Web accessibility and the EAA in Spain: who is required to comply in 2026

As of June 28, 2025, Law 11/2023 mandates accessibility for e-commerce, banking, and transport websites. Who is exempt, what is required, and how to verify compliance.

Since June 28, 2025, Law 11/2023 has mandated that websites and apps for e-commerce, banking, transport, telecommunications, audiovisual services, and e-books targeting consumers in Spain must be accessible. Service micro-enterprises with fewer than 10 employees and a turnover of up to €2 million are excluded. For everyone else, this is a mandatory requirement, not a recommendation.

For fourteen months, we have been reading articles about the European Accessibility Act. Almost all say the same thing: that you must comply with WCAG 2.1 level AA and that fines can reach one million euros. Both statements are incomplete, and the former is legally inaccurate as of today.

This guide is written to help you do three concrete things: determine if your website falls within the scope of the law, verify in twenty minutes if it fails, and decide with discernment whether you need to spend money this year or next. This is not a text intended to alarm: it is a text about boundaries.

Content verified as of August 27, 2026, against the BOE, EUR-Lex, ETSI, and the 2026 WebAIM Million report. The European technical standard is currently undergoing active revision: the section "What exactly is required" explains what is changing and what is not.

What changed on June 28, 2025

Directive (EU) 2019/882, known as the European Accessibility Act (EAA), was transposed in Spain via Title I of Law 11/2023, of May 8. Title I entered into force on June 28, 2025. There was no extension, no general moratorium, and no announced grace period.

What changed is not the technical standard. What changed is the obligated subject. Until that date, the digital accessibility required in Spain primarily targeted the public sector and a handful of large companies. Since that date, it applies to any company that sells to consumers online and is not a micro-enterprise.

It is also worth noting what did not change. The law does not mandate that every Spanish website be accessible. That headline circulates often and is false. Law 11/2023 has a restricted scope, enumerated in its Article 2, and outside of that scope, other regulations with different deadlines apply. Confusing the three Spanish regulatory layers is the most expensive mistake we have seen this year.

Industry norm: The sector publishes that "it is now mandatory for all websites" and sells audits based on fear. Fear makes people buy quickly and buy badly.

Our approach: We tell you first if you are within the scope of Article 2. If you are not, we tell you so, and there is no project to sell this year.

Who is truly obligated: the restricted scope of Article 2

Article 2 of Law 11/2023 transposes Article 2 of the Directive and enumerates products and services. Regarding websites or apps, the covered services are:

• E-commerce services
• Banking services for consumers
• Electronic communications services
• Services providing access to audiovisual media services
• Air, bus, rail, and waterborne transport services for passengers, including their websites, mobile applications, e-tickets, and travel information
• E-books and specialized software

The piece that decides almost all cases is the definition of e-commerce. The Directive sets it out in its Article 3 as services "provided at a distance, through websites and mobile device services, by electronic means and at the individual request of a consumer, with the purpose of concluding a contract with the consumer."

That definition includes two words that almost no Spanish article highlights: consumer and contract.

If your website allows a natural person to complete a purchase, a reservation, or a contract, you are an e-commerce service and are included. If your website is a corporate catalog without transactions, or if you sell exclusively to companies via quotes and invoices, the EAA does not reach you through this channel. It does not reach you that way: but it may reach you through another, and the section on the three layers explains which one.

This table resolves 90% of the inquiries we receive. The remaining 10% are mixed cases: a corporate website with a small shop, a media outlet with a paywall, or an app that acts as a storefront in one market and a transaction platform in another. In these cases, the criterion is the flow, not the domain. If there is a path within your product that ends in a contract with a consumer, that path is included.

The micro-enterprise exemption: what frees you and what doesn't

The Directive exempts micro-enterprises providing services from complying with accessibility requirements and associated obligations. The definition is twofold, and both conditions must be met.

Three clarifications that change the result in practice.

