Downloadable EAA Checklist 2026: 72 real checks

72 checks to verify if your website complies with the EAA in Spain: scope of Law 11/2023, WCAG 2.2 level A and AA criteria, evidence requirements, and downloadable CSV.

A checklist of 72 checks to verify if your website complies with Law 11/2023, which has enforced accessibility requirements since June 28, 2025. Available as a CSV and PDF, it groups WCAG 2.2 level A and AA criteria into blocks, indicating for each point how to test it and what evidence to store.

This is not an article about accessibility: it is the tool we use for our audits. We are publishing it in its entirety, including our methodology and dates, so your team can use it without us.

What this asset is and what it contains

Seventy-two checks divided into eight blocks. Each one includes its technical criterion, level, who is responsible for fixing it, how to test it in under two minutes, and what evidence must be saved. Evidence matters just as much as the fix: when facing market surveillance authorities, you are not defending an accessible website; you are defending a case file.

Industry standard: A 200-point PDF copied from WCAG in English, without specifying which ones apply to you or what to save as proof.

Our criteria: 72 checks with criteria, levels, testing methods, and evidence, in an editable CSV, so your team can conduct the audit without needing to hire us.

What Spanish regulation says, article by article

Law 11/2023, of May 8, transposes Directive (EU) 2019/882—the European Accessibility Act—and its Title I is what affects you. We have verified this against the consolidated text of the BOE: the scope of application is in Article 2, the obligations of service providers in Article 13, substantial modification and disproportionate burden in Article 16, and the sanctioning regime in Article 30. The second additional provision is titled "Promotion for micro-enterprises."

One million euros is the theoretical ceiling of the general scale, not a fine given for insufficient contrast. What is easily sanctioned is the lack of documentation: accessibility is proven with paperwork, not with good intentions.

Micro-enterprises: the exemption exists and is narrower than you are told

Directive 2019/882 exempts micro-enterprises that provide services in Article 4.5. A micro-enterprise is one that employs fewer than 10 people and whose annual turnover or annual balance sheet does not exceed 2 million euros.

Two nuances almost no one puts in writing. First: the exemption covers services, not products. If you manufacture, import, or distribute affected hardware—point-of-sale terminals, ATMs, self-service terminals, e-readers—being a micro-enterprise does not exempt you from the requirement. Second: the exemption is a legal excuse, not a commercial permit. If your store cannot be used with a keyboard, you lose sales just as much as a company with 400 employees.

Deadlines, and a contradiction you should be aware of

Directive 2019/882 establishes two transition periods in Article 32: providers may continue using products that were already legally in use before June 28, 2025, until June 28, 2030, and self-service terminals placed into service before that date may remain in use until the end of their economic life, up to a maximum of 20 years.

Contradiction detected on 08-27-2026. A finreg360 alert summarizes that same transition as "up to 10 years" for terminals and places the end of the contract transition on June 29, 2030; Article 32 of Directive (EU) 2019/882 states 20 years and June 28, 2030. None of the Spanish pages we reviewed point out the discrepancy. Before basing an investment decision on either figure, read the single transitional provision of Law 11/2023 in the BOE.

And there is a second rule that many overlook. Royal Decree 193/2023 simultaneously obligates websites and apps of private companies of a certain size or with public funding. According to the reading from insuit.net consulted on 08-27-2026, it reaches entities with more than 100 employees or over 6 million euros in turnover and beneficiaries of public aid—including Kit Digital—with staggered deadlines between January 1, 2025, and January 1, 2030. This is a secondary source: if your company is near those thresholds, the correct reference is BOE-A-2023-7417.

Technical standards: the detail almost no one mentions

This is the point that makes this asset different. It is repeated everywhere that complying with EN 301 549 is sufficient for coverage. It is more nuanced than that.

Version EN 301 549 v3.2.1 (2021-03) is cited in the Official Journal as a harmonized standard for Directive 2016/2102, regarding public sector websites. The European Commission itself reminds us that a standard only acquires legal effect when its reference is published in the Official Journal. In the documentation we were able to consult on 08-27-2026, there is no harmonized standard cited in the OJEU that provides a presumption of conformity with Directive 2019/882.

Meanwhile, ETSI has the draft EN 301 549 V4.1.0 (2025-11) in the public inquiry phase, which declares itself to be "a voluntary means of conformity with the essential requirements of Directive 2019/882" and updates chapters 9, 10, and 11 to align with WCAG 2.2.

Industry standard: Auditing against WCAG 2.1 AA because it is what the old rule says, and repeating the audit in 2027 when the new version is cited.

Our criteria: Auditing today against WCAG 2.2 AA. The nine new criteria are inexpensive if designed from the beginning and expensive if retrofitted.

