European Accessibility Act Website Requirements 2027: GDPR and AI

Which EU rules apply to a business website: a map for 2027

A website of a company in the EU, or with customers in the EU, falls under several sets of rules at once. They do not replace each other and cover different parts of the site. We put them on one map so you know what to ask a lawyer.

• Accessibility. Directive (EU) 2019/882, the European Accessibility Act: applies from 28 June 2025.
• Personal data. The General Data Protection Regulation (GDPR): what you collect, why, how you tell people and how you protect it.
• Cookies and trackers. The ePrivacy Directive and national regulators’ practice: consent before analytics and advertising are switched on.
• Artificial intelligence. Regulation (EU) 2024/1689, the EU AI Act: transparency obligations for chatbots and generated content.
• Provider details and consumer terms. For example, an Imprint for sites aimed at Germany and Austria, and information on payment, return and withdrawal terms.

Important: we are not lawyers and do not give legal opinions. Here is what official documents and law-firm overviews say as of October 2026, and where sources differ we note it. Any decision about your website is worth agreeing with a lawyer who knows your market. If you are only starting the journey with a company, begin with the best country to open a company in Europe, and for the bank side read Stripe website requirements: what banks and Wise check on your site.

European Accessibility Act: what it requires and when it applies

The Accessibility Act has applied since 28 June 2025. The covered services include e-commerce: services provided at a distance, at the consumer’s request, to conclude a consumer contract. According to law-firm overviews, this also affects companies outside the EU if they sell to consumers in the EU. Websites that work only for business (B2B) and do not conclude consumer contracts are usually outside the scope, but the line depends on how the site is built.

What is required in practice

• Information and interfaces must be perceivable, operable, understandable and robust. The reference for checking is the WCAG standards and the European standard EN 301 549.
• The whole customer journey: catalog, product description, cart, payment, support.
• A published accessibility statement and procedures that maintain compliance.
• Cooperation with the national supervisory authority on requests.

Exemptions

For microenterprises providing services (fewer than 10 employees and turnover or balance sheet of no more than €2 million) there is an exemption. But overviews differ on how it applies to online retail, and EU countries transposed the directive into national law in different ways. There is also a separate exemption where compliance would be disproportionately burdensome or would change the nature of the service. A lawyer decides these questions, not an article heading.

What a developer does: contrast, image descriptions, heading structure, forms with labelled fields, keyboard control, a visible focus, no traps in menus. It is better to build this in at the design stage. We described the wider picture of other changes in development in web development trends 2027.

GDPR website checklist: the required elements

GDPR applies if you process personal data of people in the EU: through a request form, a subscription, an account, a payment, analytics, a chat or video. The size of your company and its country do not cancel this if you offer goods and services to people in the EU or monitor their behaviour. The minimum for a website:

• A privacy policy. Who you are, which data you collect, why, on what basis, who you share it with, how long you keep it, how a person can use their rights. In plain language.
• Notice at the form. A clear link to the policy next to the form and, if needed, a separate consent checkbox; it must not be ticked in advance.
• A list of services you pass data to. Email, CRM, analytics, hosting, payment system. You need data processing agreements with them.
• Minimum data. Do not ask for what the task does not need.
• Security. HTTPS, restricted access, backups, form protection.
• Channels for people’s requests. An email address for data questions and a clear process for answering.

We build these points into websites by default, and we make policy texts as templates for the jurisdiction: the final check is done by the client’s lawyer. EU countries have their own nuances and names: in Germany it is the Datenschutzerklärung, in Poland RODO, in Spain LOPDGDD. They do not change the meaning, but they affect the wording.

Cookie banner: what regulators check

Cookies and similar technologies (pixels, SDKs) require the visitor’s consent if they are not needed for the site to work. Regulators’ practice has become stricter in recent years. The French CNIL stresses that refusing cookies must be as easy as accepting, and has ordered publishers to change banners where refusal was hidden or designed so that the user picks “accept”. The approach differs by country: for example, whether a refuse button is needed on the first layer of the banner. The French and UK regulators speak about it directly, while others, such as the Spanish one, are softer in their wording. So follow the requirements of the country your site targets.

