E-commerce accessibility: one year into the EAA, the grace period is over

What happened

The European Accessibility Act has applied since June 28, 2025 to most consumer-facing digital services sold in the EU — e-commerce included — for any company above 10 employees and 2 million euros in turnover. For a year, with no visible sanctions, many teams filed the deadline under watch-and-wait. That reading no longer holds.

On June 4, 2026, the judicial court of Caen ordered Carrefour France to make carrefour.fr and its mobile app fully accessible within six months, under a recurring penalty of 500 euros per day of delay, plus 10,000 euros in damages (the E-commerce Mag report). The associations apiDV and Droit Pluriel went to court after documenting purchase journeys that could not be completed with a screen reader. A parallel action against Auchan was dismissed at first instance; the appeal is pending.

The striking part is not the penalty, it is the reasoning. Carrefour argued its site met 71% of the French RGAA standard; the court set that aside and qualified accessibility as an obligation of result. In other words: a checkout that works "almost everywhere" remains, in legal terms, an inaccessible service for the customer stuck at payment.

From letters to case files

The shift reaches well beyond France, and it is accelerating this very semester (Level Access's status report on enforcement):

• Sweden: after 124 public complaints, the regulator PTS opened its first cases against online shops as early as October 2025 and is continuing inspections through 2026.
• The Netherlands: the ACM has sent information requests to merchants worldwide selling into the country and has announced formal enforcement for the second half of 2026 — that is now.
• Germany: the BFSG is also enforced through competition law — law firms have been sending warning letters to non-compliant shops since the summer of 2025.

As of mid-2026, no fine has yet been confirmed under the national transposition laws. The ceilings, however, are set: 100,000 euros per violation in Germany, up to one million in Spain and in Italy, 900,000 euros or 10% of turnover in the Netherlands. And the Carrefour case is a reminder that an advocacy group sometimes gets results faster than a regulator.

Where the web actually stands

The WebAIM Million report of February 2026 — the automated analysis of the top one million home pages — shows the size of the gap: 95.9% of pages have detectable WCAG failures, up from the year before, with an average of 56 errors per page (the WebAIM report). The causes are strikingly mundane: insufficient contrast (83.9% of pages), images without text alternatives (53.1%), form fields without labels (51%), empty links (46.3%). A handful of error families concentrates almost the entire problem — and they are exactly the ones that break keyboard navigation or screen reader use in a checkout.

WCAG 2.2 enters the European standard

EAA conformity is measured today through the EN 301 549 standard, which points to WCAG 2.1 level AA. Its revision incorporating WCAG 2.2 is expected during 2026, ahead of citation in the Official Journal of the EU. The added criteria speak directly to e-commerce teams: minimum size for touch targets, keyboard focus never hidden behind a sticky bar, an alternative to every drag-and-drop gesture, authentication without cognitive tests. Aiming for WCAG 2.2 AA now costs barely more than 2.1 — and saves you from reopening the work in eighteen months.

Where to start

1. Audit the purchase journey, not the home page. Search, product page, cart, payment, account creation: that is where the legal risk sits, as the Carrefour case showed.
2. Fix the five WebAIM error families first. Contrast, image alternatives, form labels, empty links and buttons: automatically detectable, fixable without a redesign, and they account for most real-world blockers.
3. Test with a keyboard and a screen reader. Ten minutes of tabbing through your checkout reveals more than any tool score — and the blockers you find are precisely the ones an advocacy group would document.
4. Publish an accessibility statement and a feedback channel. Several regulators start by checking that transparency; its absence puts you straight onto the list of files worth digging into.
5. Make accessibility part of the definition of done. A one-off audit goes stale at the next release; an acceptance criterion does not.

My take

Accessibility has just changed status: from a commendable good practice to a measurable operating risk, as security and GDPR did before it. What strikes me in the Caen ruling is the rejection of the "71% compliant" defense — precisely the argument many e-commerce leaders are preparing in good faith. The good news: most of the road is made of mundane, well-tooled fixes, far cheaper than a daily penalty, a warning letter — or the customers quietly lost for years.