WCAG 2.1 or 2.2: Which One the European Accessibility Act Actually Requires
If you've spoken to an accessibility consultant recently, you've probably heard something like "the EAA requires WCAG 2.2 AA." It's a reasonable thing to believe — WCAG 2.2 is the current W3C Recommendation and it's what most auditors test against. But it's not the legal line the EAA actually draws, and the difference matters if you're reading an audit report and trying to work out what you're actually required to fix.
What the EAA actually references
The European Accessibility Act doesn't name WCAG directly. Instead, it references EN 301 549 — the harmonised European standard for ICT accessibility, published by CEN and CENELEC. When a product or service meets EN 301 549, it's presumed to meet the EAA's accessibility requirements.
EN 301 549 v3.2.1, published in March 2021, is the version that applies. It incorporates WCAG 2.1 Level AA — the 2018 W3C standard — for web content. Not WCAG 2.2. WCAG 2.2 was published in October 2023, after EN 301 549 v3.2.1, and the harmonised standard has not yet been updated to reference it.
That means the technical benchmark for EAA compliance across all EU member states, as of June 2025 when enforcement began, is WCAG 2.1 AA — not 2.2.
What this means for your audit report
WCAG 2.2 added nine new success criteria at Levels A and AA, and removed one. If your auditor tests against WCAG 2.2 and presents the results as EAA compliance findings, you may be looking at issues you're legally required to fix — when you aren't.
The WCAG 2.2-only criteria at AA level include:
- 2.4.11 Focus Not Obscured (Minimum)
- 2.5.7 Dragging Movements
- 2.5.8 Target Size (Minimum)
- 3.3.8 Accessible Authentication (Minimum)
These are genuinely useful improvements to the standard and worth fixing. But none of them are EAA compliance requirements as of June 2025. An auditor who presents them as compliance failures alongside real WCAG 2.1 AA failures is either unaware of the distinction or not being straight with you about the legal risk. Either way, any client with a lawyer will catch it.
What the enforcement record shows
The first EAA enforcement actions — injunctions against Auchan, Carrefour, E.Leclerc, and Picard — were assessed against WCAG 2.1 AA criteria. The cases targeted checkout flows, product browsing, and missing accessibility statements. The findings were things like non-focusable interactive elements, unlabelled form fields, and missing skip navigation — all WCAG 2.1 AA failures, not 2.2-only items.
This is worth knowing because it tells you what enforcement agencies are actually prioritising: journey completion for keyboard and screen reader users, and the accessibility statement itself. It's not a pixel-by-pixel conformance check against the latest revision of the standard.
Will this change?
Yes, eventually. CEN and CENELEC are working on a new version of EN 301 549 that will reference WCAG 2.2. When that version is published and adopted, the EAA legal benchmark will move to WCAG 2.2 AA. At that point, the four criteria listed above will become compliance requirements.
That update hasn't happened yet. When it does, it will be announced. Until then, the legal line is WCAG 2.1 AA.
The right way to present an audit
An honest EAA audit distinguishes between two categories of finding: WCAG 2.1 AA failures (legal requirements) and WCAG 2.2-only failures (recommended, not required). Testing against 2.2 is fine — it catches more issues — but the compliance position should be written against the standard that actually governs.
If you're reviewing an audit report and it doesn't make this distinction, it's worth asking your auditor which findings are 2.1 AA failures and which are 2.2-only. The answer will tell you a lot about what you're actually required to fix versus what's good practice.
That distinction is built into how we run our EAA accessibility audits. WCAG 2.1 AA is the legal line; 2.2-only findings appear separately, labelled clearly. You shouldn't have to guess what the regulator is actually using.