That is why this checklist is built upon WCAG 2.2 level A and AA. The criteria that 2.2 added over 2.1—2.4.11 Focus Not Obscured (Minimum), 2.5.7 Dragging Movements, 2.5.8 Target Size (Minimum), 3.2.6 Consistent Help, 3.3.7 Redundant Entry, and 3.3.8 Accessible Authentication (Minimum), all A or AA—are marked as such in the notes column. And 4.1.1 Parsing is listed as obsolete and withdrawn, with the warning that if your tender requires WCAG 2.1, you will still need to report it. Source: w3.org/TR/WCAG22, revision of December 12, 2024, consulted on 08-27-2026.

The checklist, point by point

Check every line. A check without saved evidence counts as not done.

• A1 · Your company exceeds the micro-enterprise threshold: 10 or more people, or more than €2M in annual turnover or balance sheet

• A2 · You sell goods or services to consumers online (e-commerce, included in the scope of Art. 2)

• A3 · You provide banking, payment, consumer credit, real estate, or investment services to consumers

• A4 · You sell, distribute, or provide access to e-books and their reading software

• A5 · You provide passenger transport services with a website, app, ticket sales, or real-time information

• A6 · You provide electronic communications services or access to audiovisual communication services

• A7 · You manufacture, import, or distribute affected hardware: POS, ATMs, self-service terminals, e-readers (the micro-enterprise exemption does not cover products)

• A8 · You exceed 100 employees or €6M in turnover, or received public funding for your website: in addition to the EAA, you are covered by RD 193/2023

• B1 · The general terms and conditions explain how the service meets accessibility requirements (Art. 13 of Law 11/2023)

• B2 · There is a published accessibility statement, with date, scope (domains, subdomains, and apps), applied standard, and evaluation method

• B3 · The statement names concrete exceptions, one by one, with their reason (not a generic template formula)

• B4 · There is an accessibility contact channel with a named person in charge and a written committed response deadline

• B5 · If you claim a disproportionate burden, there is a documented assessment by service, signed and dated (Art. 16), reviewed at least every 5 years or when the service changes

• B6 · You have not received public or private funding intended for improving the accessibility of that service (if you did, you cannot claim a disproportionate burden)

• B7 · The technical documentation of conformity is locatable and deliverable to the market surveillance authority in under a week

• C1 · Every informative image has a text alternative and decorative ones are marked as decorative (1.1.1, A)

• C2 · Videos have synchronized and reviewed subtitles, not uncorrected autogenerated ones (1.2.2, A)

• C3 · Videos with essential visual information have audio description or an equivalent alternative (1.2.3 A · 1.2.5 AA)

• C4 · The DOM order matches the visual reading order (1.3.2, A)

• C5 · Personal data fields declare their purpose with autocomplete (1.3.5, AA)

• C6 · No instruction depends solely on shape, color, size, or position (1.3.3, A)

• C7 · Color is not the only carrier of information, including in error states (1.4.1, A)

• C8 · Normal text reaches 4.5:1 contrast and large text 3:1 (1.4.3, AA)

• C9 · Meaningful icons, field borders, and focus states reach 3:1 against their background (1.4.11, AA)

• C10 · The page works with 200% zoom without loss of content or function (1.4.4, AA)

• C11 · The page is used at 320px width without horizontal scrolling (1.4.10, AA)

• C12 · Text supports the criterion's spacing adjustments and emerging content on hover are dismissible, hoverable, and persistent (1.4.12 and 1.4.13, AA)

• D1 · Every function executes with a keyboard: menus, carousels, maps, modals, date pickers (2.1.1, A)

• D2 · There are no focus traps in any component or iframe (2.1.2, A)

• D3 · Single-key shortcuts can be deactivated or remapped (2.1.4, A)

• D4 · There is a skip-to-main-content link, visible upon receiving focus (2.4.1, A)

• D5 · Each page has a unique and descriptive title (2.4.2, A)

• D6 · The tab order is logical and focus returns to the trigger when closing a modal (2.4.3, A)

• D7 · The text of each link says where it leads without depending on visual context (2.4.4, A)

• D8 · The focus indicator is always visible and is not covered by fixed headers or cookie banners (2.4.7 AA · 2.4.11 AA, new in WCAG 2.2)

• D9 · Headings and labels describe the actual content or purpose (2.4.6, AA)

• D10 · Every drag action has a single-pointer alternative (2.5.7, AA · new in WCAG 2.2)

• D11 · Touch targets measure 24 × 24 CSS px or have equivalent spacing (2.5.8, AA · new in WCAG 2.2)

• D12 · Time limits are extended or deactivated, automatic movement is paused, and nothing flashes more than three times per second (2.2.1, 2.2.2, and 2.3.1, A)

• E1 · The page language is declared, as are language changes within the text (3.1.1 A · 3.1.2 AA)

