ACCESSIBILITY COMPLIANCE GUIDE
Your website might have a legal problem. Here's how to fix it.
If your business has a website, app, or digital documents, accessibility laws probably apply to you. This guide explains what that means, what's at stake, and where to start. No technical background required.
The Basics
What is website accessibility?
Website accessibility means making your site usable by everyone, including people who are blind, deaf, have motor disabilities, cognitive differences, or use assistive technology like screen readers. Most accessibility problems don't look like problems until you encounter them from a different perspective.
Here's what an inaccessible website actually looks like in practice:
The blind visitor
A person uses a screen reader: software that reads the page aloud. Your product images have no text descriptions. The screen reader says "image" with no context. Your website, to this person, is a wall of silence.
The keyboard-only user
Someone with a motor disability navigates entirely by keyboard. Your dropdown menu only opens on mouse hover. They can't access half your navigation. They leave, and they don't come back.
The low-vision visitor
Your designer chose light gray text on a white background because it looks modern. Someone with low vision can't read it. They can increase font size in their browser, but nothing helps when the contrast ratio is simply too low.
The person with epilepsy
You added an auto-playing banner animation to your homepage. It flashes at a rate that can trigger seizures in some people. There's no way to pause it. This is not just bad UX; it can cause physical harm.
Approximately 1 in 4 U.S. adults (61 million people) live with a disability. In the EU, that number is approximately 87 million people. These aren't edge cases or niche audiences. They're a quarter of your potential customers.
Why It Matters
Three reasons accessibility isn't optional
It's the law
In the U.S., the ADA has been interpreted by courts to cover websites. In the EU, the European Accessibility Act took effect in June 2025. Section 508 applies to any organization that receives or contracts with federal funding. These aren't suggestions; they have real legal consequences attached.
It's a real business risk
More than 5,000 website accessibility lawsuits were filed in U.S. federal and state courts in 2025. Pro se plaintiffs, meaning people filing without a lawyer, brought approximately 40% of federal ADA Title III filings in 2025. Small businesses are targeted as often as large ones.
It's the right thing to do
25% of your potential customers, employees, and partners have a disability. An inaccessible website sends a message, even if you don't intend it. Accessibility isn't charity. It's basic respect, and it's good business.
The Legal Landscape
What laws apply to you?
Here's a plain-English breakdown of the major accessibility regulations and who they affect.
ADA: Americans with Disabilities Act
Dated federal deadlines. The DOJ Title II rule requires WCAG 2.1 Level AA by 26 April 2027 for state and local governments serving 50,000 or more people, and by 26 April 2028 for smaller public entities and special district governments. The HHS Section 504 rule requires WCAG 2.1 Level AA by 11 May 2027 for recipients of federal health funding with 15 or more employees, and by 10 May 2028 for smaller recipients. The underlying ADA and Section 504 obligations are already in force today; these dates fix when the specific technical standard becomes mandatory.
Public universities and school districts: you are covered public entities under Title II. The date that applies to you follows the population of the jurisdiction you serve, not your enrolment or headcount. A district of 10,000 students inside a city of 200,000 is on the 26 April 2027 date, not the 2028 one. Confirm the population figure for your city, county, or state before you commit to a deadline.
If you operate a business that serves the public, your website almost certainly falls under the ADA. Many federal courts have treated websites as covered under Title III, and the DOJ's 2024 Title II rule extends WCAG 2.1 AA obligations to state and local governments explicitly. Federal circuit courts remain split on websites without a physical nexus, but WCAG 2.1 AA is the benchmark courts and settlements most commonly reference. This applies to businesses of all sizes. There is no small-business exemption for digital accessibility.
Section 508
Section 508 of the Rehabilitation Act applies to federal agencies and any organization that receives federal funding or holds federal contracts. It covers websites, software, documents, and electronic communications. If your organization takes government money or sells to the government in any capacity, Section 508 applies to your digital content. The technical standard is WCAG 2.0 Level AA, with newer guidance pointing to WCAG 2.1.
