The EAA checklist for an online shop or service business

Article 2(2) lists the services: electronic communications services, services providing access to audiovisual media, elements of air, bus, rail and waterborne passenger transport (websites, apps, e-tickets, travel information, interactive terminals), consumer banking services, e-books and dedicated software, and e-commerce services. The German market surveillance body states that the list in the BFSG is exhaustive.

E-commerce means services provided at a distance, through websites and mobile apps, by electronic means and at the individual request of a consumer with a view to concluding a consumer contract. A consumer is a natural person acting outside their trade or profession. A shop that sells only to businesses is outside this definition; a shop open to anyone is not.

Some content on a covered site is excluded: pre-recorded time-based media and office files published before 28 June 2025, maps where essential navigation information is accessible, third-party content you neither fund, develop nor control, and archives not updated after 28 June 2025. Your own product pages, search, basket, account, checkout and payment are never in that list.

A microenterprise employs fewer than 10 persons and has an annual turnover or an annual balance sheet total not exceeding EUR 2 million. Microenterprises providing services are exempt from the service requirements and the obligations attached to them (Art. 4(5)). The exemption does not cover products.

Both parts count: headcount below 10 and at least one of the two financial figures at or below EUR 2 million. The MLBF counts staff in annual work units, includes partner and linked enterprises according to the EU SME definition, and changes a company's class only after the threshold is crossed in two consecutive financial years; it asks for evidence from the last two years. A company that is part of a larger group should not assume it is micro.

Germany and Poland apply the same exemption (§ 3(3) BFSG, art. 4 point 1 of the Polish act).

Every covered service other than urban, suburban and regional transport must meet Section III of Annex I. For a shop or a service website that means four things: products used to provide the service are accessible, information about how the service works is available through more than one sensory channel and in understandable, perceivable text formats with adequate fonts, contrast and spacing, the website and mobile app are perceivable, operable, understandable and robust, and any help desk, call centre or support channel gives accessibility information in accessible modes of communication.

Section IV adds requirements for specific services. For e-commerce: provide the accessibility information about the products and services sold when the responsible economic operator supplies it, and make identification, security and payment functions, and identification methods, electronic signatures and payment services, perceivable, operable, understandable and robust. Consumer banking adds the same for identification, signatures, security and payment, and information no more complex than CEFR level B2.

Where no specific requirement covers a function, Section VII sends you to the functional performance criteria. In Germany these requirements are set out in the BFSGV, §§ 12 and 19 for services and e-commerce.

Service providers prepare information under Annex V, explain how the service meets the applicable requirements, publish it in written and oral format and in a way accessible to persons with disabilities, and keep it for as long as the service is in operation. Annex V places it in the general terms and conditions or an equivalent document. Where applicable it contains a general description of the service in accessible formats, explanations needed to understand how the service operates, and a description of how the relevant Annex I requirements are met.

National law adds detail. In Germany, Anlage 3 BFSG also requires naming the competent market surveillance authority, the MLBF, and the MLBF warns not to confuse this information with the public-sector Erklärung zur Barrierefreiheit. In Poland, art. 32 of the 2024 act puts it in the service regulations, and the e-commerce authority explains that the information to consumers says how the service meets the requirements, while gaps and remedial plans are reported to the minister.

The directive never uses the word statement. A voluntary statement page is fine; it does not replace this information.

Article 15(1) presumes conformity for services that meet harmonised standards whose references have been published in the Official Journal, as far as those standards cover the requirements. On 5 November 2026 the Commission's list of harmonised standards shows, under accessibility, references only for websites and apps of public sector bodies under Directive (EU) 2016/2102, where EN 301 549 V3.2.1 was cited by Implementing Decision (EU) 2021/1339. No reference has been published under the EAA, so the presumption in Article 15(1) is not yet available to anyone.

The Commission's standardisation request M/587 asks the European standards bodies to revise EN 301 549 and other standards to cover all EAA requirements. Poland's e-commerce authority lists EN 301 549 V3.2.1 of 2021 as the current version and says work on its update is expected to finish in the third quarter of 2026. Until a reference appears in the Official Journal, an EN 301 549 test is evidence, not a legal presumption.

It is still the right test. For web pages, conformance with clauses 9.1 to 9.4 and 9.6 of EN 301 549 V3.2.1 equals WCAG 2.1 level AA, and its other clauses cover non-web documents, software and documentation and support services. Test against WCAG 2.1 AA on the rendered pages, and add the WCAG 2.2 criteria if you want the bar the revision is likely to set; record which version you used.

Article 32 gives a transitional period ending on 28 June 2030 during which service providers may keep using products they lawfully used before that date to provide similar services. Service contracts agreed before 28 June 2025 may continue unchanged until they expire, but no longer than five years from that date. Member states may let self-service terminals lawfully in use before 28 June 2025 run until the end of their economic life, but no longer than 20 years after entry into use; Germany set 15 years and the end date 27 June 2030 for products and contracts, Poland 20 years and 28 June 2030. Nothing here covers a website or app you build or change today.

The requirements apply only as far as compliance does not fundamentally alter the basic nature of the service and does not impose a disproportionate burden (Art. 14). You decide this yourself, with the Annex VI criteria: net costs of compliance against overall operating and capital costs, estimated costs and benefits against the benefit to disabled users given how often the service is used, and net costs against net turnover. Document the assessment, keep it for five years after the service was last provided, give a copy on request and, where you rely on disproportionate burden, renew it for each category of service when the service changes, when the authority asks, and at least every five years.

If you rely on either exception, inform the authority of each member state where the service is provided; microenterprises are excused from that notice. You cannot claim disproportionate burden if you received outside funding to improve accessibility.

Each member state designates authorities that check services, follow up complaints and verify corrective action (Art. 23), gives consumers and qualified organisations a way to act before courts or authorities (Art. 29), and sets penalties that are effective, proportionate and dissuasive, with remedial action (Art. 30). If your service does not conform, you must take corrective measures and inform the authorities of the member states where it is provided.

Germany: the MLBF in Magdeburg checks services on suspicion and by sample, can order corrective measures and, as a last step, order the service to stop, and consumers or recognised associations can apply for proceedings under § 32 BFSG. Offering a service in breach of § 14(1) can be fined up to EUR 100,000.

Poland: the President of the PFRON Board and the market surveillance authorities share the work, with the minister for digital affairs as the authority for e-commerce. A consumer can complain to the business, which must answer within 30 days, and separately anyone can notify the President of the PFRON Board. Fines reach ten times the average monthly wage of the previous year, capped at 10% of turnover. Other member states set their own figures, so check the law of every country you sell into.