The Act does not set out a four-part list. Its obligations for service providers, in Articles 4, 13 and 14 and Annex I, turn into four areas of work.
Technical conformance
In practice this means WCAG 2.1 Level AA, the level EN 301 549 V3.2.1 sets out. No harmonised standard has been cited in the Official Journal under the EAA, so EN 301 549 is what conformance is demonstrated against rather than something the Act requires. We track whether EN 301 549 has been cited under the Accessibility Act and date every check.
A published accessibility statement
Published information on how your service meets the accessibility requirements, in your terms and conditions or an equivalent document (Article 13(2), Annex V). It is usually called an accessibility statement. Publishing it is not optional. Saying what does not yet meet the requirements, with your plan, is good practice. If the information is not published anywhere, that is a gap before any audit has been run.
Active governance
A named owner for accessibility, a regular testing rhythm, and a process that survives a team change. Without governance, technical compliance regresses. A passing audit today doesn't mean a compliant product next quarter. The next sprint, the next team restructure, the next product release can all undo it.
Documentary evidence
When an authority asks, you have to give it the information needed to show the service conforms (Article 13(5)). Remediation records. Decision trails. Dated assessments. The documentation that shows the organisation was not simply ignoring the obligation.
Two duties sit outside the four areas and are easy to miss. If your service does not meet the accessibility requirements, you must take corrective measures and immediately inform the competent authorities in the Member States where you provide it (Article 13(4)). If you rely on the disproportionate burden exception, you must carry out and document the assessment, keep it for five years after the service was last provided, renew it when the service is altered, when the authority asks, and at least every five years, and inform the relevant authority (Article 14). Microenterprises providing services are exempt from the accessibility requirements and from these duties (Article 4(5)).
The four areas are related, but they don't reinforce each other automatically. An organisation can have strong technical conformance and no governance to maintain it. It can have governance and no published statement. It can have all three and no documentary evidence trail. Each one is necessary. None is sufficient on its own.
The assessment method used across Europe to measure compliance is the Solid Foundations Method. It checks whether the core elements users need to complete essential tasks are in place. Not every WCAG criterion, but the ones that matter most for logging in, making purchases, contacting support, making payments. It is an expert evaluation, but not a replacement for a full audit or user testing with disabled people. The two are related but not the same, and both matter.
The difference is process, not effort.
Find out where you stand across all four
Our free initial assessment covers whether EAA applies to your organisation, which of the four areas you've covered, and what a proportionate next step looks like.
Book your free assessment today