Accessibility

Does my website legally have to be accessible?

Last updated 9 October 2026

There are four separate things here and almost every page on the subject merges them into “be WCAG 2.2 AA compliant or face fines”. They are not the same, two of them probably do not apply to you, and knowing which is which is worth real money before you commission an audit.

What actually binds a UK private company

One thing: the Equality Act 2010. Specifically the duty to make reasonable adjustments, which section 29(7)(a) applies to a service provider, and which section 20 defines. Section 20(3) is the limb a website falls under — a practice that puts disabled people at a substantial disadvantage, and reasonable steps to avoid it. Section 20(6) adds that where the issue is the provision of information, reasonable steps include providing it in an accessible format.

Two features of that duty are worth knowing, because they change what you should do:

• It is anticipatory. Schedule 2 paragraph 2(2) says the reference to a disabled person is to disabled people generally. You owe the duty to a class in advance, not to the first person who complains. Waiting for a complaint is not a strategy.
• It has a proportionality limit. Schedule 2 paragraph 2(7) says nothing requires a step that would fundamentally alter the service or the nature of the trade. That is the ceiling on what “reasonable” can demand of a small company.
• The customer cannot be charged for it. Section 20(7).

And one practical number nobody publishes: a county court claim under this part of the Act must normally be brought within six months of the act complained of, under section 118(1), unless the court thinks it just and equitable to extend.

The regulations that do not apply to you

You will be told your site must comply with the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018. Regulation 4(1) says they apply to a website or mobile application of a public sector body. Regulation 3 defines that as the State, local authorities, bodies governed by public law and associations of them. A trading company is none of those.

A tell for a stale page: if it cites SI 2018/852, it is citing an instrument that was revoked by regulation 2 of SI 2018/952. If it says the Central Digital and Data Office monitors compliance, that moved to GDS in 2022.

So is WCAG the law?

For a private company, no — and the distinction is useful rather than pedantic.

There is a quiet detail in regulation 9 worth knowing even if you are private, because it shows how this moves. When it was substituted in October 2022 it stopped naming a version: it now refers to the WCAG success criteria “as amended from time to time”. So the public sector benchmark tracks whatever WCAG currently is, without anyone passing legislation. That is how WCAG 2.2 became the expected standard.

WCAG 2.2 is the current W3C Recommendation, republished 12 December 2024. There are three conformance levels, A, AA and AAA, and AA is the one referenced in law everywhere it appears. WCAG 3.0 is still a Working Draft — if someone is selling you against a 3.0 deadline, there isn’t one.

The European Accessibility Act, and whether it reaches you

This is the part that genuinely changed, and the part most UK pages either ignore or get backwards. Directive (EU) 2019/882 has applied since 28 June 2025.

It does not cover “products and services” generally. Article 2 sets out a closed list. The ones a software buyer is likely to care about:

• E-commerce services — and the definition in Article 3(30) is the key to the whole thing. It means services provided at a distance by electronic means at the individual request of a consumer with a view to concluding a consumer contract. The trigger is a consumer contract. A B2B SaaS product, an internal tool or a brochure site with no transaction is not in the list.
• Consumer banking services, e-books and dedicated software, electronic communications services, access to audiovisual media services, and specified elements of passenger transport.

Being outside the EU does not help

Article 3(4) defines a service provider as any person who provides a service on the Union market or offers to provide one to consumers in the Union. There is no establishment or nationality requirement. A UK company running an in-scope service for EU consumers is a service provider, EU entity or not.

The microenterprise exemption

Two honest caveats. The exemption as written covers microenterprises providing services; the position for microenterprises placing products on the market is a different and lighter regime that is not described here. And there are transitional runs — service contracts concluded before 28 June 2025 can continue to expiry, but no more than five years from that date.

On penalties: Article 30 requires them to be effective, proportionate and dissuasive, and sets no figure. Every euro amount you will see quoted comes from one Member State’s implementing law, not from the Directive.

And the EAA has not been implemented in UK law, including in Northern Ireland. The Equality Commission for Northern Ireland, giving evidence to the House of Lords Sub-Committee on the Windsor Framework in December 2023, treated the EAA as falling outside the keeping-pace obligation.

What the enforcement record actually shows

Here is a gap worth knowing about, because the whole sales pitch for accessibility audits rests on the other side of it.

For the public sector there are real published figures. GDS monitored 1,203 websites and 21 apps between January 2022 and September 2024, found 29,787 issues, saw 55.3% of them fixed during monitoring and 12.4% still unfixed on retest, and referred 310 of 999 completed cases to equality bodies. The two most common failures by share of sites affected were contrast at 77.3% and visible focus at 76.3% — both of which are, bluntly, cheap to fix.

For the private sector there is no published UK dataset at all. No EHRC series, no Ministry of Justice statistic on Equality Act service claims about digital access, and no reported UK judgment against a private company over website accessibility. Part 3 claims go to the county court, most are unreported and settlements are confidential.

What that does not support is the line you will read that “no organisation has ever been successfully taken to court”. That is a claim about the absence of a record, which is not the same as a record of absence. The honest position is that nobody publishes the data, in either direction.

What I would actually do

If you are a private UK company not selling to EU consumers: you are governed by a reasonableness standard, not a technical one. Fix contrast, keyboard operation and visible focus — the three things the public sector monitoring found most often, all of which are cheap and all of which are what a complaint would be about. Being able to show you worked towards WCAG 2.2 AA is the best evidence available that your steps were reasonable.

If you sell to consumers in the EU through an in-scope service and have ten or more staff: you are in a different conversation, with a hard standard behind it, and the date for that has already passed.

Sources. Equality Act 2010 s.20, s.29, s.118 and Schedule 2. The website hook is EHRC’s statutory Code of Practice for services, paragraph 3.6, published May 2026 and updated August 2026. Public sector scope and the WCAG presumption: SI 2018/952, regulations 3, 4 and 9, regulation 9 as substituted by SI 2022/1097 on 26 October 2022; required level from the GOV.UK Service Manual, last updated 29 October 2024. WCAG 2.2: W3C Recommendation, republished 12 December 2024. EAA: Directive (EU) 2019/882, Articles 2, 3(4), 3(23), 3(30), 4(5), 30, 31 and 32. Monitoring figures: GDS, accessibility monitoring of public sector websites and mobile apps 2022 to 2024, published 17 December 2024. All retrieved 9 October 2026. This is a description of published material, not legal advice.