The Fine Print Isn't Fine
For most of the years since the European Accessibility Act (EAA) was adopted, it lived in the same category as a lot of EU compliance law for American companies: real on paper, distant in practice. That gap closed in 2025. France filed its first EAA-related lawsuits in November of that year. Dutch and German regulators confirmed they are actively notifying and investigating noncompliant organizations, with auditing efforts set to expand through 2026. And every EU member state has now published — or is in the final stages of publishing — the national fine structure attached to its own transposition of the law.
That last part matters more than it sounds. The EAA itself doesn't set a single EU-wide penalty. It's a directive, which means each of the 27 member states writes its own enforcement law, sets its own maximum fines, and runs its own investigations. For a US company selling digital products, software, or e-commerce into Europe, that means "EAA compliance" isn't one number to plan around — it's up to 27 different regulatory regimes, each with its own ceiling and its own appetite for enforcement.
What "Enforcement" Looks Like in Practice
Enforcement rarely starts with a fine. Across every jurisdiction currently active, the pattern is the same: a complaint or audit flags a noncompliant product or service, the regulator opens an investigation, the company receives formal notice, and a remediation window follows. Penalties are the last step, not the first — which is exactly why the current moment matters. Investigations that opened quietly in 2025 are the fines that get issued in 2026 and 2027, once notice periods lapse and remediation doesn't happen.
The Stat: Hungary's national transposition of the European Accessibility Act sets the highest published penalty ceiling of any EU member state, with fines reaching EUR1,260,000 per violation. (Source: EU member state EAA transposition laws)
Hungary's ceiling isn't an outlier by much. Spain has set its maximum at EUR1,000,000, and the Netherlands at EUR900,000. France, where the first lawsuits have already been filed, caps fines at EUR250,000. Germany's ceiling is comparatively modest at EUR100,000 — but Germany doesn't cap penalties as a flat figure everywhere on the continent; Italy instead ties its exposure to revenue, with fines reaching up to 5% of annual turnover. For a large company, a percentage-of-turnover penalty can dwarf every fixed-figure fine on this list, which is exactly why it's a different kind of exposure and doesn't belong on the same absolute-euro comparison above.
France: First Lawsuits, November 2025
France moved first. Its EAA-related lawsuits filed in November 2025 mark the shift from "law on the books" to "law being tested in court" — and they set a precedent other member states' regulators and litigants are watching closely. A country with a comparatively lower fine ceiling (EUR250,000) was still willing to be first to litigate, which says something about enforcement appetite that the euro figure alone doesn't capture.
Germany: BFSG and the EUR100,000 Ceiling
Germany's implementation of the EAA is known domestically as the Barrierefreiheitsstärkungsgesetz (BFSG). Its maximum fine, EUR100,000, is the lowest of the countries with published figures here — but German regulators have confirmed that enforcement activity, including notification and investigation, is already underway, with auditing efforts planned to ramp up through 2026. A lower ceiling doesn't mean lower scrutiny; it means the eventual fine is only one part of the cost. Investigation, remediation timelines, and legal exposure all precede it.
The Netherlands and Spain: Watching and Waiting
Dutch regulators have confirmed the same pattern as Germany: notification and investigation activity is live now, with more auditing capacity coming online through 2026. The Netherlands' EUR900,000 ceiling and Spain's EUR1,000,000 ceiling put both countries near the top of the published range, meaning any company operating in these markets is looking at some of the highest fixed-figure exposure in the EU, layered on top of active regulatory attention.
Why This Matters If You're Not Based in Europe
The EAA applies to products and services placed on the EU market — not to companies headquartered in the EU. A US-based software company, e-commerce retailer, or financial services provider selling to customers in Hungary, France, Germany, the Netherlands, Spain, or Italy is in scope if its digital product or service reaches consumers there, regardless of where the company's servers, offices, or legal entity sit.
This is the detail that catches US companies off guard. Compliance teams often map regulatory exposure to where they're incorporated. The EAA maps exposure to where the customer is. A US company with no EU office but real EU customers is still a real target for a French, German, or Dutch regulator running an investigation.
It also compounds with a fact that has nothing to do with Europe specifically: inaccessible digital products are already the norm, not the exception. The WebAIM Million analysis has consistently found that roughly 95.9% of home pages have detectable WCAG 2 failures — the baseline state of the web most companies are building on. Add to that the fact that roughly 1 in 4 US adults live with a disability, per the CDC, and accessibility gaps look less like an edge case and more like a mainstream product defect with a growing list of jurisdictions willing to fine you over it.
A Country-by-Country Snapshot
| Country | Maximum Penalty | Enforcement Status (2026) |
|---|---|---|
| Hungary | Up to EUR1,260,000 | Fine structure published |
| Spain | Up to EUR1,000,000 | Fine structure published |
| Netherlands | Up to EUR900,000 | Active notification and investigation; auditing ramping up |
| Italy | Up to 5% of annual turnover | Fine structure published (revenue-based, not fixed) |
| France | Up to EUR250,000 | First lawsuits filed November 2025 |
| Germany | Up to EUR100,000 (BFSG) | Active notification and investigation; auditing ramping up |
As of mid-2026, no confirmed fines issued under any of these national EAA-implementing laws have been publicly verified. That's worth sitting with, not dismissing. Authorities in this space have consistently followed the same sequence — notice, investigation, remediation window, then penalty — which means the absence of a headline fine right now is not evidence of low risk. It's evidence that the pipeline is still running its early stages, and the companies currently under investigation are the ones who will produce 2026's and 2027's enforcement news.
What US Companies Should Do Now
The practical response isn't complicated, even if the regulatory map is. Three steps matter most:
- Map your EU exposure by customer geography, not by legal entity. If you have paying customers or active users in any EU member state, the EAA's national implementing law in that country applies to you, regardless of where you're incorporated.
- Treat WCAG conformance as the baseline, not the ceiling. The EAA's technical requirements track closely with WCAG success criteria. A genuine, verified WCAG audit is the closest thing to a single artifact that addresses exposure across all 27 member states at once, because the underlying technical bar is largely shared even though the penalty structures aren't.
- Don't wait for a fine to be the trigger. Given the notice-then-investigate pattern regulators in France, Germany, and the Netherlands have already shown, an investigation opened today is a fine that could be issued well before this becomes urgent on your own timeline.
There's also a color-specific angle worth naming, since it's an easy one to miss in a compliance sweep focused on screen readers and keyboard navigation: the WHO estimates that roughly 8.3% of men and 0.5% of women have some form of color vision deficiency. Interfaces that rely on color alone to convey status, errors, or required fields fail a meaningful share of users before anyone even gets to a screen reader test — and it's one of the most common findings in real audits.
The Cost of Waiting
None of the six jurisdictions above are hypothetical anymore. Fine schedules are published, not proposed. Lawsuits have been filed, not threatened. Investigations are open, not planned. The only genuinely open question, per regulators' own public statements, is when — not if — the current wave of notices turns into the first confirmed EAA penalty.
Companies that wait for that first headline fine to start taking accessibility seriously will be starting from behind: behind on remediation timelines, behind on documentation, and behind the companies already fixing gaps before a regulator asks about them. The more useful posture is to know exactly where your products stand against WCAG and EAA requirements before any European regulator has a reason to look.
If you sell into any of the markets above, the fastest way to know where you actually stand is to get a full accessibility audit — a real, itemized report of your gaps against the same technical standards that underlie every one of these national enforcement regimes, before the first check gets written.