Being small exempts your website. It does not exempt your shelf.

Directive (EU) 2019/882, the European Accessibility Act, came into Irish law through S.I. No. 636/2023, the European Union (Accessibility Requirements of Products and Services) Regulations 2023. Regulation 1(2) brought the Regulations into operation on 28 June 2025.

That makes it unlike the two regulations Irish businesses have spent the past year reading about. The AI Act's high-risk rules now sit in December 2027. The Cyber Resilience Act's reporting duty starts in September 2026. This one started fourteen months ago, and the obligations in it were due on the first day.

The awareness figures going in were poor. A Mason Hayes & Curran survey reported in October 2024 found six in ten Irish businesses unprepared, and 62% had never run an accessibility audit. Digital Business Ireland published research ten days before the deadline finding 49% of Irish businesses still unaware of the requirements, only 35% having started any preparation, and more than 90% with no budget allocated to it.

Underneath that sits a second and quieter problem, which is what this article is about. A good number of the businesses that did hear about the Act read one line about a small business exemption and stopped there. That line is correct about the website and wrong about the stockroom, and telling the two apart takes an afternoon.

Regulation 5(4) is one sentence, and it does most of the work: paragraph (3) and Regulation 14 shall not apply to a service provided by a microenterprise.

Both halves of that matter. Paragraph (3) is the substantive duty, requiring services to meet the accessibility requirements in Parts 3 and 4 of Schedule 1. Regulation 14 is the whole of the service provider obligations, including the information duty in Regulation 14(2)(a) that most people have never heard of. A microenterprise providing a service is outside both the standard and the paperwork.

The CCPC, which is the market surveillance authority here, puts it as plainly as it can be put in its own microenterprise guidance: the requirements and obligations of the European Accessibility Act do not apply to microenterprises providing services.

That is the exemption in full, and it is genuinely generous. A three-person consultancy with a booking page owes nothing under these Regulations for that page. Worth knowing you have it, rather than paying for compliance you do not owe.

Where it stops is the part that catches people. Regulation 5(4) exempts a service. The product-side duties live in Regulations 8, 10 and 11, and those Regulations contain no turnover threshold and no headcount threshold of any kind. The CCPC says the same thing from the other direction: all businesses, including microenterprises dealing with products, must apply the accessibility requirements of the Act.

Regulation 2 defines a microenterprise as an enterprise which employs fewer than 10 persons and which has an annual turnover not exceeding two million euro or an annual balance sheet total not exceeding two million euro.

Read that carefully, because the conjunctions are doing different jobs. The headcount limb and the money limb both have to be satisfied. Inside the money limb, either measure will do on its own.

Two worked examples make the shape of it obvious. Eleven people on a turnover of €300,000 falls outside the exemption, because the headcount limb fails and nothing else can rescue it. Nine people with €4m of turnover and a balance sheet total of €1.5m falls inside it, because the second limb is satisfied by the balance sheet alone.

Headcount is across the business rather than per site, and it is the limb most likely to move without anybody thinking about the Act. A business that hires its tenth person loses the service exemption that week.

Regulation 3(1) sets out the products the Regulations apply to, and the list is exhaustive. The CCPC publishes the same six groupings with examples, which is the version worth working from.

If what you sell sits outside these six, it sits outside the product side of the Act however electronic it is. A kettle, a cordless drill and a set of kitchen scales are outside it whatever is inside them.

The two categories that catch ordinary Irish retailers are the fourth and the fifth. A shop selling home routers is dealing in consumer terminal equipment used for electronic communications services. A shop selling smart televisions or streaming boxes is dealing in equipment used to reach audiovisual media services. Both are squarely on the list, and neither feels like a regulated product to the person selling it.

Regulation 11 opens by requiring a distributor to act with due care in relation to the requirements of the Regulations when making a product available on the market. What follows is a checking duty rather than an engineering one, which is the good news, and it applies before the product goes out rather than after somebody complains.

Reselling is treated as an act with consequences. It is worth listing what the Regulation actually asks for, because it is finite and most of it can be done once per supplier rather than once per unit.

Once the service exemption falls away, Regulation 5(3) requires services to meet Parts 3 and 4 of Schedule 1, and Regulation 14 applies in full. Two separate duties come out of that, and the second is the one almost nobody has done.

The first is the site itself. Part 3 reaches the whole path a customer takes, which explicitly includes identification, authentication, payment and any security mechanism sitting in the middle of it. A checkout that works with a mouse and fails with a keyboard is the single most common failure, and it is found by trying rather than by auditing.

The benchmark is EN 301 549, which carries WCAG 2.1 level AA in full and is already the harmonised standard under the public sector web accessibility directive. Regulation 16 grants a presumption of conformity to anything meeting a harmonised standard whose reference has been published in the Official Journal, and for the Accessibility Act itself that citation is still working through the standardisation process. So the legal requirement today is Schedule 1, and EN 301 549 at WCAG 2.1 AA is how the market demonstrates it. Building to that standard is the defensible position and everybody advising on this says the same.

