Web Accessibility for UK Businesses 2026: The EAA Trap, WCAG, and What Actually Fails

"We're not in the EU, so it doesn't apply to us."

That sentence has cost UK businesses money this year, and it will cost more of them money next year.

The European Accessibility Act became applicable on 28 June 2025. It is extraterritorial: it applies to any business selling covered digital products or services to EU consumers, regardless of where that business is based. A UK company with a checkout that EU residents can complete is in scope. Location is not the test — market access is.

Through 2026 that stopped being theoretical. The first EAA lawsuits were filed in France in November 2025. The Dutch ACM has been actively enforcing against e-commerce and electronic communications. Germany fined a retailer €150,000 over checkout alt-text failures. Penalties vary substantially by member state — from around €60,000 in Ireland to roughly €900,000 in Sweden.

Meanwhile, UK domestic obligations have not gone anywhere. The Equality Act 2010 applies to private sector services, and the Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018 bind central government, local authorities and a wide range of publicly funded bodies, with compliance actively monitored and reported on by the Government Digital Service.

This guide covers both regimes, the deadline most UK businesses are not tracking, what actually fails in real audits, and why the overlay widget you may have bought does not solve this.

This is an engineering guide, not legal advice. Confirm all positions with qualified counsel before they drive build or commercial decisions.

Two regimes, one build

The Equality Act point is underrated. It does not specify WCAG or any technical standard. It requires service providers to make reasonable adjustments so disabled people are not placed at substantial disadvantage. In practice, WCAG Level AA is the benchmark against which reasonableness is assessed — but the obligation is outcome-based, which means passing an automated scan is not a defence if a disabled user genuinely cannot complete your checkout.

The practical consequence: build to one standard and satisfy both. The EAA is the stricter, more specific and more actively enforced regime, so build to EN 301 549 and the UK position follows.

The WCAG version question

Worth being straight about, because published guidance disagrees.

Some sources state that UK public sector bodies are required to meet WCAG 2.1 Level AA under the 2018 Regulations, noting that WCAG 2.2 — published October 2023 — is not formally required by UK law and is adopted as best practice. Others state the current requirement is WCAG 2.2 Level AA.

On the EU side, the harmonised standard EN 301 549 v3.2.1 incorporates WCAG 2.1 Level AA, with v4.1.1 incorporating WCAG 2.2 expected.

Confirm your specific obligation with counsel rather than relying on any published summary, including this one.Requirements differ between public and private sector and between jurisdictions, and the standards are in the middle of a version transition.

The engineering answer is the same either way: build to WCAG 2.2 Level AA. It is a superset of 2.1 — the additional success criteria cover focus appearance, dragging alternatives, target size, consistent help and redundant entry. Meeting 2.2 satisfies 2.1 automatically, removes the version question from your risk register, and pre-empts the transition when EN 301 549 v4 lands. There is no scenario where building to 2.1 today is the cheaper decision over a three-year horizon.

WCAG 2.2 also became an ISO/IEC international standard in January 2025, which strengthens its position as the reference benchmark.

What enforcement actually looks like

The 2025-to-2026 shift is from applicable to enforced.

France. First EAA lawsuits filed November 2025. The Auchan case was heard in May 2026 and dismissed on procedural grounds — though the court acknowledged the website's inaccessibility, which is not a comfortable precedent for defendants relying on procedure.

Netherlands. The ACM has been actively enforcing against e-commerce and electronic communications services.

Germany. A retailer fined €150,000 over checkout alt-text failures. The specificity there is instructive: this was not an abstract finding about a site being generally poor. It was a discrete, testable defect in a transaction path.

Across the EU. National authorities spent the second half of 2025 building capability, and enforcement activity is expected to intensify through 2026 as monitoring authorities scale up auditing.

The pattern worth noting: enforcement concentrates on transaction paths. Checkout, login, account management, booking. Not your blog. If you are prioritising remediation with finite budget, fix the paths where money changes hands first — that is where both the legal risk and the commercial loss sit.

The June 2027 deadline nobody is tracking

The EAA includes transitional provisions, and one of them has a date most UK businesses have not diarised.

Service contracts concluded before 28 June 2025 must comply by 28 June 2027.

If you have a service running under an agreement predating the EAA's application date, you have until mid-2027 rather than being immediately in breach. That is genuinely useful breathing room — and it is also a deadline that arrives in under two years for systems that are usually the oldest and least accessible in the estate.

Other transitional arrangements apply to products and services lawfully in use before June 2025, and the European Commission is due to publish its first EAA review. Confirm which transitional provision applies to your specific circumstances with counsel — this is exactly the area where a general summary is insufficient.

Practical advice: identify which of your services sit under pre-June-2025 contracts, and treat 28 June 2027 as a hard date for those. Remediating a legacy system is slower than remediating a modern one, and two years is less runway than it sounds when the work has not started.

