When the EU Accessibility Act became enforceable on 28 June 2025, the most common question I got from agency clients was some version of: "Is anyone actually going to enforce this?"

It is a fair question. EU directives have a habit of arriving with much fanfare and then sitting on the books for years before a regulator finally moves. The first GDPR fine took six months. The first DSA action took even longer.

A year in, the picture for the EAA is clearer — and more interesting — than I expected. And it shifted sharply in the last month.

There is now one private-sector court condemnation: on 4 June 2026 a French court ordered Carrefour to reach full accessibility within six months or pay €500 a day — brought not by a regulator but by disability associations. There is one large confirmed fine issued by a national court (Spain, on a partly pre-EAA legal basis). There is a steady drumbeat of private cease-and-desist actions in Germany that has already cost hundreds of operators money, even though no regulator has issued a single fine under the BFSG. And the regulators themselves are arming but have not yet bitten — France's DGCCRF, Germany's MLBF, Italy's AgID, and the Dutch ACM are all now operational.

Two things that did not happen are worth saying plainly, because both have been widely miscited. No national regulator has issued a fine directly under EAA-transposed law yet. And the Norwegian "€4,500-a-day" case that vendor blogs keep citing as a live six-figure penalty? It never cost a cent — more on that below.

So: not the wave of six-figure regulatory penalties some vendors predicted. Not silence either. The first real bite came from a courtroom, brought by an advocacy group. Here is the scoreboard, with citations.

The scoreboard

Now the case-by-case.

Spain: the Vueling fine — what it actually proves

The Vueling case is the most cited accessibility penalty in Europe right now, and it is also the most misrepresented. Several vendor blog posts have framed it as the "first EAA fine." It is not. The decision came from Spain's National High Court (Audiencia Nacional) under Royal Decree 1112/2018, the Spanish accessibility law that was already in force before the EAA took effect and that requires WCAG 2.1 Level AA for public-facing digital services.

What was the actual finding? The court ruled that disabled customers could not independently:

• Complete a flight booking on Vueling's website.
• Check in online for an existing reservation.
• Manage their booking after purchase — change seats, add baggage, request assistance.

The penalty was €90,000 plus a temporary bar on receiving public funds. The "public funds" piece matters more than people realise — for an airline that periodically benefits from aviation subsidies or government contracts, that secondary sanction can dwarf the headline fine.

Why this case is still relevant to EAA-watchers: the Spanish law it was decided under is functionally equivalent to what the EAA requires. The technical standard (WCAG 2.1 AA), the covered flows (transactional consumer journeys), and the kinds of failures (keyboard navigation, screen-reader compatibility on booking forms) all match the EAA pattern. A Spanish court has now established that "you can't book a flight as a screen-reader user" is, in fact, a fineable offense in the EU.

Read it as a preview, not a precedent.

France: the cases that just produced the EAA era's first real ruling

This is where the story changed in the last month — and where a detail most coverage got wrong actually matters.

The four cases everyone has been watching — against Auchan, Carrefour, E.Leclerc, and Picard — were not filed by the DGCCRF, the French consumer-protection regulator. They were brought by disability associations (apiDV and Droit Pluriel, with Intérêt à Agir) as private summary proceedings — référés. That distinction is the whole point: you do not need a regulator to drag you into court over accessibility. An advocacy group with a screen reader and a lawyer is enough.

And in the space of one month, those cases split two ways.

Carrefour was condemned. On 4 June 2026, the Tribunal judiciaire de Caen ordered Carrefour to bring its e-commerce site and app to full RGAA conformance within six months, or pay an astreinte of €500 per day (the statutory ceiling is €3,000/day, capped at €300,000). The reasoning is what every operator should read twice: Carrefour argued it was already 71% compliant, and the court said that is not a defense. Digital accessibility, it held, is an obligation of result — it cannot be "only slightly" met. 71% is a fail. The target is 100%.

