WCAG 2.1 AA explained: what the European Accessibility Act actually requires from your website
Every EAA compliance conversation eventually lands on the same three letters: WCAG. Vendors throw the term around and lawyers cite it, but few explanations say what it means, why level "AA" is the target, or what a site must do to meet it. This article breaks it down criterion by criterion, so you know exactly what your site is measured against.
What WCAG actually is
WCAG stands for Web Content Accessibility Guidelines. It's maintained by the W3C (World Wide Web Consortium) through its Web Accessibility Initiative (WAI) — the same body responsible for HTML and CSS specifications. WCAG isn't a law or a piece of software; it's a published set of testable success criteria defining what "accessible" means in practice, for people with visual, auditory, motor and cognitive disabilities alike.
WCAG defines three conformance levels:
- Level A — the minimum. Sites that fail Level A have severe, blocking barriers (for example, content that simply cannot be operated by keyboard at all).
- Level AA — the level almost every legal and regulatory framework in the world references, including the EAA. It covers the barriers that block or seriously hinder use for most people with disabilities: contrast, labelling, keyboard operability, predictable behaviour, error handling.
- Level AAA — the highest level. The W3C itself states AAA is not recommended as a general policy requirement for entire sites, because some AAA criteria (like a strict 7:1 contrast ratio, or providing sign-language interpretation for all video) aren't achievable for every type of content.
Why AA, specifically, is your legal target
The European Accessibility Act doesn't mention WCAG by name in its operative text — it points to a harmonised technical standard, EN 301 549, which is what national laws actually cite. EN 301 549 in turn maps its web requirements directly onto WCAG 2.1, Level AA. That's the chain: EAA → EN 301 549 → WCAG 2.1 AA. When an auditor or a market surveillance authority checks your site, AA is the bar — not A (too weak to satisfy the standard) and not AAA (not required, and often not realistic).
In numbers: WCAG 2.1 has 78 success criteria in total across all three levels. Level AA conformance means meeting all Level A and Level AA criteria combined — 50 success criteria in total. That's the actual checklist behind the phrase "WCAG 2.1 AA compliant."
The four principles: POUR
WCAG organises every one of those 50 AA criteria under four principles, known by the acronym POUR. Understanding these makes the standard far less abstract, because almost any accessibility bug you'll ever see falls cleanly into one of the four.
Perceivable — can people actually perceive the content?
Information and interface components must be presentable in ways people can perceive, regardless of sense. Two concrete AA criteria:
- 1.4.3 Contrast (Minimum) — text needs at least 4.5:1 contrast against its background; large-scale text (roughly 18pt, or 14pt bold) needs at least 3:1.
- 1.4.11 Non-text Contrast — UI components (button borders, form field outlines, icons that convey meaning) and graphical objects need at least 3:1 contrast against adjacent colours.
Operable — can people actually operate the interface?
Interface components and navigation must be operable by everyone, not just mouse users. Two concrete AA criteria:
- 2.1.1 Keyboard — all functionality must be operable through a keyboard interface, with no exceptions that require specific timing for individual keystrokes.
- 2.4.7 Focus Visible — any keyboard-operable interface must have a visible indicator of where keyboard focus currently is, so a sighted keyboard user always knows where they are on the page.
Understandable — can people understand the content and how it works?
Both the content and the operation of the interface must be understandable. Two concrete AA criteria:
- 3.3.1 Error Identification — if an input error is detected automatically, the item in error must be identified and the error described to the user in text.
- 3.3.3 Error Suggestion — if an input error is detected and a suggested correction is known, it must be provided to the user (unless doing so would jeopardise security).
Robust — does it keep working across technologies?
Content must be robust enough to be interpreted reliably by a wide range of user agents, including assistive technology. One concrete AA criterion:
- 4.1.2 Name, Role, Value — every UI component needs a programmatically determinable name and role, with states and values exposed to assistive technology — this is behind most "screen reader can't tell what this button does" defects, especially on custom widgets built from styled
<div>s instead of real form controls.
