Why Europe’s accessibility law turns every bank release into evidence

The week

June 28, 2026 marked one year since the European Accessibility Act began to apply across the European Union. The directive, adopted in 2019 and transposed into national law by each member state, sets accessibility requirements for a list of products and services. They include consumer banking services, e-commerce, and self-service terminals such as ATMs and payment terminals. Service providers must meet the requirements and publish information explaining how their services meet them. National authorities enforce the rules, and penalties and procedures vary by member state. Microenterprises providing services are exempt, and transition rules let some existing contracts and terminals continue for a period. In the last week of June 2026, banks serving EU consumers completed their first year under the regime.

Many banks ran the Act as a project with an end date. They audited the app and website against WCAG criteria, using the European standard EN 301 549 as the working benchmark while standards bodies revised it for the Act. They fixed what the audit found and published an accessibility statement. That was necessary work. The difficulty a year later is that a banking service changes every week. App releases, new document templates, vendor updates and terminal replacements each can undo a fix. A statement that the service conforms is only as good as the most recent change. We divide the service into four parts, each with its own way of drifting and its own evidence: digital releases, documents and communications, physical terminals, and embedded vendor components.

Digital releases

Apps and websites received most of the investment, and the main journeys are usually in good shape. The failures cluster at the edges. Authentication steps, one-time passcode screens, CAPTCHA alternatives, session timeouts and error messages are where a customer using a screen reader, magnification or switch access is most likely to be stopped. Those are also the screens that change most often, because security and fraud teams adjust them.

Evidence here comes from the delivery pipeline. Automated accessibility checks can run on every build and catch a meaningful share of problems, such as missing labels and contrast failures. They cannot judge whether a flow makes sense with a screen reader. That needs periodic manual testing by people who use assistive technology, focused on complete tasks such as logging in, paying a bill or disputing a card transaction. A bank that keeps the results of both, with defects tracked to closure like any other release defect, can show a supervisor what state the service was in on a given date. A bank that relies on last year’s audit cannot.

The public information the Act requires belongs in the same loop. If the published description of how the service meets the requirements is written once and never revisited, it will drift from the product. Versioning that statement, assigning an owner and reviewing it at each major release keeps the public claim and the internal evidence in step. It also gives complaint handlers something accurate to point to.

Documents and communications

Statements, contracts, fee information, notices and letters are part of the service. Many are produced as PDFs by older document composition systems that were never designed to output tagged, structured files. Customer service channels, including chat and video, must work for people with disabilities too. This part usually sits with operations teams, outside the digital program, which is why it lags.

Volume is the practical starting point. A small number of templates typically produce most customer documents. Converting those templates to accessible output, and offering alternative formats on request through a defined and logged process, covers most customers first. The evidence is a template register showing which templates have been remediated and tested, plus records of alternative-format requests and how quickly they were met. Every new template should pass the same check before it goes live, or the register goes stale.

Physical terminals

ATMs and payment terminals are covered as products, and the product obligations fall mainly on manufacturers, importers and distributors. Banks still choose and operate the fleet. The directive allows self-service terminals already in use before June 28, 2025 to continue until the end of their economically useful life, up to a maximum of twenty years. That gives banks time, but only if replacement plans account for it.

The evidence a bank needs here is mostly procurement evidence. New terminal purchases should require the manufacturer’s declaration of conformity and the supporting technical documentation. Fleet records should show which units fall under the transition rule and when each is due for replacement. Branch staff guidance on assisting customers at terminals, and on reporting faults that affect accessibility, completes the record. Banks should confirm with counsel how the transition rules apply in each member state where they operate.

Embedded vendor components

The fourth part runs through the other three. Banks rely on vendors for digital banking platforms, identity verification flows, card management widgets, chat tools, payment authentication screens and document generation. Many of these appear inside the bank’s own journeys at the most important moments. When a vendor component fails, the customer sees the bank’s name, and the bank remains the service provider answerable to the authority.

Evidence from vendors should be tested rather than filed. Contracts can require conformance with the applicable standard, notice before releases that change customer-facing screens, test results for each major release and remediation timelines for defects. The bank’s own task-based testing should cover vendor screens, since that is where the customer actually experiences them. A vendor accessibility report that is two years old describes a product the bank no longer runs.

For US banks and fintechs, the Act matters where they provide covered services to consumers in the EU, and counsel should confirm scope. The same engineering habits also support accessibility obligations and litigation defense in the United States.

With hindsight

From October 2026, the first year looks like the early period of most EU service rules. Each member state had to designate enforcement authorities, and their readiness varied. Germany’s joint authority for its national law, set up by the 16 states and based in Magdeburg, took up full nationwide work only in September 2025, three months after the obligations applied. Published accounts of the first year describe enforcement driven mainly by complaints, with corrective orders coming before penalties. Penalties and procedures still differ by country. For banks, the ordinary pace of release change means a 2025 audit says little about the service a supervisor would test in 2026. Documents produced by older composition systems remain a weak area for many institutions. Work on revising the European standard for the Act has continued. Banks should follow guidance from the authorities in each member state where they serve consumers, and confirm obligations with counsel.