First: the exemption is for services, not for products. A micro-enterprise that manufactures or distributes products included in the scope (payment terminals, e-readers, consumer computer equipment) is not exempt from the requirements; it is relieved of part of the documentary burden regarding disproportionate burden assessment. It is a reduction in paperwork, not a substantive exemption.

Second: the threshold is double. Nine people with €3 million in revenue is not a micro-enterprise. Twelve people with €900,000 is not either. We have seen this miscalculated on e-commerce forums several times this year.

Third: the EAA exemption does not take you out of the rest of the legal framework. It does not free you from Royal Decree 193/2023, it does not free you from obligations stemming from contracts with the public sector, and it does not free you from a discrimination claim. You are outside of one specific law, not outside of accessibility.

Industry norm: "We are eight, it doesn't apply to us, we carry on as usual." This is correct regarding Law 11/2023 and premature regarding everything else.

Our approach: We verify the threshold, leave it in writing with a date, and note the date on which it will cease to be true if the team grows.

The three layers of Spanish regulation

Here is the real difference between this guide and those you have already read. In Spain, there is no single digital accessibility law: there are three overlapping layers, with different subjects, different deadlines, and technical standards cited differently.

Layer 1. Public Sector: Royal Decree 1112/2018. It obligates websites and apps of the state, regional, and local public sector, and extends to private entities when they provide publicly funded services or services linked to public service delivery. It requires a published and annually reviewed accessibility statement, a feedback mechanism with a response within twenty business days, and a claim procedure with a maximum resolution time of two months.

Layer 2. Private sector with consumer transactions: Law 11/2023. This is the new layer, the one that entered into force on June 28, 2025, and which we described above.

Layer 3. Goods and services available to the public: Royal Decree 193/2023. This is the layer almost no one mentions, and the one that will surprise many corporate websites that believe they are currently exempt. RD 193/2023 regulates basic accessibility conditions for access and use of goods and services available to the public. It reaches companies providing services to the public—with special attention to those of "special economic importance" as defined in Law 56/2007: more than 100 employees or an annual turnover exceeding €6 million in sectors such as electronic communications, financial services, utilities, travel agencies, passenger transport, and retail—and sets its own calendar.

Read this twice if you have a corporate website without a shop. The EAA does not obligate you today. The 2029 and 2030 calendar does point at you. You have time, but you do not have a pardon.

What exactly is required: why "WCAG 2.1 AA" is not the legal answer

This is where the Spanish consensus is wrong, and where the most money is being spent poorly.

Law 11/2023 does not say "comply with WCAG." It says that products and services within its scope must meet the accessibility requirements in its Annex I. Those requirements are written in functional terms: information perceptible through more than one sensory channel, understandable presentation, sufficient size and contrast, compatibility with assistive technology, and alternatives for non-text content.

the connection to WCAG comes through another channel: the presumption of conformity. Article 15 of the Directive—Article 17 of the Law—establishes that products and services complying with harmonized standards published in the Official Journal of the European Union (OJEU) are presumed to be in conformity. The candidate standard is EN 301 549. And here is the nuance that changes the conversation:

As of today, there is no harmonized standard cited in the OJEU that grants automatic presumption of conformity with the EAA. Complying with EN 301 549 V3.2.1 is the best available proof of diligence and is what any surveillance authority will look at. But it is not a formal pass. The mandatory part is Annex I; the technical standard is the path, not the destination.

And the standard is moving. ETSI published the draft EN 301 549 V4.1.0 in November 2025 and the final draft in June 2026, aligned with WCAG 2.2. The final version, V4.1.1, is expected within this year.

Verified 27-08-2026. Sources contradict each other on two points, and we state this rather than hide it. One: the Directive sets a maximum of 20 years of use for self-service terminals in service before 2025 in Article 32.2; several reference Spanish summaries publish 10 years. If you have ATMs or kiosks, check the single transitional provision of Law 11/2023 in the BOE before planning the renewal. Two: both "UNE-EN 301549:2019" and "UNE-EN 301549:2022" circulate as valid. Before writing a specific version in a contract, check the reference in the UNE catalog and the OJEU.

