Beautifly Digital

Is Your Website Breaking Accessibility Law? What the Rules Actually Require of a UK Business

Accessibility is a subject where the advice online is either a shrug or a warning letter. Neither helps much when you run a small business and want to know whether you are obliged to do something, under what rules, and what it would take. The short version: three sets of rules get muddled together constantly, they apply to different organisations, and only one names a technical standard. This guide separates them, then gets practical.

Three regimes, routinely confused

  • The Equality Act 2010. Applies to businesses providing goods and services to the public in England, Wales and Scotland. Requires reasonable adjustments for disabled people. Names no technical standard at all.
  • The Public Sector Bodies Accessibility Regulations 2018. Apply to public sector bodies. Require conformance with a named technical standard and a published accessibility statement. Do not apply to private businesses.
  • The European Accessibility Act. A European Union directive. Its requirements reached a range of private-sector digital services from 28 June 2025. It reaches a UK business only indirectly, through the law of the member state whose market the business sells into.

Most small UK businesses are in the first category only. Plenty are in the first and third. Almost none are in the second, though a lot of agency marketing implies otherwise, because the public sector rules are the only ones with a tidy standard to quote.

The Equality Act: an open-ended duty, not a checklist

If you provide goods, facilities or services to the public, you have a duty to make reasonable adjustments so that disabled people are not put at a substantial disadvantage. A website is a service, so it is covered.

Three features surprise people.

It is anticipatory. You are not waiting for a disabled customer to ask. The duty is to think about it in advance, which means considering it when you commission or rebuild a site, not when a complaint arrives.

It names no standard. There is no statutory requirement to meet any particular technical specification. That cuts both ways: nobody can issue you a compliance certificate, and nobody can point at a clause you have breached. What matters is the outcome for the user.

Enforcement is by individuals, not a regulator. No body audits private websites and issues fines under the Equality Act. A disabled person put at a substantial disadvantage can bring a civil claim, and the Equality and Human Rights Commission publishes guidance on how the duty is understood. Most matters are resolved by correspondence long before anything formal.

The word that does the work is reasonable, and it scales with the organisation. What is reasonable for a sole trader with a brochure site is not what is reasonable for a company with an in-house development team. Cost, practicality, the size and resources of the business, and how much the adjustment would actually help are all part of it. For a small business that usually means getting the cheap, well-understood things right, documenting the decisions you took and why, and offering an alternative route — a phone number, an email address, a person — for anybody who cannot use the site.

One geographical point, because it is often got wrong: the Equality Act 2010 does not extend to Northern Ireland. Equivalent protections there come from earlier disability discrimination legislation, administered separately. The duty is comparable in substance, but do not cite the 2010 Act in Belfast.

The public sector regulations, and why they still matter to you

The Public Sector Bodies Accessibility Regulations 2018 require public sector websites and mobile apps to meet WCAG 2.2 at level AA and to publish an accessibility statement. This is where the standard everybody quotes comes from.

If you are a private business, these regulations do not apply to you. They are still relevant for two reasons. First, if you sell to the public sector, or build sites for organisations that do, the requirement reaches you contractually and it will be specific. Second, WCAG 2.2 AA is the most sensible yardstick available for working out what "reasonable" looks like, because it is a published list of testable criteria rather than an opinion. Using it as a target is good practice. Being told a private business is legally obliged to meet it is not.

The European Accessibility Act: does it reach you?

This is the part most often described badly, so it is worth care.

The EAA is an EU directive, and a directive does not bind a business directly. It obliges member states to put requirements into their own national law, and it is that national law which creates the duty. So the practical question for a UK business is not "does the directive apply to me" but "am I supplying into a member state's market such that that state's implementing law catches me". That matters, because national implementations differ in scope, enforcement and timing, and a single European answer does not exist.

Its requirements became applicable to covered private-sector products and services from 28 June 2025. Among the service categories covered are e-commerce, consumer banking, e-books, electronic communications and passenger transport services. If you sell to consumers in the EU, this is worth getting advice on rather than guessing.

The exemption most often misquoted is the microenterprise one, so here it is precisely. A microenterprise is an undertaking employing fewer than 10 persons and having either an annual turnover not exceeding €2 million or an annual balance sheet total not exceeding €2 million. Note the structure: the headcount test and the financial test both have to be met, but within the financial test either the turnover figure or the balance sheet figure will do. Note also its limit: it applies to service providers. Microenterprises dealing in products are not exempted in the same way, though they get lighter procedural treatment. A small shop selling physical goods should not assume this exemption settles everything.

