Questions and answers · with article numbers
Common questions
Short answers that link to the long ones. Each carries an article number or a WCAG criterion, so you can check it at the source.
Scope
Does the act apply to every website?
No. It applies to the services listed in art. 3(2) when provided to consumers — including electronic commerce, meaning any page where a consumer concludes a distance contract (art. 5(32)). The practical test: can something be ordered, booked, paid for or signed on this page? If yes, you are in scope, however brochure-like the site looks. If it only informs and points to a phone number, you are outside. The boundary, with examples.
I run a shop. Am I definitely covered?
Yes, if you sell to consumers and are not a micro-enterprise. Art. 18 adds requirements for identification, security, payment and signatures — that is, for sign-in, cart, checkout and consents, not just for the home page. Shops step by step.
What is a micro-enterprise, and what is it allowed to skip?
A business with an average of fewer than 10 employees and an annual turnover or balance sheet total of up to €2 million (the definition from the Entrepreneurs' Law, measured over the last two financial years). Its services are excluded from the act (art. 4(1)). Products are not. Contracts with partners, marketplace requirements and other laws still apply. Crossing the threshold in two consecutive years ends the exemption, and the act grants no separate grace period for that. The exemption and its asterisk.
I am a sole trader. Am I a micro-enterprise?
Almost certainly — one person is fewer than ten, and the €2 million threshold is out of reach for most sole traders. But the exemption covers services only, it does not remove risk under other law (unfair market practices, GDPR on your forms), and a corporate or public client will ask about accessibility in a tender anyway. The exemption removes the obligation, not the reason.
My site takes appointment bookings or course sign-ups. Is that a service under the act?
Yes, if the booking ends in a contract — even with no online payment. Art. 5(32) is about concluding a distance contract by electronic means, not about having a cart. The calendar, the sign-up form and the confirmation e-mail are one service and have to be accessible together.
I sell through Allegro and Amazon. Does that get me off the hook?
No. The platform answers for its interface, you answer for yours — your own shop, your company site, and whatever you put in yourself: product descriptions, images with text instead of a text alternative, size tables pasted as pictures, instruction PDFs. If you sell exclusively on someone else's platform and run no consumer-facing service of your own, your obligations are correspondingly smaller — but not zero.
What about a contact form or a newsletter?
Neither is a contract, so on their own they do not turn a site into an art. 3(2) service. But once you are covered, the contact form is usually your complaint channel under art. 37(1) — and a channel that cannot be used with a screen reader is not a channel.
I only sell to businesses (B2B). Am I covered?
The act covers services for consumers — natural persons acting outside their business activity (art. 5(14)). A strictly B2B platform that verifies a tax number at registration: no. A "for business" shop that anyone can in fact buy from without verification: yes. What counts is who can actually buy, not what the header says.
The company is established abroad and sells into Poland. Does the Polish act apply?
Yes — a service provider is anyone offering a service to a consumer in the EU (art. 5(35)), and supervision belongs to the authority of the country where the service is provided. The law of the country of establishment applies too. The technical requirements, however, are common across the Union (EN 301 549), so one thorough audit serves every market at once. Implementations in other countries.
I am a public body. What changes?
Not the standard: WCAG 2.1 AA under the 2019 act. What changes is enforcement wherever you provide an art. 3(2) service (tickets, e-books, payments): a consumer complaint with a 30-day deadline and fines under art. 73 arrive alongside the existing accessibility statement and supervision. Two regimes side by side.
Mobile apps too?
Yes — art. 12(2)(3) names websites and mobile applications; art. 5(32) covers services provided through "mobile devices". EN 301 549 chapter 11 translates WCAG for apps, and the platform accessibility APIs (TalkBack, VoiceOver) are there what correct HTML is on the web.
Deadlines
When did it start to apply?
28 June 2025 (art. 88). There is no "adjustment period" for new contracts or new content — the deadline has passed, and every day of delay is a day on which a consumer can file a complaint.
I heard about 2030. What is that?
Art. 85(1): service contracts concluded before 28 June 2025 may run on unchanged until they expire, and no later than 28 June 2030. It is an exception for contracts, not for websites. A shop concluding new contracts today is covered today — and an amendment or a change of terms creates a new contract.
What about old PDFs and videos?
Excluded: recorded media and document files published before 28 June 2025, and archives not updated since that date (art. 86). New ones must be accessible. Watch the trap: terms, a price list or a manual edited after that date is a new document, and the exclusion does not come back to it.
I am redesigning, or changing the theme. Does that reset anything?
