Most European Accessibility Act coverage focuses on the EU-wide deadline of June 28, 2025. What gets less attention is that individual member states enforce the EAA and their own pre-existing accessibility laws through their own national agencies, with their own procedures, and those procedures keep evolving well past the headline deadline. Italy is the clearest example right now. Its digital accessibility authority, AgID, the Agenzia per l'Italia Digitale, adopted a new regulation, Determination No. 84/2026, that formalizes exactly how it investigates and sanctions accessibility violations, from the moment a complaint lands to the moment a fine is issued.
This matters because Italy already had accessibility law on the books well before the EAA. The Stanca Law, in force since 2004, required public sector and certain private entities to meet accessibility standards, and Legislative Decree 82/2022 extended and updated those obligations ahead of the EAA's own arrival. What Determination 84/2026 changes is not the substance of who has to comply. It is the enforcement machinery: a unified, documented, step-by-step process for how AgID actually turns a complaint into a fine.
The Fact: Under the Stanca Law framework, non-compliant public entities can face fines up to 5% of turnover, and other covered private entities face fines ranging from EUR 5,000 to EUR 40,000, with a 90-day cure period before any financial penalty applies. (Source: AgID Determination No. 84/2026, under Law 4/2004 and Legislative Decree 82/2022)
The 90-Day Cure Window Is the Part Worth Understanding
The single most actionable detail in the new regulation is the 90-day cure period. Once AgID identifies or receives a complaint about an accessibility violation, the entity is given 90 days to remediate before any financial sanction is applied. That is among the most generous cure windows in the EU, and it means the fine is not really the primary risk for an organization that responds quickly and in good faith to a complaint. The real risk sits with organizations that ignore the notice entirely, treat a first complaint as noise, or lack the internal process to turn "we received an accessibility complaint" into an actual remediation project inside three months.
That last part is where most organizations are unprepared, not because 90 days is unreasonable, but because most companies have no defined internal workflow for what happens when a formal accessibility complaint arrives. It typically has to route through legal, get triaged to engineering, get prioritized against a normal product roadmap, and get verified as actually fixed, all inside a fixed external clock that started the moment the complaint was filed, not the moment someone in the company noticed it.
Who Determination 84/2026 Actually Covers
The underlying obligation, who has to be accessible in the first place, has not changed. Public sector bodies and entities covered under the Stanca Law and Legislative Decree 82/2022 were already in scope, and since June 28, 2025, the EAA extended accessibility requirements to a broad range of private-sector consumer-facing products and digital services selling into the EU, which for Italy specifically means falling under both the older national framework and the newer EU-wide one depending on the entity type and sector. What the new determination adds is procedural clarity: a single, unified process for how a complaint moves from filing to resolution, replacing what had previously been a less consistently documented enforcement path.
For organizations selling into Italy specifically, or with entities registered there, this is worth treating as a signal, not a technicality. A regulator that formalizes its enforcement pipeline is a regulator preparing to use it more consistently, not less. AgID is also the body individuals file complaints with directly when they experience a lack of accessibility, which lowers the friction for a real end user to trigger the process in the first place.
How This Compares to Other EU Enforcement So Far
Italy's approach, generous cure window, high potential penalty ceiling for public entities, sits differently than some of its neighbors. Our EAA enforcement map covers how France, Ireland, and Hungary have approached enforcement differently, from criminal exposure in Ireland to some of the highest recorded civil fine ceilings in Hungary. Italy's formalized, cure-first process is a notably different posture: it rewards fast remediation more explicitly than punitive first-strike enforcement, which changes the calculus for how an organization should respond to a first complaint versus treating every notice as an existential threat.
What This Means Practically
If your organization operates a site or app reachable from Italy, or has any EU-facing consumer product, the practical takeaway from Determination 84/2026 is less about the specific fine amounts and more about the process now being documented and predictable. An organization that gets a complaint now knows, in writing, what the clock looks like and what triggers an actual sanction. That is genuinely useful information for building an internal response plan before a complaint ever arrives, rather than improvising one under a live 90-day deadline.
For the broader compliance picture across all EU markets your organization might sell into, our European Accessibility Act guide walks through who has to comply and since when across the whole bloc, not just Italy specifically.
If you want a read on where your own site would land if a complaint were filed with AgID today, our team runs free accessibility scans and can walk through the specific gaps against WCAG and EN 301 549. Reach us at experts@wcag.world, or review AgID's own guidance directly and the European Commission's Accessibility Act overview for the primary sources behind this.
A practical review loop
Start with the task a person needs to complete, not with the score produced by a single automated scan. Write down the entry point, the expected focus order, the announcement a screen reader should receive, and the recovery path when something goes wrong. Then repeat that task with a keyboard and at least one assistive technology setup. This turns a vague accessibility concern into an observable acceptance test.
The useful evidence is specific. Capture the URL, the control label, the keystrokes, the browser state, and the expected result. Separate a defect from a design choice, and separate both from a limitation in the test environment. Give the product owner a short reproduction and a clear severity rationale. A developer can fix a named interaction. Nobody can reliably fix a general instruction to make a page more accessible.
Finally, put the check into the delivery process. Add the scenario to a pull request checklist, retest it after JavaScript changes, and keep a small set of representative pages available for regression testing. That routine protects the people who depend on the workflow and gives the team a defensible record of what was tested, when it was tested, and what happened.
For the next review, use these related resources: request the relevant WCAG review.