Directive (EU) 2019/882 · Article 30
Penalties under the European Accessibility Act are set by each Member State
The directive does not contain a single fine. Article 30 tells Member States to lay down penalties that are effective, proportionate and dissuasive, and to make sure they are applied. The result is twenty-seven regimes, with different amounts, different authorities and, more important than the amounts, different powers to stop a service.
What the directive itself says
Article 30 requires penalties to be effective, proportionate and dissuasive, and asks that they take into account the extent of the non-compliance and the number of units concerned. It also says explicitly that penalties are not a substitute for fixing the problem: the obligation to comply stands whatever the fine.
Article 29 adds the part most providers overlook. Consumers, and the bodies acting for them, can bring proceedings before national courts or administrative authorities. In several countries that route moves faster than the regulator.
The money is rarely the worst outcome
Market surveillance authorities can order a service to be brought into conformity within a deadline, and where the failure persists they can restrict or withdraw the service from the market. For an online business, a withdrawal order is not a line in a budget: it is the checkout switched off in that country. Fines are published too, and a published decision reaches your enterprise customers before your sales team does.
What changes from country to country
| What to check | Why it matters |
|---|---|
| The implementing law | BFSG in Germany, Law 4/2004 as amended in Italy, Ley 11/2023 in Spain. The obligation is the same directive, the procedure is national. |
| Which authority | Some states use a single market surveillance body, others split between sector regulators for banking, telecoms and transport. |
| How a case starts | Almost always a consumer complaint, occasionally a sweep. Rarely a spontaneous audit. |
| The deadline to cure | The order to bring the service into conformity comes with a period. Missing it is what escalates the case. |
| Maximum amounts | Set nationally, from low five figures to six figures, often per infringement rather than per company. |
| Publication | Several regimes publish decisions, which is the part that reaches buyers. |
Because the amounts move with national law, any provider who quotes you one figure for the whole Union is selling a headline. What is stable across all twenty-seven is the sequence: complaint, request for evidence, order with a deadline, penalty or restriction if the deadline passes.
The request for evidence is the moment that decides the case
When an authority writes, it does not ask whether you have a statement. It asks what the statement is based on: which standard, which tools, which date, which journeys, which barriers are still open and what the plan is. An organisation that can attach a dated test report with a public code usually ends the matter there. An organisation that cannot moves to the next stage, where the deadline and the order appear.
Where exposure concentrates
- Checkout and payment flows, because a barrier there produces an immediate complaint from someone who wanted to buy.
- Account creation and login, especially one-time codes with short timers.
- Customer support channels, when the only route to a human is a widget a screen reader cannot open.
What reduces exposure, in order
A real test, dated, on the journeys that carry revenue. A statement written from that test, naming the limitations you have not closed yet. A feedback channel that logs messages and forwards them within two business days, because a complaint answered in two days rarely becomes a case. A retest cycle that catches regressions before a customer does.
None of that removes the duty to fix what is broken, and nothing sold as a certification does either. What it does is put you in the group whose case ends at the first email.
What a complaint actually looks like
It rarely arrives as a legal letter. Someone who could not finish a purchase writes to the authority, or to a consumer association, describing what happened on a specific page on a specific day. The authority forwards it and asks you to explain. At that point the file contains their account and nothing of yours, and whatever you send becomes the record.
This is why the date on a test matters as much as its content. A report finished after the complaint arrived tells the authority you started once you were caught. A report from months earlier, with the barrier already listed as open and a fix planned, tells a different story about the same barrier.
Two years in, the pattern is visible
The obligation has applied since 28 June 2025, long enough for the first cases to work through. They start with consumers who could not complete something ordinary, they concentrate on checkout, login and support, and they are decided on evidence rather than on wording. Nothing about that pattern requires a lawyer to anticipate: it requires a test that already exists.
The providers who get through it quickly share one habit. They treat the statement as the visible end of a file that already contains the test, the open barriers and the log of what customers reported, rather than as a page written once and forgotten.
What to have ready, in one folder
The statement as published, the test report with its date and standard, the list of open barriers with target dates, the log of messages received through the feedback channel and how they were handled, and the record of the last retest. Five documents, one folder, and an answer that takes an hour instead of three weeks.
Non-EU providers are not out of reach
The directive follows the consumer, not the seat of the company. A provider established outside the Union that sells covered services to consumers inside it is subject to the same national procedures, and enforcement travels through the marketplace, the payment chain and the national court route in Article 29. See what the 28 June 2025 date changed and the checklist we use before signing.
Questions we get before buying
Does the directive set a single EU-wide fine?
No. Article 30 leaves penalties to each Member State and only requires them to be effective, proportionate and dissuasive.
Can a service really be withdrawn?
Yes, where non-compliance persists after an order to bring the service into conformity. For an online service that means being stopped in that market.
Who can start a case against us?
A consumer complaint usually does. Article 29 also allows consumer bodies and public bodies to act before courts or administrative authorities.
Are penalties per company or per infringement?
It depends on the national law. Several regimes count per infringement, which is why the number of affected units matters in Article 30.
Does a published decision matter more than the fine?
For B2B providers, often yes. Enterprise buyers screen suppliers, and a published decision is easy to find.
We are established outside the EU. Are we exposed?
Yes, if you sell covered services to consumers in the Union. The obligation follows the consumer, not your registered office.
Does a statement on its own protect us?
No. What protects you is the evidence behind it: a dated test, the standard used, the open barriers and what you are doing about them.
How fast do authorities usually move?
The first contact is a request for information with a deadline. The escalation happens when that deadline passes without an answer.
Do microenterprises face penalties?
Service microenterprises under 10 staff and up to 2 million euro are exempt from the service requirements, so the question does not arise for them.
Can you represent us before the authority?
No. We provide the test, the documentation and the record. Representation is a matter for your own counsel.
Have the evidence ready before the first email arrives
A dated test, a statement written from the result, a public code and a feedback channel that answers in two business days.