Laws and standards
What applies to you, and when.
Accessibility law is converging on one technical standard, WCAG, enforced through different routes: regulators in Europe, lawsuits and procurement in the United States. This page is a plain-language summary, not legal advice.
European Union
The European Accessibility Act
Directive 2019/882 has applied across the EU since 28 June 2025. It covers products and services sold to EU consumers regardless of where the company is based, including e-commerce (the full customer journey, on websites and apps), consumer banking, telecoms, transport booking and information, e-books and audiovisual media services.
Service providers with fewer than 10 employees and €2 million or less in turnover are exempt. Service contracts agreed before 28 June 2025 may continue unchanged until they expire, but for no longer than five years, so until 28 June 2030. Products lawfully used to provide a service before that date may also be used until 28 June 2030. New contracts must comply now.
The technical standard is EN 301 549, which incorporates WCAG 2.1 AA, with an update aligning to WCAG 2.2 under way. Enforcement is national: Germany's market-surveillance body has been operating since September 2025, with correction orders first and fines up to €100,000; French courts issued the first compliance orders in 2026.
Key dates
- 28 Jun 2025 Act applies
- 28 Jun 2030 Pre-existing service contracts and products end
United States
ADA Titles II and III, and Section 508
Title III: businesses open to the public
Courts treat websites and apps of businesses open to the public as covered by the ADA, and usually reference WCAG 2.1 AA as the benchmark. Enforcement is by private lawsuit: 3,117 web accessibility suits were filed in federal court in 2025, up 27% on 2024, with more than 5,000 including state courts. Nearly half of federal cases involved companies sued before.
Title II: state and local government
The Department of Justice rule requires state and local governments, and the vendors whose products they use, to meet WCAG 2.1 AA by 26 April 2027 for entities serving 50,000 people or more, and by 26 April 2028 for smaller entities and special districts.
Section 508: selling to the federal government
Federal agencies must buy accessible technology and ask vendors for an Accessibility Conformance Report. Without one, the purchase generally cannot proceed. Many states, universities and large enterprises apply the same requirement in their own procurement.
What it costs to ignore
- $1.5k–5k typical opening demand letter
- $5k–20k typical filed-case settlement, plus plaintiff's fees
- $25k–50k defence costs per claim
Ranges reported by accessibility and legal publishers; actual figures vary by case.
Elsewhere
United Kingdom, India, and what comes next
United Kingdom
The Equality Act 2010 requires reasonable adjustments for disabled people, and public-sector bodies must meet WCAG 2.2 AA under the 2018 accessibility regulations. The UK is outside the EU Act, but UK companies selling to EU consumers are covered by it.
India
The Rights of Persons with Disabilities Act 2016 requires accessible ICT, and government websites follow the Guidelines for Indian Government Websites (GIGW 3.0), which adopt WCAG. Indian companies selling into the EU or the US are covered by those jurisdictions' rules.
Next: the EU Cyber Resilience Act
Software and connected products sold in the EU must meet cybersecurity requirements under Regulation (EU) 2024/2847. Vulnerability reporting has applied since 11 September 2026; the main obligations apply from 11 December 2027, with fines up to €15 million or 2.5% of worldwide turnover. Verified compliance documentation for the CRA is Suretto's next module.
One standard underneath
WCAG 2.2 Level AA satisfies EN 301 549, the ADA rules' WCAG 2.1 AA benchmark, Section 508 and GIGW. Meeting it once, with evidence, covers every market above.
Sources: European Commission, EAA · Level Access, EAA overview · Seyfarth Shaw, 2025 lawsuit filings · DOJ Title II deadline extension · Section508.gov · European Commission, Cyber Resilience Act.
See it on your own product.
Start with one agreed user journey at no cost through early 2027. We agree the defects, deliverables and your review effort before the pilot begins.