"Let a lawyer tell me": what accessibility law requires of your website

The line usually comes up in the second meeting. Someone asks whether the website has to be accessible by law. Someone else says that’s a matter for public bodies, a third person half-remembers something about a European directive, and in the end someone settles it: “let a lawyer tell me”. Nobody calls the lawyer, of course. The subject goes back in the drawer until a user, an association or a public tender pulls it out again, and by then there’s no time to decide calmly.

And what actually happens is the opposite of what people fear. Not everyone who’s worried is covered, and not everyone who’s covered is worried. We’ve seen foundations convinced the law had nothing to do with them when it applied to them in two different ways, and large companies that had asked for a quote, alarmed, about an obligation that, once you read the rules, they don’t have. The noise from people selling fear has achieved both things at once: that those who are obliged ignore it and those who aren’t end up paying.

So let’s bring some order to it. There are three sets of rules, and each one has its own way in, through a different question: who you are, what you sell and where you are. A month ago we explained why accessibility is about people before it’s about laws. This article is the other half, the part that one deliberately left out.

If you’re in a hurry, here’s the short answer. In Spain, a website has to be accessible by law if it belongs to the public sector or runs on public money (since 2019 and 2020), if it sells to or contracts with consumers online and its owner isn’t a microenterprise (since 28 June 2025), or if its region’s law requires it. In practice, that means meeting the international WCAG guidelines at level AA and, in the public sector, publishing an accessibility statement and having a channel for complaints.

First accessibility question: who are you?

The oldest of the three is Royal Decree 1112/2018, Spain’s implementation of the European directive on the accessibility of public sector websites. If you’re a public administration, a public body, a public university or an organisation that depends on one, you’re covered, and have been for a while. New websites since 20 September 2019, existing ones since 20 September 2020, and mobile apps since 23 June 2021.

So far, so familiar. What almost nobody reads is the first additional provision, which is where the decree steps outside the public sector. It asks public administrations to require the same criteria from websites and apps that have received public funding, from companies running a public service under a concession or contract (the text specifically mentions education, health, culture, sport and social services) and from private schools, training centres and universities funded wholly or partly with public money. A state-funded private school, a private university that receives public funding or a research park linked to a public university aren’t public administrations, but they’re on the same list.

Before you answer this first question, look at where your organisation’s money comes from, because instinct tends to get this one wrong. If part of what you do is paid for with public money, you’re most likely already covered, and have been for some years.

Second accessibility question: what do you sell?

The second law is the one that’s had the most written about it and been the worst explained. It’s Law 11/2023, which brings Directive (EU) 2019/882, known as the European Accessibility Act, into Spanish law, and its Title I has applied since 28 June 2025. This time, what counts is what you do. The law covers anyone who sells products or provides services to consumers through digital channels, such as e-commerce, banking, transport, telecommunications or e-books.

And e-commerce covers a lot more than it sounds. If someone on your website signs up for a course and pays for it, books a place, enrols or books accommodation, you’re providing a service to a consumer through a digital channel. Online enrolment is an electronic contract, even if you don’t think of yourself as a shop.

There are two details that take the wind out of half the alarmist conversations. The first is that microenterprises providing services are exempt: if you have fewer than ten employees and your turnover or balance sheet doesn’t exceed two million euros, the obligation doesn’t apply to you. The second is for anyone who’s read that the obligation only applied to companies with more than a hundred employees or six million in turnover. That came from a different rule, a provision of the old information society services law that Law 11/2023 itself repealed in 2023. Anyone still quoting it is working from old notes.

The law also has a safety valve, “disproportionate burden”. It lets you skip a specific requirement if you can show with figures that meeting it would ruin you. That said, it’s an exception you have to document, and you can’t use it if you’ve received public or private funding to improve accessibility. There’s also a transition period: service contracts signed before 28 June 2025 can carry on as they were until they expire, with 28 June 2030 as the cut-off date. For a website, in practice, this changes little, because what your website offers today is already the service you provide today.

