placeholder text instead of an explicit `<label for="...">` or `aria-label`. When a screen reader user navigates into the field, the placeholder vanishes or fails to announce context. The user is told "Edit text," with zero indication whether they are expected to enter an email address, credit card number, or account password.
• 3. Keyboard Traps and Missing Focus Rings (WCAG 2.1.1 & 2.4.7): CSS resets that declare `outline: none` or `*:focus { outline: none; }` without providing custom focus rings. A keyboard-only user (or anyone using switch devices or screen magnifiers) presses `Tab` to navigate your site and is left completely blind, with no visual cursor indicating where their focus is. Even worse: unmanaged custom dropdowns and modal dialogs that trap keyboard focus in an endless DOM loop with no way to press `Escape` to exit.
• 4. Images and Icon Buttons Without Alt Text (WCAG 1.1.1): In modern component libraries, developers frequently write buttons containing raw inline SVGs: `<button><svg>...</svg></button>`. To a sighted user, the magnifying glass icon is obviously a search button. To a screen reader, it is announced as "unlabelled button," completely halting the user’s ability to complete a transaction.
• 5. Vague Link and Button Text (WCAG 2.4.4): Buttons and anchor links containing generic labels like "Click here," "Learn more," "Read more," or "Submit." Blind users frequently navigate pages by pulling up an alphabetical rotor list of all hyperlinks on the page. A screen reader announcing "Learn more, Learn more, Learn more, Click here" provides zero semantic information about destination or action.

Is an accessibility overlay enough? No, and why

When founders learn about the EAA, their immediate instinct is often to seek a cheap, instantaneous fix. Within minutes, they encounter aggressive advertisements from "accessibility overlay" companies promising full legal compliance by pasting a single line of JavaScript into the website header.

Here is the unvarnished reality: Accessibility overlays do NOT make your site compliant with the European Accessibility Act. In fact, installing an overlay often increases your legal and brand liability.

Here is why the global accessibility community, European regulatory bodies, and disability rights organizations unanimously reject overlays:

• Overlays cannot rewrite underlying DOM architecture: An injected client-side script cannot fix broken keyboard focus traps, improper semantic landmark structures, un-synchronized custom state machines, or missing server-rendered form relationships. Automated AI heuristics cannot guess what an ambiguous database entity or complex dynamic chart actually means.
• They actively conflict with assistive technologies: Disabled individuals already use specialized, highly configured assistive software—such as NVDA, JAWS, Apple VoiceOver, or high-contrast OS themes. When an overlay script overrides the browser’s native accessibility tree, it frequently conflicts with the user’s personal assistive setup, creating a chaotic and unusable browsing experience.
• Regulatory and judicial rejection: Over 800 accessibility professionals and disability advocates signed the international Overlay Factsheet. In both European enforcement actions and US federal court rulings, judges have repeatedly held that third-party overlay widgets do not shield businesses from accessibility lawsuits or statutory non-compliance fines.

The Bottom Line: The law requires the underlying code, document structure, and user interface of your digital service to be accessible natively. There is no automated shortcut that absolves you from writing semantic HTML.

How do I check my site today? The free scan, with a sample report screenshot

You do not need to wait for a warning letter from an EU market surveillance agency or a formal legal audit to understand where your platform stands. You can inspect your primary conversion funnels and marketing pages right now using our free automated scanner.

Navigate to wolfitway.com/tools/wcag and input your domain. In under 60 seconds, our engine crawls your public pages and evaluates your baseline compliance against EN 301 549 and WCAG 2.1 AA criteria.

The automated report generates an itemized breakdown of your code health:

• Color Contrast Matrix: Pinpoints every text node, button, and active link that falls below the 4.5:1 ratio threshold, displaying the exact foreground and background hex values alongside required adjustments.
• ARIA & Form Label Inspection: Scans all inputs, textareas, and modal triggers to ensure explicit programmatic labeling and valid ARIA attributes.
• DOM Hierarchy & Landmark Structure: Verifies logical `<h1>` through `<h6>` nesting order and standard HTML5 landmark regions (`<header>`, `<main>`, `<nav>`, `<footer>`).