• E2 · Receiving focus does not trigger a context change (3.2.1, A)

• E3 · Changing the value of a control does not submit the form or navigate without prior notice (3.2.2, A)

• E4 · Navigation and repeated components behave the same on all pages (3.2.3 and 3.2.4, AA)

• E5 · The help mechanism appears in the same relative place on all pages where it exists (3.2.6, A · new in WCAG 2.2)

• E6 · Each field has a visible label associated by for/id, not just a placeholder (3.3.2, A)

• E7 · Errors are identified in text, described, and correction is suggested (3.3.1 A · 3.3.3 AA)

• E8 · For purchases, contracts, and financial data, submission is reversible, verifiable, or confirmable (3.3.4, AA)

• E9 · You are not asked to re-enter information already provided in the same process (3.3.7, A · new in WCAG 2.2)

• E10 · Authentication does not require remembering, transcribing, or solving a cognitive test without an alternative, and password pasting is permitted (3.3.8, AA · new in WCAG 2.2)

• F1 · Each component exposes the correct name, role, value, and state to the accessibility tree (4.1.2, A)

• F2 · Status messages are announced without stealing focus (4.1.3, AA)

• F3 · Custom components follow documented ARIA patterns, without invented roles or aria-labels that contradict visible text

• F4 · The site has been tested with two real screen reader and browser combinations (NVDA with Firefox, VoiceOver with Safari)

• F5 · 4.1.1 Parsing is listed as obsolete and withdrawn in WCAG 2.2; if a tender requires WCAG 2.1, keep reporting it

• G1 · The cookie banner operates with a keyboard, has visible focus, and does not cover content; rejecting takes the same clicks as accepting

• G2 · The payment gateway (Redsys, Bizum, Stripe) has been navigated entirely with a screen reader: the third-party iframe also responds to your consumer

• G3 · The payment and shipping forms support autocomplete for name, address, phone, and card (1.3.5, AA)

• G4 · The captcha has a non-visual alternative and does not depend on recognizing images

• G5 · Invoices and downloadable PDFs are tagged, or an HTML alternative with the same information exists

• G6 · The complete purchase process is finished with only a keyboard, including the address selector and session warning

• G7 · Amounts are read correctly aloud: "€1,234.56", and the VAT breakdown is text, not an image

• G8 · Accessibility information lives in the general terms and conditions, not hidden in a loose PDF

• G9 · Transactional emails (confirmation, shipping, return) are read in plain text without losing information

• G10 · Chat support, review widgets, and any third-party scripts pass the same checks as your code

• H1 · There is a dated audit with the sample of pages declared by template, not just the homepage

• H2 · The sample covers the full flow: registration, purchase, private area, and password recovery

• H3 · Each failure has a criterion, severity, responsible person named, and committed date

• H4 · Manual tests are separated from automatic ones in the report

• H5 · Testing has been done with assistive technology users, not just simulators

• H6 · There is no accessibility overlay presented as regulatory compliance

• H7 · The contract with your studio names accessibility as an acceptance criterion, not as an optional item

• H8 · There is a periodic review scheduled on the calendar, with an assigned responsible person and budget

Methodological sheet of the downloadable

The asset is published in three formats with the same content: CSV in UTF-8 with BOM, spreadsheet (.ods and .xlsx) with validations in the status columns, and printable A4 PDF for audits performed on paper.

CSV column schema

How it is scored

It is not scored in percentages. A 92% compliance rate with a blocker in the payment process is a 0 commercially: no one buys. The asset's rule is simple. If any item marked as a blocker is "non-compliant," the overall result is "non-compliant," no matter how many green checks are around it.

An audit is passed based on its worst item, not the average of its items.

Version, license, and maintenance

Version 1.0, published on August 27, 2026, built on WCAG 2.2 (revision 12-12-2024) and on the consolidated text of Law 11/2023. CC BY 4.0 license: you can use it in your audits, incorporate it into your tenders, and modify it, provided you cite the source. It is reviewed when a harmonized standard for Directive 2019/882 is cited in the OJEU and when ETSI publishes EN 301 549 V4.1.1 as the final standard. Each version retains the previous ids so you can compare audits separated by time.

How we use it within a project

This checklist is not used at the end, when there is no budget left to fix anything. It is distributed across six steps.

If any item cannot be met without redoing a third-party integration, we tell you before billing for it and document it as an exception with its reason. We prefer to deliver a justified exception than a false green check.

Accessibility is not a layer added at the end of a project: it is a consequence of having correctly traced the grid, states, and reading order. You have the full checklist, the method, and the sources; use it with whoever you want. Does this way of working suit you?

Frequently asked questions

Am I exempt from the EAA if I am a freelancer or have a very small company?

