WCAG 2.2 AA is not a certification and it is not a badge. It is a technical checklist, 56 testable requirements at the level most laws point to, and the closest thing a website has to a legal standard in the UK and EU. Most small businesses ignore it, which works fine until the day it does not. The EU started enforcing it on 28 June 2025. Here is what it actually involves, who it matters to, and what doing it properly costs.
What AA actually means
WCAG stands for Web Content Accessibility Guidelines, written by the W3C. Version 2.2 came out in October 2023 and contains 86 success criteria in three levels. Level A is the minimum. Level AA is the one contracts and laws care about. Level AAA is nice to have and almost never required.
“AA” is not a vibe. To claim WCAG 2.2 AA, every one of the 32 A-level criteria and every one of the 24 AA-level criteria has to pass. That is 56 checks, each of them testable, each of them a yes or no. They sit under four principles: perceivable, operable, understandable, robust. You cannot make up for a failed criterion somewhere else, and you cannot half-pass one.
The 2023 update added nine criteria. Four of them are at AA, and they are all common sense once you read them:
| New WCAG 2.2 AA rule | What it means in plain English |
|---|---|
| Focus Not Obscured | When you tab through the page, the focused element is never hidden behind a cookie banner, chat widget or sticky header |
| Dragging Movements | Anything you drag, like a slider or a map, also works with a tap or a button |
| Target Size (Minimum) | Every clickable target is at least 24x24 CSS pixels, or has enough space around it that you cannot miss |
| Accessible Authentication | Logging in does not force you to recall and type a password unaided; password managers and paste have to work |
None of these are exotic. They are the sort of thing that breaks for everyone eventually, which is the honest case for doing this at all.
Who is actually on the hook
In the UK, the Equality Act 2010 applies to every provider of goods and services, private sector included. A website counts as a service, and the duty is to make “reasonable adjustments”, anticipated in advance rather than fixed after a complaint. The Act never mentions WCAG by name, but WCAG 2.2 AA is the benchmark used in practice, and the safest reading. Public bodies have their own regulation on top: they must meet AA and publish an accessibility statement, and the regulator publicly names those that do not.
Private UK businesses have not lost a court case over a website yet. That is mostly because claims settle. The RNIB has brought discrimination claims over inaccessible sites and settled them out of court, and the numbers behind the problem are large: 14.1 million disabled people in the UK, and the Click-Away Pound survey put losses to inaccessible sites at over £17 billion in 2019.
The EU is further along. The European Accessibility Act has been enforceable across all 27 member states since 28 June 2025. It covers e-commerce, banking, transport booking, telecoms and streaming, and it reaches any business selling to EU consumers, wherever that business is based. A UK shop shipping to France or Germany is in scope. New services had to comply from day one; services that already existed have until June 2030. The micro-business carve-out is narrower than people assume: under 10 employees and under €2 million turnover, or you are covered.
The fines are real. Germany can fine up to €100,000 per violation. France ranges from €5,000 to €250,000, plus €25,000 a year for a missing accessibility statement. French disability organisations sent formal legal notices to four major grocery retailers within days of the deadline, and injunctions followed in November 2025. Enforcement is starting with the big names, but the machinery now exists for everyone else.
The £30-a-month fix that is not a fix
One fact is worth more than the whole accessibility-widget industry:
Automated tools catch roughly 30-40% of WCAG barriers. The rest only show up when a human tests the site with a keyboard and a screen reader.
That is why the widget industry exists, and why it is a trap. The pitch is one line of JavaScript, a floating button, a monthly fee, instant compliance. In April 2025 the US Federal Trade Commission fined accessiBe, the biggest seller of these widgets, $1 million for claiming its product could make any website WCAG compliant. The claims were, in the FTC’s words, false, misleading or unsubstantiated.
The widget problem is structural, not just legal. A screen reader reads the HTML your server sends. A widget injects fixes after the page has loaded, which is too late, and it often makes things worse. Over 70% of screen reader users say overlays make sites harder to use, per the WebAIM survey. Meanwhile 22.6% of US accessibility lawsuits in the first half of 2025 targeted sites that had an overlay installed. The widget is not a shield. It can read as evidence you knew there was a problem and chose the cheap version.
What doing it properly costs
This is where the honest numbers help:
- Retrofitting an existing site. A proper audit of a small UK site runs roughly £500 to £5,500 depending on who does it and how deep they go. Manual audits of a 10-30 page site typically land between $2,000 and $7,000 on the US market. For a 5-10 page marketing site, plan on 2-3 weeks to audit and 3-6 weeks to fix what it finds. Then it slowly breaks again as you add pages, so it needs repeating.
- Building it in from the start. Close to free. Alt text, real form labels, keyboard navigation, contrast and focus states are design decisions, not extra work. This is why every site we build ships with WCAG 2.2 AA in scope at the fixed price rather than as an add-on: retrofitting is where the cost actually lives.
What to do today
If you are not ready to pay for an audit, start with one page and a free scan. WAVE and the axe browser extension both run in a couple of minutes and will find the 30-40% of issues a machine can see. Fix what they flag, then check the five things automation misses:
- Every image has a text alternative that says what it shows.
- Every form field has a label you can click.
- The whole page works with the keyboard alone, and you can always see where you are.
- Text contrast is at least 4.5 to 1.
- There is a published accessibility statement saying what you have done and how to report a problem.
That is not compliance. It is the difference between ignoring the problem and being able to show a regulator or a customer that you are working through it, which is what the enforcement bodies actually look at first.