Accessibility is now a procurement gate

The commercial change in 2026, and the one that affects revenue rather than risk.

Enterprise buyers and public sector customers increasingly require accessibility documentation during vendor selection and contract renewal. Expect requests for WCAG conformance claims, audit summaries and remediation roadmaps as a standard part of the process.

What this means if you sell software or services: you now need a conformance artefact, not a claim. A VPAT or equivalent accessibility conformance report, an audit summary, and a dated remediation roadmap for known gaps. Vendors who can produce these move through procurement. Vendors who cannot get filtered before anyone evaluates the product.

A warning about accessibility statements. Under enforcement they function as public-facing compliance documents that can be assessed against actual user experience. A statement claiming conformance while checkout or login fails keyboard navigation creates risk rather than reducing it. Publish what is true, including known issues and target dates. An honest statement with a remediation plan is defensible; an inaccurate one is evidence.

What actually fails

From real audit patterns, ordered by how often they appear and how much they matter.

Keyboard traps and unreachable controls. A modal that cannot be dismissed without a mouse. A custom dropdown that cannot be operated with arrow keys. This blocks users entirely rather than inconveniencing them, and it is the most common serious failure in modern JavaScript applications.

Missing or meaningless alternative text. Particularly on functional images — buttons, icons, product images in a checkout. The German €150,000 fine turned on exactly this.

Form labels not programmatically associated. Visually adjacent text is not a label. A screen reader user hears an unlabelled field and cannot proceed.

Focus management in single-page applications. Route changes that do not move focus, modals that do not trap it, content that appears without announcement. SPA frameworks make this easy to get wrong and it is invisible to sighted testing.

Colour contrast below threshold. The most commonly cited and least severe. Easy to fix, easy to detect, and it dominates automated scan reports in a way that distorts prioritisation.

Error messages not announced. Validation errors rendered visually with no ARIA live region. The user submits, nothing appears to happen, and they abandon.

Custom components without ARIA semantics. A div styled as a button is a button to a sighted user and nothing to a screen reader. Every design-system component is a potential instance of this.

Timeouts without extension. Session expiry in a checkout with no warning or extension mechanism.

The distribution matters. Automated tools reliably catch contrast and missing alt text — roughly 30 to 40 percent of issues. Keyboard traps, focus management and semantic failures require manual and assistive-technology testing, and they are where the serious failures live. A clean automated scan is not evidence of compliance.

Why overlays do not work

Worth being direct, because a lot of UK businesses have bought one and believe the problem is handled.

Overlay widgets — the accessibility toolbar that offers contrast toggles and text resizing — do not remediate the underlying code. They add a layer on top of an inaccessible document. Keyboard traps remain traps. Unlabelled form fields remain unlabelled. Semantic failures remain semantic failures.

Beyond not fixing the problem, overlays frequently interfere with users' own assistive technology, which is why disability advocacy organisations have campaigned against them, and why a number of legal claims have been brought against sites using them.

The EU framework assesses whether a service is genuinely perceivable, operable, understandable and robust for users with disabilities. A widget does not change that assessment.

If you have one: it is not a compliance measure and should not be described as one in your accessibility statement. Budget for actual remediation.

Building it in

Retrofitting accessibility costs several times what building it in does. The difference is process, not tooling.

Design-system first. Fix components once and every instance inherits it. A single accessible header, navigation and form-field component resolves issues across hundreds of pages. This is the highest-leverage intervention available and it is why accessibility work should start in the design system rather than page by page.

Automated checks in CI. axe-core or equivalent, running on pull requests, blocking on new violations. Catches the 30 to 40 percent that automation catches, and — more importantly — stops regression. Most teams remediate once and drift back within a year without this.

Manual keyboard testing in the definition of done. Every interactive feature, tabbed through, before it ships. This costs minutes per feature and catches the most serious failure class.

Assistive technology testing at milestones. NVDA and VoiceOver on critical paths. Not every sprint — but before any release touching checkout, login or account management.

Continuous monitoring rather than annual audits. An annual audit tells you what was broken once a year. Continuous checking tells you the day it breaks. Given that most accessibility regression comes from routine feature work, the annual model detects problems roughly six months after they were introduced.

This is how we structure web development engagements for clients with EU exposure — accessibility as a property of the component library and the pipeline rather than a phase before launch. The same discipline applies to eCommerce platforms, where checkout is both the highest-risk path legally and the highest-value one commercially, and to mobile applications, which are explicitly in EAA scope alongside websites.

Cost, timeline and team shape

That last row is the argument. Building it in adds 8 to 15 percent. Retrofitting a transactional site costs multiples of that, takes longer, and produces a worse result because you are working around architecture that was not designed for it.

Genuine accessibility depth is a scarce and somewhat undervalued specialism in the UK market — it sits close to the general frontend rate despite being materially harder to find. Rate context is in our UK developer day rate index, and regional availability in our Manchester software development guide.