If you employ fewer than 10 people and do not exceed 2 million euros in annual turnover or balance sheet, the exemption for service providers in Directive 2019/882 may apply to you. It does not cover you if you manufacture, import, or distribute affected products, and it does not give back the sales you lose from a website that cannot be used with a keyboard.

Is it enough to comply with WCAG 2.1 AA to be covered?

It is the reasonable floor, and the checklist goes one step further: it audits against WCAG 2.2 AA because the draft EN 301 549 V4.1.0 (2025-11) is already aligned with that version. We cannot promise you a presumption of conformity: as of August 27, 2026, we are not aware of a harmonized standard cited in the OJEU for Directive 2019/882.

Does an overlay or accessibility widget make me compliant?

No, which is why it appears as a failure in item H6 of this checklist. A script that injects on top does not fix the markup, reading order, or focus states, which is precisely where most websites fail.

How much does it cost to fix what comes out of the audit?

It depends on how many blocking items touch shared components: changing a contrast token takes minutes, redoing a custom date selector takes days. We work with a fixed price per phase agreed upon before starting, without surprise hours, and if after reviewing the completed checklist we believe you do not need us, we will tell you.

Can I use this checklist in a tender or a contract with another provider?

Yes, the CC BY 4.0 license allows it by citing the source, and it is intended for that: the blocking, responsible, and due_date columns act as acceptance criteria. Change the thresholds that do not fit your case before signing.

Keep reading

• Web accessibility in Spain after the European Accessibility Act: who is obligated and what is required
• How to check if your website complies: 20-minute self-applicable test
• Accessibility overlays do not make you comply with the EAA: the evidence
• 47-point checklist before putting a website into production
• Contract and rights assignment template, to name accessibility as an acceptance criterion

Transparency note. Some of our own data in this guide is still being measured on real projects, with a single method. We will publish it with its sample size and date range once the sample is large enough; until then, every figure you see carries its source and date of consultation.

Sources

• https://www.boe.es/buscar/act.php?id=BOE-A-2023-11022 — consolidated text of Law 11/2023 in the BOE. Provides the actual numbering of the articles cited: Art. 2 scope of application, Art. 13 obligations of service providers, Art. 16 substantial modification and disproportionate burden, Art. 30 sanctioning regime, second additional provision on micro-enterprises, and single transitional provision. Consulted 08-27-2026.
• https://www.boe.es/buscar/pdf/2023/BOE-A-2023-11022-consolidado.pdf — consolidated PDF of the same law; confirms the index and pagination of the previous articles. The articulated body could not be extracted in full, which is why detailed data is attributed in the text to secondary sources.
• https://finreg360.com/alerta/la-ley-de-accesibilidad-busca-eliminar-barreras-de-las-personas-con-limitaciones-funcionales-para-acceder-a-productos-y-servicios/ — legal alert. Provides the definition of micro-enterprise (less than 10 people and ≤ €2M), the list of affected services, the sanctioning range of €301–€1,000,000, and the content of Art. 13 and Art. 16. It is also the source of the documented contradiction regarding transitional deadlines (10 years and 06-29-2030).
• https://www.insuit.net/es/real-decreto-193-2023/ — reading of Royal Decree 193/2023. Provides the thresholds for obligated private companies (more than 100 employees or more than €6M), the reference to UNE-EN 301549, and the staggered deadlines from 2025 to 2030. Marked as a secondary source in the article.
• https://www.w3.org/TR/WCAG22/ — W3C recommendation. Provides the exact list of new criteria in WCAG 2.2 with their level (2.4.11 AA, 2.4.12 AAA, 2.4.13 AAA, 2.5.7 AA, 2.5.8 AA, 3.2.6 A, 3.3.7 A, 3.3.8 AA, 3.3.9 AAA), the withdrawal of 4.1.1 Parsing, and the date of the last revision, December 12, 2024.
• https://www.etsi.org/deliver/etsi_en/301500_301599/301549/04.01.00_20/en_301549v040100ev.pdf — draft EN 301 549 V4.1.0 (2025-11) in ETSI public inquiry phase. States that it is declared a voluntary means of conformity with Directive 2019/882, the reference to mandate M/587, and the alignment of chapters 9, 10, and 11 with WCAG 2.2.
• https://digital-strategy.ec.europa.eu/en/policies/latest-changes-accessibility-standard — European Commission page. States that EN 301 549 v3.2.1 was cited in the Official Journal in August 2021 for Directive 2016/2102 and that a standard only has legal effect when its reference is published in the OJEU. Last recorded update: June 30, 2025.
• https://www.etsi.org/deliver/etsi_en/301500_301599/301549/03.02.01_60/en_301549v030201p.pdf — EN 301 549 V3.2.1 (2021-03), current harmonized version cited in the OJEU.