EAA compliance checklist — four areas of work, what each one means in practice
An audit covers one of the four areas of EAA compliance work. This checklist covers all four: what each one means and what evidence you need to show for it.
EAA compliance is not a single task. The Act does not set out a four-part list. Its obligations for service providers, in Articles 4, 13 and 14 and Annex I, turn into four areas of work, and each one has to be done separately. An audit does not produce your published information, and neither of them keeps the service accessible after the next release.
This checklist is structured around those four areas. Use it to identify which you have addressed, which you have partially addressed, and which have not been started. The free assessment covers all four.
Two duties sit outside the four areas and are easy to miss. If your service does not meet the accessibility requirements, you must take corrective measures and immediately inform the competent authorities in the Member States where you provide it (Article 13(4)). If you rely on the disproportionate burden exception, you must carry out and document the assessment, keep it for five years after the service was last provided, renew it when the service is altered, when the authority asks, and at least every five years, and inform the relevant authority (Article 14). Microenterprises providing services are exempt from the accessibility requirements and from these duties (Article 4(5)).
Before using this checklist: The EAA applies to specific products and services provided to consumers in the EU, and microenterprises providing services are exempt. If you are not certain whether the EAA applies to your organisation, the free assessment is the right starting point. Applying the checklist to an organisation that is out of scope wastes resource.
Area 1 — Technical conformance
The accessibility requirements are set out in Annex I of the Act. No harmonised standard has been cited in the Official Journal under the EAA, so no standard yet gives a presumption of conformity. In practice, conformance is usually assessed against EN 301 549 V3.2.1, which carries WCAG 2.1 Level AA.
What you need to be able to demonstrate
Your primary digital product has been assessed against WCAG 2.1 Level AA. The assessment was conducted by a qualified assessor, not an automated tool alone. Automated tools identify approximately 30–40% of accessibility barriers. A genuine conformance assessment includes manual review and assistive technology testing.
The assessment covered your most commercially critical user journeys, whichever apply to your product: checkout, account creation, booking, payment, onboarding. A homepage that passes technical testing is not a compliant product if the checkout is broken.
Known barriers have been documented. Either they have been remediated, or they are recorded as known barriers with a timeline for remediation. Ignoring findings is not an option. Documenting them with a remediation plan is.
The assessment has a date. Compliance is not a permanent state. It needs to be maintained. An assessment from two years ago is not evidence of current compliance.
-
Check
Has your primary digital product been assessed against WCAG 2.1 Level AA by a qualified assessor?
-
Check
Did the assessment include manual review and assistive technology testing, not only an automated scan?
-
Check
Did the testing cover your most critical user journeys, and not only the homepage or marketing pages?
-
Common gap
Most organisations have run an automated scan and consider this an EAA compliance audit. Automated tools find approximately 30–40% of accessibility barriers. The remaining 60–70% require human testing. An automated scan result is not a compliance position.
The Tribunal judiciaire de Caen established the standard clearly in its June 2026 ruling against Carrefour: accessibility is an obligation of result. Carrefour’s argument that it had met 71% of criteria was rejected. The court found that 100% of RGAA criteria must be met. Partial conformance is not a defence.
-
Common gap
AI-assisted development tools produce non-compliant code by default. If your development team uses AI coding tools without an accessibility review step in the workflow, non-compliant features accumulate with every release. See the AIMAC benchmark findings.
Area 2 — A published accessibility statement
The EAA requires you to publish information explaining how your service meets the accessibility requirements, in your general terms and conditions or an equivalent document, in written and oral format and accessible to disabled people (Article 13(2) and Annex V). It is usually called an accessibility statement. A generic privacy-style paragraph does not do this job.
What your statement should contain
Annex V sets the minimum: the accessibility requirements that apply, a description of the service and how it works, and how the service meets those requirements. The items below go further. They are good practice, and they are what makes a statement useful to the people who read it.
A clear statement of conformance. This says whether your product is fully conformant, partially conformant, or non-conformant with EN 301 549. Most organisations are partially conformant. Claiming full conformance without evidence is a greater risk than accurately stating partial conformance with known exceptions documented.
A list of known exceptions. These are specific barriers that have not yet been remediated, with the reason and a timeline. "We are working on it" is not sufficient. Named barriers with named timelines are what make the list credible.
A feedback mechanism. Users need a way to report accessibility barriers and request accessible alternatives. This should be a real mechanism that receives and responds to reports, not a form that disappears into a void.
Contact details for the responsible body. This names who is responsible for accessibility within the organisation, and how to reach them.
