The EAA's Second Deadline: Accessibility Lands June 28, 2027

Every accessibility law has a grandfather clause, and every grandfather clause eventually expires. The European Accessibility Act (EAA) made headlines on June 28, 2025, when enforcement began. The date that actually catches companies is the second one: service contracts agreed before June 28, 2025 lose their protection no later than June 28, 2027, roughly ten months out ¹. Enforcement has also stopped being theoretical: France's first EAA lawsuits were filed in November 2025, and US federal website accessibility suits hit 3,117 in 2025, up 27% from the year before ². This is a design-system problem as much as a legal one, and the teams that treat it that way will finish with months to spare.

The second deadline nobody planned for

The EAA, formally Directive (EU) 2019/882, was adopted in April 2019 and transposed by all 27 member states by 2022 ³. It sets harmonized accessibility requirements for a specific list: computers and operating systems, smartphones, ATMs and ticketing machines, e-readers, television equipment, and services covering telephony, banking, e-commerce, e-books, and air, bus, rail, and waterborne passenger transport. It does not cover every website on the internet, only products placed on the EU market and services provided to EU consumers, which for most consumer-facing companies is most of their digital surface.

The transitional provisions are where the surprise lives. Article 32 of the directive states that service contracts agreed before June 28, 2025 may continue without alteration until they expire, but no longer than five years from that date ¹. Five years from June 28, 2025 is June 28, 2027. If your e-commerce storefront, banking app, e-book service, or ticketing flow runs under a vendor or platform contract signed before June 2025, that contract was never an exemption, it was a countdown. A separate transitional period extends to June 28, 2030 for products lawfully used to provide services before June 2025, with self-service terminals allowed to run to the end of their economic life, capped at 20 years ¹.

The EAA's reach is explicitly extraterritorial. Any company that places covered products on the EU market or provides covered services to EU consumers is in scope regardless of where it is headquartered, and non-EU businesses must appoint an EU-based authorized representative to handle compliance matters ⁴. For US-based teams this is not a Brussels problem; it is a contracts, product, and design problem with a deadline on the calendar.

Enforcement stopped being theoretical

The compliance clock and the enforcement clock are different instruments, and both are running. Market surveillance began June 28, 2025. France sent formal legal notices to major retailers that July, Sweden launched market surveillance in October, and the first EAA-related lawsuits were filed in the French Commercial Court in November 2025. In 2026 the Dutch ACM is actively enforcing EAA requirements for e-commerce and electronic communications ⁴. Penalties are set by each member state and differ wildly, from roughly €60,000 in Ireland to about €900,000 in Sweden, and a company selling across several member states can face enforcement in each simultaneously ⁴.

The US side points the same direction from a different angle. The DOJ's Title II web accessibility rule, published April 24, 2024, requires state and local governments to meet WCAG 2.1 AA, and an interim final rule issued April 20, 2026 pushed the compliance dates out to April 26, 2027 for jurisdictions of 50,000 or more people and April 26, 2028 for smaller entities and special districts ⁵. Public-sector deadlines moved out, yet private-sector litigation is climbing: plaintiffs filed 3,117 website accessibility lawsuits in federal court in 2025, a 27% increase over 2024, representing 36% of all Title III filings, with New York alone accounting for 1,021 website cases and 46% of cases involving repeat defendants ². The pattern across both jurisdictions is consistent: grandfather windows close, enforcement follows, and deferral keeps getting more expensive.

What compliant actually means

The EAA does not name WCAG directly. It defines accessibility requirements and creates a presumption of conformity when a product or service meets the harmonized European standard EN 301 549, currently version 3.2.1, which incorporates WCAG 2.1 Level AA in full and extends beyond it to hardware, mobile apps, documentation, video players, and third-party content integrated into covered services ⁴. That presumption is rebuttable: an enforcement authority can still challenge a service that formally conforms but is not accessible in practice ⁴. Conformance is evidence, not armor.

The standards themselves moved this year. WCAG 2.2, a W3C Recommendation since October 2023 with an editorial update in December 2024, was approved as the international standard ISO/IEC 40500:2025 on October 21, 2025 ⁶. EN 301 549 version 4.1.1, expected to publish in 2026, incorporates WCAG 2.2 ⁷. Teams designing to WCAG 2.2 today are matching the standard the law is about to adopt, and since WCAG 2.2 is fully backwards compatible with 2.1, there is no conflict in starting now.