Practical consequence for your project: if you are designing or redoing a website in 2026, work against WCAG 2.2 level AA. The criteria that 2.2 adds to 2.1 are few and inexpensive if resolved in the grid and focus states from the beginning. Repairing them later, when the standard is cited in the OJEU, costs several times more.

Industry norm: Design for 2.1 because it is what the article you read said, and pay again in 2027 for the 2.2 criteria.

Our approach: Design for 2.2 AA now, because the difference is paid once in the system and zero times in each template.

The six failures that account for almost everything

The WebAIM Million report analyzes the homepages of the million most visited domains every February. The 2026 data is uncomfortable and is the best public reference that exists to calibrate the scale of the problem.

The data useful for work is not the global percentage. It is the distribution: six types of failures account for 96% of all detected errors.

Look at the list again. None of the six is a difficult problem. Five of the six are resolved in the design system and templates, just once, not page by page. Contrast is a palette decision. Form labels are a component decision. Document language is an attribute in the <html> tag.

This has a direct reading on the budget: most of the measurable non-compliance in Spain is not an expensive audit problem; it is a poorly mapped system problem. A color that does not guide is a color that hinders, and now it is a color that is non-compliant.

And it has a second reading, less comfortable. Automated tools detect approximately one-third of the WCAG criteria. The rest—logical tab order, alt text that describes what the image signifies rather than what it contains, error messages that explain how to correct, content that remains usable at 400% zoom—can only be seen by a person testing. A green report from a free tool is not proof of compliance; it is proof that there are no syntax errors.

How to check if your website complies: twenty minutes, no paid tools

This does not replace an audit. It serves to know if you have a problem, how big it is, and if it is worth paying for an audit this quarter.

• Unplug your mouse. Navigate the entire page using the Tab key: if you cannot reach the menu, the search bar, the form, and the buy button, and return, you have a blocking failure.
• Look at where the focus is with each Tab press. If at any point you don't know which element is selected, you are missing a visible focus indicator.
• Open the dropdown menu with the keyboard and close it with Escape. If it opens and doesn't close, or if the focus escapes behind a modal, it is a serious failure.
• Set the browser zoom to 200% and then to 400%. If horizontal scroll appears or text overlaps, the design is not adaptable in the sense of the standard.
• Test the contrast of small text: minimum 4.5:1 against its actual background, including text over images and disabled button text that should be readable.
• Submit a form with an incorrectly filled field. If the error appears only in red and without text, it does not comply: color cannot be the only carrier of information.
• Check that each field has a real associated label, not a placeholder that disappears when typing.
• Look at the source code: <html lang="es"> must be present and must match the actual language of the page.
• Read the alt text for three product images. If they say "image1.jpg" or repeat the product name written next to it, they are wrong.
• Check that each page title is distinct and describes its content, and that there is a single <h1> with a coherent hierarchy below it.
• If there is video with voice, check that it has real subtitles, not unreviewed auto-generated ones.
• Search for the "skip to content" link by pressing Tab from the beginning of the page.

If you fail four or more of those twelve points, you don't need a second opinion: you need a budget. If you fail one or two, it is a week's work. The full development of this test, with screenshots and criteria, is in the sister guide for checking in twenty minutes that we link to at the end.

Overlays do not make you compliant

Every time a regulatory date approaches, the same offer appears: a line of JavaScript, a monthly fee, and the promise of automatic compliance. In Spain, they are being sold using Law 11/2023 in their sales pitch.

The technical argument is simple and does not admit much rebuttal. Conformity with WCAG is defined by success criteria, and there are criteria that no external script can satisfy: it cannot decide if alt text correctly describes what an image means, it cannot reorder the logic of a purchase flow, it cannot rewrite an error message to explain how to correct it. It can cover six syntax failures. It cannot manufacture meaning.