European Accessibility Act (EAA)
Since 28 June 2025, the EAA has required that products and services sold in the EU be accessible. This covers e-commerce, banking, transportation, telecommunications, streaming services, and more. If you have EU customers, this applies to you. Non-compliance can result in fines, mandatory remediation orders, and restrictions on selling in EU markets. Member states set their own enforcement mechanisms and penalty levels, so the exposure depends on where your buyers are.
Ireland. S.I. No. 636 of 2023 transposed the EAA with effect from 28 June 2025 and is among the transpositions carrying criminal sanctions. Under Regulation 32, a summary conviction can carry a fine of up to €5,000 or up to 6 months imprisonment (or both); a conviction on indictment, up to €60,000 or up to 18 months imprisonment (or both). Company officers can be personally liable where the offence was committed with their consent or connivance, and consumers can bring proceedings in the Circuit Court. The Competition and Consumer Protection Commission (CCPC) is the lead market-surveillance authority for products, Coimisiún na Meán covers audiovisual media services, and the National Disability Authority (NDA) monitors public sector accessibility separately.
Germany. The Barrierefreiheitsstärkungsgesetz (BFSG) transposed the EAA with effect from the same date, 28 June 2025. Its penalties are administrative rather than criminal: under Section 37, fines reach €100,000 per violation. Market surveillance sits with the Marktüberwachungsstelle der Länder für Barrierefreiheit von Produkten und Dienstleistungen (MLBF AöR). Germany also carries a risk that has no direct equivalent elsewhere: a competitor or a trade association can serve an Abmahnung, a formal cease-and-desist demand with legal costs attached, under German unfair-competition law, without waiting for a regulator to act. The BFSG's microenterprise exemption reaches services but not products, so read it carefully before assuming it applies to you.
EN 301 549
EN 301 549 is the European technical standard that defines what "accessible" means in practice. If the EAA is the law, EN 301 549 is the rulebook. It incorporates WCAG 2.1 Level AA as its baseline for web content, plus additional requirements for software, hardware, and documents. Meeting EN 301 549 is the way you demonstrate compliance with the EAA.
Not sure which laws apply to you? If you have a website and customers, whether in the U.S., the EU, or both, at least one of these probably does. When in doubt, making your site accessible protects you regardless of jurisdiction, and signals good faith to any regulator or plaintiff.
Small businesses, freelancers, and solo developers
There is no small-business exemption in the ADA for digital accessibility. Title III applies to places of public accommodation regardless of headcount or revenue, and courts have applied it to the websites of businesses with a single employee. The dated DOJ and HHS deadlines above are for public entities and federal funding recipients; your ADA obligation is not on a timer, because it is already in force.
In practice, size changes the exposure rather than the duty. Pro se plaintiffs accounted for approximately 40% of federal ADA Title III filings in 2025 and small businesses are targeted as often as large ones, because a scan-and-send complaint costs the filer almost nothing. That is why remediation is the cheaper path well before you reach enterprise scale.
If you build or maintain sites for clients, the same standard is what your contracts are increasingly measured against. A documented scan, a tracked remediation history, and an exportable audit trail are what turn "we fixed it" into something you can hand to a client, an insurer, or opposing counsel. That evidence is worth having whether you are one person or fifty.
Pallas starts at 3 team members and 5 web assets on the Starter plan, which is sized for exactly this. See what Starter includes →
Beyond the US and EU
Australia, Canada, and the United Kingdom
If you sell or operate outside the US and EU, three more frameworks are likely to apply. Each points to WCAG as its practical benchmark, and each is tightening toward WCAG 2.2 Level AA.
