Five lines in a German checkout template break EN 301 549 — and in the Irish sign-in page next door, half the findings are not law until October.
That last part is the one nobody gets right, including every chatbot I asked. The European Accessibility Act has applied to new e-commerce, banking, booking and e-book services in the EU since 28 June 2025. But the technical standard actually cited in the Official Journal — Implementing Decision (EU) 2021/1339 — is EN 301 549 V3.2.1, and V3.2.1 is WCAG 2.1 AA. Version 4.1.1, the one that folds WCAG 2.2 in, is expected to be cited around October 2026. Until then, a WCAG 2.2 criterion is good practice, not an obligation.
So a tool that reports "WCAG 2.2 failure" in September 2026 is telling you something true about accessibility and something false about your legal exposure. Those are different questions and they have different budgets.
The five lines
<html> <!-- §9.3.1.1 no lang -->
<img src="/logo.png"> <!-- §9.1.1.1 no alt -->
<div onclick="pay()">Jetzt kaufen</div> <!-- §9.2.1.1 not keyboard operable -->
<span style="color: #999">inkl. MwSt.</span> <!-- §9.1.4.3 2.85:1, AA needs 4.5:1 -->
<iframe src="/sepa"></iframe> <!-- §9.4.1.2 no title -->
Fixed:
<html lang="de">
<img src="/logo.png" alt="Acme GmbH home">
<button type="button" onclick="pay()">Jetzt kaufen</button>
<span style="color: #767676">inkl. MwSt.</span> <!-- 4.54:1 -->
<iframe title="Payment form" src="/sepa"></iframe>
#767676 is worth memorising: it is the lightest grey that still clears 4.5:1 on white. #777 is 4.48:1 and fails by two hundredths. Tailwind's text-gray-400 is about 2.8:1 and fails outright; text-gray-600 is 7.5:1.
What the "not yet" bucket contains
WCAG 2.2 added nine success criteria in total. Four of them are what this linter can see in markup, so they sit in its not-yet bucket — worth fixing early, but not to be reported to your compliance officer as violations today:
- §9.2.4.11 focus not obscured — a sticky header covering the focused element
- §9.2.5.8 target size — anything under 24 by 24 CSS pixels
- §9.3.3.7 redundant entry
-
§9.3.3.8 accessible authentication — this is the one that catches CAPTCHAs and
onpaste="return false"on password fields
If you are shipping a sign-in page in the EU, §9.3.3.8 is the one to plan for. It is not enforceable this morning. It very likely is next year.
Where the free tools stop
axe-core and eslint-plugin-jsx-a11y are good and you should keep using them. They report WCAG success criteria. What they do not print is the EN 301 549 clause number, which is the vocabulary of the audit, the accessibility statement, and the market surveillance authority in each member state. And they do not distinguish the standard in force from the standard incoming, because from a pure accessibility standpoint that distinction does not matter — it only matters when someone asks what you are legally required to have fixed by when.
That gap is a two-column table, and that table is the extension.
The microenterprise line
One more thing the chatbots get backwards: the exemption for fewer than 10 employees and under €2 million turnover applies to services, not products. If you ship a product covered by the Act, being small does not exempt you. Check which side of that line your company is on before you decide the deadline is not yours.
EN 301 549 Lint is free for the file you have open — all 28 rules, the clause number, and the corrected line. The $29 licence adds a whole-repository scan, the dated evidence export, and CI output. A manual WCAG audit is quoted at $100–$250 per page (Accessible.org, 2026).
Free in your browser (the same rules): https://getreadystack.com/tools/en301549-lint
Licence ($29, once, 7-day refund): https://buy.polar.sh/polar_cl_9o33w7ZEWFvtHnsjAVCGBPT5ubS1CZsHl7iec0wNhUa
Top comments (0)