Auchan was dismissed — for now. A month earlier, on 5 May 2026, the Tribunal judiciaire de Lille threw out the parallel case against Auchan on a threshold technicality: the court applied the old 2005 law's €250M-revenue trigger instead of the €2M e-commerce threshold under the 2019 directive — even while noting Auchan was only 41% RGAA-compliant. The associations have appealed to the Cour d'appel de Douai. Read this as a procedural escape that is now contested on appeal, not as a court blessing an inaccessible site. Do not build your compliance plan around the €250M reading; the operative e-commerce trigger is €2M.

The cases against E.Leclerc and Picard are still awaiting hearings.

Separately — and this is the part that is the regulator — the DGCCRF began its own field controls in January 2026. That track is still pedagogical (explain, then formal notice before any fine), and its first sector probe opened into rail-transport online booking. No regulatory fine yet. So France now has two parallel pressures: fast association référés that are already producing rulings, and a regulator that is warming up.

The full breakdown of how French enforcement works — the association route, the DGCCRF track, the astreinte mechanism — lives in our France EAA fines page.

Norway: the case everyone miscites — the threat that worked

You will see the Norwegian HelsaMi case cited all over vendor blogs as a live penalty "running into the mid-six figures." That is wrong, and it is worth correcting carefully, because the truth is actually a better lesson than the myth.

Here is what really happened. Norway is in the EEA and enforces EAA-equivalent universal-design rules. Its supervisor found that HelsaMi, a public health portal, failed multiple WCAG 2.1 AA criteria around form labeling, focus management, and assistive-technology compatibility. On 8 December 2025 it issued a decision: fix the failures by 19 December, or a coercive fine (tvangsmulkt) of NOK 50,000/day would begin to accrue.

HelsaMi fixed the issues in time. A follow-up test on 23 December 2025 confirmed compliance, and the supervision was closed. The daily penalty was never triggered. Total charged: €0.

So the headline isn't "a portal is bleeding €4,500 a day." It's that the threat of a daily penalty, on a tight deadline, forced a real fix in eleven days. That is exactly how the mechanism is designed to work — and it's the model EU regulators are most likely to copy.

Two reasons this matters for EU operators:

• The daily-penalty tool is enforcement-cheap and behaviorally effective — it does not need to be charged to change behavior, only credibly threatened. Expect more regulators to reach for it.
• The deadlines are short. HelsaMi got eleven days. The "we'll fix it next sprint" timeline that works for most issues does not survive a regulator's clock — which is the argument for finding your failures before one lands on your desk.

Germany: the wave nobody is counting properly

Within weeks of the BFSG (the German EAA transposition) taking effect in August 2025, German e-commerce operators started receiving Abmahnungen — formal cease-and-desist letters — citing accessibility violations on their websites.

The twist: most of these are not from regulators. They are from specialist law firms using Germany's UWG (Gesetz gegen den unlauteren Wettbewerb, the unfair competition act), arguing that an inaccessible competitor gains an unfair advantage and that competitors or qualified consumer organisations are entitled to sue.

This sidesteps the BFSG enforcement track entirely. There is no regulatory complaint, no 14-day fix window, no astreinte. There is a letter, a settlement demand (typically €1,500–€4,000), and a remediation deadline. Refuse, and you're in front of a German court on competition-law grounds.

I cannot give you a real count, because the cases settle privately and aren't published. The number we hear from German agency partners is "low four-figure" — somewhere in the 1,000–3,000 range in the first nine months. Each individual case is small. The aggregate cost across the German SMB market is already higher than any single regulatory fine the EU has produced.

The regulatory track is now arming, though. The German states' joint market-surveillance authority for accessibility — the MLBF, based in Magdeburg — became operational under the September 2025 state treaty and entered active control in Q1 2026, with a statutory fine band of €10,000–€100,000. As of June 2026 it has not publicly named an operator. So the live risk is still the Abmahnungen — but the BFSG fine track is no longer purely theoretical.

If you sell into Germany, this is the enforcement risk you should plan around today. Not (yet) the BFSG fines. The Abmahnungen.