Disability Discrimination Act 1992 (DDA)
The DDA prohibits disability discrimination in the provision of services, which the Australian Human Rights Commission (AHRC) treats as covering digital services. In April 2025 the AHRC updated its guidance to recommend conformance with WCAG 2.2 Level AA for public-facing digital services in both the public and private sectors, with AS EN 301 549 as the underlying technical standard. The Australian Government's Digital Service Standard requires at least WCAG 2.1 Level AA for federal digital services. Complaints are made to the AHRC and, if conciliation fails, can be escalated to the Federal Court, which can order compensation. The DDA's reach over websites was established early in Maguire v. Sydney Olympic Games Organising Committee (2000) and reinforced by the Coles online-shopping accessibility matter settled in 2015.
How Pallas helps: every finding is mapped to WCAG 2.2 and EN 301 549, the standards the 2025 AHRC guidance points to. EN 301 549 mappings are derived from the WCAG scan.
Pallas security posture aligns applicable Essential Eight controls to the ML2 baseline. A formal IRAP assessment is planned as Australian federal contracts warrant.
Accessibility for Ontarians with Disabilities Act (AODA)
Deadline: 31 December 2026. Private-sector and not-for-profit organizations in Ontario with 20 or more employees must file an accessibility compliance report by this date. It is part of a three-year reporting cycle, not a one-time event.
Ontario public sector. The Ontario Government, provincial agencies, municipalities, school boards, colleges, universities, hospitals, and other designated public sector organizations are covered by the same Integrated Accessibility Standards Regulation on their own reporting cycle, which runs on even-numbered years and is separate from the private-sector cycle above. The Information and Communications Standards under the IASR require WCAG 2.0 Level AA on public websites and web content. Provincial government ministries and designated agencies are additionally subject to the French Language Services Act in designated areas; that Act does not reach private businesses.
The AODA (2005) and its Integrated Accessibility Standards Regulation include an Information and Communications Standard requiring web content to meet WCAG 2.0 Level AA; many organizations target 2.1 to align with the federal Accessible Canada Act. The Accessibility Directorate of Ontario enforces through scheduled reviews and complaint-driven investigations. Penalties run up to CAD 100,000 per day for a corporation and up to CAD 50,000 per day for a director or officer. Quebec's Law 25 governs related data obligations.
Federal: Accessible Canada Act. The Digital Technologies Accessibility Regulations were registered on 5 December 2025. Federal public sector entities must comply by 5 December 2027. Large federally regulated private sector organizations must comply by 5 December 2028. Penalties reach CAD 250,000 per violation. The technical standard is CAN/ASC-EN 301 549, which adopts EN 301 549 and therefore incorporates WCAG 2.1 Level AA. Enforcement sits with the Accessibility Commissioner at the Canadian Human Rights Commission.
How Pallas helps: Pallas reports against WCAG 2.0, 2.1, and 2.2, so you can evidence AODA conformance and support your compliance-report answers with a documented audit trail. Pallas already scans to EN 301 549, the standard CAN/ASC-EN 301 549 adopts, so federally regulated Canadian organizations can evidence the federal requirement from the same scan. EN 301 549 mappings are derived from the WCAG scan, and automated scanning covers the criteria that can be machine-tested; a manual review checklist covers the rest.
Equality Act 2010
The Equality Act 2010 prohibits disability discrimination in the provision of services, which is read to include websites and mobile apps. Public sector bodies additionally fall under the Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018 (PSBAR), which require WCAG 2.1 Level AA and are moving toward WCAG 2.2. Enforcement sits with the Equality and Human Rights Commission (EHRC) for the Equality Act and with the Government Digital Service (GDS) for public sector monitoring, a function GDS absorbed from the Central Digital and Data Office. There is no fixed statutory fine ceiling, but county court claims are routine and the costs to a defendant can be substantial.
How Pallas helps: Pallas scans to WCAG 2.2 Level AA, the UK best-practice benchmark. Automated scanning covers the criteria that can be machine-tested; a manual review checklist covers the rest.
