EAA compliance in the Netherlands: what organisations need to know

The Netherlands has one of the most active EAA enforcement environments in Europe. The ACM (Authority for Consumers and Markets) began active auditing following the June 2025 deadline and is progressing through its inspection programme. Penalty decisions are expected in the second half of 2026.

As of June 2026, the ACM has moved from the information-gathering phase of its enforcement programme toward formal sanctions. Organisations that received ACM contact during the audit phase and have not responded should treat this as urgent: the window between initial contact and formal penalty action is closing.

The mandatory reporting requirement

The Netherlands has a requirement that most organisations operating there have either missed or misunderstood. Under Dutch implementation of the EAA, organisations must proactively report their accessibility compliance status to the ACM. This is not a passive obligation: it requires submitting documentation of your compliance position, with a compliance declaration available on request.

Organisations that failed to report by the October 2025 deadline, or submitted incomplete documentation, have moved to the front of the ACM audit queue. If you have not already reported, this is the most urgent action to take.

The ACM's own audit data makes the scale of the problem clear: in 61% of the approximately 100 major webshops it tested, ordering was entirely impossible for users with disabilities. Not difficult. Entirely impossible. Those organisations are now in the enforcement queue.

The ACM approach to enforcement

The ACM has stated publicly that fines are not its primary goal. Its stated position is that it aims to be mission and value driven, contributing to equal access rather than punishing non-compliance. In practice, this means the ACM is likely to give organisations a remediation window before imposing fines, except in cases of egregious or wilful non-compliance.

This remediation-first approach does not mean enforcement is soft. It means organisations that engage constructively, demonstrate active governance, and have a credible remediation plan are in a significantly better position than those that have done nothing. The ACM responds to evidence of genuine effort.

One important caveat: the remediation-first approach is not universal. The Netherlands can impose immediate penalties for egregious or wilful violations without a prior warning or remediation window. An organisation that has received notification of non-compliance and taken no action, or that has been found to be deliberately non-compliant, should not assume a grace period will be offered.

Financial services: AFM not ACM

For financial services organisations operating in the Netherlands, the relevant enforcement authority is the AFM (Authority for Financial Markets), not the ACM. The AFM has the same fine ceiling and enforcement mandate, but covers banking, insurance, investment platforms, and payment services. If your organisation provides digital financial services to Dutch consumers, your regulator is the AFM.

This distinction matters. Engaging with the ACM when your authority is the AFM, or assuming the ACM's remediation-first approach applies equally to AFM enforcement, may lead to incorrect assumptions about your risk position.

Penalties

The ACM and AFM can impose fines of up to 10% of annual turnover, with a maximum of €900,000. This ceiling places the Netherlands among the highest in Europe for EAA penalties. Administrative fines in the range of €5,000 to €100,000 are more typical for first-instance violations where an organisation has been unresponsive or shown no evidence of compliance activity.

Fines are calculated per violation, not per organisation. An organisation with multiple inaccessible products or services could face separate penalty assessments for each.

What EAA compliance requires

For organisations operating in the Netherlands, full EAA compliance requires four things:

• Technical conformance against EN 301 549 (WCAG 2.1 Level AA) across all consumer-facing digital products and services.
• A published accessibility statement accurately describing your current compliance position, what is not yet accessible, and your remediation plan.
• Active governance with a named owner, a regular testing rhythm, and a process that survives team changes.
• Documentary evidence of ongoing management, ready for the ACM or AFM on request.

The compliance declaration submitted to the ACM as part of mandatory reporting draws on all four. An organisation without governance and documentary evidence cannot produce a credible compliance declaration.

Which organisations are covered

Any organisation providing covered products or services to consumers in the Netherlands is in scope, regardless of where it is headquartered. A US SaaS company with Dutch enterprise customers that has consumer-facing elements, a UK e-commerce retailer selling to Dutch consumers, and a Dutch FinTech are all subject to the same obligations.

Microenterprises (fewer than 10 employees and annual turnover or balance sheet total not exceeding €2 million) may be exempt from some obligations but should verify this specifically before assuming exemption applies.

Common questions

Does the EAA apply to my Dutch company?

If your organisation provides covered digital products or services to consumers in the Netherlands, it is in scope regardless of where it is headquartered. A US SaaS company with Dutch enterprise customers that has consumer-facing elements, a UK e-commerce retailer selling to Dutch consumers, and a Dutch FinTech all face the same obligations.

What is the mandatory reporting requirement, and did I miss it?

Organisations operating in the Netherlands were required to proactively report their accessibility compliance status to the ACM by October 2025. This is a documentation and compliance declaration requirement, not a passive obligation. Organisations that missed the deadline, or submitted incomplete documentation, have moved to the front of the ACM's audit queue. If you have not reported, doing so now is the most urgent action available to you.

Which authority enforces the EAA for my organisation: ACM or AFM?

Most organisations fall under the ACM (Authority for Consumers and Markets). Financial services organisations, including banking, insurance, investment platforms, and payment services, fall under the AFM (Authority for Financial Markets) instead. Both have the same fine ceiling and enforcement mandate. Assuming the wrong authority applies to your organisation can lead to incorrect assumptions about your risk position.

How much could a Dutch EAA fine actually be?

The ACM and AFM can impose fines of up to 10% of annual turnover, with a ceiling of €900,000. Administrative fines in the range of €5,000 to €100,000 are more typical for first-instance violations. Fines are calculated per violation, not per organisation, so an organisation with multiple inaccessible products or services could face separate penalty assessments for each.

Has anyone actually been fined yet in the Netherlands?

No EAA administrative fine has been published in the Netherlands, or in any EU market, as of this page's last update. That does not mean enforcement is inactive: the ACM has already audited approximately 100 major webshops, finding that 61% made ordering entirely impossible for disabled users, and formal sanctions are expected in the second half of 2026. The absence of a published fine reflects enforcement timing, not enforcement absence.