Automated scanners catch approximately 35% to 50% of WCAG failures (primarily mechanical and mathematical violations like contrast and attributes). The remaining 50% consists of behavioral interaction: keyboard navigation flow, focus management, screen reader announcement timing, and dynamic state transitions.

You can test your behavioral accessibility right now in 5 minutes with a simple manual exercise: put your mouse away. Use only the `Tab` key, `Shift+Tab`, `Spacebar`, and `Enter`. Can you reach your navigation menu, open a dropdown, fill out your signup form, and submit payment without touching your trackpad? If you get stuck in a modal or lose your visual focus cursor, you have an urgent fix.

What does fixing it cost?

When faced with an accessibility audit revealing hundreds of legacy contrast, focus, and semantic errors across an old WordPress, Webflow, or bloated React codebase, founders often assume remediation will consume months of engineering bandwidth and tens of thousands of euros in consultant fees.

In reality, attempting to patch accessibility onto a fundamentally broken, component-heavy legacy site is like trying to fix the foundation of a house after the roof is already built. You spend weeks fighting CSS specificity wars and hacking third-party plugin scripts that you don’t even own.

The far more cost-effective strategy is sovereign clean-sheet engineering: building your core marketing funnel, landing pages, and key conversion paths accessible-by-default.

For a comprehensive briefing on the EAA legal requirements and our compliance advisory services, visit our dedicated statutory guide at wolfitway.com/european-accessibility-act.

The Sovereign Landing Page Solution: Full WCAG 2.2 AA compliant landing page in 3 working days, €1,200 fixed investment.

• Built from scratch using semantic HTML5 and accessible Nuxt 4 architecture. • Certified WCAG 2.2 AA conformance: verified 4.5:1+ contrast ratios, explicit ARIA bindings, and perfect keyboard focus navigation. • 100/100 Google Lighthouse performance score with sub-second LCP. • Zero recurring platform fees—you own 100% of the source code and host directly on your own infrastructure.

Inspect deliverables and reserve your 3-day sprint: wolfitway.com/landing

Frequently Asked Questions about the European Accessibility Act

Does the European Accessibility Act apply to UK or US companies with no EU office?

Yes. The EAA applies to any business that places covered products on the EU market or provides covered digital services to consumers residing in the European Union, regardless of where the company is legally incorporated or hosted. If a US or UK SaaS company markets to EU consumers, accepts transactions in Euros, or provides consumer services within the single market, it must comply with the EAA.

What is the exact technical difference between WCAG 2.1 AA and EN 301 549?

WCAG (Web Content Accessibility Guidelines) is the global technical standard maintained by the W3C. EN 301 549 is the European harmonized standard for digital accessibility. For web content and electronic documents, EN 301 549 Clause 9 directly references and adopts WCAG 2.1 Level AA in its entirety as the baseline benchmark for presumption of conformity under the EAA.

Can a purely B2B SaaS platform ignore the EAA if it does not sell to individual consumers?

Directly under statutory text, pure B2B services (where both parties are legal business entities and the product is not used by general consumers) are technically outside the primary scope of Directive 2019/882. However, in practice, B2B SaaS companies face indirect contractual mandates: enterprise clients subject to the EAA or public procurement rules (Directive 2016/2102) are legally required to audit their vendor supply chains and mandate WCAG 2.1 AA conformance in software contracts. Furthermore, if your B2B site has a self-serve checkout or public pricing page, consumer protection authorities may classify the signup flow as an e-commerce service.

Do I need to publish an Accessibility Statement on my website under the EAA?

Yes. Annex V of Directive 2019/882 requires service providers to formulate an Accessibility Statement explaining how the service meets accessibility requirements. The statement must be published in an accessible format on the website or application, detail the level of conformity achieved, explain any alternative mechanisms provided, and provide a direct contact mechanism for users to request assistance or report barriers.