WCAG 2.1 AA vs WCAG 2.2 AA: do you need to upgrade?
WCAG 2.2 was published by the W3C in October 2023. It's not a replacement standard that invalidates 2.1 — it's an incremental addition. WCAG 2.2 adds 9 new success criteria on top of 2.1 and removes exactly one: 4.1.1 Parsing, dropped as obsolete now that browsers and assistive technology handle malformed HTML consistently enough that the criterion no longer adds value.
| New AA criterion in 2.2 | What it covers |
|---|---|
| 2.4.11 Focus Not Obscured (Minimum) | A focused element must not be entirely hidden by sticky headers, cookie banners or chat widgets. |
| 2.5.7 Dragging Movements | Any function that uses a dragging gesture must also be operable with a single pointer action, without dragging. |
| 2.5.8 Target Size (Minimum) | Clickable targets must be at least 24×24 CSS pixels, with limited exceptions. |
| 3.2.6 Consistent Help | If help mechanisms (contact link, chatbot, FAQ) exist across multiple pages, they must appear in the same relative order. |
| 3.3.7 Redundant Entry | Information already entered by the user in a process must be auto-populated or available for reuse, not re-typed. |
| 3.3.8 Accessible Authentication (Minimum) | Login can't rely solely on a cognitive function test (like memorising a password) without an alternative — password managers and copy-paste must be allowed. |
Because 2.2 only adds criteria and drops one that had become redundant, meeting WCAG 2.2 AA automatically satisfies WCAG 2.1 AA — it's a superset. For now, EN 301 549 and most current EU enforcement guidance still centre on WCAG 2.1 AA as the legal baseline for the EAA, so that's what we test against by default. Adopting the 2.2 criteria proactively is still worth it — several (target size, dragging alternatives, redundant entry) fix real problems for older users and people with motor impairments, and are likely to be folded into the reference standard over time.
The myth: "AA compliant" is not a pass/fail checkbox
One persistent misunderstanding is treating "WCAG 2.1 AA compliant" as a single binary state — like an SSL certificate that's either valid or not. It isn't. Conformance is assessed criterion by criterion, per page or template. A site can pass 1.4.3 Contrast on its homepage and fail it on checkout because a different developer built that flow with different brand colours. A component library might pass 4.1.2 on its buttons and fail on a custom date picker built later by another agency.
That's why automated scanning alone isn't the full picture, and why manual testing matters: judgment-based criteria like 2.4.7 (is that focus indicator actually visible in context?) or 3.3.1 (is that error message actually clear?) can't be fully verified by a script. We go deeper into what a scanner can and can't catch, and what a human tester adds, in our upcoming manual vs. automated testing article.
Understanding the standard is step one
Knowing what WCAG 2.1 AA requires is necessary — but it doesn't tell you where your site stands against those 50 criteria. That takes a scan of your actual code. Our free accessibility scan runs real axe-core rules — the same open-source engine used industry-wide, not an overlay or widget — against your homepage and reports concrete WCAG failures with the exact selectors involved. For a full page-by-page audit that also covers the judgment-based criteria a scanner can't test alone, see our audit pricing.
See how your site scores against these exact criteria
Run the free scan on your homepage and get concrete WCAG 2.1 AA failures, not a vague grade.
Scan my websiteWhere this fits in your broader compliance work
If you haven't yet mapped whether the EAA applies to your business at all, start with our European Accessibility Act guide for online shops. For a prioritised, page-by-page action list once you know AA is your target, see the 2026 accessibility checklist. If you're unsure whether your specific organisation falls under the Act's scope, our upcoming who must comply with the EAA article walks through the exemptions in detail. And if someone on your team is still tempted by an "instant fix" widget, read why that doesn't hold up in our practical guide before spending the budget.