Industry norm: A monthly widget that promises compliance, does not document it, and leaves the non-compliance where it was, now with an overlay that often gets in the way of screen readers.

Our approach: Fix the design system and templates once, leave a written record of what was corrected, and never pay a subscription fee for it again.

Disproportionate burden: the door that exists and what it costs to cross it

The law provides for two real exceptions: substantial modification of the nature of the product or service, and disproportionate burden for the economic operator. They are in Article 14 of the Directive and Article 16 of Law 11/2023, with evaluation criteria in an annex.

This is not a box to be checked. To invoke it, you must evaluate and document the relationship between the cost of making the service accessible and the operator's resources, keep that documentation, re-evaluate it when the service changes, and be prepared to hand it over to the surveillance authority when requested.

Our experience with this is short and clear: for a medium-sized website or shop, setting up and maintaining the disproportionate burden file costs more than fixing the six failures in the previous table. The exception is intended for real cases of disproportion, not for delaying a budget decision.

Who monitors and what can happen

During the first year of the law being in effect, the usual question was who controlled this. In February 2026, that loophole was closed.

Market surveillance is the responsibility of the authorities designated by the autonomous communities in accordance with Article 27 of Law 11/2023; the technical Unit coordinates, supports, represents Spain before European bodies, and exercises surveillance in areas where no authority has been designated. Translated: since February 2026, there is a state desk to which a user can direct a claim regarding an inaccessible website.

Regarding sanctions, the range circulating is correct but cited incorrectly. The amounts come from the regime of infractions and sanctions regarding equal opportunities and non-discrimination of persons with disabilities, from Royal Legislative Decree 1/2013.

Writing "fines of up to one million euros" next to the photo of a shop with five employees is dishonest. The top tier is reserved for very serious infractions and operators of a different scale. The realistic risk for a Spanish SME is not the fine: it is a user complaint, an administrative request with a deadline, and exclusion from public tenders, where accessibility is being incorporated as a criterion and as a cause for rejection of offers.

What it costs to fix it and in what order

We cannot give you a market figure because none exists published with methodology in Spain, and we will not invent one. What we can give you is the distribution of effort, which is stable across projects and is what truly allows you to read a budget.

— = data being measured; we will publish it once we have our own sample.

And this is the order in which we do it, because order matters more than budget:

1. Contrast and visible focus in the system, not in the pages. A change in color variables and focus states fixes thousands of instances at once. It is the work with the best relationship between effort and criteria resolved.
2. Forms and purchase flow. Associated labels, error messages with text, coherent tab order. This is where non-compliance turns into lost sales, not just legal risk.
3. Semantic structure. One <h1>, real hierarchy, lang declared, skip to content link, marked regions.
4. Interactive components. Modals, dropdowns, carousels, tabs. This is where time goes, and where a poorly chosen library costs weeks.
5. Content. Alt text written by someone who understands the product, manually reviewed subtitles.
6. Documentation. The record of what was corrected, what is pending, and the decisions made, with dates. If a request arrives tomorrow, that document is your defense.

— = data being measured; we will publish it once we have our own sample.

Our stance, stated plainly: accessibility is cheap in the Planning phase and expensive in any subsequent phase. It is a property of the grid and the typographic rhythm, not a layer that is painted on top.

How we work

We work in stages, with a fixed price per phase agreed upon before starting. Accessibility is not a separate phase: it enters into three of them.

And the exclusions, which are the part that gives value to the rest:

• We do not certify. In Spain, there is currently no official certification of EAA conformity for services, and whoever sells you a seal is selling you a graphic.
• We do not promise zero incidents. We promise criteria verified one by one and a record of what remains open, dated.
• We do not install overlays, even if you ask for them. If what you need is a three-day patch, we tell you that we are not the right studio.
• If your website is outside of Article 2 and your real calendar is 2029, we tell you so and there is no project this year.

A dated record of what was corrected demonstrates your diligence to a surveillance authority; a bought seal demonstrates nothing.

