EAA compliance in Ireland — what directors need to know

The European Accessibility Act (EAA) has been enforceable in Ireland since 28 June 2025 under S.I. No. 636/2023 — the European Union (Accessibility Requirements of Products and Services) Regulations 2023. Ireland's implementation goes further than most EU member states in one significant respect: it includes criminal penalties for serious or persistent non-compliance.

The four things EAA compliance requires

EAA compliance is not a single checklist item. It requires four things, all of which are mandatory:

• Technical conformance. Your digital products and services must meet EN 301 549 — the harmonised European standard. In practice, that means WCAG 2.1 Level AA.
• A published accessibility statement. A mandatory public declaration of your current compliance position, what is not yet accessible, and your remediation plan. Irish regulators request this first in any complaint process.
• Active governance. A named owner for accessibility, a regular testing rhythm, and a process that survives a team change.
• Documentary evidence. Dated assessments, remediation records, and a compliance process that demonstrates the organisation was actively managing its obligations.

Criminal liability — who is at risk

Serious or persistent non-compliance — meaning organisations that knew and didn't act — can be prosecuted as a criminal offence under the Regulations. For the most serious cases, prosecuted in the higher courts, the penalty is a fine of up to €60,000, imprisonment of up to 18 months, or both.

What makes this unusual is who is at risk. Where a company commits an offence under the Regulations, directors, managers, secretaries, and other officers of that company can be held personally liable. The liability does not stop at the corporate level. It follows the individuals whose decisions, actions, or neglect contributed to the non-compliance.

Enforcement: ComReg is already active

This is not a theoretical risk. ComReg — the Commission for Communications Regulation — is already processing formal complaints, including one against Ireland's largest mobile operator. Enforcement has started.

ComReg is the enforcement authority for electronic communications services. The CCPC (Competition and Consumer Protection Commission) handles products. Coimisiún na Meán covers audiovisual and media services.

Irish regulators review the accessibility statement early in any complaint process. It is typically the first document they request. An organisation without one starts any investigation at a disadvantage.

The due diligence defence

Irish law allows that a defendant who can demonstrate they exercised due diligence may have a case against the charge. In practice, that means documented evidence of active accessibility management: assessments, remediation records, and a compliance process that shows the organisation was not simply ignoring the obligation.

That evidence is exactly what a structured compliance programme produces. It is also, in most cases, the difference between a defensible position and a personal liability.

Which organisations are covered

The EAA applies to any organisation providing covered products or services to consumers in Ireland — regardless of where the organisation is headquartered. A US-based SaaS company with Irish enterprise customers, a Dutch e-commerce retailer selling to Irish consumers, and an Irish-headquartered FinTech all face the same obligations.

Microenterprises (fewer than 10 employees and annual turnover or balance sheet total not exceeding €2 million) may be exempt for some obligations, but should verify this with a qualified adviser before assuming exemption applies.