What a sound implementation looks like

• Analytics, advertising and third-party videos with tracking are not loaded before consent.
• The “accept” and “reject” buttons look the same and sit side by side.
• There are detailed settings by category and a list of the cookies used.
• The choice is saved and easy to change later.
• The banner language matches the page language.

If you do not need trackers, the simplest solution is to drop them and use analytics without cookies. Then the banner can be minimal. But decide whether you need a banner together with a lawyer in your country.

EU AI Act and your website: what already applies

Regulation (EU) 2024/1689 was introduced in stages. According to law-firm overviews, the main date is 2 August 2026: the transparency obligations in Article 50 started to apply from then. If an AI assistant or chatbot runs on your site, people must be told they are talking to an AI when this is not obvious. AI-generated content (images, audio, video, text) must be marked in a machine-readable way, and deepfakes and some texts published to inform the public must be clearly labelled. For systems placed on the market before 2 August 2026, the overviews name a transition period for labelling until 2 December 2026.

Requirements for “high-risk” systems (for example, in hiring or evaluating people) were, per the same overviews, moved by the “digital omnibus” (per overviews, Regulation (EU) 2026/1744, published in July 2026) to 2 December 2027 for certain categories and to 2 August 2028 for those built into products. An ordinary small-business website rarely involves high-risk systems. Since we rely on overviews, not on the text of the amendments, check the current dates in the Official Journal and with a lawyer.

What to do on the site: label the bot as AI in its first message, say how to reach a human, do not publish generated images of people as “real customers” and keep an internal list of the AI tools you use. We wrote about the cost and work of bots in how much a chatbot or AI assistant costs, and about how a site gets into AI answers in how to rank in ChatGPT.

Imprint, company details and consumer terms

Websites aimed at Germany and Austria need an Imprint (Impressum): the site provider’s details, reachable without undue effort. An IHK Ostwestfalen leaflet refers to § 5 DDG. An Imprint usually contains the name and legal form, address, a way to make contact (email and a second channel), registration details and, where applicable, a VAT number and the responsible person. The content depends on the type of activity, so a lawyer checks it.

If you sell to consumers, the site must show clear terms: prices including taxes, payment and delivery methods, the period and process for returns, information on the consumer’s right to withdraw from the contract, and contacts for complaints. This is not a “pretty formality”: banks and payment systems look exactly here, and mistakes lead to disputes and fines. We covered what a bank checks in Stripe website requirements: what banks and Wise check on your site. For a new site with legal pages for the jurisdiction, the website in 24 hours for €599 fits, and for a site with a blog and two languages, the business website for €2,490.

A practical tip: keep a “site file”, one document listing the pages, forms, services that receive data, the cookies and AI tools in use, the date of the last review and the name of the person responsible. Such a file saves a lawyer time, helps you answer a bank or regulator quickly and shows that you take the requirements seriously. Update it with every noticeable change to the site: a new form, a new analytics service, a new widget. Violations often arise not when the site is built but later, when someone adds a script and forgets to tell the lawyer.

Checklist: does your website meet EU requirements

Tick the items you have in place. The checklist is a self-check tool, not a legal opinion and not a compliance certificate. If some items are unticked, that is a reason to talk to a lawyer and a developer.

How we built the checklist: we took the items that follow from the documents and regulator practice listed above. The weights reflect how strongly an item affects risk. For a bank check, there is a separate checklist in the article on banks and Stripe.

What to choose in your situation

• You sell to consumers in the EU. Start with accessibility and purchase terms, then cookies and policies. This is what customers and banks check most often.
• Your site is only a business card and a request form. A policy, a correct form and a tidy banner are enough; accessibility is still better built in.
• Your site has an AI chat. Label it as AI and give a channel to reach a human.
• Your site is old. Order an audit: an SEO audit for €490 shows the technical base, while accessibility and legal items are checked separately with a lawyer.
• You are choosing who will build the site. Read how to choose a web development company: ask how the contractor builds in accessibility and privacy.
• You want to know whether your whole project is ready. Describe it through the contact page, and we will tell you which points to settle first.

Rules and interpretations change, so check the current state on the date you decide. For requirements for customers in your country, ask a lawyer; we do not give legal opinions.