How EAA Enforcement Works: From Complaint to Fine

The enforcement clock is running

The European Accessibility Act came into force on June 28, 2025. Enforcement doesn’t wait for organizations to be ready — it begins when a complaint is filed or when a monitoring authority initiates a review. Understanding how that process works, and what your obligations are at each stage, is the first step to managing it sensibly.

Who enforces the EAA?

The EAA is a European directive, meaning each EU member state enacts it through national legislation and designates its own enforcement bodies. This creates some variation across countries, but the basic structure is consistent.

Market surveillance authorities monitor products and services for compliance. In France, this function sits partly with the DGCCRF (Directorate General for Competition, Consumer Affairs and Fraud Prevention). In Germany, enforcement is distributed across regional bodies. In Italy, the AgID (Agency for Digital Italy) handles public sector accessibility, with consumer authorities covering private sector services.

Ombudsman or mediation mechanisms allow users to request accessible alternatives or lodge formal complaints before a regulatory body becomes involved.

Most enforcement begins with a complaint from a user or an advocacy organization, rather than a proactive audit by the authority.

The enforcement pathway: five stages

Stage 1: The user encounters a barrier

A person with a disability attempts to use your website or app and cannot complete a task — they can’t use the checkout, navigate your menus with a screen reader, or access content that’s presented only as an inaccessible PDF.

Stage 2: Complaint filed with your organization or a regulator

The user first contacts your organization (via the feedback mechanism required by the EAA, or by email/phone). If you don’t respond, or your response is inadequate, they may escalate to the relevant national enforcement body.

Disability advocacy organizations also file complaints systematically — they audit websites specifically to identify barriers, then file on behalf of their members or the public. This is how many GDPR complaints were initiated, and it’s how EAA enforcement will increasingly work.

Stage 3: Investigation

The enforcement authority examines the complaint. They may:

• Request documentation from your organization (accessibility statement, audit records, remediation plans)
• Conduct their own technical assessment of the site
• Engage technical experts to evaluate conformance

This phase can take weeks to months, depending on the authority and the complexity of the case.

Stage 4: Formal notice

If the authority finds the complaint credible and your site non-compliant, they issue a formal notice — a legally binding order that identifies the specific violations, requires corrective action, and sets a deadline for compliance.

A formal notice is not yet a fine. It’s an opportunity to fix the problem before sanctions apply. Organizations that respond promptly, document their remediation progress, and maintain communication with the authority typically have better outcomes than those who ignore the notice.

Deadlines in formal notices are typically 30 to 90 days, though this varies by member state and severity.

Stage 5: Sanctions if violations persist

If an organization fails to comply with the formal notice within the specified timeframe, the authority can impose sanctions.

Financial penalties vary significantly by country:

• France: provisions for fines of up to €25,000 per year per violation under the relevant accessibility legislation
• Italy: penalties under the BFSG implementation scale with severity
• Germany: fines under the BFSG can reach into the tens of thousands of euros

Beyond financial penalties, authorities can order temporary suspension of the service, require corrective public notices, and in extreme cases restrict market access for the product or service in question.

What to do if you receive a formal notice

Don’t ignore it

A formal notice is not a suggestion. The deadlines are real. Organizations that fail to respond — even if they begin remediation — risk the perception of bad faith, which affects how the authority treats subsequent interactions.

Acknowledge receipt and confirm you’re engaging

A brief, professional acknowledgment that you’ve received the notice and are actively addressing it costs nothing and establishes goodwill. If you have legal counsel, loop them in immediately.

Commission or accelerate an accessibility audit

If you haven’t yet audited the service identified in the notice, do it now. You need to understand the full scope of violations — not just the ones the complainant identified — to create a credible remediation plan.

Document everything

The authority will want evidence that you’ve taken concrete steps. Maintain records of:

• What audit was conducted and when
• What issues were identified
• What was fixed and when it was deployed
• What remains outstanding and your timeline for addressing it

An accessibility statement that reflects your current state — including known gaps and your remediation timeline — is part of this documentation.

Negotiate where possible

Enforcement authorities generally prefer resolution over punitive action. A well-documented remediation plan with credible timelines is often accepted in lieu of immediate full compliance. Organizations that demonstrate genuine effort and transparency tend to receive more favorable treatment than those who deny the problem or promise future action without specifics.

Proactive compliance is far cheaper

The calculus is straightforward. A thorough accessibility audit costs a fraction of a formal enforcement action. Remediating known barriers before they generate complaints costs less than scrambling to fix them under deadline pressure with regulators watching.

The organizations that manage EAA compliance well are treating accessibility as a continuous program, not a one-time project. That means regular audits, integrating accessibility into development workflows, and maintaining an accessibility statement that reflects where you actually stand.

If you haven’t started yet, the fastest beginning is a free automated scan to understand your current position. When you’re ready to move beyond what automation can see, talk to our team about what a full compliance program looks like for your organization.