One product, one standard underneath. These frameworks all resolve to WCAG (2.0, 2.1, or 2.2) and, in Europe and Australia, to EN 301 549, so one product covers the jurisdictions above. Each Pallas scan runs against the profile you choose, WCAG 2.2 A, AA, or AAA, Section 508, or EN 301 549, and Section 508 and EN 301 549 mappings are derived from the WCAG scan.
The Standard
What does "compliant" actually look like?
The international standard for web accessibility is called WCAG: Web Content Accessibility Guidelines. Think of it as a checklist of things your website needs to do to be usable by everyone. The current version is WCAG 2.2, and most laws reference Level AA as the minimum target.
There are over 50 specific requirements. You don't need to memorize them. Here's what they cover in plain language:
Can people see it?
- Text has enough contrast against its background
- Images have text descriptions for screen readers
- Videos have captions and audio descriptions
- Nothing relies only on color to convey meaning
- Content can be enlarged to 200% without losing functionality
Can people use it?
- Everything works with a keyboard, no mouse required
- Touch targets are large enough to tap accurately
- Users have enough time to read and respond
- Nothing flashes in a way that could trigger seizures
- Users can skip repetitive navigation to get to content
Can people understand it?
- Page language is identified so translation tools work
- Navigation is consistent across pages
- Error messages clearly explain what went wrong
- Forms tell you what's expected in each field
- Instructions don't rely on shape, location, or color alone
Does it work with assistive technology?
- Screen readers can parse the page structure and headings
- Buttons and links are properly labeled
- Dynamic content updates are announced to screen readers
- Custom controls have the right roles and states
- Focus is managed correctly when content changes
You don't need to know how to check all of this manually. Automated scanning covers the criteria that can be machine-tested, and a manual review checklist covers the rest, because most of WCAG cannot be verified by software.
The Risk
What happens if you don't address this?
Not a scare tactic, just an honest accounting of what's at stake.
Lawsuits
ADA website accessibility lawsuits have increased nearly every year since 2017, with more than 5,000 federal and state website accessibility suits filed in 2025. The Northern and Southern Districts of New York account for a disproportionate share of filings, but no state is exempt. Small businesses are frequently targeted because they're less likely to have legal defenses in place.
An overlay widget will not save you
38.5% of the businesses sued over accessibility in 2025 already had a widget-based accessibility overlay installed, according to the AudioEye 2026 Web Accessibility Litigation Report. The widget did not prevent the claim, because plaintiffs could still show that forms, checkout, and navigation remained unusable. In April 2025 the Federal Trade Commission approved a final order requiring the overlay vendor accessiBe to pay $1,000,000 over its compliance claims. Why an overlay is not compliance →
EU enforcement
EAA enforcement began in June 2025. Penalty structures vary by EU member state, but consequences can include fines, mandatory remediation orders, and restrictions on selling products or services in EU markets. Non-compliance is not simply a financial penalty; it can result in losing access to the market entirely.
A note on good faith: Courts and regulators look more favorably on organizations that can demonstrate they are actively working to improve accessibility, even if they haven't reached full compliance yet. Having records of what you scanned, what you found, and what you fixed matters. "We're working on it" is a meaningful defense when you can prove it.
Where to Start
Five steps to get from zero to compliant
You don't need to fix everything overnight. You need a clear path and steady progress.
- 1
Find out where you stand
Run an accessibility scan on your website to get a concrete list of issues. This replaces vague worry with specific problems you can actually act on. You need to know what's broken before you can fix it.
- 2
Prioritize by impact
Not all issues are equal. Start with the ones that completely block access: missing image descriptions, keyboard traps, missing form labels. These are both the most harmful to users and the most defensible as priorities. Save low-severity issues for later passes.
- 3
Fix and verify
Work through the issues and retest each fix to confirm the problem is actually resolved, not just partially addressed. It's easy to fix the symptom without fixing the cause. Verification matters.