WCAG 2.2 AA in plain English

The specification itself is written for implementers. Here is what the level AA criteria mean for a typical business site, with the formal wording left where it belongs.

  • Contrast. Text has to stand out sufficiently from its background, and so do the visual boundaries of buttons and form fields. Pale grey body text on white is the most common failure on well-designed sites, because designers like it.
  • Keyboard operation. Everything has to work without a mouse: menus, dropdowns, sliders, modals, cookie banners. Tab through your own site once and you will find things that cannot be reached or cannot be escaped.
  • Visible focus. When something is selected by keyboard, you must be able to see which thing. Removing the focus outline because it looked untidy is a frequent and easily reversed mistake.
  • Images. Meaningful images need a text alternative that conveys the meaning. Decorative images need an empty one so screen readers skip them. "Image of" and filenames are not alternatives.
  • Forms. Every field needs a label that stays visible, errors must be described in words rather than only by turning the box red, and the user must be able to correct a mistake without starting again.
  • Headings and structure. One main heading per page and a logical order below it. Screen reader users navigate by headings, so this is navigation, not decoration.
  • Target size. Interactive controls need to be large enough to hit reliably, which is mostly a question about mobile layouts and closely spaced icon links.
  • No reliance on one sense. Do not convey required information by colour alone, and do not require a drag or a precise gesture with no simpler alternative.
  • Video and audio. Pre-recorded video needs captions, and audio-only content needs a transcript.
  • Help stays put. Keep contact and help links in a consistent place across pages.

Checking your own site in an evening

You can get a long way without buying anything, provided you are honest about the limits.

What automated tools catch: missing alternative text, contrast failures, unlabelled form fields, missing page language, broken heading order, duplicate element identifiers. A free browser-based checker will find these quickly, and these are also the cheapest things to fix. Run one on your five most important pages, not just the homepage.

What automated tools miss: most of it. Whether your alternative text is meaningful, whether the keyboard order makes sense, whether an error message explains anything, whether a custom dropdown announces itself, whether a caption is accurate. Published research on automated testing consistently finds tools detect a minority of real barriers.

The manual checks worth doing yourself:

  • Unplug the mouse and complete your main task — buy something, book something, send an enquiry — using only the keyboard.
  • Zoom the browser well in and check that nothing overlaps, disappears or requires sideways scrolling.
  • Turn on the screen reader already built into your operating system and listen to one page. The first five minutes are uncomfortable and extremely instructive.
  • View the site on a phone and try the menu, the forms and any close buttons with a thumb.
  • Read your own form error messages and ask whether they tell somebody what to do.

Do you need an accessibility statement?

A published statement is mandatory for public sector bodies under the 2018 regulations, with a prescribed structure. For a private business it is not required, and it is still worth having.

A good one is short and honest: what standard you are aiming at, what you know is not yet right, what you are doing about it and roughly when, and how to contact you if somebody hits a barrier, by a route that is not the website. An untrue claim of full conformance is worse than no statement at all, being both a false statement to customers and a record of your own position if anybody disputes it.

What to fix first

This week, the items that are cheap, certain and high-impact: text contrast, visible keyboard focus, form labels, alternative text on images that carry meaning, and a keyboard-operable cookie banner and main menu. These typically take one developer a day or two and remove a large share of real-world barriers.

This month, the paths that make you money: the enquiry form, the checkout, the booking flow, the login. Walk each one by keyboard and with a screen reader and fix what you find. A site with an inaccessible checkout has a commercial problem as well as a legal one.

This quarter, the structural work: heading hierarchy across templates, captions and transcripts, replacing custom widgets that will not behave with standard components, and the accessibility statement.

Ongoing, the only part that sticks: add accessibility to your definition of done. Check it when a new page goes live, when a template is built, and before any third-party widget is added. Embedded chat widgets, booking tools and consent banners are where accessibility most often regresses on an otherwise good site, and adding an inaccessible one next spring puts you back where you started.

Sources

  • Equality Act 2010
  • Equality and Human Rights Commission — guidance for service providers on reasonable adjustments
  • Equality Commission for Northern Ireland
  • Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018
  • Government Digital Service — guidance on accessibility requirements for public sector websites and apps
  • World Wide Web Consortium, Web Accessibility Initiative — Web Content Accessibility Guidelines 2.2
  • Directive (EU) 2019/882 on the accessibility requirements for products and services
  • European Commission — recommendation concerning the definition of micro, small and medium-sized enterprises