EAA enforcement — who enforces the Act and what happens when they do

EAA enforcement began the day the Act became enforceable on 28 June 2025. It did not wait for organisations to be ready. In France, disability organisations sent formal notices on 7 July 2025 and went to court in November 2025. In Sweden, PTS launched systematic inspections within months. In the Netherlands, the ACM began auditing webshops and found that 61% made ordering entirely impossible for disabled users. Enforcement is not coming. It is here.

How EAA enforcement works: the two tracks

EAA enforcement operates through two independent tracks. An organisation can face both simultaneously.

Track 1: Regulatory enforcement. National authorities audit organisations, issue formal findings, and impose financial penalties. The process varies by market but the outcome is the same: a formal compliance obligation with financial consequences for non-compliance.

Track 2: Civil society enforcement. Disability organisations with legal standing bring proceedings directly, without waiting for a regulator. France showed how this works within months of the EAA applying. The mechanism is available in every EU member state. It does not require a complaint to be filed with a regulator first.

Neither track requires the other to act first. An organisation under regulatory investigation can simultaneously face civil society proceedings. Both are independent paths to a compliance obligation.

Who enforces the EAA — by market

Ireland: ComReg enforces for electronic communications. The CCPC enforces for products and for consumer services generally. Ireland attaches criminal sanctions to EAA non-compliance: fines up to €60,000 on indictment, and imprisonment up to 18 months. See our Ireland enforcement guide.

Netherlands: the ACM (Authority for Consumers and Markets) enforces for e-commerce and digital services. The AFM enforces for financial services. Providers whose services are not accessible must report it to the ACM or the AFM. Fines can reach 10% of annual turnover and no ceiling is verified. Penalties have been legally available since June 2025 and none has yet been issued. See our Netherlands enforcement guide.

Sweden: PTS (Post and Telecom Authority) conducts proactive systematic inspections. PTS opened eleven further cases on 3 March 2026, bringing the total to 28. The organisations named include H&M, IKEA, Coop, ICA and Systembolaget. As of 23 September 2026 the programme remains investigatory and no penalty has been imposed. Sweden's enforcement programme in detail covers the inspections and the organisations named. A sanktionsavgift (SEK 10,000–10,000,000) is available for breaching the duties listed in section 37, including the duty to keep a service accessible, and an order to put a breach right may carry a vite. Under section 38 of Lag (2023:254), a sanktionsavgift cannot be imposed for a breach covered by a föreläggande om vite where that breach is the basis of an application to have the vite imposed. For products, where the operator does not correct the non-compliance, the market surveillance authority must ensure the product is withdrawn or recalled, or its supply prohibited or restricted (Regulation (EU) 2019/1020, article 16(5)). See our Sweden enforcement guide.

France: the DGCCRF carries out the controls, and disability organisations have brought court cases alongside it. The Auchan case was dismissed on a procedural threshold that the court was explicit has nothing to do with whether the site was accessible, and is being appealed. Carrefour was ordered to make its online commerce services fully accessible within six months. E.Leclerc had a hearing listed for 22 September 2026. No outcome has been reported. See our France civil society enforcement guide.

Germany: private enforcement via Abmahnung operates independently of regulators. Any competitor or qualifying organisation can send a formal warning letter without involving a public authority. The MLBF, the market surveillance authority, can separately impose administrative fines up to €100,000. See our Germany BFSG guide.

Finland: Traficom is the designated supervisory authority. It investigates complaints and conducts its own market surveillance. See our Finland enforcement guide.

Italy: AgID (Agenzia per l’Italia Digitale) enforces with a cure period, proportionate to the type and gravity of the violation, before financial penalties apply. No fine has yet been issued. See our Italy enforcement guide.

What happens when enforcement arrives

Step 1: First contact. Enforcement has begun with notice everywhere it has begun at all. A regulator or a complainant makes contact and asks what the organisation knows about its own service. Nothing at this stage is a penalty.

Step 2: Investigation. The regulator or court assesses whether the product meets the accessibility requirements of the national transposition. What that assessment covers varies by market and by the nature of the complaint.

Step 3: Formal finding. A formal notification of non-compliance is issued. In Italy this starts the cure period.

Step 4: Escalation. Where an organisation does not act, the routes available differ by market: a court order with a daily penalty in France, a statutory charge in Sweden, administrative fines in the Netherlands. None has yet been levied in the seven markets we monitor. We have written up what has happened instead.

Step 5: Appeal. Organisations can appeal decisions. The Auchan case was dismissed on narrow procedural grounds specific to that entity. The Carrefour compliance order stands and is running.

What EAA enforcement does not look like

No EAA administrative fine has been published in the seven markets we monitor. This is not evidence of low enforcement risk. The markets we monitor have begun with audits, supervision and notices; none has yet reached a published sanction. Germany’s private enforcement track has been active since enforcement began, without involving public authorities at all.

The absence of published fines reflects the pace of enforcement proceedings, not the absence of enforcement activity.

What this means for your organisation

The question is not whether your organisation will face enforcement. It is whether, when enforcement arrives, you are in a position to demonstrate genuine compliance management. The due diligence defence in Ireland, the cure period in Italy, and the documented governance requirement across all markets reward organisations that started compliance work early and can evidence what they did.

Governance includes a named owner, a testing process, and a remediation record. It is what distinguishes an organisation that responds to enforcement contact from one that has no documented position at all. See our governance guide for what that requires in practice.