1. SMEs: are you in scope? The exact threshold and its exceptions
Directive 2019/882 (the European Accessibility Act) applies to private-sector digital services since 28 June 2025: e-commerce, banking, insurance, transport, ticketing, e-books and digital media, electronic communications services. Despite a stubborn misconception, company size changes nothing — with one narrow exception.
The microenterprise exemption: what it really covers
Only companies with fewer than 10 employees and under €2M turnover or balance sheet are exempt — and only for their services (never for products: terminals, kiosks and e-readers stay covered). Three limits to know by heart:
- It does not apply to essential services: banking, insurance, transport and electronic communications are covered regardless of size.
- It flips quickly: the moment you cross the threshold (hiring, growth), you are in scope with a short compliance runway.
- It does not protect commercially: clients, marketplaces and tenders contractually require EN 301 549 compliance regardless of the exemption.
In practice, a 25-person e-commerce SME is fully in scope: EN 301 549 / WCAG 2.2 AA compliance and an accessibility statement are mandatory.
2. Who enforces what: DGCCRF, ARCOM, Défenseur des droits, DPAs
- DGCCRF: the market surveillance authority for the EAA in the private sector. It receives complaints, runs inspections, imposes the administrative fines of the Consumer Code and publishes decisions.
- ARCOM (audiovisual and digital communications regulator): competent for audiovisual media service accessibility — programme subtitling, audio description, French sign language. If you publish video as part of a service, this applies to you.
- Défenseur des droits: the enforcement route for users, including private-sector services — a customer shut out by an inaccessible interface can file a complaint, and its decisions feed application case law.
- Data protection authorities: whenever accessibility touches consent (cookie banners), competences stack — our consent-invalidation thesis.
3. The accessibility statement, step by step
The accessibility statement is the simplest document to produce and the most frequently skipped. It must be reachable from every page (footer link) and contain four blocks:
- Conformity status: “fully compliant”, “partially compliant” or “non-compliant”. The honest "partially compliant" is not just accepted but expected — no company scores 100%.
- Audit results: date, evaluation method (self-assessment, external audit), reference standard (EN 301 549 / WCAG 2.2 AA) and scope covered.
- Inaccessible content: precise list, proposed alternatives (e.g. accessible PDF invoice on request) and remediation schedule.
- Enforcement routes: internal reporting procedure then Défenseur des droits, with the statement's last update date.
Classic mistake to avoid: pasting a generic template. A statement claiming full conformity while the Reject button test fails is a false statement, separately penalised and indefensible.
4. Multi-year plans and accessibility coordinators in SMEs
The multi-year accessibility plan is your documented compliance roadmap. Mandatory for the public sector (French decree 2019-768), it has become the expected practice for covered companies: it demonstrates good faith during a DGCCRF inspection and turns a scary deadline into a managed plan. Minimum content:
- Scope and diagnosis: which journeys, documents and channels (web, mobile, app) were audited.
- Usage-based prioritisation: sales and support journeys first, institutional content next, archives last.
- Realistic scheduling: quarterly milestones over 1-3 years, aligned with planned rebuilds (theme redesign, CMS migration).
- Committed resources: team training (3-5 days suffice for an integrator), tooling budget, external audit on critical scopes.
- Tracking indicators: share of conformant WCAG criteria, complaints handled, remediated documents.
The accessibility coordinator: a person, not an agency
Appointing an internal accessibility coordinator (even part-time) is the highest-return investment: they centralise reports, arbitrate priorities with the DPO and keep the statement current. In an SME the role usually lands on the web or quality lead — what matters is that the person is named, trained and heard.
5. Penalties, calendar and a pragmatic action plan
The scale for legal persons: up to €150,000 per infringement, injunctions with daily coercive payments (up to €1,500/day), remediation within 30 days, and specific penalties for missing or false statements (full details in our 2026 penalty scale). For an SME the operational risk usually arrives before the legal one: public formal notices, tender exclusions, EN 301 549 audit clauses imposed by enterprise clients.
A 4-step action plan (decreasing return on effort)
- Measure: free scanner plus manual audit of key journeys (contrast, keyboard, screen readers). Our 25-point checklist is the grid.
- Fix the vital: accessible consent banner (our developer guide provides the code), order and contact forms, transaction documents.
- Document: publish the honest accessibility statement, launch the multi-year plan, name the coordinator.
- Embed: add WCAG criteria to ticket definitions of done, train teams, re-test at every release.
For the full framework and obligation map, our Digital Accessibility Observatory gathers every guide of the Accessibility Desk.