We covered the legal mechanism in more detail in our German Abmahnung risk article — and you can check the German maximum fine and authority on our Germany fines page.

The Netherlands: the dog that hasn't barked yet

Of all the EU markets, the Netherlands has the most mature reporting infrastructure in place — and the highest fine ceiling at up to €900,000 or 1% of annual turnover per violation. Mandatory accessibility reporting under the Implementatiewet Toegankelijkheidsvoorschriften kicked in October 2025, and the ACM (Autoriteit Consument & Markt) is already publishing findings: it reported that 61% of the largest Dutch webshops are not accessible, and has said it will name the worst performers.

But there is no published case yet of a Dutch operator actually being fined under the new regime.

Two readings of this:

1. The Dutch enforcement model is report-then-fine. The reporting phase is producing a target list. The first fines will land later this year.
2. The Dutch regulator is deliberately staging. The Netherlands has six sector-specific enforcers (ACM for e-commerce, AFM for finance, ILT for transport, RDI for telecoms, CvdM for media, NVWA for products), and the coordination overhead means the first cases will likely be very deliberate.

Either way, "no Dutch case yet" is not "no Dutch risk."

What the first year actually tells us

Four patterns are worth flagging.

1. The first real bite came from a courtroom, not a regulator. The headline outcome of year one is the Carrefour condemnation — and it was won by disability associations in summary proceedings, not by the DGCCRF. If your risk model only watches what regulators do, you are watching the slower channel. The faster one is an advocacy group with a lawyer and a screen reader.

2. "Mostly compliant" is now a losing defense. Carrefour argued 71% RGAA conformance; a French court called that a fail and held accessibility to be an obligation of result — full conformance, not a passing grade. Whatever your automated score says, the legal target is 100% on the criteria that matter. Plan for conformance, not for a number.

3. The biggest fine ceilings are not the most active jurisdictions. The Netherlands (€900,000 / 1% turnover), Hungary, and Italy (5% of revenue) have produced no individual fine. France, with comparatively modest caps, produced the first ruling. Don't read fine ceilings as a risk-ranking — though watch Italy, whose AgID has declared 2026 "the year of enforcement," and the Dutch ACM, which is now naming names.

4. The non-regulatory channel is the costliest one in aggregate. The German Abmahnung wave has, conservatively, moved more money than every regulatory fine combined. If you sell into Germany and have not done a WCAG 2.1 AA audit on your checkout, your exposure is right now, not "eventually."

What to do this quarter

If you ship anything customer-facing into the EU, three things matter more than the headline fines:

1. Audit checkout and account flows first. Across every case above — Vueling, the French four, the German Abmahnungen — the failing pages were the same: booking, checkout, account self-service. These are also the easiest to fix because they are the most-trafficked and the most-monitored.
2. Publish an accessibility statement. France fines specifically for not having one. Germany's MLBF expects to see it. The Netherlands' ACM uses it as a triage signal. It is the single highest-leverage compliance artifact.
3. Run automated scans monthly. Most of the violations cited in the cases above are automated-detectable — colour contrast, missing form labels, broken focus order, ARIA misuse. Automated tools catch about 30–40% of WCAG failures, but they catch the load-bearing ones that complainants notice.

For step three, I built Webply — it scans your real templates against WCAG 2.1 AA, ranks findings by EAA legal risk, and gives developers a fix-list ordered by what gets you fined.

We'll keep updating this

The enforcement picture is going to keep moving. Carrefour's appeal options and the E.Leclerc and Picard hearings are still ahead. The Auchan appeal at Douai will test the €2M-vs-€250M threshold question. The Netherlands will publish its first fines. Germany's MLBF will eventually produce a named BFSG case to complement the private Abmahnung track. Italy's revenue-scaled regime will get its first test under the new AgID enforcement procedure.

When that happens, this page gets updated — we now refresh it monthly. If you spot an enforcement action I missed, tell us — we'd rather track it than guess.

For the full country-by-country reference (maximum fines, enforcement authorities, official sources for all 27 EU states), see EAA Fines by Country.