A general counsel at a mid-sized US ecommerce company once told our team, flatly, "we're incorporated in Delaware, we don't have an office in the EU, this doesn't touch us." His company shipped to fourteen EU countries and ran a checkout flow that a screen reader user could not complete. He was wrong on both counts, and he found out the expensive way.
That assumption, "we're not based there, so their law can't reach us," is the single most common and most costly misunderstanding US companies have about the European Accessibility Act. It feels intuitive. It is also not how the EAA's jurisdiction actually works.
The Stat: The EAA has been enforceable across all 27 EU member states since June 28, 2025, and applies based on where a product or service is offered, not where the company is headquartered. (Source: Directive (EU) 2019/882)
Why "we're not based there" doesn't work
The EAA is not a company-location statute. It is a market-access statute, much closer in structure to GDPR than to a typical US regulation. GDPR does not ask where a company is incorporated. It asks whose personal data is being processed. The EAA asks a parallel question: whose product or service is being offered, and where does the person receiving it stand.
If a US company runs an ecommerce site that ships to Germany, France, and Poland, or a SaaS platform that signs contracts with EU-based customers, or a mobile banking app that EU consumers can download and use, the company is offering a product or service into the EU market. That's the trigger. A Delaware certificate of incorporation and a headquarters in Austin do not change that fact, any more than they would exempt the company from EU value-added tax on those same sales.
This is the same logic explained in more general terms in our piece on who actually has to comply with the EAA, which walks through the full scope of covered entities. If you haven't confirmed where your company sits in that scope, start there. This guide picks up from the opposite end: you already know, or now suspect, that the EAA applies to you, and you need an actual plan to get compliant, not just a definition of the law.
The compliance path, step by step
Once jurisdiction is settled, the work is mechanical. It is not mysterious, and it does not require reinventing anything, because the EAA points to an existing technical standard rather than inventing a new one.
Step 1: Run a real gap analysis against EN 301 549
EN 301 549 is the European technical standard that operationalizes the EAA's accessibility requirements, and it maps closely to WCAG 2.1 Level AA for web and software content. A gap analysis means testing your actual product, not your marketing site, against these success criteria: keyboard operability, color contrast, form labeling, focus order, error identification, and captioning for any video or audio content. Automated scanners will catch some of this. They will not catch checkout flows that trap keyboard users or screen reader announcements that don't match the visible state of the page. That kind of testing needs a human who uses assistive technology daily to actually try to complete your core user flows.
Step 2: Prioritize by user-facing impact, not by ease of fix
Every gap analysis produces a long list. The mistake is treating every item as equally urgent. Rank issues by whether they block a task entirely (a form that can't be submitted without a mouse) versus whether they degrade the experience (a heading that's visually styled but not marked up semantically). Fix the blockers first. This is also the order regulators and plaintiffs' counsel tend to look at, since the EAA's enforcement priority in most member states follows the same "can a disabled user actually complete the transaction" logic.
Step 3: Build your VPAT and align it to EN 301 549, not just WCAG
A Voluntary Product Accessibility Template documents, criterion by criterion, how your product conforms. US companies often already have one built against Section 508, which is a good start, but it needs to be reframed against EN 301 549 specifically for the EU market, since that's the standard EU regulators and business customers will actually ask for. If your team has never assembled one, our guide on how to read a VPAT covers the document structure and the specific line items that trip up first-time filers.
Step 4: Fix the highest-impact issues first, document as you go
Remediation should happen in the same priority order as your gap analysis. Keep a written record of what was found, what was changed, and when, both because it demonstrates good-faith effort and because EU market surveillance authorities can request evidence of your conformity process, not just its outcome.
Documentation matters more under the EAA than most US teams expect, because the framework is built around a "presumption of conformity" for products that follow the harmonized standard, but that presumption only helps you if you can actually produce the paper trail behind it. A changelog entry that says "fixed accessibility issues" is not evidence. A record that ties each fix to a specific EN 301 549 criterion, the date it was resolved, and who tested the resolution, is. Treat this the same way your finance team treats an audit trail: not because anyone is watching today, but because someone might ask tomorrow.
Step 5: Set a realistic internal timeline, and treat it like a compliance deadline, not a backlog item
Because the EAA has been enforceable since June 28, 2025, "we'll get to it eventually" is no longer a defensible internal position for a company actively selling into the EU. A realistic first-pass timeline for a mid-sized product, from kickoff of the gap analysis through a documented VPAT and first round of remediation, typically runs three to six months depending on the size of the product surface. Build that into a quarter, assign an owner, and report progress the way you would for any other regulatory deadline.
If your team is further along and wants to understand what active enforcement looks like right now across specific member states, our piece on how enforcement in 2026 is playing out for US companies covers that ground directly. This guide is the "how do we actually get compliant" companion to that enforcement picture, not a restatement of it.
The exemption that actually matters, and its limits
The one real carve-out is the micro-enterprise exemption: businesses with fewer than 10 employees and under EUR 2 million in annual turnover. If your company genuinely fits that description, the EAA's obligations don't apply to you in the same way. But this exemption is narrow, applies to the company providing the service (not to a US parent with a small EU-facing subsidiary), and does not cover every product category. It's worth confirming with counsel rather than assuming it applies because your team feels small.
For more detail on the official legal source, the European Commission's page on the European Accessibility Act and the full text of Directive (EU) 2019/882 are the primary references worth bookmarking. Neither is a substitute for legal counsel familiar with your specific product and market footprint, but both are useful for grounding an internal conversation in the actual text of the law rather than in secondhand summaries.
It's also worth remembering that the exemption question and the compliance question are not the same project. Even a company that ultimately confirms it qualifies for the micro-enterprise exemption should still document that determination, since "we assumed we were exempt" is a much weaker position than "we reviewed our employee count and turnover against the exemption criteria and confirmed we qualify, in writing, on this date."
Start the plan, not just the research
The company from the opening story eventually got its checkout flow fixed. It just cost more, took longer, and happened under more pressure than it needed to, because the work started only after a customer complaint rather than as a planned project.
If you already know the EAA applies to your business and you're ready to move from "we should look into this" to an actual gap analysis and remediation plan, our team can help you build that roadmap. Take a look at our EAA compliance solutions or email experts@wcag.world to talk through where your product stands today.