Back to Blog

Legal Compliance

Real EAA enforcement in 2026: every fine, lawsuit, and warning we could verify

Eleven months after the EU Accessibility Act went live, here is what enforcement actually looks like — the Vueling €90,000 fine in Spain, the four pending French lawsuits, Norway's daily penalty, and the German Abmahnung wave. With the receipts.

23 May 2026

11 min read

Ravid, Webply

Also in:

EN

DE

When the EU Accessibility Act became enforceable on 28 June 2025, the most common question I got from agency clients was some version of: "Is anyone actually going to enforce this?"

It is a fair question. EU directives have a habit of arriving with much fanfare and then sitting on the books for years before a regulator finally moves. The first GDPR fine took six months. The first DSA action took even longer.

Eleven months in, the picture for the EAA is clearer — and more interesting — than I expected.

There is one large confirmed fine issued by a national court (Spain, on a partly pre-EAA legal basis). There are four pending lawsuits filed by the French DGCCRF against household-name retailers. There is one ongoing daily penalty in Norway running into five figures per week. And there is a steady drumbeat of private cease-and-desist actions in Germany that has already cost hundreds of operators money, even though no regulator has issued a single fine under the BFSG.

So: not the wave of six-figure penalties some vendors predicted. Not the regulatory silence either. Something in between, which is what enforcement of a new EU directive usually looks like in year one.

Here is the scoreboard, with citations.

The scoreboard

Now the case-by-case.

Spain: the Vueling fine — what it actually proves

The Vueling case is the most cited accessibility penalty in Europe right now, and it is also the most misrepresented. Several vendor blog posts have framed it as the "first EAA fine." It is not. The decision came from Spain's National High Court (Audiencia Nacional) under Royal Decree 1112/2018, the Spanish accessibility law that was already in force before the EAA took effect and that requires WCAG 2.1 Level AA for public-facing digital services.

What was the actual finding? The court ruled that disabled customers could not independently:

• Complete a flight booking on Vueling's website.
• Check in online for an existing reservation.
• Manage their booking after purchase — change seats, add baggage, request assistance.

The penalty was €90,000 plus a temporary bar on receiving public funds. The "public funds" piece matters more than people realise — for an airline that periodically benefits from aviation subsidies or government contracts, that secondary sanction can dwarf the headline fine.

Why this case is still relevant to EAA-watchers: the Spanish law it was decided under is functionally equivalent to what the EAA requires. The technical standard (WCAG 2.1 AA), the covered flows (transactional consumer journeys), and the kinds of failures (keyboard navigation, screen-reader compatibility on booking forms) all match the EAA pattern. A Spanish court has now established that "you can't book a flight as a screen-reader user" is, in fact, a fineable offense in the EU.

Read it as a preview, not a precedent.

France: the four lawsuits that will matter most

In November 2025, the French DGCCRF (the consumer protection and competition authority) filed proceedings against four very large retailers — Auchan, Carrefour, E.Leclerc, and Picard — for non-compliant e-commerce sites.

These are the first EAA-specific lawsuits filed in the EU, full stop.

As of 23 May 2026, all four cases are still pending. No court ruling, no fines imposed. But the strategic choice matters: the DGCCRF picked four operators that are politically untouchable in the sense that "you should know better." Each one is a multi-billion-euro retailer with an in-house compliance team. The implicit message to mid-market operators is: if we're willing to sue the largest names in French retail, we're willing to look at you.

The maximum fine in the French regime — outside of ARCOM's track for very large companies — is €37,500 per violation, with a daily astreinte (periodic penalty payment) capped at €300,000 cumulative for ongoing non-compliance. ARCOM, the audiovisual regulator that handles public-sector sites and companies above €250M revenue, can layer on its own fines up to €50,000 plus a recurring €25,000/year penalty for missing accessibility statements.

If Carrefour gets hit for €30M+ in aggregate astreinte while their compliance team rebuilds the checkout, that will reshape every French boardroom's calculus on this in a single news cycle.

The full breakdown of how French enforcement works — DGCCRF vs ARCOM, the astreinte mechanism, what triggers a complaint — lives in our France EAA fines page.

Norway: the case that's actually costing money right now

Norway is not in the EU. But it's in the EEA, has transposed the EAA-equivalent obligations, and is enforcing them with the bluntest tool available: a continuous daily penalty.

The HelsaMi case involves a public health portal that failed multiple WCAG 2.1 AA criteria around form labeling, focus management, and assistive-technology compatibility. The Norwegian Equality and Anti-Discrimination Tribunal imposed a daily penalty of NOK 50,000 (roughly €4,500/day) that accrues until the portal is brought into compliance.

The remediation has not been straightforward. The fine has now been running for several months. Conservatively, the running total is in the mid-six figures.

