Since 28 June 2025, the EU Accessibility Act has required most websites and apps selling digital products or services to EU consumers to meet WCAG-level accessibility — Level AA, the same standard referenced by most accessibility laws worldwide. That date has already passed; this isn't a future compliance project, it's a present one, and it applies based on where the consumer is, not where the business selling to them is registered.
That last point is the one that catches international builds off guard. A site built in Malaysia for a client selling into Germany or France doesn't get to treat EU law as someone else's problem just because neither the studio nor the client's head office sits in Europe. For white-label and cross-border work specifically — the kind we cover in our white-label guide — the question of which markets a site actually serves belongs in scoping, the same way domain and hosting ownership does in our piece on who should own what. Both are easy to skip past when nobody in the room is explicitly responsible for asking.
Good engineering gets you partway there, not all the way
We build semantic HTML and keyboard-operable components by default — it's a quality habit, not a compliance programme, and it genuinely does cover a meaningful slice of WCAG's baseline criteria without anyone having to think about accessibility as a separate line item. What it doesn't cover is the content layer that keeps changing after launch: an image uploaded without alt text, a form field added without a label, a brand refresh that quietly drops text contrast below the threshold. None of those break anything a browser will complain about, which is exactly why they survive unnoticed. Treating accessibility as a feature that gets "finished" at delivery is the same mistake as treating a TLS certificate or a page-speed score as permanent once they're green on launch day — all three drift, and all three belong on a maintenance plan's recurring checklist, not its one-time setup list.
Who's actually covered, and the exemption that surprises people
The Act's micro-enterprise exemption is real but narrow: businesses with fewer than 10 employees and under €2 million in annual turnover or balance sheet total are exempt, for certain service categories. That threshold catches fewer businesses than people assume — a 30-person agency's client, or a well-established SME with a handful of staff but solid revenue, is often still in scope even though it feels "too small" to be a target for EU-level regulation. We're not in a position to rule on whether a specific client qualifies for the exemption; that's a question for their own legal counsel, not a web studio. What we can do during scoping is flag that the question exists at all, early enough that the answer shapes the build rather than getting discovered in an audit after launch.
Frequently asked questions
Does the EU Accessibility Act apply to a business based outside the EU?
Yes. The Act is triggered by where the consumer is, not where the business is registered or hosted. A Malaysian, Singaporean, or GCC company selling digital products or services to EU consumers is in scope the same way an EU-based one is — so a white-label build going to an EU-facing client needs this question asked at scoping, not discovered after launch.
Is my business too small to be covered?
There is a real exemption, but it's narrow: micro-enterprises, defined as fewer than 10 employees and under €2 million in annual turnover or balance sheet total, are exempt for certain service categories. A small business above that threshold, or one outside the exempted categories, is still covered. Confirm the specific exemption with the client's own legal counsel rather than assuming it applies — this article is a starting point, not a compliance ruling.
What accessibility standard does the Act actually require?
WCAG Level AA is the reference standard — the same contrast, keyboard-operability, and form-validation criteria used by most accessibility laws worldwide. WCAG 2.2, published by the W3C in October 2023, is the current version and is backward-compatible with 2.1, so building to 2.2 AA satisfies the Act's requirement and anything written against the older version.
The deadline was in 2025 — is it too late to do anything about it?
No — 28 June 2025 is when the requirement became enforceable, not a cutoff after which fixing a site stops mattering. A non-compliant site covered by the Act is already exposed; closing the gap now still removes that exposure going forward. Enforcement mechanisms and penalties are set by each EU member state individually, so the practical risk varies by which market a client actually sells into.
Once a site is built accessible, is that permanent?
No. Accessibility drifts the same way page speed and certificates do — a new content block without alt text, a form field added without a label, or a colour tweak that drops contrast below the threshold can each quietly break conformance after launch. It needs the same periodic re-check as any other item on a maintenance plan, not a one-time pass at delivery.