The EAA cure window: why a notice isn't a fine — and why that's not a reason to wait

There's a fact about European Accessibility Act enforcement that the people selling fear would rather you didn't know, and a second fact that the people selling false comfort would rather skip. Put them together and you get the truth — which is more useful than either.

Fact one: under the EAA, a regulator almost never opens with a fine. Enforcement starts with a correction period — a window to fix the problem.

Fact two: you don't control when that window opens, you aren't guaranteed to get one, and it only protects you if you can prove you used it.

This is the cure window. Understanding it is the difference between panic-buying an overlay widget and doing the thing that actually works.

What the law actually says

The EAA is a directive, so it sets the framework and leaves the penalties to each of the 27 member states. The directive itself names no fine amounts. Article 30 requires only that national penalties be "effective, proportionate and dissuasive." That single phrase is why the numbers vary so wildly from country to country — and why any vendor quoting one universal figure is guessing. (For the actual per-country numbers, see our EU Accessibility Act fines by country breakdown.)

The mechanism that matters here is in Article 20, the national procedure for dealing with non-compliance. When an authority finds a service or product that doesn't meet the requirements, it must first require the operator to take corrective action within a reasonable, prescribed period. Only if the operator fails to bring things into compliance within that period can the authority escalate — to restricting, prohibiting, or withdrawing the service from the market.

Read that order carefully, because it's the whole point: correct-first, escalate-only-if-you-don't. The market-access measures and fines sit at the end of a process, not the start of it.

What the cure window looks like in practice

The length of the window is set nationally and case by case — the directive says "reasonable," not "90 days." In the early enforcement we've seen, the periods have been real and concrete: in France, for example, disability advocacy organisations issued formal legal notices to major retailers with a deadline to comply, and only moved to emergency court action months later when the fixes didn't materialise.

The pattern across member states in the first year has been consistent, and it has a name among practitioners: guidance first, fines later. Regulators are publishing checklists and notices, building monitoring capacity, and showing a clear preference for remediation over punishment. As of early 2026, no fines have been issued under any EAA-transposed law.

If you stopped reading here, you'd conclude you have plenty of time. That's the false-comfort trap. Keep going.

Catch one: you don't control the clock

The regulator's correction-first process is only one of the ways a complaint reaches you — and it's often the slowest. Private actors move faster and don't owe you a comfortable window:

• Germany. Within weeks of the deadline, businesses started receiving competitor and consumer-group warning letters (Abmahnungen). Because many accessibility obligations function as rules of market conduct, non-compliance can expose you to unfair-competition claims — a private channel that runs entirely outside the regulator's timeline.
• France. NGOs issued legal notices almost immediately and followed with injunctions when responses fell short.
• The Netherlands. The national framework explicitly allows consumers civil remedies for accessibility failures.

A regulator may give you a tidy correction period. A competitor's lawyer or an advocacy group will set their own deadline — and the first you hear of it may be a letter, not a friendly notice.

Catch two: the window only protects you if you can prove you acted

Here's the part that turns the cure window from a comfort into a strategy.

Across these regimes, the thing that mitigates penalties and helps you on appeal is good-faith evidence that you took the problem seriously and acted on it. A correction period is an opportunity to build that evidence — or to waste it. The operator who can show "we detected these issues on this date, we shipped these specific fixes on these dates, and here's what's still under review" is in a completely different position from the one who can only say "we meant to get to it."

That evidence is not a screenshot of a green badge. It's a record: dated, specific, and hard to back-date. A badge claiming you're "compliant" is, if anything, worse than nothing — because if it's not true, it's a written misstatement someone can hold against you. (More on that in how to write an accessibility statement without overclaiming.)

The smart posture: be inside your own window before anyone opens one

Put the two facts together and the move is obvious. The cure window is real, so a fine is not your immediate risk. But you don't control when it opens, and it only helps you if you've genuinely acted. So the winning position is to already be remediating, with a documented trail, before any notice arrives.

Concretely, that means:

1. Find the real barriers — deterministically, not by guesswork — on the journeys that matter most, starting with the ones that block people from completing a purchase or signing up.
2. Fix them in your actual code, not with a script that overlays cosmetic patches a screen reader sees straight through.
3. Keep a dated, tamper-evident record of what was found, what was fixed, when, and what's still open for human review — so that if a regulator, a competitor, or an advocacy group ever asks "what did you do, and when?", you have a credible, time-stamped answer.

This is the entire reason Conformly exists, and why our loop is detect → fix → document → monitor rather than scan-and-shame. We detect issues deterministically, open the fixes as real pull requests against your repository, and produce a dated, hash-chained audit trail of every change. We never tell you you're "compliant" — no honest tool can — but we make sure that when the window matters, you can prove you used it.

What to do today

You can't prepare for a notice you haven't quantified. Start by finding out what an automated scan can already see on your most important page — it takes under a minute and costs nothing: run a free audit.

And if Germany is your market specifically, the real (and much-misquoted) numbers behind all of this are here: BFSG fines explained.

The cure window is a gift. It's just not a reason to wait — it's a reason to start, while starting is still on your terms.

---

Conformly closes the accessibility loop for EU businesses: detect, fix via real pull requests, document, monitor. Fixes, not findings. This article is general information, not legal advice; for your specific situation, consult a qualified lawyer.