Website accessibility in Estonia. Who the EAA actually covers — and what happens if you ignore it

Does the law actually apply to you?

Before you start fixing contrast ratios and writing alt text, answer one question: does the law cover you at all? A large share of Estonian online businesses worry about this needlessly, and another share are relaxed without reason. The line runs between two tests.

1. Do you sell online to consumers? Section 2(3)(1) of the Products and Services Accessibility Act lists e-commerce first among covered services, and section 2(8) extends the requirements to the online sale of any product or service. If your site only introduces the company and nothing can be bought there, it is not on the statutory list.
2. Are you larger than a microenterprise? Section 2(11) exempts microenterprise service providers from the requirements entirely. This single provision decides the answer for most Estonian online shops — and it is the part most alarming articles leave out.

The short answer: the requirements apply if you sell online to consumers and you have at least ten employees or more than two million euros in turnover. If either of those is not the case, you are outside the law — though not outside the consequences, because an inaccessible checkout loses customers regardless of what any statute says.

The law, the dates and what they cover

The source is EU Directive 2019/882, known as the European Accessibility Act. Estonia transposed it through the Products and Services Accessibility Act, adopted by the Riigikogu on 30 May 2022 and in force since 28 June 2022. The substantive requirements only started to apply three years later: under section 22(1) they cover products placed on the market and services provided from 28 June 2025.

Two ministerial regulations sit underneath. Regulation no. 45 sets out the functional accessibility requirements; regulation no. 46 covers the criteria for assessing disproportionate burden. For an online store the operative text is section 22 of regulation no. 45, which addresses e-commerce directly.

Alongside e-commerce, the Act covers five more services: electronic communications, e-books and the software needed to read them, financial services, parts of passenger transport services, and services providing access to audiovisual media. If your business touches any of those, the requirements apply even where nothing is sold directly on the site.

There are also transitional periods worth knowing. Service contracts concluded before 28 June 2025 may continue unchanged until they expire, but no longer than 28 June 2030, and a provider may keep using a product it already used before that date until the same 2030 cut-off.

The microenterprise exemption: where the line runs

This is the most practical section of the article, because for most Estonian companies the answer lives here. Section 3(4) defines a microenterprise as an undertaking with fewer than ten employees whose annual turnover and annual balance sheet total do not exceed two million euros.

Two traps. First, the headcount and the financial test apply together: a twelve-person company is not a microenterprise even with 300,000 euros of turnover. Second — and this is an Estonian peculiarity — the English text of the directive puts or between turnover and balance sheet, while the Estonian statute uses a conjunction that requires both figures to stay within the threshold. Read literally, Estonia’s test is the stricter one. If you are anywhere near the line, confirm the reading with your accountant rather than picking the interpretation you prefer.

Note also that the exemption is written for service providers. If your company manufactures or imports covered products — payment terminals, e-readers, self-service terminals — microenterprise status does not exempt you. It only lightens the paperwork: under section 5(2) a microenterprise dealing with products does not have to document its burden assessment.

One thing the exemption does not do is change reality. It releases you from the statute, not from the lost sale. If your checkout cannot be completed with a keyboard, that customer is gone whether or not an inspector ever visits. The same work that makes a store accessible usually improves conversion and search visibility too — we went through the evidence in web design trends 2026.

European Accessibility Act website requirements

Estonian law does not hand you a checklist saying “contrast ratio at least 4.5:1”. Section 10(2) of regulation no. 45 states the principle instead: a website and a mobile-device-based service must be made perceivable, operable, understandable and robust. Those four words are the POUR principles that underpin the international standard.

For e-commerce, section 22 of the regulation adds three more specific duties:

• Information about the accessibility of what you sell. Where the responsible operator has already given you that information — a sign-language product video, for example — you have to publish it. You are not required to generate it yourself.
• Authentication, payment and security functions. Everything that forms part of the service has to be perceivable, operable, understandable and robust. In practice: choosing a bank link, entering a confirmation code and completing the order all have to work by keyboard and with a screen reader.
• The same duty for third-party components. Using an external payment or e-signature provider does not transfer the obligation to them. The requirement attaches to the service you provide.

In day-to-day work this comes down to four things more often than anything else: sufficient colour contrast, labelled form fields, a checkout that can be completed with the keyboard, and meaningful alt text on product images. Those are also the web’s most common failures, and fixing them covers the bulk of a typical gap. If you are rebuilding anyway, design it in from the start — ecommerce development from scratch is a much cheaper place to handle accessibility than a retrofit.

There is an important carve-out for old content. Section 22(5) excludes pre-recorded audio and video published before 28 June 2025, office file formats published before that date, and website content that has not been updated or modified since. An untouched archive can stay as it is — but the moment you edit a page, the requirements apply to what you changed.

European Accessibility Act and WCAG: what maps to what

Most published explanations over-simplify here, so let us be precise.

• WCAG (Web Content Accessibility Guidelines) is a W3C guideline. The working benchmark is level AA. WCAG 2.1 dates from 2018; WCAG 2.2, from 2023, adds nine success criteria, six of them at level A or AA.
• EN 301 549 is the European standard. It incorporates WCAG and adds further requirements of its own. The current published version is V3.2.1, which carries WCAG 2.1 level AA. A newer version referencing WCAG 2.2 is still in the ETSI voting stage.

