European Accessibility Act for US Companies: Who Actually Has to Comply

You are very likely in scope if any of these describe your business:

• You run e-commerce and ship to EU addresses. Online sale of goods or services to EU consumers is explicitly a covered service under the EAA, regardless of where your warehouse is.
• You sell SaaS or a mobile app with EU-based subscribers. If EU consumers can sign up, pay, and use your product, that service falls inside the EAA's scope even if you never built an EU-specific version.
• You offer banking, telecom, transport, or e-book/audiovisual services to EU consumers. These are named categories in the directive, on top of the general e-commerce catch-all.
• You manufacture, import, or distribute covered hardware. Computers, smartphones, self-service terminals, and e-readers are covered on the product side, and the microenterprise exemption below does not reach product manufacturers, importers, or distributors the way it reaches service providers.

You are probably notin scope if your business is purely domestic: a local service business, a US-only marketplace, or a site that has never taken a payment from an EU billing address. Scope follows your customers, so if you genuinely have none in the EU, the EAA has nothing to regulate yet. It's worth checking your analytics and payment processor for EU traffic and transactions before concluding you're clear.

This is the misconception that trips up the most US companies. The EAA regulates economic operators — manufacturers, importers, distributors, and service providers — based on whether they place products or provide services on the EU market, not based on where the company is incorporated or staffed. A US-only company with an EU-facing checkout page is providing a service to EU consumers whether or not it has ever registered a European entity.

In practice, this looks a lot like how many US companies already think about GDPR: the law is European, but it follows the customer's location, so a company with zero physical presence in the EU can still be squarely inside scope. If your legal or compliance team has already been through a GDPR applicability exercise, the same customer-location logic applies here.

1. Check for EU customers first. Pull EU-billing-address transactions from your payment processor and EU sessions from your analytics before you spend time on anything else. No EU customers usually means no current EAA exposure.
2. Honestly assess the microenterprise exemption. Check headcount and revenue at the group level, and confirm you're a service provider, not a product manufacturer or importer, before relying on it.
3. Run a baseline WCAG 2.2 scan. Our free WCAG checker runs on axe-core and 9 custom checks, and will surface roughly 30–40% of WCAG success criteria automatically — the machine-detectable ones like missing alt text, contrast failures, and unlabeled form fields. That's a real starting point, not a full audit.
4. Manually test the flows EU customers actually use. Checkout, account creation, and support forms are where automated scans run out and keyboard/screen-reader testing needs to pick up. Our WCAG checklist walks through the criteria a scanner can't verify on its own.
5. Set up recurring monitoring, not a one-time fix. Sites drift. A page that passed in March can regress by fall after a redesign or a new checkout vendor. Scheduled monitoring catches that drift before an auditor does.

If you want help prioritizing fixes once you have a scan result, CompliaScan can suggest AI-generated fixes using your own API key (OpenAI, Anthropic, or Gemini) — it never touches your site's markup automatically. The suggestions are a starting point for a developer, not a substitute for one, and nothing here is legal advice; for anything EAA-specific to your business, talk to counsel familiar with EU market-access rules.