EAA enforcement — who enforces the Act and what happens when they do

EAA enforcement began the day the Act became enforceable on 28 June 2025. It did not wait for organisations to be ready. In France, disability organisations filed lawsuits nine days after that date. In Sweden, PTS launched systematic inspections within months. In the Netherlands, the ACM began auditing webshops and found that 61% made ordering entirely impossible for disabled users. Enforcement is not coming. It is here.

How EAA enforcement works: the two tracks

EAA enforcement operates through two independent tracks. An organisation can face both simultaneously.

Track 1: Regulatory enforcement. National authorities audit organisations, issue formal findings, and impose financial penalties. The process varies by market but the outcome is the same: a formal compliance obligation with financial consequences for non-compliance.

Track 2: Civil society enforcement. Disability organisations with legal standing bring proceedings directly, without waiting for a regulator. France demonstrated this model nine days after the EAA became enforceable. The mechanism is available in every EU member state. It does not require a complaint to be filed with a regulator first.

Neither track requires the other to act first. An organisation under regulatory investigation can simultaneously face civil society proceedings. Both are independent paths to a compliance obligation.

Who enforces the EAA — by market

Ireland: ComReg enforces for electronic communications. The CCPC enforces for products and for consumer services generally. Ireland is the only EU member state with criminal sanctions for EAA non-compliance: directors face personal liability, fines up to €60,000 on indictment, and imprisonment up to 18 months. See our Ireland enforcement guide.

Netherlands: the ACM (Authority for Consumers and Markets) enforces for e-commerce and digital services. The AFM enforces for financial services. A mandatory reporting requirement has been in effect since October 2025. Fines can reach 10% of annual turnover and no ceiling is verified. Penalties have been legally available since June 2025 and none has yet been issued. See our Netherlands enforcement guide.

Sweden: PTS (Post and Telecom Authority) conducts proactive systematic inspections. The full list of 28 organisations under investigation was published on 3 March 2026 and includes H&M, IKEA, Coop, ICA, and Systembolaget. As of August 2026 the programme remains investigatory and no penalty has been imposed. Sweden's enforcement programme in detail covers the inspections, the notices issued, and the market-ban power that makes it the sharpest regime of the three Phase 1 markets. Two penalty types apply: Sanktionsavgift (SEK 10,000–10,000,000) for non-cooperation, and Vite for non-remediation. Under section 38 of Lag (2023:254), a sanktionsavgift cannot be imposed where the same breach is already covered by a föreläggande om vite. They are alternatives for a given violation, not cumulative. Market ban authority exists. See our Sweden enforcement guide.

France: no single national EAA regulator. Enforcement is driven by disability organisations with legal standing. As of June 2026, two EAA court rulings have been issued. The Auchan case was dismissed on a procedural threshold. The court found the site inaccessible. The case is being appealed. Carrefour was ordered to make its online commerce services fully accessible within six months. E.Leclerc has a hearing scheduled for 22 September 2026. See our France civil society enforcement guide.

Germany: private enforcement via Abmahnung operates independently of regulators. Any competitor or qualifying organisation can send a formal warning letter without involving a public authority. Bundesnetzagentur can separately impose administrative fines up to €100,000. See our Germany BFSG guide.

Finland: Traficom enforces on a complaint-driven basis. Conditional daily fines apply where compliance orders are not met. See our Finland enforcement guide.

Italy: AgID (Agenzia per l’Italia Digitale) enforces with a 90-day cure period before financial penalties apply. Fines can reach €1,000,000 for very serious violations, though none has yet been issued. See our Italy enforcement guide.

What happens when enforcement arrives

Step 1: First contact. Enforcement has begun with notice everywhere it has begun at all. A regulator or a complainant makes contact and asks what the organisation knows about its own service. Nothing at this stage is a penalty.

Step 2: Investigation. The regulator or court assesses whether the product meets the accessibility requirements of the national transposition. What that assessment covers varies by market and by the nature of the complaint.

Step 3: Formal finding. A formal notification of non-compliance is issued. In Italy this triggers the 90-day cure period.

Step 4: Escalation. Where an organisation does not act, the routes available differ by market: a court order with a daily penalty in France, a statutory charge in Sweden, administrative fines in the Netherlands. None has yet been levied under any transposition. We have written up what has happened instead.

Step 5: Appeal. Organisations can appeal decisions. The Auchan case was dismissed on narrow procedural grounds specific to that entity. The Carrefour compliance order stands and is running.

What EAA enforcement does not look like

No EAA administrative fine has been published in the seven markets we monitor. This is not evidence of low enforcement risk. Most markets began with audit and monitoring phases before moving to formal sanctions. Germany’s private enforcement track has been active since enforcement began, without involving public authorities at all.

The absence of published fines reflects the pace of enforcement proceedings, not the absence of enforcement activity. The organisations under investigation now are the organisations that will face the first published decisions.

What this means for your organisation

The question is not whether your organisation will face enforcement. It is whether, when enforcement arrives, you are in a position to demonstrate genuine compliance management. The due diligence defence in Ireland, the 90-day cure period in Italy, and the documented governance requirement across all markets reward organisations that started compliance work early and can evidence what they did.

Governance includes a named owner, a testing process, and a remediation record. It is what distinguishes an organisation that responds to enforcement contact from one that has no documented position at all. See our governance guide for what that requires in practice.