The noise from people selling fear has achieved both things at once: that those who are obliged ignore it and those who aren't end up paying.

Third accessibility question: where are you?

The third layer is regional, and it’s the one fewest people have on their radar. Each Spanish region has legislated on accessibility at its own pace and, when it comes to digital, in very different depth. Almost all of them have an accessibility law, but few have developed it to the point of saying exactly what they require of a website and what happens if it doesn’t comply.

Catalonia, which is the one we know first-hand, has done so. It has Law 13/2014 on accessibility and the Catalan Accessibility Code, approved by Decree 209/2023 and in force since 1 March 2024. The Code includes websites among the communication elements that have to be accessible and sets deadlines for adapting existing ones. On digital it’s not as clear-cut as the two national laws, but, unlike the national public sector law, it comes with its own penalties. We’ll come back to that shortly.

Outside Catalonia, the answer changes from region to region, and we’re not going to pretend we know all seventeen by heart. We work with organisations in Galicia, Madrid and elsewhere, and in each case we’ve had to read the regional rules as carefully as the national ones. If you’re in another region and don’t know what yours requires on digital, write to us with your location and what your website does, and we’ll tell you what we’ve found, even if we don’t end up working together. It saves you searching blind, and it’s a lot cheaper than finding out with a complaint already on the table.

What accessibility requires of you, in plain terms

Technically, and luckily, all three end up asking for the same thing. The European reference is the EN 301 549 standard, which in turn incorporates the WCAG, the accessibility guidelines published by the W3C, the consortium that sets web standards. The version currently cited in the Official Journal of the EU is 3.2.1, which requires WCAG 2.1 at level AA, the middle of its three levels. Version 4.1.1 came out in September 2026, moving to WCAG 2.2, and is waiting for the Commission to cite it in the Official Journal; the sector expects that before the end of the year. So if you build to WCAG 2.2 AA today, you meet what’s required now and what will be required in a few months. That’s how we work as standard, mainly so we don’t have to do the job twice.

On top of the technical standard, there’s paperwork. Royal Decree 1112/2018 requires a published, up-to-date accessibility statement, a channel for any user to report problems and request content in an accessible format, and a periodic review. Law 11/2023 requires you to explain how your service meets the accessibility requirements and to keep that information up to date for as long as the service exists. They look like details, but a website with no accessibility statement and no complaints channel is the first one an inspector, a user or a tender panel will spot, and they don’t even need to open a tool to see it.

Where I said fine for failing on accessibility, read complaint

Which brings us to the question that tends to open or close budgets: what happens if you don’t comply. It depends on which door you came in through, and there are three levels.

The first is the complaint, and it’s the most underestimated. Royal Decree 1112/2018 has no penalties, and in seven years it hasn’t produced a single fine. What it has is a procedure: anyone can report a barrier, ask for content in an accessible format, file a complaint if they get no reply and, in the end, go to the Ombudsman. None of that is a penalty, but it all ends up in writing, with dates, in a file that tends to resurface at the worst possible moment.

The second level is the penalty proper, and here there are figures. Law 11/2023 refers to the rules of each sector and, where there are none, to the General Law on the rights of people with disabilities, which ranges from 301 euros for minor offences to one million for very serious ones. In Catalonia, Law 13/2014 has its own bands: up to 6,000 euros for minor offences, up to 30,000 for serious ones and up to 300,000 for very serious ones. But so far they’ve rarely if ever been applied to websites. Enforcement of Law 11/2023 is in the hands of the regions, and the machinery is still being built. Since February 2026 there’s a national unit, the UTAC, set up by Royal Decree 143/2026 to coordinate those authorities and receive complaints, but it’s only a few months old. So no, Spain isn’t handing out fines left, right and centre. Then again, assuming there’ll never be one is gambling with your money.

The third level doesn’t go through any inspector. In France, on 4 June 2026, a court in Caen ordered Carrefour to make its website and app accessible within six months, with a fine of 500 euros for every day of delay. Two disability associations asked for it and a judge decided it, with no administrative authority involved. In Spain there’s also a quieter and more common route: tenders. More and more public tenders and large clients ask for an accessibility conformance report, and anyone without one is left out. That lost contract never shows up in the penalty statistics, but you feel it in the accounts all the same.

