De regionale kaart van toegankelijkheidsregelgeving: VS, EU, VK, Australië, Nieuw-Zeeland en de GCC-landen

The short version: there is no single global accessibility law. The US leans on litigation, with WCAG 2.1 AA as settlement precedent, not a fixed rule for private sites. The EU, UK, and Australia impose real statutory duty. New Zealand and Saudi Arabia mandate government sites mainly. The UAE sits in between. This is not legal advice.

I get asked some version of "are we compliant" by clients running sites across several regions at once, and the honest answer is always "it depends where your users are." Let me walk you through what each region actually requires.

Why isn't there one global accessibility law?

Because disability rights law is written by nations and blocs, not by a single global body. The UN Convention on the Rights of Persons with Disabilities sets a rights framework most countries have signed, but it is not a testable technical standard. WCAG, maintained by the W3C, is the closest thing to a shared language, and regulators have adopted different versions of it (2.0, 2.1, 2.2) for different reasons: anti-discrimination law here, procurement policy there, a genuine mandatory regime in a few places. That is why the map below looks like a patchwork. It is one.

Does the US actually require WCAG for private company websites?

Not by a fixed rule, and that surprises people. Under Title III of the ADA, the Department of Justice has never issued a regulation naming a technical standard for public accommodations. What exists instead is precedent: WCAG 2.1 AA shows up again and again in DOJ settlements and consent decrees, even though the DOJ itself has stated it does not formally endorse WCAG as the required standard (American Bar Association, to re-verify). That is why litigation, not regulation, drives US practice, and it is not slowing: 3,117 website lawsuits were filed in federal court in 2025, a 27 percent jump over 2024, now 36 percent of all federal ADA Title III filings, up from 28 percent the year before. Nearly half targeted a repeat defendant, and e-commerce drew close to 70 percent of the total (Seyfarth Shaw, ADA Title III; UsableNet, both to re-verify).

Two other US rules are more precise. Section 508 has bound federal agencies to WCAG 2.0 AA since March 2017, though many now test against 2.1 or 2.2 (Section508.gov). A 2024 DOJ rule gave state and local governments an explicit standard, WCAG 2.1 AA, under Title II, with deadlines recently extended to April 26, 2027 for larger entities and April 26, 2028 for smaller ones and special districts (ADA.gov, Federal Register). Government has a rule. Private business has precedent. Not the same thing.

What does the European Accessibility Act actually require, and from when?

The European Accessibility Act became enforceable on June 28, 2025. It covers a wide, consumer-facing slice of the economy: banking, e-commerce, transport, telecommunications, digital media, and the physical devices people use to reach them, including ATMs and payment terminals. Products and services already on the market before that date can keep operating without retrofitting until June 28, 2030 (Bird & Bird). Its technical backbone, EN 301 549, currently folds in the full text of WCAG 2.1 AA, with the next version expected to move that baseline up to WCAG 2.2 AA (Deque).

Here is the part clients miss: the EAA is a directive, not a regulation, so each member state writes its own implementing law, timeline, and penalties. Germany's Barrierefreiheitsstärkungsgesetz has been in force since June 28, 2025, requires WCAG 2.2 AA, exempts only very small firms (under ten employees or two million euros in revenue), and lets regulators fine up to 100,000 euros per violation (Bundesregierung, Level Access). France's RGAA sets 106 testable criteria and only binds private companies once their French-territory revenue crosses 250 million euros, with fines up to 50,000 euros for non-compliance and 25,000 euros more for a missing accessibility statement, both able to recur and double on repeat (Pivotal Accessibility). Ireland goes further still, treating EAA breaches as a criminal matter, up to 18 months in prison alongside a 60,000 euro fine (Level Access, to re-verify). One directive, genuinely different consequences by country.

Is the UK still under EU accessibility rules after Brexit?

No, and this trips people up constantly. The UK runs its own two-track system. Private business sits under the Equality Act 2010, which covers websites through "reasonable adjustments": no named technical standard in the Act, but WCAG 2.2 AA is the recognized benchmark, and the Equality and Human Rights Commission can investigate non-compliant organizations (Boia). Public sector bodies sit under a stricter, second law, the Public Sector Bodies Accessibility Regulations 2018, which names WCAG 2.2 AA directly, requires a published accessibility statement, and, since a December 2022 addendum, auto-updates to whatever the current WCAG version is (GOV.UK). The UK kept the same public and private split you see elsewhere. It just built it entirely under its own law.

Does Australia's accessibility law reach private business, not just government?

Yes, one of the broadest private-sector reaches on this map. The Disability Discrimination Act 1992 predates the commercial web, but courts and the Australian Human Rights Commission have applied it to websites since Maguire v SOCOG in 2000, when a blind complainant successfully argued the Sydney Olympics website discriminated against him, and was awarded 20,000 Australian dollars (Boia). The AHRC's 2014 guidance recommends WCAG 2.0 AA as the baseline, though serious practice has moved to 2.1 or 2.2. There is no proactive regulator auditing sites here as EU authorities do; enforcement runs through complaints to the AHRC and, where that fails, the courts, but the DDA applies to private companies exactly as it does to government.