Frequently Asked Questions

Accessibility is not an obligation to be fulfilled: it is a property that is designed. When it is in the grid, in the color, and in the reading order, there is nothing to remedy later; when it is added on top, it is always noticeable.

Do you want us to look at your website and tell you which regulatory layer you fall under and what you need to do this year? The first call is 30 minutes and it costs nothing. Tell us what you have in front of you.

Frequently asked questions

Does my corporate website without a shop have to be accessible in 2026?

Under Law 11/2023, no: without transactions with a consumer, you are not an e-commerce service. Under Royal Decree 193/2023, a calendar does point at you, with January 1, 2029, for new services and January 1, 2030, for existing ones.

We are seven people and generate €1.2 million in revenue. Are we exempt?

Yes regarding Law 11/2023, because you meet the two micro-enterprise conditions: fewer than 10 people and up to €2 million. Leave a written record of the date you checked this, because the exemption is lost the day you cross either of the two thresholds.

Is complying with WCAG 2.1 level AA enough?

It is the best proof of diligence available and it is what a surveillance authority will look at. It is not an automatic legal presumption: as of August 27, 2026, there is no harmonized standard cited in the OJEU for Directive 2019/882, and what is required is Annex I of the law.

Does a green report from an automated tool serve as proof?

It serves to demonstrate that there are no syntax errors, and that is approximately one-third of the criteria. The rest requires manual testing with keyboard and screen reader, and that test must be documented with date and scope.

How long does it take for you to make a website compliant?

It depends on the size of the catalog and how many interactive components need to be redone; a brand and content website usually takes 6 to 12 weeks. Before giving you a date, we do the audit and tell you what falls outside the scope, so you don't discover the rest halfway through the project.

Keep reading

• Accessibility overlays do not make you EAA compliant: the evidence
• How to check if your website complies: 20-minute self-test
• Downloadable EAA checklist, for your provider or committee
• Legal obligations of a website in Spain: GDPR, cookies, and Consent Mode v2
• Redesigning your website without losing traffic or ranking: how to do it in phases
• Checklist of 47 checks before putting a website into production

Transparency note. Some of our own data in this guide is still being measured on real projects, with a single method. We will publish it with its sample size and date range once the sample is large enough; until then, every figure you see carries its source and date of consultation.

