Directive (EU) 2019/882, the European Accessibility Act, has been in force across all 27 Member States since 28 June 2025. It covers banking, e-commerce, transport operators, e-books, and consumer-facing digital services. Information-only patient websites, disease awareness platforms, and most brand.com sites currently sit outside the active enforcement perimeter. Legal teams across pharma have confirmed this reading and moved the file to the bottom of the pile.
That reading is correct today. It is also the reason to start work now.
European regulation tends to arrive slowly and bite quickly. The EAA has a built-in review clause: by 2030, the Commission reassesses which services should be added to scope. Patient information already appears in advocacy submissions to that review. Once a service moves in, national transpositions follow within months and enforcement within a year. Any pharma company that waits for the trigger will be rebuilding a portfolio under deadline pressure, which is the single most expensive way to achieve compliance.
Strictly, information-only patient sites are not named in the current Annex I service list. Pharmaceutical e-commerce, patient portals that transact or authenticate, and mobile health apps that qualify as consumer digital services are already in scope. The exemption for microenterprises, fewer than 10 employees and under 2 million euros turnover, does not apply to any pharma manufacturer.
Two factors complicate the "we're outside scope" position. First, Member States may impose stronger national requirements than the EAA baseline, and several have signalled broader interpretations of "digital services" during transposition. Second, the dividing line between an information site and a service is thinning fast: add a symptom checker, an HCP locator, a dosing reminder, or an authenticated patient area, and the classification shifts. Promedia's own legal review of the pharma scope, documented in the AI Design System deck, flags penalties up to 100,000 euros or 4 percent of annual turnover depending on how each Member State implements enforcement.
The UCB offer deck captures the patient-centric case plainly: around 87 million people in the EU live with some form of disability. Many of them live with the conditions pharma brands exist to treat. Accessible patient platforms are a legal variable today and a reach variable always.
A mid-size pharma typically manages something like 40 country sites, 15 disease awareness platforms, and 20 brand sites. Each has its own CMS, its own agency of record, its own design tokens, and in most cases no WCAG 2.2 AA baseline check on record. Auditing that estate site by site, in a single sprint, is neither affordable nor useful.
A sequenced approach works better:
Promedia's design system accessibility audit of a pharma multibrand email system illustrates the leverage. The system scored 33 out of 100 on accessibility, the lowest of any dimension, with 132 critical findings and 57 warnings, against an overall health score of 78. The root causes numbered only four. Fixing those four structural issues delivered the majority of the compliance gain across every brand email the system produced. The same pattern holds for websites built on a shared design system.
The WCAG Compliance Plugin inside Promedia's AI Design System offer runs this audit on a design system in minutes, which makes a quarterly backlog cadence realistic rather than aspirational.
Industry cost analyses are consistent and uncomfortable. Retrofitting accessibility into an existing digital product costs 10 to 30 times more than embedding it from the start. A comparative study by HTD Health put early integration at around 22,000 dollars for a given scope, against 70,000 to 135,000 dollars or more for the same scope remediated after launch. A separate analysis by WCAG Safe concluded there is no scenario where waiting is cheaper once legal fees, settlements, and emergency fixes are added.
Multiply those figures across 75 properties under a six-month compliance deadline and the economics stop being a budget conversation and start being a crisis conversation. The fixes themselves are structural: colour tokens, focus states, semantic markup, component library accessibility, PDF tagging, video captioning. None of this can be hot-patched across a portfolio in a quarter.
Building accessibility in now, one design system at a time, one audit at a time, costs a fraction of a rushed rebuild. Barrierbreak's analysis puts the proactive saving at up to 90 percent versus reactive remediation.
Sequencing matters more than speed. A realistic 18 to 24 month plan looks like this:
This is the sequence that lets Medical, Regulatory, and Brand share one roadmap rather than three competing ones. It also gives procurement a defensible multi-year envelope instead of an emergency line item in 2029.
Not explicitly in the current scope. The EAA covers consumer-facing digital services such as banking, e-commerce, transport, e-books, and patient portals that transact or authenticate. Information-only patient sites and most brand.com properties sit outside active enforcement today, but the 2030 review clause and ongoing advocacy submissions make inclusion plausible within the next regulatory cycle.
28 June 2030 is the end of the transitional period for existing products and services already on the market before 28 June 2025. The Commission is also required to review the scope of the Directive and may propose adding further services. Pharma teams should treat 2030 as both a compliance date for existing in-scope services and a scope-expansion checkpoint for everything else.
The EAA aligns with the harmonised European standard EN 301 549, which references WCAG 2.1 at level AA as the technical baseline, with WCAG 2.2 AA increasingly treated as the working target. Annex I of the Directive requires digital services to be perceivable, operable, understandable, and robust, which is the WCAG framework in plain language.
Penalties are set by each Member State during national transposition and vary significantly. Common ranges reach up to 100,000 euros per violation or 4 percent of annual turnover, with additional powers to withdraw non-compliant services from the market. Several Member States permit stronger national requirements than the EAA baseline, so pharma teams should check each local transposition rather than relying on a single EU-wide figure.
The honest recommendation is unglamorous: inventory the estate this quarter, audit the shared design systems next quarter, and move to a rolling cadence from there. By the time patient information sites are confirmed in scope, whether that happens in 2030 or later, the portfolio is already compliant and the budget was spread across four years rather than four months.
If you want a second pair of eyes on how to sequence this across a specific patient estate, including which properties to audit first and how to structure the design-system work, that is the conversation Promedia has most often with brand and medical affairs leads right now.
One short email when we publish. No spam, no sales pitch. Unsubscribe whenever.
