Digital accessibility: who is covered, and where to start

Digital accessibility is no longer a best practice, it is a legal obligation backed by fines, and in France it rests on two distinct regimes that are often confused. The first covers the public sector and companies with more than 250 million euros in annual revenue. The second, derived from the European directive known as the Accessibility Act, has applied since 28 June 2025 to a list of consumer services including e-commerce, whatever the size of the company above the micro-enterprise threshold.

A decree published last week has just realigned the French framework on the European timetable. This is a good moment to take stock: who is covered, what “accessible” actually means, what non-compliance costs, and where to start without launching a six-month project.

Two regimes, and that is where the confusion starts

The first regime is an old one. Article 47 of the law of 11 February 2005 requires online public communication services to be accessible. Its scope covers public law entities, private law entities entrusted with a public service mission, and private companies whose revenue reaches at least 250 million euros, a threshold set by the decree of 24 July 2019.

The second regime is recent and changes the picture for far more companies. European directive 2019/882, transposed in France by the ordinance of 6 September 2023, has applied since 28 June 2025. It no longer reasons by company size but by type of service: e-commerce, consumer banking, passenger transport, e-books, electronic communications, access to audiovisual media services.

The consequence is simple and widely overlooked. An online shop with thirty employees was never covered by the 250 million threshold, but it is covered by the directive. Only micro-enterprises providing services are exempt, meaning those employing fewer than ten people and with annual revenue not exceeding two million euros. Above that, the shop has to be accessible.

What changed on 27 August 2026

The decree no. 2026-816 of 24 August 2026, published in the Journal officiel on 26 August and in force the following day, amends the 2019 decree to align it with the dates and exempt content of the European directive. Three changes are worth remembering.

First, the text now refers explicitly to the harmonised standards published in the Official Journal of the European Union. In practice, the compliance framework is no longer an isolated French specificity: it is anchored to the European standard, itself built on the WCAG level AA criteria.

Second, the framework must now state which categories of services and which functionalities it covers, and be updated regularly to stay aligned with those harmonised standards. That is a clarity requirement that was missing.

Third, the chapter on monitoring has been reorganised: the sanction provisions that appeared in the decree are repealed, replaced by annual compliance monitoring by the minister responsible for people with disabilities and a report to the European Commission every three years. Beware the misreading: this does not remove the sanctions, which live in the law and not in the decree. They are still handed down by Arcom.

What the fines actually are

A figure of 250,000 euros circulates widely on the websites of accessibility software vendors. It matches nothing in French law. The real amounts, as set by the law since the 2023 ordinance, are the following.

Arcom, the regulator responsible for enforcing these obligations, can impose a financial penalty of up to 50,000 euros for failing to meet the accessibility obligations themselves, and up to 25,000 euros for the declaratory obligations, meaning displaying the compliance statement and publishing the accessibility declaration and the multi-year plan. The amount takes into account the nature, seriousness and duration of the breach, as well as any previous breaches. Where the same breach persists six months after a penalty, a new penalty can be imposed.

One subtlety is worth knowing for large companies: for those covered under the 250 million euro threshold, Arcom is competent to check the display obligations, but not to act on technical non-compliance itself. In other words, the immediate risk lies with the missing documents, not with the site’s score. That does not make compliance optional, it simply moves the point of control.

For products and services falling under the directive, breaches are treated as fifth-class offences at 7,500 euros, cumulative depending on the number of breaches found, with the possibility of suspending the placing on the market if they persist.

What “accessible” means in practice

The framework that applies in France is the RGAA, which implements the European standard EN 301 549, itself built on the WCAG level AA criteria. Behind that pile of acronyms, the essentials come down to a handful of checks anyone can run without a tool.

• Contrast. The WCAG criterion asks for a ratio of at least 4.5 to 1 between text and its background, and 3 to 1 for interface elements such as a button border. It is the most widespread defect, and the easiest to fix: it is settled in the brand guidelines, not in the code.
• Text alternatives. Every image that carries information must have alternative text, a level A requirement, the most basic there is. Purely decorative images take an empty alt, as we detail in our article on the alt tag.
• Keyboard navigation. Everything that can be done with a mouse must be doable with the Tab key, with a visible focus indicator. A menu or a modal window that cannot be closed with the keyboard blocks some users entirely.
• Text resizing. Criterion 1.4.4 requires that text can be enlarged up to 200% without loss of content or functionality. A font size set in pixels prevents that, as we explain in our comparison of rem and pixels.
• Forms. Every field must have an associated label, and error messages must say what to fix. A red asterisk with no text tells a screen reader nothing. Using ARIA attributes correctly is a subject in its own right, covered in our article on the aria-label attribute.

