Tomorrow is Global Accessibility Awareness Day 2026. Thousands of companies will post something. A week later, most will look exactly the same as the week before.
For companies running a real accessibility programme, GAAD is a programme milestone: the moment to publish the annual statement update, release the year-in-review for users, and set the next 12 months' roadmap. For companies without a programme, it is just a social post. The gap between those two companies is a maturity gap, and right now, that gap has a regulatory cost attached to it.
The European Accessibility Act has been in force since 28 June 2025. In France, disability organisations have taken four major retailers to court over inaccessible apps and websites. The first EAA court ruling landed in May 2026, and the appeal that will determine how the rules apply to mid-market companies is now in front of the Cour d'appel de Douai. Sweden's regulator has opened investigations into 39 e-commerce services. Germany's market surveillance authority has been operational since September 2025.
The question for a mid-market mobile team is: where are we, and what does the next move look like? A maturity model is the clearest way to answer that.
Why GAAD-as-event is the tell
The Global Accessibility Awareness Day(opens in new tab) was founded in 2012. It runs every third Thursday in May. Its goal is to get people thinking and talking about digital access.
That goal matters. But thinking and talking about something is not the same as building systems around it.
Companies at the lower end of the maturity scale treat GAAD as the whole programme. One LinkedIn post. Maybe an internal Slack message. Nothing measurable happens on 22 May that would not have happened anyway.
Companies at the upper end use the same day differently. GAAD week is when the annual accessibility statement gets refreshed and published. It is when the customer-facing report goes out. It is when the next year's roadmap is signed off. The day is not the work. It anchors the work.
The day you observe GAAD is not meaningful. What surrounds it is.
The five levels: a maturity model for mid-market mobile apps
The W3C Accessibility Maturity Model(opens in new tab) and the BSI ISO/IEC 30071-1 standard(opens in new tab) both provide frameworks for organisational accessibility capability. The model below draws on that industry groundwork and adapts it for mid-market mobile app teams specifically: companies with one to five consumer apps, 11 to 250 employees, and compliance-adjacent buyers who do not have a dedicated accessibility team.
For each level, five dimensions matter: who owns accessibility, how often anything happens, what evidence exists, what a regulator would find on an unannounced inspection, and what disabled users actually experience.
Level 1: Ad hoc
Ownership: Nobody in particular. Accessibility comes up when a user complaint arrives or when someone reads a GAAD post.
Cadence: Annual, if that. Triggered by external events, not internal programme rhythm.
Evidence: None that a regulator could request. No published accessibility statement. No audit trail. No remediation log.
Regulator response: An inspector from Italy's AgID, Sweden's PTS, or Germany's MLBF asks to see the accessibility statement. There is not one. That finding alone is a documented gap under Article 13 of the EAA, before a single line of code has been tested.
User experience: Disabled users encounter barriers with no route to report them. No feedback channel, no named contact.
Most mid-market mobile companies are at Level 1. That is not an indictment. The EAA only came into force in June 2025.
Level 2: Reactive
Ownership: Product or engineering picks it up when something breaks. Accessibility is a bug category, not a programme.
Cadence: Irregular. Fix when a customer complains. Maybe commission a one-off audit before a major launch.
Evidence: Scattered. A Jira label, some closed support tickets, a consultant's PDF from 18 months ago. No published accessibility statement. No structured record.
Regulator response: The regulator asks for the statement. Still nothing to show. A one-off audit without a dated, published statement does not meet the Article 13 obligation. The regulator has a finding without testing a single criterion.
User experience: Some barriers get fixed, eventually. Users who know to complain sometimes get a result. Users who do not, or who lack the energy to push, get nothing.
Level 2 is more common than it looks. It often masquerades as progress because tickets do get closed. But closed tickets without a statement, a remediation roadmap, and a feedback mechanism are not a compliance posture.
Level 3: Managed
Ownership: A named person. Often a senior product manager or a compliance lead who has EAA on their list alongside five other regulatory obligations.
