Everyone is getting ready for WCAG 2.2. Two thirds of Europe's biggest sites still fail 2.1 Level A.

The next version of the European accessibility standard is scheduled for citation on 30 November 2026. EN 301 549 V4.1.1 swaps WCAG 2.1 for WCAG 2.2, and six new success criteria arrive at levels A and AA. There is a small industry of readiness checklists for it already.

So I measured what the current version looks like first. The answer is that the deadline people are preparing for is not the one they have missed.

I scanned the most-visited websites on EU country domains and counted which clauses of EN 301 549 they fail today, under the version cited right now. Not the one arriving. The one in force since before the European Accessibility Act deadline passed in June 2025.

Sixty-four per cent fail clause 9.4.1.2, Name, Role, Value. It is Level A, the lowest bar the standard has, and it has been in every version of WCAG since 2008.

Here is the full picture, and then the reasons to distrust parts of it.

What was measured

Target size is the odd one out: it is a WCAG 2.2 criterion and not currently required. It is in the table because it is the only one of the six arriving in V4.1.1 that the rule engine used here has a check for, which is a point I will come back to.

Thirty-two sites of the 149, about one in five, failed nothing that automated testing can detect. That is not the same as passing.

Two of those rows are not independent. The rule that most often breaks Name, Role, Value is a link with no accessible name, and the same defect also fails Link Purpose. One missing label lands in two rows of that table. I am pointing this out because a table of six numbers implies six problems, and some of them are the same problem counted twice under different clauses — which is, incidentally, why conformance is claimed against clauses rather than rule counts.

What the failures actually are

Clause names are abstract. On a second pass I recorded which underlying rule produced each failure, so the table above turns into something you can picture. That pass covered the top 120 domains and measured 59 of them.

It is a worse-performing group than the full sample, and predictably so: it is the more-visited end of the list, which the section above already found does worse. Name, Role, Value fails on 73% of it against 64% overall. Read the shares below as proportions within that group, not as headline rates.

What breaks Name, Role, Value, on the 43 sites of 59 that failed it:

The first one is usually an icon: a magnifier, a basket, a social media glyph, marked up as a link with an image inside and no text anywhere. The second is usually an advert. Neither is an architectural problem. Both are a missing attribute.

The rest are simpler still. In that same group, every single contrast failure came from one rule, every target-size failure from one rule, and every non-text-content failure was an image with no alternative text. Not a long tail of exotic problems. One thing, repeated.

None of this is hard. That is the uncomfortable part: it is not hard, and two thirds of the most-visited sites in Europe have it anyway.

The finding I did not expect

I assumed the biggest sites would do best. They have the most money and the most staff.

Splitting the measured sites at the median rank:

The more popular half is roughly three times less likely to come back clean. I cannot prove the mechanism from this data, but the plausible one is unglamorous: big sites carry more third-party widgets, more legacy, more teams shipping into the same page, and more of everything that goes wrong. Budget does not appear to be the constraint.

The one WCAG 2.2 criterion a scanner can reach

Thirty-four per cent fail target size, and that number needs a caveat before anyone repeats it.

A third of the sites showed a cookie consent dialog to an anonymous visitor, and on one in five the dialog covered more than 40% of the screen. I did not dismiss them. Clicking "accept all" on somebody else's site, unattended and at scale, is not something a research script should be doing, and it would also have changed what I was measuring.

So the target-size number partly describes consent dialogs. Splitting it:

• Sites showing a consent dialog: 40% fail target size
• Sites without one: 31%

The gap is real and the finding survives it. Consent dialogs are worse than the pages behind them, and the pages behind them are not fine.

The other five criteria arriving in November — focus not obscured, dragging movements, consistent help, redundant entry, accessible authentication — were not measured here at all. Each is a judgement about behaviour that the page source does not contain: whether a sticky header covers the control that just took focus, whether every drag has a single-pointer alternative, whether a login demands something a person cannot be expected to do. axe-core has no rule for any of them, and I am not aware of a scanner that does.

That is the single most useful thing to know about this transition. Five of the six need a person. Any tool advertising a WCAG 2.2 readiness check is checking one criterion in six and staying quiet about the other five.

Two loads, two answers

Every page was loaded twice, seconds apart, and only criteria that failed both times were counted.

That rule exists because the pilot caught a large retailer passing target size on one load and failing it on the next, with nothing changed in between. In the full run, nine sites of 149 disagreed with themselves that way. Six per cent.

Six per cent turned out to be the flattering number.

I ran a second, smaller pass over the top of the same list a few hours later. On the first 120 domains, the disagreement rate was 10% in the first run and 19% in the second. And 57 sites were measured in both passes, hours apart: eight of them, one in seven, produced a different set of failing clauses the second time.

Nobody deployed anything in the seconds between two loads. Rotating promotional content, A/B tests and consent variants move the geometry of a page across a threshold on their own. Over hours, an editorial site simply becomes a different page.

I would rather quote the six per cent. It is the number I found first and it makes the sample look tidiest. The other three come from the same data and they all say the effect is larger.

If you commissioned a dated accessibility audit, you bought a description of one moment. You can test that for nothing, and without believing me, because I sell a scanner and have an obvious stake in the answer: run any free checker over your own homepage twice in a row, then again this afternoon.