These five points cover a large share of the non-conformities found in audits. None of them requires rebuilding the site.

The three documents you will be asked for

Technical compliance is not enough: the French regime also requires you to document it, and that is precisely where checks are most direct.

The compliance statement must appear on the homepage, indicating whether the service is fully, partially or not compliant. The accessibility declaration details the audit result, the known non-conformities, the exempt content and how to report a problem. The multi-year accessibility plan, together with its annual action plans, describes the trajectory over several years.

These three items are public and can be checked in thirty seconds by anyone, including a competitor or an advocacy group. The legal framework published by DINUM sets out what they should contain. It is the first place to look if you want to know where you stand.

Miracle solutions are not solutions

A market has grown around third-party scripts promising compliance in one line of code, often sold as accessibility overlays or widgets. The reasoning deserves to be laid out calmly, because the sales argument is appealing and the disappointment expensive.

A script running in the browser can add convenience shortcuts, a font-size setting or a high-contrast mode. Those are real features, and they are not useless. But it cannot guess the information carried by an image, restructure an inconsistent heading hierarchy, correctly label a form field whose label does not exist, or make a checkout usable with a keyboard when it never was. And compliance is assessed on what the user actually receives, not on the presence of a tool.

The decisive test is simple: ask the vendor which precise criteria of the framework their product moves your site from non-compliant to compliant on, and require an audit before and after. The conversation quickly becomes clearer.

What a compliance audit really is

It is worth knowing what the word covers before ordering one. The RGAA technical method has 106 control criteria, with an average of two and a half tests per criterion. The audit does not cover the whole site but a sample of pages representative of the service, to which are added randomly drawn pages representing at least ten percent of the sample.

The evaluation rule is strict and explains many disappointing scores: according to the official compliance evaluation method, a criterion is validated only if it is validated on every page of the sample. The compliance rate is then obtained by dividing the number of validated criteria by the number of applicable criteria. A single faulty page is therefore enough to invalidate a criterion for the whole sample.

One last point to know: only some of the criteria can be checked automatically. Tools do spot insufficient contrast or missing alternatives, but they do not judge whether an alternative text is relevant or whether a keyboard journey is coherent. A serious audit therefore includes a manual part, and that is what explains its cost.

Where to start

The classic mistake is to launch a full RGAA compliance audit across the entire site, receive a two-hundred-page report, and do nothing with it. A more useful path comes down to four steps.

Start by working out which of the two regimes applies to you, or both. The question is settled by revenue on one side and the nature of the service on the other. Then run a quick check on the five points above, on three pages only: the homepage, a content page and the conversion funnel. Within an hour you will know whether you are far off or close.

Next, publish the mandatory documents, even if the site is not compliant. An honest declaration stating partial compliance and a dated action plan puts you in a better position than silence, both with the regulator and with a user who runs into an obstacle. Finally, fix by template rather than by page: pages built on the same model share their defects, and fixing the template fixes them all at once.

The right moment to deal with the subject remains, of course, the design phase. Writing the criteria into the project specifications costs a few lines; retrofitting them costs several times that. It is exactly the same logic as for performance thresholds, which we detail in our article on Core Web Vitals.

What we take away from it

In three years accessibility has moved from good intention to monitored obligation, with a named regulator, quantified amounts and public documents that can be held against you. For most companies, the real work is smaller than it looks: five checks, three documents, and fixes made at template level.

And there is a benefit that is rarely put forward. Sufficient contrast, clean keyboard navigation, properly labelled forms and text that survives enlargement improve the experience for everyone, not only for users with disabilities. It is one of the rare compliance subjects that also improves conversion.

If you do not know where you stand, the diagnosis takes half a day: identify the applicable regime, check the five points on three templates, and produce a dated action plan. That is the starting point of our design and user experience projects. Let’s talk.