Which Compliance Date Actually Binds Your Website in 2026?
The European Accessibility Act has applied since 28 June 2025. The AI Act obligations most enterprise teams built their 2026 plans around have moved: the rules for high-risk systems in sensitive areas now apply from 2 December 2027, and for systems embedded in regulated products from 2 August 2028. If your roadmap treated this August as the compliance cliff, the requirement that is already enforceable is the one that likely slid down the list.
This is not an argument that one regulation matters more than the other. It is a sequencing problem. Attention followed the headline deadline, and the headline deadline moved. Meanwhile the obligation that has been live for more than a year is documentary, which means the question a supervisory authority asks is not whether your site is accessible today. It is whether you can show what it has been.
We covered how to hold generated frontend code to a production bar in our standards framework for the AI-generated frontend. That piece asks what good looks like. This one asks a narrower question with a legal edge: what you must be able to produce, and how a team producing code faster than it can review it produces evidence at the same rate.
What Applies Now, and What Moved
Two timelines are worth separating, because they are frequently discussed as one.
The European Accessibility Act, Directive (EU) 2019/882, required Member States to apply its measures from 28 June 2025. Its scope reaches consumer-facing services, including e-commerce, defined in the directive as services provided at a distance through websites and mobile services by electronic means for concluding a consumer contract, and consumer banking services. If you sell to consumers in the Union through a website, assume you are in scope and confirm the specifics with counsel.
The AI Act, Regulation (EU) 2024/1689, entered into force on 1 August 2024 and applies in phases. Prohibitions took effect in February 2025. Governance rules and obligations for general-purpose AI models applied from 2 August 2025. Transparency rules arrive in August 2026. The obligations for high-risk systems used in sensitive areas were amended and now apply from 2 December 2027, with systems embedded in regulated products following on 2 August 2028.
The practical consequence is narrow and worth stating plainly. The AI Act amendment bought time for one category of work. It bought no time at all for the accessibility obligations that have been in force since June 2025.
Why the Transitional Period Is Read Wrong
Article 32 of the directive does provide transition, and it is regularly overread. Products used in the provision of a service before the application date may continue to be used for five years. Self-service terminals may run to the end of their economic life, capped at twenty years, provided they are not replaced.
Neither of those is a general grace period for your website. They are provisions about hardware and legacy products already in service. A consumer-facing web experience you have shipped changes to since June 2025 is not a legacy terminal. Teams that read Article 32 as breathing room for the digital estate have usually read a provision about ATMs as a provision about their checkout.
Compliance Is a Documentary Obligation
This is the shift most engineering organizations have not internalized, and it is where the work actually sits.
The directive obliges service providers to include information on how the service meets the accessibility requirements in their general terms and conditions or an equivalent document. Where a provider claims that meeting a requirement would impose a disproportionate burden, that assessment has to be documented against the criteria the directive sets out. A claim you have not written down is not a defense. It is an assertion.
Read those together and the deliverable becomes clear. Being accessible is the goal. Being able to demonstrate it, on request, for a period rather than a moment, is the obligation. Most teams we assess can produce a scan report from a date. Very few can produce a record of what the site did between the dates.
The Evidence Problem Generated Code Created
The gap widened for a reason that has nothing to do with regulation.
Accessibility defects are not rare edge cases. The 2026 WebAIM Million analysis of one million home pages detected WCAG 2 failures on 95.9 percent of them, up from 94.8 percent the year before, with detected errors per page rising to 56.1. Those are automated detections on home pages, so they understate the total, and the trend is the wrong direction.
Now add throughput. When a meaningful share of interface code is generated from a prompt or a design file, the volume of change per week rises faster than review capacity. A quarterly manual audit describes a version of the site that no longer exists by the time the report is delivered. Point-in-time assurance was always a compromise. Against generated code it stops being evidence at all.
The answer is not to slow the tooling. It is to make the record continuous, so the artifact a supervisor asks for is a by-product of shipping rather than a project someone has to run.