Not in your favour. The exclusions in art. 85 and 86 cover what already existed — a new theme, a new template and new content are new, and fall under the act in full. That is why the conformity assessment is repeated after every substantial change rather than done once.
How often must a disproportionate-burden assessment be repeated?
At least every 5 years, and sooner if the service or the circumstances you relied on change (art. 21). The documentation is kept for 5 years and handed to the authority on request, and the reliance itself is notified to the supervising authority on your own initiative.
Technique
WCAG 2.1 or 2.2? Level AA or AAA?
The law — through EN 301 549 — points at WCAG 2.1 AA. WCAG 2.2 AA is a superset and the better target, because its new criteria land squarely on shops and sign-in: 2.4.11 (focus not obscured by a sticky header or a cookie bar), 3.2.6 (help in the same place on every page), 3.3.7 (no re-entering the same data during checkout), 3.3.8 (sign-in without a memory test — pasting and password managers must work) and 2.5.8 (touch targets at least 24×24 px). Nobody requires AAA in full, and it cannot be met for every kind of content. Levels and differences.
What contrast exactly is required?
Text: at least 4.5:1 against its background (WCAG 1.4.3). Large text — from 24 px, or 18.66 px bold: 3:1. Interface components and meaningful graphics — field borders, icons, chart bars: 3:1 (1.4.11). What counts is the colour actually seen after backgrounds, gradients and transparency have been composited, which is why we measure it in a browser rather than in a stylesheet. Logos and purely decorative text are exempt.
Do videos need captions and audio description?
At level AA: captions for all recorded audio (1.2.2), audio description of what can be seen but not heard (1.2.3 and 1.2.5), and captions for live streams (1.2.4). Unedited YouTube auto-captions usually do not qualify — they get proper names, prices and punctuation wrong, and those are exactly what carries the meaning. A video with only background music needs no captions.
Is a CAPTCHA allowed?
Yes, but not an image-only one. WCAG 1.1.1 requires an alternative addressing a different sense — an image plus an audio version, or better, a method with no cognitive test at all (a token, a honeypot, rate limiting). WCAG 2.2 goes further: 3.3.8 rules out memory tests and image recognition as the only route to signing in.
Are AI-generated alt texts good enough?
As a starting point yes, as a finished product no. A model describes what is in the picture; an alternative has to say why the picture is here. A product photo in a card needs the variant name, not "person holding an object"; a size table pasted as an image needs the data, not a description. A purely decorative image should carry alt="" rather than a sentence — and that is what an automated tool almost never proposes.
I use WordPress / Shopify / Shoper. Is that enough?
No platform is accessible out of the box. It depends on the theme, the plugins and the content — and the commonest violations come from what gets added after installation: the slider, the discount pop-up, the consent banner and the reviews plugin. Check the site; the report separates what comes from the theme (contrast, focus) from what comes from the content (alt texts, headings). Shop platforms.
Does an accessibility overlay solve it?
No. An overlay does not change the page's code, it adds its own widget on top — and organisations of blind people publicly ask people not to use such tools, because they often break screen readers more than they help. An overlay can also create violations of its own: an unlabelled button, a focus trap, an abrupt change of context. The authority and the auditor measure the page as the user meets it — overlay included. More on ordinary websites.
What is ARIA and do I have to use it?
A set of attributes telling screen readers what an element is and what state it is in. Needed for custom components — tabs, accordions, modals. Unnecessary wherever plain HTML already says it: a <button> does not need role="button". The first rule of ARIA is not to use ARIA unless you must, because badly used it is worse than none. Explained.
Is structured data (schema.org) required?
No. But the same structure that earns rich results in Google is a sign of a well-built, accessible page — and it has fields for the product accessibility information required by art. 18(1). More on structured data.
What about the payment gateway — that is not my code.
The operator answers for its own form; you answer for choosing it, embedding it and for the whole path leading to it. The exclusion in art. 4(2)(b) covers content you do not control — and a payment module you picked and installed yourself is under your control. If the gateway is inaccessible the duty does not disappear: change the gateway, or add a second way to pay. Who answers for third-party modules.
Duties and consequences
What do I need "on paper"?
A conformity assessment of the service (art. 32(1)), accessibility information in your terms or an equivalent document (art. 32(2)(1)), and, if you rely on disproportionate burden, the assessment documentation kept for 5 years plus a notification to the authority (art. 21). Those are three different documents, and only the second is visible from outside — which is why its absence is the first thing an authority checks. The act article by article.
What exactly goes into a conformity assessment?
The act gives no template (art. 32(1) states the duty, not a form). What an authority will accept in practice: the scope examined (addresses, journeys, the mobile version), the method and benchmark (WCAG 2.1 AA via EN 301 549), a list of non-conformities with their locations, a remediation plan with dates and an owner, plus a date and a signature. A tool's report is an annex to that document, not the document itself.