- 4
Document everything
If you're ever questioned about your accessibility compliance, having records of what you found, what you fixed, and when you fixed it is your best defense. Document issues, exceptions, and decisions, not just final outcomes.
- 5
Make it ongoing
Accessibility isn't a one-time project. Your website changes: new pages, new features, new content. Each change can introduce new issues. Regular scans catch problems before they accumulate into a liability.
The Tool
How Pallas helps
Pallas is an accessibility operations platform built by Lonia AI. It goes beyond telling you what's wrong; it gives you a workspace to track, assign, and resolve every issue so nothing falls through the cracks.
Step 1
Scan
Analyze your website or documents against WCAG 2.2, Section 508, and EN 301 549. Get a clear list of issues with severity levels (critical, major, minor, advisory) and specific guidance on what to fix.
Step 2
Fix
Every issue enters a structured workflow: assign it to the right person, track progress, verify the fix through retesting. Whether it's your developer, designer, or content team, everyone knows what they own.
Step 3
Prove
Generate compliance reports for stakeholders, maintain an audit trail of every action, and document exceptions with rationale. If you're ever questioned, you have the records to show your work.
Automated scanning covers the criteria that can be machine-tested. A manual review checklist covers the rest, because most of WCAG cannot be verified by software. Section 508 and EN 301 549 mappings are derived from the WCAG scan.
Sources
Where these figures come from
- Disability prevalence (approximately 1 in 4 U.S. adults / 61 million): U.S. Centers for Disease Control and Prevention, "Disability Impacts All of Us."
- People with disabilities in the EU (approximately 87 million): European Commission, "Union of Equality: Strategy for the Rights of Persons with Disabilities 2021-2030."
- Website accessibility lawsuit volume (more than 5,000 federal and state suits in 2025) and the year-on-year trend: UsableNet 2026 lawsuit trends report.
- Pro se plaintiffs at approximately 40% of federal ADA Title III filings in 2025: Seyfarth Shaw ADA Title III tracker.
- Businesses sued in 2025 that already had an accessibility overlay installed (38.5%): AudioEye 2026 Web Accessibility Litigation Report.
- FTC final order requiring accessiBe to pay $1,000,000 (April 2025): US Federal Trade Commission, In the Matter of accessiBe Ltd.
- Murphy v. eyebobs (US District Court for the Western District of Pennsylvania, No. 21-cv-00017, filed January 2021, resolved October 2021): complaint published by Seyfarth Shaw at adatitleiii.com; case reporting by the Law Office of Lainey Feingold and Equal Entry. Described on why not an overlay.
- European Accessibility Act application and June 2025 enforcement date: Directive (EU) 2019/882. Irish criminal sanctions and the CCPC's market-surveillance role: S.I. No. 636 of 2023.
- DOJ Title II web accessibility rule compliance dates (26 April 2027 and 26 April 2028) and standard (WCAG 2.1 Level AA): US Department of Justice final rule under ADA Title II, 28 CFR Part 35 (2024).
- HHS Section 504 web accessibility rule compliance dates (11 May 2027 and 10 May 2028) and standard (WCAG 2.1 Level AA): US Department of Health and Human Services final rule under Section 504 of the Rehabilitation Act (2024).
- Accessible Canada Act Digital Technologies Accessibility Regulations (registered 5 December 2025; compliance 5 December 2027 and 5 December 2028; penalties to CAD 250,000 per violation; standard CAN/ASC-EN 301 549): Government of Canada, Canada Gazette.
- AODA compliance-report deadline (31 December 2026, organizations with 20 or more employees) and penalty ceilings: Accessibility for Ontarians with Disabilities Act, 2005 and its Integrated Accessibility Standards Regulation (O. Reg. 191/11).
This guide is general information, not legal advice. Consult qualified counsel for your organization's specific obligations. Last updated: 15 September 2026.
Ready to find out where you stand?
Free scan, no account needed. Your email is required so we can send the report. Paid plans use OAuth signup, no password, cancel anytime.