Is New Zealand's accessibility law as strict as Australia's?

No, and the two get conflated constantly for sitting next to each other on a map. New Zealand's Government Web Accessibility Standard 1.2 took effect March 17, 2025, and mandates WCAG 2.2 AA, but only for public service departments and a named list: the NZ Police, Defence Force, Parliamentary Counsel Office, and Security Intelligence Service (digital.govt.nz). Other public bodies are encouraged to follow it, not required to. Private business faces no equivalent digital mandate at all: the Human Rights Act 1993 prohibits disability discrimination and could in principle extend to an unusable website, but there is no named WCAG requirement behind it the way there is in Australia. Do not assume the Australian bar clears you in New Zealand's private sector, or the reverse.

What do the UAE and Saudi Arabia actually require?

This is the part of the map I have to be most careful with. The region has less public legal analysis than the others, and one country here is a genuine grey area.

The UAE: a federal baseline, and a stricter standard in Dubai

The UAE's foundational law is Federal Law 29 of 2006 on the rights of people of determination, amended 2009, alongside a 2017 national digital accessibility policy. The Telecommunications and Digital Government Regulatory Authority runs a Web Accessibility Policy aligned to WCAG 2.1 AA, but its stated scope is federal government websites and e-services (TDRA). Dubai goes further: its Universal Design Code, issued in 2017, is mandatory for Dubai government entities and also binds private-sector developments seeking permits in the emirate, mandating WCAG 2.1 AA with penalties reported up to 200,000 UAE dirhams (Dubai Municipality, to re-verify). Honest read: government-wide WCAG 2.1 AA federally, and a genuinely enforceable private-sector obligation in Dubai specifically, tied to permitting rather than a single nationwide private-sector law.

Saudi Arabia: a real government mandate, and a genuine grey area

Saudi Arabia's Digital Government Authority runs a Digital Government Accessibility Policy, issued in 2023, requiring government digital platforms to meet WCAG 2.1 AA, with audits and mandatory reporting for public entities (DGA). Where I want to be straight with you: guidance describes its audience as "government entities and the private sector who develop or operate digital government related activities," which reads to me as vendors and contractors serving government, not a blanket law covering every private business's own website. Several compliance vendors describe a broader, compulsory private-sector obligation and an April 2026 deadline, but I could not trace that claim to a primary legal source, so I am flagging it as unverified rather than settled law (to re-verify, treat cautiously). If you operate in Saudi Arabia and are not a government contractor, get local counsel to confirm your actual exposure.

The regional compliance map, side by side

What holds true across every region on this map

The details differ everywhere. Three things do not.

WCAG 2.1 or 2.2 AA is the closest thing to a universal answer. Every region above references it, as hard law, working benchmark, or settlement precedent. Build to 2.1 AA today and 2.2 AA where you can, and you are never starting from zero anywhere on this list.

Government is always ahead of private business. The public sector has the clearer, more enforced rule everywhere. Private business either inherits that standard informally (the UK, the US), gets a separate and broader duty (the EU, Australia), or is not addressed yet (New Zealand, arguably Saudi Arabia).

Enforcement style, not just the law, decides your real risk. The US moves through litigation volume, the EU through market surveillance fines, Australia and the UK through complaints-based regulators, and the Gulf through government policy and, in Dubai, permitting. The same WCAG target carries very different consequences depending on which engine is behind it.

The sequence I run for a client operating across regions

1. Identify every region your users actually sit in, not just where you are incorporated.
2. Build to WCAG 2.2 AA as your working default. It clears or nearly clears every row on the table above.
3. Check each region's private-sector threshold specifically. France's revenue test and Germany's employee-count exemption do not transfer anywhere else.
4. Publish an accessibility statement wherever any region requires one. It is the first thing every regulator here asks for.
5. Flag genuine grey areas to your team and to counsel, rather than treat a vendor's marketing claim as settled law, and re-check this map yearly. EN 301 549, the UK's PSBAR, and Saudi Arabia's policy are all mid-revision as of this writing.

Two mistakes I see careful teams make

Treating "WCAG compliant" as one fixed, portable claim. WCAG 2.0, 2.1, and 2.2 AA are not the same target, and a page clearing one can fail another. Section 508 still names 2.0; the EU and UK name 2.2. Build to the newest version and you cover the older ones by default.

Assuming government-grade compliance settles the private-sector question. A page meeting the UK's PSBAR, New Zealand's Standard 1.2, or Saudi Arabia's DGA policy is meeting a public-sector rule. Whether it also satisfies a private-sector duty in the same country is separate, sometimes real (the UK's Equality Act), sometimes barely addressed (New Zealand, Saudi Arabia's wider private sector). One answer does not stand in for the other.

Your turn

Pull up your site's analytics and list the countries your real traffic comes from. Match each one against the table above. Where you are relying on assumption rather than a confirmed answer, particularly Saudi Arabia's private-sector exposure, that is your next task, not a someday item.