Four Artifacts Worth Having Before Anyone Asks
This is the set we build with clients, ordered by how much they reduce exposure per unit of effort.
- A written conformance target. Name the standard and the level you hold yourself to, and put it somewhere durable. An unstated target cannot be met or missed, which sounds safe and is the opposite.
- Per-change automated checks, with retained output. Run accessibility checks on every merge and keep the results with their timestamps. Retained output is the difference between claiming a practice and evidencing one, and it costs almost nothing once wired.
- A documented burden assessment wherever you claim one. If a requirement is genuinely disproportionate for a given surface, write the assessment against the directive criteria at the time you make the decision. Reconstructing that reasoning two years later, under questioning, is a much worse exercise.
- A current accessibility statement that matches reality. The statement should reflect what the checks actually show, including known gaps and the plan for them. A statement that overclaims is worse than a modest one, because it converts a technical gap into a credibility problem.
None of this requires a new platform, and none of it is a quarter of work. It is pipeline plumbing plus the discipline to write decisions down when you make them.
What to Do With the Time the Amendment Bought
The deferral of the high-risk obligations is real relief for teams building systems that fall into those categories. The mistake would be to treat it as general slack.
The sequence we would run: confirm which of your consumer-facing services are in EAA scope, establish whether you can currently produce evidence for any period rather than any date, wire the per-change checks and retention if you cannot, and only then return to the AI Act workstream with a longer runway than you had last month. That order reflects what is enforceable now rather than what has been discussed most.
Key Takeaways
- The European Accessibility Act has applied since 28 June 2025, and covers consumer-facing services including e-commerce and consumer banking.
- The AI Act timeline was amended: high-risk obligations in sensitive areas now apply from 2 December 2027, and embedded regulated products from 2 August 2028, while transparency rules arrive in August 2026.
- Article 32 transition covers products already in service and self-service terminals, not your website, and is routinely overread as a general grace period.
- The accessibility obligation is documentary: information in your terms, and a written assessment wherever you claim a disproportionate burden.
- Generated interface code raises change volume past review capacity, so point-in-time audits stop functioning as evidence, and the record has to become continuous.
Frequently Asked Questions
Does the AI Act delay change our accessibility obligations?
No. They are separate instruments with separate timelines. The amendment moved dates inside the AI Act only. Accessibility obligations under the European Accessibility Act have applied since 28 June 2025 and were not affected.
We are not established in the EU. Does this reach us?
The directive is concerned with products placed on the Union market and services provided to consumers in the Union, so the location of your headquarters is not the deciding factor. If you sell to EU consumers through your site, treat scope as likely and confirm the specifics with counsel rather than assuming distance protects you.
Is an automated scan enough to demonstrate conformance?
No, and it never was. Automated checks catch a meaningful share of defects and nothing that requires judgement, such as whether focus order is sensible or whether an error message is understandable. They are the continuous layer. Manual and assistive-technology testing remains necessary for the parts a rule cannot evaluate.
Where should a team with limited capacity start?
Retention. Turn on accessibility checks in the pipeline and keep the output, even before you fix much. It is the cheapest step, it starts the clock on having a record, and it converts every subsequent fix into dated evidence rather than an undocumented improvement.
Sources
- European Union, "Directive (EU) 2019/882 on the accessibility requirements for products and services," 2019. Link.
- European Commission, "Regulatory framework on AI," 2026. Link.
- European Union, "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence," 2024. Link.
- WebAIM, "The WebAIM Million: The 2026 Report on the Accessibility of the Top 1,000,000 Home Pages," 2026. Link.
Next Steps
If someone asked today for evidence that your consumer-facing site met its accessibility target across the last six months, the honest answer for most teams is a scan from one afternoon. Closing that gap is pipeline work, not a compliance program. Stable Solutions builds the checks, retention, and documentation into the delivery process as an R and D partner, so the evidence exists before anyone asks for it. Explore our App and Web Development services or contact our team to review what your estate can currently demonstrate.