WCAG 2.2 added nine success criteria, and the ones that bite design systems are concrete. Target Size (Minimum) requires interactive targets of at least 24 by 24 CSS pixels. Focus Appearance demands a visible focus indicator with sufficient contrast. Accessible Authentication prohibits authentication steps that rely on a cognitive function test such as memorizing a password or solving a puzzle, opening the door to passkeys and one-time codes. Dragging Movements requires a single-pointer alternative to drag-and-drop, Redundant Entry lets users skip re-entering the same data, and Consistent Help keeps help mechanisms in a predictable place ⁸. None of these are exotic; all of them are component-contract decisions.

The remediation path runs through your design system

Here is the uncomfortable data point: WebAIM's 2026 scan of the top 1,000,000 home pages found that 95.9% had detectable WCAG 2 failures, up from 94.8% in 2025. Low contrast text appeared on 83.9% of home pages, missing alternative text on 53.1%, missing form input labels on 51%, empty links on 46.3%, empty buttons on 30.6%, and missing document language on 13.5% ⁹. These are not exotic edge cases; they are the ordinary output of teams that ship without accessibility as a design-system property.

The useful reframe is that most detected failures are token and component defects, not page-specific bugs. Contrast is a color-token decision, so fix it once by auditing every text-and-background pair against 4.5:1 for normal text and 3:1 for large text and UI components, then encode the passing pairs into semantic tokens such as text-default and text-muted instead of letting designers pick ad hoc hex values. That token-first structure is exactly the taxonomy laid out in our token-first design systems guide. Input labels, focus indicators, and target size are component contracts: every input ships with a programmatic label, focus is never invisible (WCAG 2.2's Focus Appearance), and interactive targets stay at least 24 by 24 CSS pixels with adequate spacing. Alt text, document language, and empty links are content and template discipline: an alt-text policy, a lang attribute set at the layout root, and link text that never depends on a neighboring image.

The process that makes it stick is a regression gate, not a one-time cleanup. Start with an automated scan using axe DevTools or Lighthouse to triage, then manual keyboard and screen reader passes with NVDA or VoiceOver against an EN 301 549 v3.2.1 checklist, then put axe-core in CI and add per-component tests with jest-axe so a component that loses its label fails the build. Accessibility that is not tested in the pipeline is a promise that quietly expires with the next refactor.

The paperwork is as binding as the code

Compliance has an administrative half that teams routinely underestimate. Service providers must publish an accessibility statement covering the provider's name and contact details, the service's accessibility features, anything not covered and why, and an accessible support channel, and must offer at least one accessible customer channel for questions and problem reports ⁴. Product manufacturers carry heavier obligations: technical documentation, conformity assessment, CE marking, and five-year records ⁴.

The two escape hatches are narrower than they sound. Disproportionate burden under Article 14 is not a blanket exemption; it applies only to specific requirements that are genuinely impractical, must be documented using Annex VI criteria, which weigh compliance cost against overall costs and turnover and against the benefit for people with disabilities, and must be reassessed at least every five years, with documentation produced on request ⁴. The microenterprise exemption applies to services only, requires fewer than 10 employees and no more than €2 million in annual turnover or balance sheet total, and disappears the moment the business grows past either threshold ⁴. Neither is a strategy; both are documented claims.

A twelve-month runway to June 28, 2027

With roughly ten months left, a phased plan through the design system is realistic. Months one and two are inventory and audit: list every covered service, flag every contract signed before June 2025, run the automated and manual baseline, and produce a gap matrix against EN 301 549 v3.2.1 with WCAG 2.2 readiness marked. Months three through five fix the system itself: color tokens with guaranteed contrast pairs, accessible component contracts for labels, focus, and target size, and template fixes for language and help placement. Months six through nine remediate the flows that carry the most traffic and the most legal exposure, checkout, login and authentication, account management, and booking, including third-party integrations such as payment widgets and chat embeds, which count as part of the covered service. Months ten and eleven are verification and evidence: full retest, screen reader passes, published accessibility statement, content-team training, and disproportionate burden documentation if any claim is worth making. The last stretch is continuous monitoring and statement upkeep, since authorities can request evidence at any time, not only after it.

The teams that treat accessibility as a design-system investment, tokens, components, tests, and evidence built once and maintained continuously, will be done by spring 2027 and will absorb the EN 301 549 v4.1.1 update as a small delta. The teams that treat it as a legal checkbox will be doing the June 2027 scramble, remediating the same contrast, label, and focus defects at page level, one emergency ticket at a time. The grandfather clock is visible on the calendar now. The only real decision is which team to be.