An agency built the site. Who is liable?
Towards the authority and the consumer, you are — because you are the one providing the service (art. 32). Settling up with the contractor is a matter of the contract between you: if you ordered a WCAG-conformant site and did not get one, you have a warranty or contractual claim. The administrative fine under art. 73 still lands on you, not on the agency.
How large is the fine?
Up to ten times the previous year's average monthly salary — 89,035.60 PLN in 2026 — and no more than 10% of last year's turnover (art. 73(1)). There are five separate grounds, including a missing conformity assessment and a failure to notify the authority on your own initiative; the fine is imposed for the state of affairs, not for intent. The road to a fine.
Who supervises?
For electronic commerce: the minister responsible for computerisation; banking: the Financial Ombudsman; telecoms, media and e-books: the President of UKE; transport: sectoral authorities; the whole is coordinated by the President of PFRON (art. 38).
What does a consumer complaint look like?
It comes to you first — in writing, orally or electronically (art. 37(1)). You have 30 days to answer; no answer means the request is upheld; delivery within 6 months (art. 37(2)–(4)). Only then may the consumer — or anyone else — notify PFRON (art. 67). Those 30 days are the cheapest moment to fix things. Deadlines from the owner's side.
Can a consumer claim damages from me?
The act gives them a complaint and a notification to the authority, not a money claim of its own. That does not mean there is no financial risk: general civil law remains, so do the rules on unfair market practices and UOKiK proceedings over practices infringing the collective interests of consumers — and those carry their own, higher penalties. Ask a lawyer about damages; here we answer only for what the act itself says.
Can the authority shut my shop down?
It can prohibit the provision of the service for up to 180 days by decision (art. 62(1)(2)), extend the prohibition until proceedings end (art. 64) and declare the decision immediately enforceable (art. 65(4)). Before that, though, comes a call to remove the non-conformity within up to 120 days — a prohibition does not arrive without warning.
Can I plead cost?
Yes — "disproportionate burden" (art. 21), but with an assessment against three criteria, documentation, reassessment every 5 years and a notification to the authority. You cannot, if you received public funding for accessibility (para. 11). And it does not work on a whole service at once: you plead a specific requirement against a specific element, not "we cannot afford it".
The checker
How does the free check work?
We open the page in a real browser (desktop 1280 px, phone 390 px and 320 px), measure contrast, focus, motion, touch targets and scrolling, inspect the code (language, title, alt texts, labels, headings, ARIA) and the act's own requirements (accessibility information, contact channel, shop signals). A result in 20–60 seconds, no sign-up. Run it.
Will you check the cart or a page behind a login?
The free check takes one public address — and it can be any subpage, including a product card or the first step of the cart. Sign-in and the full purchase journey (cart, checkout, payment, account) belong to the whole-site check, where we test them as a sequence, because art. 18 covers the whole path to an order rather than individual screens. Pricing.
Does 100/100 mean I comply with the act?
No. An automated tool settles 30–50% of WCAG criteria. A score of 100 means we found no violations in what can be measured by machine. The rest — whether an image alternative makes sense, whether the heading order matches the content, whether an error message helps — needs a person, which is why the report shows a separate "not checked" section and never counts it as passed.
Can I hand the report to a lawyer or an agency?
Yes — the link lives 90 days and opens in four languages (a language parameter in the URL). Every finding carries its location in the code, the WCAG criterion, the EN 301 549 clause and the article of the act, so it can go to a developer without translation. The paid version adds a remediation instruction for each problem.
Will my site's results be made public?
No. We do not publish, share or sell the results of individual domains — nor the list of sites that have been checked. A public list of results with company names would be a ready-made list for art. 67 notifications and a lead list for agencies, and on a domain carrying someone's surname it would also be personal data. The report is seen by whoever holds the link. At most we may publish aggregate figures, with no names. Privacy policy.
What do you do with the data about my site?
The report (address, findings, screenshots) — 90 days on our server, then it is gone. A short, non-personal summary (domain, score, platform, whether it is a shop) goes into an internal Castomo registry, which is not published, and is deleted 24 months after the last check. Your e-mail — only to send you the report, and with separate consent, to contact you. We analyse public pages only. Privacy policy.
How often should I re-run the check?
After every substantial change — a new theme, a new consent banner, a new plugin, a rebuilt checkout — and as a precaution once a quarter. Accessibility is a property of the service, not a one-off project: the commonest story is a site fixed in March and broken in May by a discount pop-up.