The second duty is Regulation 14(2)(a) with Schedule 3, and it is a written one. Before the service is provided, you prepare information explaining how the service meets the applicable accessibility requirements. Schedule 3 says it goes in the general terms and conditions or an equivalent document, and that it must include a general description of the service in accessible formats, the explanations needed to understand how the service operates, and a description of how the Schedule 1 requirements are met. Regulation 14(2)(b) requires it to be publicly available in writing and in oral format, in a manner accessible to people with disabilities. Regulation 14(2)(c) requires it kept for as long as the service is in operation.

Regulation 3(4) carves five things out of the website and mobile application duties, and they matter because they are the difference between a bounded remediation job and an unbounded one.

Pre-recorded time-based media published before 28 June 2025 is outside it, as are office file formats published before that date. Online maps and mapping services are outside it, provided that essential information on maps intended for navigational use is given in an accessible digital manner. Third-party content that you neither fund, develop nor control is outside it. And archive content is outside it, meaning pages whose content has stood unchanged since 27 June 2025.

Two further boundaries are worth stating plainly. Regulation 5(3)(a) leaves urban, suburban and regional transport services outside Part 3, and Regulation 3(2)(d) reaches only their interactive self-service terminals.

And the service list in Regulation 3(2) applies to services provided to consumers. Regulation 2 defines e-commerce services as services provided at a distance by electronic means at the individual request of a consumer, with a view to concluding a consumer contract. A platform that trades only with other businesses, with no consumer route through it, sits outside that definition. Very few Irish trading sites are genuinely closed to consumers, so that is a point to verify rather than assume.

Regulation 38 provides three transitionals, and they are regularly repackaged as a general grace period running to 2030. Each of them is narrower than that.

Service contracts agreed before 28 June 2025 may continue without alteration until they expire, capped at five years from that date, which is 28 June 2030. A service provider may also keep using products it was already lawfully using to provide similar services, to the same date. Self-service terminals lawfully used before 28 June 2025 may stay in similar service to the end of their economically useful life, capped at twenty years after entry into use.

Every one of those is about a continuing contract or about kit already installed. A website is neither. Anybody offering a 2030 deadline for a checkout rebuild is reading Regulation 38(1)(b) as something it has never said.

Regulation 15 provides the only substantive relief available to a business that is in scope. The accessibility requirements apply only to the extent that compliance would avoid two outcomes: a fundamental alteration of the basic nature of the product or service, and a disproportionate burden on the operator.

The second is the one people reach for, and it is expensive to rely on properly. Regulation 15(3) sends the assessment to Schedule 4, which is a costing exercise: the ratio of net compliance costs to the overall costs of manufacturing, distributing or providing, the ratio of those costs to net turnover, and named heads for one-off organisational costs and ongoing development costs. Regulation 15(4) then requires the assessment documented, the written record kept for five years after the product was last made available or the service last provided, and a copy handed over on request.

Regulation 15(7) makes it a live document for services. It is renewed whenever the service is altered, whenever the compliance authority asks, and in any event at least every five years.

Regulation 15(8) is the one that decides whether the argument is available at all. An operator loses the disproportionate burden ground entirely where it has received funding from sources other than its own resources, public or private, provided for the purpose of improving accessibility. Taking a grant for an accessibility project and then pleading cost is closed off in terms.

There is a genuine microenterprise relief here, and it is worth stating precisely because it is smaller than it sounds. Regulation 15(5) lifts the documentation duty from a microenterprise that deals with products, and Regulation 15(10) lifts the duty to notify the authority that the ground is being relied on. Both are filing reliefs sitting on top of the escape route. They change what you keep on paper and they leave the underlying product duties exactly where they were, and Regulation 15(6) still lets the CCPC ask you for the facts behind the assessment.

Regulation 32 creates the offences. They include a failure to comply with Regulation 5(1), which is the core duty to place compliant products and provide compliant services, a failure to document or notify under Regulation 15, a failure on the EU declaration of conformity under Regulation 17, misuse of the CE marking, a failure to comply with a direction from an authority, and furnishing information a person knows or ought reasonably to know is false or misleading in a material respect.

Regulation 32(6) sets the penalties. On summary conviction, a class A fine, which is up to €5,000, or imprisonment for up to six months, or both. On conviction on indictment, a fine of up to €60,000 or imprisonment for up to eighteen months, or both. Regulation 32(7) directs the court to have regard to the seriousness of the failure, the number of units of products or services involved, and the number of people affected.

Imprisonment on the face of a consumer protection instrument is unusual enough to read twice. Arthur Cox and Mason Hayes & Curran both flag it, and the €100,000 figure that circulates in some write-ups of this instrument has no basis in Regulation 32.

Regulation 33 extends it to individuals. Where an offence by a body corporate is proved to have been committed with the consent, connivance or approval of a director, manager, secretary or other officer, or to be attributable to that person's wilful neglect, that person also commits the offence and is punished as if personally guilty of it.

Set against that, the CCPC has said publicly that it will take a proportionate approach to regulating the Act, and that it aims to support enterprises, particularly microenterprises and SMEs, in understanding and complying with their obligations. Enforcement is live, and the stated posture is help before prosecution.

The work that settles this is scoping rather than remediation, and it is short. A business that spends six months on the question before knowing which side of Regulation 5(4) it falls on has spent the money in the wrong order.