Sources

• https://www.boe.es/buscar/act.php?id=BOE-A-2023-11022 — Law 11/2023, of May 8: consolidated text. Confirms that Title I transposes Directive (EU) 2019/882, the structure (arts. 1-31), art. 16 (substantial modification and disproportionate burden), art. 17 (presumption of conformity), art. 27 (surveillance authorities), and the single transitional provision.
• https://eur-lex.europa.eu/legal-content/ES/TXT/HTML/?uri=CELEX:32019L0882 — Directive (EU) 2019/882: complete list of products and services in art. 2, literal definition of 'e-commerce services' (art. 3), micro-enterprise exemption (art. 4.5) and simplified regime for products (art. 4.6), art. 14 (disproportionate burden), art. 15 (presumption of conformity), art. 31 (transposition, 28-06-2025), and art. 32.2 (self-service terminals, maximum 20 years).
• https://accesibilidadweb.dlsi.ua.es/?menu=ley11-2023 — University of Alicante: confirms the entry into force of Title I on 28-06-2025 (with the exception of art. 27.4) and that Law 11/2023 removes the previous private-sector web accessibility obligations from Law 34/2002.
• https://www.iberley.es/noticias/entra-vigor-ley-11-2023-que-regula-accesibilidad-los-canales-digitales-35022 — Iberley: micro-enterprise threshold (fewer than 10 workers and up to €2 million turnover or balance sheet) and transitional calendar until 2030. Secondary source verified against EUR-Lex.
• https://finreg360.com/alerta/la-ley-de-accesibilidad-busca-eliminar-barreras-de-las-personas-con-limitaciones-funcionales-para-acceder-a-productos-y-servicios/ — finReg360: scope of financial and e-commerce services, dates 28-06-2025 and 29-06-2030, sanction bracket €301 to €1,000,000. Publishes 10 years for self-service terminals, a figure that contradicts art. 32.2 of the Directive and which the article expressly points out as a discrepancy.
• https://www.boe.es/buscar/act.php?id=BOE-A-2026-4520 — Royal Decree 143/2026, of February 25: creates the Technical Unit for support and coordination of surveillance authorities regarding accessibility requirements, its functions (art. 3, including point of contact with the public and receipt of complaints), publication in BOE no. 52 of 27-02-2026, and entry into force 28-02-2026.
• https://accesibilidadweb.dlsi.ua.es/?menu=rd193-2023 — University of Alicante: scope of Royal Decree 193/2023 (goods and services available to the public, companies of special economic importance from Law 56/2007), level A and AA, and calendar January 1, 2029, for new private services and January 1, 2030, for existing ones.
• https://www.insuit.net/es/accesibilidad-web-normativa-empresas/ — Thresholds of 'company of special economic importance' from Law 56/2007: more than 100 workers or more than €6 million in annual turnover, and sectors included (electronic communications, financial, supplies, travel agencies, passenger transport, retail).
• https://www.boe.es/buscar/act.php?id=BOE-A-2018-12699 — Royal Decree 1112/2018: scope of public sector and extension to funded or concessionaire private entities, accessibility statement with annual minimum review, feedback mechanism with 20-business-day response, and claim procedure with two-month maximum.
• https://www.dsca.gob.es/en/derechos-sociales/discapacidad/derechos-personas-discapacidad/infracciones-y-sanciones — Ministry of Social Rights, Consumer Affairs and Agenda 2030: sanction bracket of €301 to €1,000,000 regarding non-discrimination due to disability, referred to Royal Legislative Decree 1/2013.
• https://accesibilidadweb.dlsi.ua.es/?menu=rdl1-2013 — University of Alicante: brackets of art. 83 of RDL 1/2013 (minor up to €30,000, serious up to €90,000, very serious up to €1,000,000).
• https://www.etsi.org/deliver/etsi_en/301500_301599/301549/04.01.00_30/en_301549v040100va.pdf — ETSI: final draft EN 301 549 V4.1.0 (2026-06), harmonized standard prepared under standardization mandate C(2022) 6456 for Directive (EU) 2019/882, with clauses 9, 10, and 11 aligned to WCAG 2.2.
• https://en.wikipedia.org/wiki/EN_301_549 — Version history of EN 301 549: V3.2.1 (2021-03) as the current published version, which fully incorporates WCAG 2.1, and V4.1.1 expected for 2026 with WCAG 2.2 AA.
• https://accessible.org/eaa-vs-en-301-549-difference/ — Confirms that EN 301 549 has not yet been formally harmonized with the EAA and therefore complying with it does not currently generate a presumption of conformity; V4.1.1 expected in 2026, draft V4.1.0 released in November 2025.
• https://webaim.org/projects/million/ — WebAIM Million 2026 (February 2026 analysis): 95.9% of homepages with detectable WCAG 2 failures, average of 56.1 errors per page versus 51 in 2025, and breakdown of the six dominant failures (contrast 83.9%, missing alt 53.1%, form labels 51.0%, empty links 46.3%, empty buttons 30.6%, undeclared language 13.5%), which account for 96% of errors.
• https://overlayfactsheet.com/en/ — Overlay Fact Sheet: 1,031 signatories and the literal statement that no overlay product on the market can make a website fully comply with any existing accessibility standard nor eliminate legal risk.
• https://www.ine.es/prensa/edad_2020_p.pdf — INE, EDAD 2020 (press release from 19-04-2022): 4.38 million people with disabilities in Spain, 94.9 per thousand inhabitants; rates by type, including hearing (27.6) and vision (23.6). Consulted to size the problem; finally not cited in the body to avoid mixing prevalence of disability with regulatory obligation.