Estonia’s supervisory authority states plainly that websites within the scope of the Act are held to the same standard as the public sector, namely EN 301 549 V3.2.1. The same authority warns against a common shortcut: EN 301 549 and WCAG are not the same standard, because EN 301 549 layers additional requirements on top — limiting yourself to a WCAG checklist is not enough.

One honest clarification you will rarely see elsewhere. A formal presumption of conformity — where following a standard automatically counts as complying with the law — only comes from a harmonised standard cited in the Official Journal of the European Union. Under Directive 2019/882, no such standard has been cited yet. That does not make EN 301 549 irrelevant; it is the substantive yardstick everyone builds and audits against. It simply means conformity today is demonstrated against the requirements themselves, not against a certificate. Which is also why there is no EAA certification to buy — if a vendor offers you one, they are selling something the law does not recognise.

Penalties and enforcement: the real numbers

Supervision sits with the Consumer Protection and Technical Regulatory Authority (Tarbijakaitse ja Tehnilise Järelevalve Amet, TTJA), which under section 21 also acts as the extra-judicial body for these misdemeanours. By its own account, enforcement is driven mainly by consumer tip-offs, alongside planned supervision using samples the authority selects itself.

The figures are in section 20, and they are quoted incorrectly almost everywhere — including on foreign pages that specifically target Estonian search results. Here they are precisely:

• Natural person — up to 100 fine units. A fine unit has been eight euros since 1 January 2025, so the current ceiling is 800 euros. The statute names no euro figure here at all, only fine units.
• Legal person — up to 20,000 euros. This one is usually reported correctly.
• Penalty payment — up to 10,000 euros. This is not a fine. It is the enforcement instrument in section 19, available when a company ignores a precept from the authority.

The recurring error is presenting that 10,000-euro penalty payment as “the fine for an individual”. They are two different instruments in two different sections, and conflating them overstates personal exposure by more than tenfold.

More consequential than any of the money is what section 18 permits. The authority can require immediate remediation and, failing that, prohibit or restrict the provision of the service on the Estonian market. For an online store that is a considerably harder outcome than a fine.

And the other side of the ledger, stated honestly: the authority has not published any enforcement statistics under this Act — no counts of precepts, no fines issued. Anyone quoting you precise Estonian enforcement numbers is drawing on something other than a public source.

How to test your own site

Three things you can do today without commissioning an audit. Start with the purchase path rather than the homepage — that is where the expensive failures hide.

1. Automated scan. Run WAVE, axe DevTools or the Lighthouse accessibility audit in Chrome. Within minutes you will have contrast failures, missing alt text and unlabelled form fields. Remember that automation covers only part of the criteria — a clean report is not conformance.
2. Keyboard test. Put the mouse away and complete the whole purchase with Tab, Enter and Space: add to cart, contact details, delivery method, bank link, confirmation. Watch whether focus is always visible and whether anything traps you. Most stores fail at the payment or delivery step.
3. Screen reader and zoom. Listen to the cart with a screen reader (VoiceOver on macOS, the free NVDA on Windows) and zoom the browser to 200 per cent. If a button announces itself as “button” or text starts overlapping, you have found a defect.

For a sense of scale: WebAIM’s 2026 study of one million home pages detected WCAG failures on 95.9 per cent of them, with the shopping category running roughly a quarter worse than average. If you find problems on your own store, you are the rule rather than the exception.

Disproportionate burden: when you do not have to comply

Sections 4(5) and 5 allow you to depart from the requirements in two situations: where compliance would fundamentally alter the basic nature of the service, or where it would impose a disproportionate burden. This is not a free pass — it is a procedure with a defined shape.

• The assessment must be documented and kept for five years.
• It must be reviewed when the service changes, when the authority asks, or every five years.
• You must notify the authority which requirements you are not applying, and produce the assessment on request.
• You cannot rely on the exception if the accessibility work was funded from sources other than your own resources.

The authority’s guidance makes two points worth repeating. Carrying out the assessment is not itself a duty — you only do it if you want to invoke the exception. And a disproportionate burden in relation to one requirement does not release you from all the others. In practice, for a small online store, documenting a burden assessment often costs more than simply fixing the contrast and the form labels.

A final boundary that is frequently blurred: this article is about the private sector. Accessibility of government and municipal websites in Estonia flows from section 32 of the Public Information Act instead, and that regime carries no fines at all — a body served with a precept must act within five working days. The supervisor is the same authority in both cases; the consequences are not.

In one sentence: check first whether you are a microenterprise service provider; if you are not, take EN 301 549 V3.2.1 — that is WCAG 2.1 level AA — as your yardstick, walk the checkout with a keyboard, and fix contrast, form labels, alt text and focus visibility. Most gaps close with those four.

This article is general information, not legal advice. For an assessment of your specific obligations, work from the statute itself and the authority’s guidance, or ask a lawyer. If the question is the technical one — whether your website meets the requirements and what to fix first — that part is our job.

FAQ