EAA compliance in Ireland: what directors need to know

The European Accessibility Act (EAA) has been enforceable in Ireland since 28 June 2025 under S.I. No. 636/2023, the European Union (Accessibility Requirements of Products and Services) Regulations 2023. Ireland's implementation goes further than most EU member states in one significant respect: it includes criminal penalties for serious or persistent non-compliance.

The four areas of EAA compliance work

EAA compliance is not a single checklist item. It comes down to four areas of work:

• Technical conformance. In practice this means WCAG 2.1 Level AA, the level EN 301 549 V3.2.1 sets out. How the standard relates to the Act explains the detail, and whether EN 301 549 has been cited under the Accessibility Act is tracked and dated.
• A published accessibility statement. Published information on how your service meets the accessibility requirements, in your terms and conditions or an equivalent document (Regulation 14 and Schedule 3). It is usually called an accessibility statement. Saying what is not yet accessible, and your plan, is good practice.
• Active governance. A named owner for accessibility, a regular testing rhythm, and a process that survives a team change.
• Documentary evidence. Dated assessments, remediation records, and a compliance process that demonstrates the organisation was actively managing its obligations.

Criminal liability: who is at risk

Serious or persistent non-compliance (meaning organisations that knew and did not act) can be prosecuted as a criminal offence under the Regulations. For the most serious cases, prosecuted in the higher courts, the penalty is a fine of up to €60,000, imprisonment of up to 18 months, or both. A criminal conviction is one of three separate sanction mechanisms the EAA makes available, and the financial penalty is rarely the one that matters most.

What makes this unusual is who is at risk. Where a company commits an offence under the Regulations, a director, manager, secretary or other officer also commits an offence if it was committed with their consent, connivance or approval, or is attributable to their wilful neglect (Regulation 33). The liability does not stop at the corporate level.

Penalties at a glance

Conviction type	Who	Maximum penalty
Summary conviction	Organisation or individual	€5,000 fine and/or 6 months imprisonment
Conviction on indictment	Organisation or individual	€60,000 fine and/or 18 months imprisonment
Director or officer liability	Named individuals, where the offence involved their consent, connivance, approval or wilful neglect	Same as above: personal, not corporate

Enforcement in Ireland

Complaint routes are open: the CCPC takes reports through an online form, and the Central Bank accepts complaints about how firms comply. No order or fine has been issued in Ireland.

The CCPC (Competition and Consumer Protection Commission) is the primary market surveillance authority, with services enforcement distributed across sector regulators: ComReg for electronic communications, the Central Bank for consumer banking services, Coimisiún na Meán for audiovisual and media, and the National Transport Authority for transport.

Publishing information on how your service meets the accessibility requirements is a legal requirement in its own right (Regulation 14). An organisation that has not published it has a gap that is visible to anyone who looks.

The due diligence defence

It is a defence for the person charged to prove that they exercised due diligence and took all reasonable precautions to avoid the offence (Regulation 34). In practice, that means documented evidence of active accessibility management: assessments, remediation records, and a compliance process that shows the organisation was not simply ignoring the obligation.

That evidence is exactly what a structured compliance programme produces. It is also, in most cases, the difference between a defensible position and a personal liability. The defence cannot be constructed retrospectively. Genuine accessibility work with no documentation will be hard to prove.

Which organisations are covered

The EAA applies to any organisation providing covered products or services to consumers in Ireland, regardless of where the organisation is headquartered. A US company selling online to Irish consumers, a Dutch e-commerce retailer shipping to Ireland, and an Irish bank offering consumer banking services are all in scope, unless they are microenterprises providing services.

Microenterprises providing services (fewer than 10 persons, and an annual turnover or balance sheet total not exceeding €2 million) are exempt from the accessibility requirements and the obligations that go with them (Article 4(5)).

Common questions

Does the EAA apply to my Irish company?

If your organisation provides covered digital products or services to consumers in Ireland, it is in scope regardless of where it is headquartered. A US company selling online to Irish consumers, a Dutch e-commerce retailer shipping to Ireland, and an Irish bank offering consumer banking services are all in scope, unless they are microenterprises providing services under S.I. No. 636/2023.

Can a director actually go to prison for EAA non-compliance?

Yes. On conviction on indictment, the maximum penalty for an individual director or officer is a fine of €60,000 and/or imprisonment of up to 18 months. Summary conviction carries a maximum of €5,000 and/or 6 months. The personal liability provision is explicit in S.I. No. 636/2023, Regulations 32 and 33.

Which authorities enforce the EAA in Ireland?

Enforcement is distributed across sector regulators: the CCPC is the primary market-surveillance authority, with the Central Bank for consumer banking services, Coimisiún na Meán for media, the National Transport Authority for transport, and ComReg for electronic communications. Complaints can be made to the CCPC through its online form, and to the Central Bank about how financial firms comply. No order or fine has been issued in Ireland.

What is the due diligence defence?

It is a defence for the person charged, whether a company or an individual, to prove that they exercised due diligence and took all reasonable precautions to avoid the offence (Regulation 34). In practice that means documented evidence of active accessibility management: assessments, remediation records, and governance processes. The defence cannot be constructed retrospectively. Genuine accessibility work without documentation will be hard to prove.

What happens when an EAA complaint is filed in Ireland?

A user can submit a complaint to the competent authority, which is the CCPC for most services or the relevant sector regulator. The authority investigates and can refer the matter for prosecution if non-compliance is found to be serious or persistent.