Two reasons this matters for EU operators:

• Several EU regulators — including the Dutch ACM and the Belgian DGIE — have indicated they may copy the continuous-daily-penalty model. It is enforcement-cheap and behaviorally effective.
• The "we'll fix it next sprint" timeline that works for most regulatory issues breaks completely against a clock that's adding €4,500 per business day.

Germany: the wave nobody is counting properly

Within weeks of the BFSG (the German EAA transposition) taking effect in August 2025, German e-commerce operators started receiving Abmahnungen — formal cease-and-desist letters — citing accessibility violations on their websites.

The twist: most of these are not from regulators. They are from specialist law firms using Germany's UWG (Gesetz gegen den unlauteren Wettbewerb, the unfair competition act), arguing that an inaccessible competitor gains an unfair advantage and that competitors or qualified consumer organisations are entitled to sue.

This sidesteps the BFSG enforcement track entirely. There is no regulatory complaint, no 14-day fix window, no astreinte. There is a letter, a settlement demand (typically €500–€3,000), and a remediation deadline. Refuse, and you're in front of a German court on competition-law grounds.

I cannot give you a real count, because the cases settle privately and aren't published. The number we hear from German agency partners is "low four-figure" — somewhere in the 1,000–3,000 range in the first nine months. Each individual case is small. The aggregate cost across the German SMB market is already higher than any single regulatory fine the EU has produced.

If you sell into Germany, this is the enforcement risk you should plan around. Not the BFSG fines. The Abmahnungen.

We covered the legal mechanism in more detail in our German Abmahnung risk article — and you can check the German maximum fine and authority on our Germany fines page.

The Netherlands: the dog that hasn't barked yet

Of all the EU markets, the Netherlands has the most mature reporting infrastructure in place — and the highest single-violation fine ceiling at €110,000. Mandatory accessibility reporting under the Implementatiewet Toegankelijkheidsvoorschriften kicked in October 2025, and the ACM (Autoriteit Consument & Markt) now publishes a non-compliance list.

But there is no published case yet of a Dutch operator being fined under the new regime.

Two readings of this:

1. The Dutch enforcement model is report-then-fine. The reporting phase is producing a target list. The first fines will land later this year.
2. The Dutch regulator is deliberately staging. The Netherlands has six sector-specific enforcers (ACM for e-commerce, AFM for finance, ILT for transport, RDI for telecoms, CvdM for media, NVWA for products), and the coordination overhead means the first cases will likely be very deliberate.

Either way, "no Dutch case yet" is not "no Dutch risk."

What the first 11 months actually tell us

Three patterns are worth flagging.

1. The regulators with the biggest fine ceilings are not the most active. Belgium (€200,000 / 6% of turnover), Hungary (€1.26M), and Italy (5% of revenue) have produced no enforcement signal. France, with a relatively modest €37,500 cap, has produced the most. Don't read fine ceilings as a risk-ranking.

2. The first targets are not who vendors predicted. Vendor blogs spent 2025 warning that startups and SMBs would be the first wave. The actual first wave was four of the largest retailers in France, plus a Spanish flag carrier. Regulators chose visible targets to set precedent. The second wave, historically across other directives, hits mid-market operators 6–18 months after the first wave.

3. The non-regulatory channel is the costliest one in aggregate. The German Abmahnung wave has, conservatively, moved more money than every regulatory fine combined. If you sell into Germany and have not done a WCAG 2.1 AA audit on your checkout, your exposure is right now, not "eventually."

What to do this quarter

If you ship anything customer-facing into the EU, three things matter more than the headline fines:

1. Audit checkout and account flows first. Across every case above — Vueling, the French four, the German Abmahnungen — the failing pages were the same: booking, checkout, account self-service. These are also the easiest to fix because they are the most-trafficked and the most-monitored.
2. Publish an accessibility statement. France fines specifically for not having one. Germany's MLBF expects to see it. The Netherlands' ACM uses it as a triage signal. It is the single highest-leverage compliance artifact.
3. Run automated scans monthly. Most of the violations cited in the cases above are automated-detectable — colour contrast, missing form labels, broken focus order, ARIA misuse. Automated tools catch about 30–40% of WCAG failures, but they catch the load-bearing ones that complainants notice.

For step three, I built Webply — it scans your real templates against WCAG 2.1 AA, ranks findings by EAA legal risk, and gives developers a fix-list ordered by what gets you fined.

We'll keep updating this

The enforcement picture is going to change a lot over the next 12 months. The French cases will produce rulings. The Netherlands will publish its first fines. Germany's BFSG will eventually produce a regulatory case to complement the private Abmahnung track. Italy's revenue-scaled penalty regime will get its first test.

When that happens, this page gets updated. If you spot an enforcement action I missed, tell us — we'd rather track it than guess.

For the full country-by-country reference (maximum fines, enforcement authorities, official sources for all 27 EU states), see EAA Fines by Country.