Let someone else tell me if I’m accessible

That leaves how you prove you comply, and here there are two very tempting shortcuts that don’t work.

The first shortcut is the automated tool that gives you zero errors. These tools are good at picking up the mechanical stuff, like contrast or images without alt text, but they miss everything that takes judgement: the order in which you move through the page with a keyboard, whether the alt text says anything useful, or whether a form leaves a screen reader user stranded on the third field. The second shortcut is the widget you install in an afternoon that promises compliance, a sort of digital snake oil. European enforcement bodies increasingly see it as a sign of the opposite.

The route that works is a manual audit, with real user testing, done by someone who didn’t build the website. In the previous article we put it another way: whoever builds it shouldn’t mark their own homework. That’s why we work with Tothom Web, an accessibility auditor accredited as an inspection body by ENAC, Spain’s national accreditation body. It certifies against EN 301 549 and, we’re told, is already accredited for the new version of the standard. We design, build and fix, and they do the audit and the certification. If the report were signed by the same company that gets paid to fix what the report finds, it wouldn’t be worth much. And that goes for us too.

Does your website have to be accessible?

To know whether this applies to you, and how much, you don’t need a legal opinion. You just need to answer these questions looking at how your organisation works day to day and, wherever the answer is “yes”, note the date from which you’ve been covered.

If you answer “no” to the first three, you can relax. Even so, read the previous article, because the people who can’t use your website are still there even if the law doesn’t require anything of you. If any of them is “yes”, you now know since when you’ve been covered and which two documents you’ll be asked for first. What you do with that is up to you, and there’s no need to wait for a lawyer to tell you.

Sources

• Ministry of the Presidency, Relations with the Cortes and Equality, Real Decreto 1112/2018, de 7 de septiembre, sobre accesibilidad de los sitios web y aplicaciones para dispositivos móviles del sector público, BOE, 2018: scope (art. 2), extension to private entities with public funding, concession holders and publicly funded centres (first additional provision), application deadlines (fifth final provision) and no penalty regime.
• Head of State, Ley 11/2023, de 8 de mayo, Title I, BOE, 2023: transposition of Directive (EU) 2019/882, products and services covered, microenterprise exemption, disproportionate burden, enforcement authorities and penalties by reference (arts. 27 to 30); repeal of the fifth additional provision of Law 34/2002.
• European Union, Directive (EU) 2019/882 (European Accessibility Act), 2019: applicable since 28 June 2025, with a transition period for service contracts until 28 June 2030 (art. 32).
• Royal Legislative Decree 1/2013, Ley General de derechos de las personas con discapacidad y de su inclusión social: penalty bands from 301 to 1,000,000 euros, applicable on a supplementary basis to Law 11/2023.
• Government of Catalonia, Llei 13/2014, del 30 d’octubre, d’accessibilitat and Decret 209/2023, de 28 de novembre, pel qual s’aprova el Codi d’accessibilitat de Catalunya, DOGC: in force since 1 March 2024, websites as communication elements and penalty regime (up to 6,000, 30,000 and 300,000 euros).
• Ministry of the Presidency, Justice and Relations with the Cortes, Real Decreto 143/2026, de 25 de febrero, BOE, 2026: creation of the Technical Support and Coordination Unit for enforcement authorities (UTAC), attached to the Directorate-General for the Rights of Persons with Disabilities.
• ETSI, CEN and CENELEC, EN 301 549 V4.1.1, 2 September 2026: adoption of WCAG 2.2; the version cited in the Official Journal of the EU is still V3.2.1 (WCAG 2.1 AA) at the time of writing.
• Tribunal judiciaire de Caen, interim order of 4 June 2026 (RG 25/00691), apiDV and Droit Pluriel v. Carrefour France: six-month deadline and a penalty of 500 euros per day, reported by Handicap.fr and Deque.