European Accessibility Act

Spain’s EAA: Ley 11/2023, UNE 139803, and Fines

Last updated May 25, 2026

Spain transposed the European Accessibility Act through Ley 11/2023, de 8 de mayo, de trasposición de Directivas de la Unión Europea en materia de accesibilidad de determinados productos y servicios (BOE-A-2023-11022). Title I of the law (Articles 1–31) is the EAA transposition; its main obligations apply from 28 June 2025, in line with the Directive's entry-into-application date.

The scope tracks the EAA's enumerated listin Article 2 of the Directive — it is not “every business selling to EU consumers.” Covered services include e-commerce, consumer banking, electronic communications, transport ticketing and check-in, e-books and reading software, and access to audiovisual media services. Covered products include consumer terminal equipment, self-service terminals (ATMs, ticketing machines), and e-readers. Because e-commerce services themselves are explicitly in scope via Article 2(2)(f), a Spanish or non-Spanish shop selling otherwise non-EAA goods can still fall inside the regime through its ecommerce service.

On fines, Ley 11/2023 does not set its own euro ceilings. Article 27 of the law defers to the sanctioning regime of sector legislation and, supplementarily, to Real Decreto Legislativo 1/2013 (TRLGDPD) — the consolidated general law on the rights of persons with disabilities. Under TRLGDPD Title III, the headline fine band is €301 to €1,000,000 across three categories: leves up to €30,000, graves up to €90,000, and muy graves from €90,001 to €1,000,000 (see the Ministerio de Derechos Sociales infractions page). Accessory measures defined by TRLGDPD can accompany a sanction, for example loss of public subsidies and disqualification from competing for them.

The supervisory architecture is split. Day-to-day vigilance over covered products and services is shared between the Spanish State and the comunidades autónomas. At national level the sanctioning procedure is initiated by the relevant directorate of the Ministerio de Derechos Sociales, Consumo y Agenda 2030 (formerly Derechos Sociales y Agenda 2030). Real Decreto 143/2026 created the Unidad técnica de apoyo y coordinación (UTAC) of the vigilance authorities, assigned to the Dirección General de Derechos de las Personas con Discapacidad.

The technical baseline is the European harmonised standard EN 301 549, which incorporates WCAG 2.1 Level AA for web content. Spain's older national standard UNE 139803:2012— the AENOR standard historically referenced in the public-sector regime and aligned with WCAG 2.0 — is now effectively legacy: conformance is demonstrated against EN 301 549 (which AENOR has adopted into the Spanish catalogue), with UNE 139803 retained as the national-language reference document.

Two parallel regimes — Ley 11/2023 vs RD 1112/2018

As in Italy and France, Spanish accessibility law runs on two parallel tracks, and many vendor summaries collapse them. The distinction matters for which obligations bind you and which authority you would hear from first.

• Ley 11/2023— the EAA transposition. Covers private-sectorproducts and services on the Article 2 enumerated list (e-commerce, banking, transport ticketing, e-books, and the rest). In force from 28 June 2025. Sanctions flow through Article 27 to TRLGDPD's €301–€1,000,000 band.
• Real Decreto 1112/2018 + UNE 139803 — the older public-sector regime transposing the Web Accessibility Directive (2016/2102). Covers public-sector websites, public-service-delegate sites, and mobile apps. The technical reference here is UNE-EN 301 549 via UNE 139803:2012 alignment with WCAG. Different scope, different supervisory route, different audit cadence.

A non-Spanish ecommerce seller is almost certainly inside Ley 11/2023 and almost certainly outside RD 1112/2018. A bank that also processes public-sector payment flows can be inside both.

What Ley 11/2023 actually covers

The substantive scope of Ley 11/2023 Title I tracks the EAA. Two framings to keep in mind:

• It is an enumerated list. Covered services include e-commerce, consumer banking services, electronic communications services, services giving access to audiovisual media services, elements of passenger transport (websites, mobile apps, electronic ticketing, real-time travel information), e-books and dedicated reading software, and certain telephone services. Covered products include computer hardware and operating systems for general consumer use, self-service terminals (ATMs, ticketing, check-in), consumer terminal equipment for electronic communications and audiovisual media, and e-readers.
• E-commerce services pull other businesses in. Article 2(2)(f) of the Directive lists e-commerce services themselves, so a store selling otherwise non-EAA goods (for example, clothing or furniture) can still be in scope via its checkout, product pages, account flow, and customer-service interface.
• Microenterprise carve-out for services. The EAA exempts microenterprises (fewer than 10 employees and annual turnover or balance sheet up to €2 million) from the service obligations— not from the product obligations. Ley 11/2023 inherits this carve-out, and it is interpreted narrowly: if you sit on either side of the threshold, take counsel before relying on it.

Fine bands and supervisory architecture

Article 27 of Ley 11/2023 sends sanctions to whichever sectoral regime applies (telecoms, financial, audiovisual, etc.). Where no sectoral regime governs, the law applies the general disability framework: Title III of Real Decreto Legislativo 1/2013 (TRLGDPD). The bands published by the Ministerio de Derechos Sociales, Consumo y Agenda 2030:

• Leves (minor) — up to €30,000.
• Graves (serious)— up to €90,000.
• Muy graves (very serious) — €90,001 to €1,000,000.