The date the statement was last reviewed. Statements that have not been reviewed since they were first published are a compliance risk. They claim a conformance position that may no longer be accurate.
-
Check
Does your organisation have a published accessibility statement?
-
Check
Does it reference EN 301 549 (not only WCAG, and not the Web Accessibility Directive, which covers public-sector bodies)?
-
Check
Does it include a dated list of known exceptions with remediation timelines?
-
Check
Does it include a working feedback mechanism?
-
Check
Has it been reviewed within the last twelve months?
-
Common gap
An absent or inadequate statement is the first signal that an organisation is not managing compliance actively.
Area 3 — Active governance
Technical conformance without governance regresses. Every product release, every new feature, every AI-assisted development cycle can introduce new accessibility barriers. The EAA requires procedures that keep the service in conformity as it changes (Article 13(3)). A one-off audit does not meet it.
What active governance requires
A named owner for accessibility within the organisation. Someone whose role includes responsibility for maintaining the compliance position, reviewing the accessibility statement, and ensuring accessibility is considered in the product development process. This does not need to be a full-time role. It does need to be a named responsibility, not a collective assumption.
A testing cadence. Accessibility is assessed on a schedule, not only when a complaint arrives or a new product launches. How frequently depends on how often the product changes. A product that releases weekly needs weekly accessibility review. A product that releases quarterly needs quarterly review.
A remediation workflow. When barriers are identified, there is a process for triaging, prioritising, and addressing them. That holds whether they come from an audit, a user complaint, or a development review. Findings do not sit in a spreadsheet indefinitely.
Accessibility in the product development process. New features are reviewed for accessibility before release, not after. This is the only way to prevent the compliance position from degrading with every release cycle.
-
Check
Is there a named owner for accessibility within your organisation?
-
Check
Is accessibility review scheduled, rather than carried out only in reaction to a problem?
-
Check
Is there a remediation workflow for triaging and addressing identified barriers?
-
Check
Is accessibility reviewed before new features go to production?
-
Common gap
Most EAA non-compliance is a governance failure, not a technical one. Organisations that have done accessibility work but have no named owner and no testing cadence are not in a compliant position. The technical work regresses without governance to maintain it. See the EAA governance guide.
Area 4 — Documentary evidence
The fourth area is about evidence. EAA compliance is not only about what you have done. It is about what you can demonstrate. If enforcement contact arrives, the question is not "are you compliant?" It is "what can you show?"
What you need to be able to produce
Dated records of accessibility assessments. Who conducted them, when, what methodology was used, what was found. Internal assessments and external audits both count, but an external audit from a qualified assessor is stronger evidence of due diligence.
Remediation records. What barriers were identified, what actions were taken, when they were resolved. This does not need to be elaborate. A structured log in a shared document is sufficient. What it cannot be is absent.
Evidence of governance activity. Meeting notes where accessibility was discussed. Review records. Sign-off records showing accessibility was considered before a release. Named ownership. These documents demonstrate that compliance is being actively managed, not assumed.
In Ireland specifically, the due diligence defence under S.I. No. 636/2023 requires the person charged to prove that they exercised due diligence and took all reasonable precautions to avoid the offence. This defence is only available to organisations that can produce evidence of active management. The evidence cannot be created retrospectively.
-
Check
Do you have dated records of your most recent accessibility assessment?
-
Check
Do you have records of what was found and what actions were taken?
-
Check
Do you have evidence of governance activity, such as named ownership, review records and sign-off processes?
-
Common gap
In Ireland, the due diligence defence against criminal prosecution requires evidence that cannot be created after the fact. An organisation that has done genuine accessibility work but has kept no records of it will struggle to prove that defence. The records are as important as the work.
-
Common gap
A documented compliance position is what the Complete Compliance Framework delivers. Organisations with significant compliance risk need a dated, documented record of active management.
If you have only run an audit
If you have run an audit and nothing else, you have started on the first area and not yet on the other three.
That is not a reason for alarm. It is a reason for a clear next step. The free assessment covers all four areas in twenty minutes and identifies which gap is most urgent for your organisation, market and product.
A note on disproportionate burden. The EAA provides an exemption where compliance would impose a disproportionate burden on the organisation. This exemption is a safeguard with conditions, not an opt-out. Relying on it without the required assessment does not work: the exception applies only where the assessment has been carried out and documented. See the disproportionate burden guide for what qualifying actually requires.
Find out where your organisation stands
Our free initial assessment covers your current accessibility position, which of the four areas of EAA compliance work you have covered, and what a proportionate next step looks like.
Book your free assessment today