The EU changed the rules. We help you meet them — without the panic.

An EU law that applies from 28 June 2025. It requires many consumer-facing digital products and services sold in the EU — online shops, banking, e-books, ticketing and transport apps among them — to be accessible, which in practice means meeting the WCAG standard. Each member state enforces it through its own national authority.

NIS2 sets EU cybersecurity duties for organisations in sectors such as energy, transport, health, digital infrastructure and IT services. It also makes those organisations responsible for the security of their suppliers, so a small vendor that is not directly in scope is increasingly asked to prove its security readiness in order to keep the contract.

If you sell covered digital products or services to consumers in the EU, start from the assumption that it applies. The directive does exempt microenterprises — fewer than 10 staff and under 2 million euro turnover — that provide services, and it allows relief where a change would impose a disproportionate burden. The exemptions are narrower than most people expect and member states have implemented them differently, so check with your national authority and treat our scan as a starting point rather than a legal opinion.

Both laws leave enforcement to national authorities, so the penalties differ by country: the EAA requires member states to set sanctions that are effective and dissuasive, while NIS2 adds fines and accountability at management level. We are deliberately not going to quote a scary number at you. For most small businesses the first real consequence is commercial rather than legal — a customer complaint, a procurement questionnaire you cannot answer, or a deal that stalls because you have no evidence to show.

No, and we will not pretend otherwise. Automated testing reliably catches a meaningful subset of WCAG issues — colour contrast, missing image alternatives, unlabelled form fields, broken heading structure, keyboard traps — but the criteria that need human judgement cannot be checked by a machine: whether alt text is actually useful, whether focus order makes sense, whether a custom widget works with a screen reader. Our scan does the mechanical part in minutes and flags clearly what a person still needs to review.

You get the report and you are free to stop there — no card, no obligation. If you want more, the paid step is a prioritised fix-list plus a draft accessibility statement, with optional monitoring that re-scans on a schedule and alerts you when something regresses. Both products are in early access at the moment, so joining the list is how you get the first scan when your track opens.

It is designed to be finished in one sitting by someone who is not a security specialist: plain-language questions about access control, backups, patching and incident handling, with your answers saved so you can come back to them. Gathering the evidence usually takes longer than answering the questions, which is why the kit ships with policy templates you can adapt instead of writing them from scratch.