EAA enforcement in 2026: what web agencies need to know

Published July 2026.

If you build or maintain websites for European clients — or for clients who sell into the EU — the European Accessibility Act stopped being a "someday" compliance topic in June 2025, when it became enforceable. A year in, enforcement is no longer theoretical: national authorities across member states are issuing findings, and the first widely reported court actions started landing in 2026. For a web agency, that's the moment client requests shift from "can you make this look nicer" to "can you prove we won't get fined."

What actually changed

The EAA (Directive (EU) 2019/882) requires a broad set of products and services — including e-commerce, banking, and other digital services sold into the EU — to meet accessibility requirements, in practice aligned with WCAG 2.1 AA. What changed in 2025 wasn't the law itself (it was adopted back in 2019); it's that the multi-year transposition and grace period ended, and member states now have working enforcement mechanisms — market surveillance authorities, complaint channels, and in some sectors, real penalties.

For agencies, the practical shift is this: a client who could previously treat accessibility as a nice-to-have now has actual downside risk for ignoring it, and — separately, in the US — ADA-related web accessibility lawsuits have kept climbing year over year regardless of EU law. Both pressures point the same direction: clients want to know what they're exposed to, and agencies are the ones who get asked first.

What agencies are actually being asked to produce

Not usually a certificate — nobody can issue one honestly, automated or not. What clients ask for, in practice:

• A list of what's currently wrong, prioritized by severity.
• Evidence that issues found were actually fixed, not just claimed fixed.
• A written accessibility statement they can publish and point to.
• For larger clients or public-sector work, a VPAT.

That's a workflow, not a one-time scan. It's also, not coincidentally, exactly what Gangway is built to produce: scan → prioritized findings → fix workflow → rescan verification → the documents above, generated from the same audit trail rather than assembled by hand under deadline pressure.

The one thing not to do

Don't tell a client their site is "compliant." No automated tool — Gangway included — catches more than a fraction of WCAG success criteria through automation alone (the honest estimate floats around 30–40%); the rest needs a human pass. Overclaiming compliance is exactly the pattern the FTC went after accessiBe for in 2023, and it's the fastest way to turn a good-faith effort into a liability. The safer, defensible position — and the one worth telling your clients — is "here's what we found, here's what we fixed, here's the evidence, and here's what still needs a human review." That's a sentence you can stand behind in a dispute. "We're compliant" is not.

See how Gangway's remediation workflow works or start a 14-day trial.