Half the sample never got measured

Of 300 domains sampled, 151 were excluded. This is where a study either tells you what it threw away or quietly rounds its own numbers up.

Three of these are worth a comment.

The stylesheet exclusions are self-protection. A page that renders unstyled fails layout rules that the real page passes, and target size is exactly such a rule. I know this because it happened to me in August: a scan caught our own site mid-deploy and reported sixteen violations that vanished on the next run. Reporting invented failures is the same category of error as inventing a passing grade, so any page whose CSS did not arrive is thrown out rather than counted.

Eleven per cent of the sample blocked us outright. Bot protection does not distinguish between a scraper and an accessibility audit. If you are wondering why third-party research on this subject is thin, that is part of the answer.

Four sites were excluded because our scanner obeyed their Content Security Policy — and that turned out to be our bug, not their barrier. This paragraph originally said that a strict CSP prevents anybody from auditing your accessibility from outside. That was wrong, and it is corrected here on 22 August. A strict policy refuses to execute a <script> element appended to the document, which is exactly how this tool was loading its rule engine. Auditors built as browser extensions never had the problem, because they run outside the document. Neither do we any more: the loader was changed the same day to go through the debugging protocol instead, which is one line. Read those four as a limitation of the tool on the day, not as a property of the sites, and expect the category to be absent from the next dated run.

The exclusions are not random. A site with sophisticated bot protection is probably a different kind of organisation from one without. The 149 sites I could measure are the ones that let me in, and if anything I would expect that group to skew toward the simpler end.

What this is not

It is not a compliance rate. The EAA covers e-commerce, banking and payments, electronic communications, transport ticketing and information, audiovisual media services and e-books. It does not cover every website. A news portal is outside scope unless it sells subscriptions — and nearly every large European newspaper does, which pulls most of them back in, but "most" is not "all" and I did not check them one by one. Microenterprises under ten staff are exempt from the service requirements entirely.

So read the numbers as a picture of the European web, not as an audit of the regulated subset of it.

Failing a criterion is not the same as breaking the law. The harmonised standard gives a presumption of conformance. Missing it means you no longer have that presumption, not that a penalty follows.

Automated testing finds roughly 30 to 40% of WCAG failures. Every number here is a floor. The 21% that came back clean did not pass an accessibility audit; they passed the third of one that a machine can perform.

One page per site. The homepage. A conformance claim covers a service, and I measured a front door.

Clause 9 only. EN 301 549 has more than web pages in it. Clause 10 applies the same success criteria, through WCAG2ICT, to documents a service delivers rather than renders: the invoice, the ticket, the statement of account, the e-book. For most of the categories the EAA names, that is a large share of what a customer actually reads, and nothing here looked at any of it. So the 30 to 40% above is a share of failures in web content, not a share of the obligation — read it as generous rather than conservative.

Method

Sample: the Tranco research list, id 74V8X generated 21 August 2026, filtered to domains whose TLD belongs to an EU member state, taken in rank order. Tranco averages five ranking providers over thirty days specifically to resist the manipulation that single-source top-site lists suffer from, and it pins every list to an id so the sample can be reconstructed exactly.

Top 300 such domains. One page each, the apex URL, loaded twice with roughly a second between, and a criterion counted only when it failed both times. Detection by axe-core 4.13.0, with results mapped onto EN 301 549 clauses. robots.txt was respected, the user agent identified the crawler and pointed at a page explaining it, and no site was crawled beyond its front page.

A second pass a few hours later repeated the method over the top 120 domains and additionally recorded which rule produced each failure. It measured 59 sites. Every figure above says which pass it comes from; the headline table is the 300-domain run.

No company is named. Naming them would travel further and it would turn a measurement into an accusation from someone who sells the remedy. WebAIM has published the same shape of study annually for years without naming anybody, and that seems like the right precedent.

The data is published: every site as a row, with its rank bucket, its country, the clauses it failed, whether it disagreed with itself between loads, and for the 151 excluded ones, why. The rows carry no domains. That is not a hedge — the sample is reconstructible from the Tranco id and the selection rule above, so anyone can rebuild the exact list and re-run it, which is the part that matters for checking my work. The tool is MIT licensed and the script that produced this is in the repository at scripts/benchmark.mjs.

If this crawler turned up in your logs, the same page says what it requested and how to refuse it in one line of robots.txt.

The part that matters

November is a real deadline and the six criteria are real work, five sixths of which no tool will do for you.

But if you are choosing what to fund this quarter, the standard you are already measured against has been sitting there since June 2025, and two thirds of the most-visited sites in Europe do not meet its lowest bar. The unlabelled button is not waiting for a new version of anything.

Updated 31 August 2026. A reader pointed out that the piece said "EN 301 549"
while measuring clause 9, and that clause 10 the documents a service hands
you is both a large part of the obligation and a place no scanner is pointed.
He was right, and the omission flattered the numbers. The paragraph about it in
"What this is not" was added that day, along with the same admission in the
tool's own output, which named clause 12 and skipped clause 10 in exactly the
same way. Nothing else was changed: the figures are as first published.