Prescription periods follow TRLGDPD: 1 year for leves, 3 years for graves, 4 years for muy graves. Accessory measures alongside a sanction can include the loss of public subsidies, prohibition from competing for them, and — for entities providing social services — disqualification of the institution. We deliberately do not quote a fixed multi-year “operational ban” here because the EAA-specific Title I of Ley 11/2023 does not itself impose one as a generic remedy; sector-specific suspensions can apply (for example under telecoms or financial-services regulation) but those depend on the sectoral authority and the conduct, not on Ley 11/2023's headline regime.

Vigilance is distributed. At autonomiclevel, each comunidad autónoma supervises within its territory. At national level, the sanctioning procedure for EAA-scope cases is initiated by the relevant directorate of the Ministerio de Derechos Sociales, Consumo y Agenda 2030. The new Unidad técnica de apoyo y coordinación (UTAC) created by Real Decreto 143/2026 coordinates the vigilance authorities and sits under the Dirección General de Derechos de las Personas con Discapacidad.

UNE 139803, EN 301 549, and how they relate to WCAG 2.1 AA

Three documents sit in a stack, and conflating them is the most common Spain-specific mistake:

• WCAG 2.1 Level AA— the W3C success-criteria set every other document references for the web portion of accessibility.
• EN 301 549— the harmonised European standard (CEN/CENELEC/ETSI) that operationalises EAA conformity for ICT products and services. EN 301 549 incorporates WCAG 2.1 AA by reference for web content. AENOR has adopted EN 301 549 into the Spanish catalogue as UNE-EN 301 549.
• UNE 139803:2012— the older Spanish national standard, aligned with WCAG 2.0 in its 2012 revision. UNE 139803 is the standard historically named in Spanish public-sector accessibility texts and in early implementations of RD 1112/2018. It remains an authoritative Spanish-language reference, but for EAA conformance under Ley 11/2023, the operative document is UNE-EN 301 549.

Practical implication: a clean WCAG 2.1 AA audit gets you most of the way to EAA conformance in Spain, but it is not the deliverable a Spanish auditor will reach for. Expect EN 301 549 / UNE-EN 301 549 to be the named reference in any inquiry.

Accessibility statement obligations

Article 13 and Annex V of the EAA require service providers to publish accessibility information — in their terms and conditions or an equivalent document. Ley 11/2023 inherits that. Annex V itself lists only three minimum elements: a general description of the service in accessible formats, descriptions and explanations to understand the service's operation, and a description of how Annex I accessibility requirements are met. Conformance level, remediation timetable, audit date, feedback mechanism, and an escalation contact are best practice and national-transposition additions, not Annex V minima.

For Spain specifically, publishing a stable Spanish-language accessibility statement (Castilian at minimum; regional-language translations where you actively market in Catalan, Basque, or Galician) with a working feedback channel that responds in Spanish is the defensible pattern. Generator templates and the field list live in our accessibility statement generator.

How non-Spanish sellers are affected

The EAA is extraterritorial by design. Any economic operator that places covered products or services on the EU market is in scope regardless of where the company is headquartered, and Ley 11/2023 inherits that reach when those services touch Spanish consumers. A US Shopify store shipping to Spanish customers, a UK SaaS that bills Spanish businesses through a self-serve checkout, or an Irish-incorporated marketplace whose front-end serves Spanish shoppers are all inside the regime. The threshold question is not where you are headquartered but whether you offer an EAA-covered service (e-commerce, banking, transport ticketing, e-books, etc.) to consumers located in Spain.

Two operational consequences: your accessibility statement should name Spain as a covered market if you take Spanish orders and should point to a supervisory authority a Spanish consumer can escalate to; and your remediation roadmap should be tracked against EN 301 549 / WCAG 2.1 AA, which is what a Spanish auditor or complainant's expert will reach for. Sibling country guides if you sell across the EU: Germany (BFSG), France (Loi 2023-171 / RGAA 4.1), and Italy (D.Lgs. 82/2022 + Stanca).

How SweepHound supports Spain-EAA readiness

Honest scope first: SweepHound does not make your site “Ley-11/2023 compliant” on its own. Readiness is a documented audit plus a remediation programme plus a published accessibility statement, and the last word always belongs to a human auditor and Spanish counsel. What SweepHound does is the part automation can honestly do:

• Dual-engine WCAG 2.1 AA scanning — axe-core plus IBM Equal Access, mapped to the criteria EN 301 549 / UNE-EN 301 549 incorporate for web content. The same evidence a Spanish auditor would reach for first.
• Auto-generated accessibility statement scaffolding — SweepHound currently generates English statement drafts only. You can publish the English statement and add a Castilian translation alongside it on the same URL.
• Code-level remediation guidance — every detected violation comes with the specific HTML, CSS, or ARIA change to make. No overlays, no badge-washing.
• Monitoring for regressions — scheduled rescans with diffs so a redesign or a marketing-template change does not silently break a service the Spanish vigilance authorities would consider in scope.

For most non-Spanish sellers, the path forward is to work through the EAA compliance checklist, scan, fix the high-severity issues, publish your accessibility statement, and set up monitoring before a Spanish vigilance authority gets to you first. See pricing or start a free scan to begin.