What actually happens if you have done nothing

The short version

With the Act applicable since 28 June 2025, we went looking for the fines. We searched in French, Dutch, Swedish and German, on the regulators' and the associations' own sources rather than on English-language summaries.

There are none. Not one confirmed administrative monetary fine under any transposition, in any of the seven markets we monitor.

That is not the same as nothing happening. What exists is court orders, supervision programmes, formal notices and private warning letters. Every enforcement route that has actually opened has begun with notice and an opportunity to remediate. Italy writes a cure period into its sanctions regulation, proportionate to the type and gravity of the violation, so the chance to remediate is a rule rather than a matter of practice.

Which means the question is not what a penalty would cost. It is what you would be able to show when someone asks.

What notice actually means, market by market

Sweden: the steps are in the statute

Sweden is the clearest worked example because the steps are written into law. Under Lag (2023:254), when PTS finds that a service falls short, it must first issue an uppmaning, a request to put the deficiency right within a set time (section 32). If the deficiency is not fixed in time, it can issue a föreläggande, a formal order which may carry a vite, a conditional fine (sections 32 and 35). Separately, it can impose a sanktionsavgift, an administrative charge set by statute at between SEK 10,000 and SEK 10,000,000, for a breach of the duties listed in section 37 (sections 37 and 39).

Two things are worth knowing about those steps. Under section 38, a sanktionsavgift cannot be imposed for a breach covered by a föreläggande om vite where that breach is the basis of an application to have the vite imposed. And PTS has published a list of 28 named organisations under supervision, including H&M, IKEA, Coop, ICA and Systembolaget, opened in two tranches, the most recent announced 3 March 2026. As of 23 September 2026 no penalty had been imposed on any of them.

France: a regulator and the courts

In France the DGCCRF carries out the controls, and on 4 September 2026 announced corrective or repressive follow-up for about half of the 20+ e-commerce sites it had checked, with results due in early 2027. The court cases so far were brought by disability rights organisations directly, and French courts have reached opposite conclusions a month apart.

On 5 May 2026 the Tribunal judiciaire de Lille rejected a claim against Auchan E-Commerce, holding that a revenue threshold in France's 2005 domestic accessibility law took precedence. The associations describe that interpretation as badly erroneous and the appeal is pending.

On 4 June 2026 the Tribunal judiciaire de Caen ordered Carrefour France to make its online commerce services fully accessible within six months, which puts the deadline at 4 December 2026. French press reporting puts the penalty at €500 per day of delay after that date. The figure does not appear in the associations' own communiqués, so it is reported rather than confirmed.

The Caen reasoning is the part worth reading closely. Carrefour argued that a conformance rate of 71% was sufficient. The court disagreed, treating accessibility as an obligation of result rather than of effort. In the judge's words, a commerce site cannot be only a little accessible.

Netherlands: fines available, none issued

The ACM is the general market surveillance authority, with sector regulators alongside it. Financial penalties have been legally available since June 2025. None has been issued. The published posture is compliance first, and the enforcement activity so far has been investigation and remediation rather than penalty.

Germany: private warning letters

What exists in Germany is Abmahnungen, private warning letters sent by competitors or associations rather than by a regulator. German lawyers consider many of them legally weak. No administrative fine has been issued under the BFSG.

Ireland: three authorities, one Act

Ireland has no single accessibility regulator. Responsibility is distributed by sector: the CCPC for products and general services, the Central Bank for consumer banking services, ComReg for electronic communications. The transposition also carries criminal liability provisions for specified breaches, which is unusual among member states and is the reason Irish organisations tend to treat this differently from their European counterparts.

A complaint usually starts with a customer

The mental image most businesses have is a regulator arriving unannounced. That is not how any of the documented cases began.

Every route that has actually opened started with a person who could not do something. In France, disability organisations gathered evidence through a committee of blind and partially sighted IT specialists, then sent formal notices, then went to court when nothing changed. In Sweden it went the other way: PTS opened a supervision programme without waiting for anyone to complain. In the Netherlands, the ACM sampled webshops and wrote to them.

What follows is a request for information. What an organisation can produce at that point is whatever it wrote down before it was asked.

Which is why an inaccessible product with an honest accessibility statement is in a better position than an inaccessible product with an optimistic one. The statement is a dated public claim about the service, and it is the one document that exists whether or not anyone has looked at the product.

What actually changes the outcome

Enforcement that begins with notice rewards something specific: being able to show that you assessed your product and acted on what you found.

That is a different thing to prepare for than a fine, and it is achievable. It does not require a finished remediation. It requires evidence that the work is real and under way.

Carrefour lost on a documented 71%. A conformance percentage is not a defence. A dated record of assessment, decisions and action is.

What "enough" looks like if you have done nothing yet

The honest answer is smaller than most people expect. Being defensible at the start means an evaluation and a dated plan, not a finished product.

Concretely, that means: knowing which of your journeys a customer has to be able to complete; having tested at least one of them properly, with a keyboard and a screen reader; having written down what you found and when; having decided what to fix first; and having a statement that describes the product as it actually is. The four areas of work in full set out what each of those looks like when it is finished rather than started.

None of that requires a consultancy. An organisation that does it itself is in a defensible position, and we would rather say so than pretend otherwise.

Two things that make it worse

Most of what we find is a product that has not been looked at. Two decisions actively worsen the position.

An inaccessible product with an accurate statement is a gap. An inaccessible product with an inaccurate statement is a documented claim. A statement that says more than the product delivers converts an omission into a written assertion, and it is the first document anyone reads.

An accessibility widget described as compliance is the second. Overlays adjust what a page already provides. Where a control was built without a name or without keyboard access, there is nothing for the widget to adjust. We tested three Irish sites running the same overlay; two were reachable, and both had a real failure beneath it. One was a Level A keyboard failure on the purchase journey, on a site whose accessibility statement credited the overlay.

Where this leaves you

We have found no EAA fine in the seven markets we monitor. That is not a reason to relax. It is the reason the window is open. Enforcement starts with notice, and what you will be asked for is evidence that you looked. Doing nothing is the only response that leaves you with nothing to show.