Six mistakes UK teams make

1. Assuming Brexit exempts you. The EAA applies on market access, not establishment. If EU residents can transact with you, you are in scope.

2. Buying an overlay and considering it done. It does not remediate the code and can make things worse for assistive technology users.

3. Treating a clean automated scan as compliance. Automation catches 30 to 40 percent. The serious failures are keyboard and semantic issues that require manual testing.

4. Publishing an accessibility statement that overstates conformance. Under enforcement the statement is a compliance document assessed against actual experience. An inaccurate one is evidence against you.

5. Remediating page by page instead of component by component. Fixing the design system resolves issues at scale. Fixing pages resolves them one at a time and they regress.

6. Not tracking the June 2027 transitional deadline. Services under pre-June-2025 contracts have a date, and legacy systems take longest to remediate.

Frequently asked questions

Does the European Accessibility Act apply to UK businesses? Yes, where a UK business sells covered digital products or services to consumers in the EU. The EAA applies on the basis of market access rather than where a company is established, so being outside the EU does not remove the obligation. It became applicable on 28 June 2025.

What WCAG level do UK websites need to meet? UK public sector bodies are bound by the Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018, with published guidance differing on whether the current requirement is WCAG 2.1 or 2.2 Level AA — confirm your specific obligation with counsel. Private sector obligations under the Equality Act 2010 are outcome-based rather than tied to a named standard, with WCAG Level AA used as the practical benchmark. Building to WCAG 2.2 Level AA satisfies both and pre-empts the standards transition.

What are the penalties for EAA non-compliance? Penalties are set by individual member states and vary considerably, from around €60,000 in Ireland to approximately €900,000 in Sweden. Germany fined a retailer €150,000 over checkout alt-text failures. Non-compliance can also result in market restrictions.

Is the EAA actually being enforced? Yes. The first lawsuits were filed in France in November 2025, the Dutch ACM has been actively enforcing, and enforcement activity is expected to intensify through 2026 as national monitoring authorities scale up auditing capability.

What is the June 2027 EAA deadline? Service contracts concluded before 28 June 2025 must comply by 28 June 2027. Other transitional provisions apply to products and services lawfully in use before June 2025. Confirm which applies to your circumstances with qualified counsel.

Do accessibility overlay widgets make a website compliant? No. Overlays add a layer over inaccessible code without remediating it — keyboard traps, unlabelled form fields and missing semantics all remain. They can also interfere with users' own assistive technology, and their use has featured in legal claims rather than defending against them.

How much does accessibility remediation cost? An audit of a mid-sized site typically runs £6k to £20k. Design-system component remediation runs £25k to £70k. Full remediation of a mid-sized transactional site runs £40k to £140k. Building accessibility into a new build adds roughly 8 to 15 percent to build cost, which is a fraction of retrofitting.

Will accessibility work help SEO? Frequently, yes — though it should not be the primary reason. Semantic HTML, proper heading structure, descriptive link text, alternative text and clear document outlines all serve both screen readers and crawlers, because both consume structural cues rather than visual layout.

What is the single highest-impact thing to fix first? Keyboard operability on transaction paths — checkout, login, account management. Enforcement concentrates there, keyboard failures block users entirely rather than inconveniencing them, and it is where you are losing revenue as well as carrying risk.

The short version

Two regimes, one build. The EAA is extraterritorial, applicable since June 2025, actively enforced in 2026, and reaches any UK business that EU consumers can buy from. The Equality Act 2010 was already there.

Three things worth doing this quarter.

Establish whether you have EU customers. If EU residents can complete a transaction with you, you are in scope, and a surprising number of UK businesses have not asked the question.

Audit your transaction paths for keyboard operability. Checkout, login, account management. That is where enforcement concentrates and where the serious failures live.

Fix the design system, not the pages. One accessible component library resolves issues at scale and stops them regressing.

And if you are relying on an overlay widget, budget for real remediation. It is not doing what you were told it does.

About Akoode Technologies

Akoode Technologies is an AI and software development company headquartered in Gurugram, India, with a US office in Oklahoma, working with clients across the UK, USA and India. We build web platforms, custom software, AI and machine learning systems, mobile applications and eCommerce platforms for startups, SMEs and enterprises across 15+ industries, with 180+ projects delivered globally and clients across the UK, including London and Manchester.

Verified ratings: 4.9 out of 5 on Google across 110 client reviews, and 5.0 out of 5 on GoodFirms.

If you want to know where your site actually stands — including whether you have EU exposure you have not accounted for — book a call.

This article is an engineering guide, not legal advice. Regulatory positions reflect published guidance and legal commentary as of August 2026. Published sources differ on the current WCAG version required under UK public sector regulations, and EN 301 549 is undergoing a version transition. Confirm all obligations, transitional provisions and conformance requirements with qualified counsel before they drive build or commercial decisions. Cost bands are indicative planning figures, not quotations.