Cadence: Annual. One manual audit per year, typically commissioned out to a consultancy for a six-figure invoice and a PDF deliverable. Statement published, dated, and linked from the website. Findings live in Jira until sprint capacity allows.
Evidence: The statement exists. It is dated. It covers the main consumer app. A findings backlog is documented. Remediation activity can be evidenced, at least partially.
Regulator response: The statement exists, and the regulator can read it. The question now shifts to whether the substance behind it does. Is the compliance status honest? Are the non-conformances listed? Is there a working feedback contact? Is the statement scoped to the mobile app and not just the marketing website?
A Level 3 company can survive an initial request from a regulator. It may struggle with follow-up questions about specific findings.
User experience: Barriers are tracked and, slowly, fixed. A feedback route exists, though response times may be inconsistent.
The published Article 13 accessibility statement is the threshold between Level 2 and Level 3. Nothing below this line constitutes a defensible EAA posture.
Level 4: Integrated
Ownership: Accessibility is embedded in the development lifecycle. Design reviews include accessibility criteria. Code review checks specific EN 301 549 clauses. QA includes accessibility as a first-class test category, not an afterthought. A named owner coordinates the programme.
Cadence: Continuous by process, with an annual manual audit cycle to verify. The statement is updated with each material release, not once a year. Audit findings produce an actionable remediation plan with a documented evidence trail, not a PDF that sits in a shared drive.
Evidence: Dated audit reports. A statement that reflects the current product state, not the state from the last audit. A staffed feedback mechanism with logged response times. A remediation roadmap that is actually being worked against.
Regulator response: A notice of investigation arrives. The company has the statement, the audit trail, the remediation records, and the feedback log. It can answer questions without scrambling. This is the company that does not panic.
User experience: Barriers are identified before users encounter them. The feedback mechanism is real, responses are prompt, each release is measurably more conformant than the last.
Level 4 is the bar for surviving regulatory scrutiny without backpedalling. A Level 3 company that receives a formal investigation notice spends the following weeks trying to produce evidence it does not have. A Level 4 company has the evidence already.
Level 5: Continuous
Ownership: Programme-level. Accessibility has a named executive sponsor, a dedicated budget, and a defined role in the product team. Nobody owns it alone because nobody needs to.
Cadence: Always on. Monitoring runs continuously. Quarterly internal audits supplement the annual full-product audit cycle. The statement is updated with every significant release. The customer-facing report goes out on a fixed annual cadence, using GAAD week as the anchor.
Evidence: Timestamped and versioned. Every audit finding is dated. Every remediation item is logged against the finding it resolves. The feedback loop is closed inside documented SLAs. A regulator asking for evidence gets a structured file, not a search through archived email threads.
Regulator response: This company is the one the regulator points to as the example. It has not just met the minimum. It has built the kind of evidence trail that shows continuous good faith effort over time. In any enforcement context, that distinction matters.
User experience: Disabled users experience a product built with them in mind from the start, not retrofitted later. The feedback channel is real, staffed, and closes loops.
Very few mid-market mobile companies are at Level 5 today. The target is not Level 5 by GAAD 2026. The target is to know what level you are at, and what the next move is.
What the EAA actually expects
The EAA does not prescribe a maturity model. It prescribes specific obligations, and those obligations map cleanly onto the levels above.
Article 13 of Directive 2019/882 requires companies to provide service accessibility information to consumers. In practice, that means a published accessibility statement at a discoverable URL, scoped to the actual product, dated, with a compliance status declared and a feedback route included. A statement that meets these requirements is the Level 2 to Level 3 threshold.
Article 13(3) of the same directive requires service providers to have procedures in place so that the service stays in conformity as it changes. A one-time audit with no ongoing programme does not satisfy this, which is the structural reason Level 3 is necessary but not sufficient for companies that want to avoid follow-up scrutiny. The six elements an EAA-credible audit checks map directly to both obligations.
The enforcement picture confirms where the bar sits. Italy's AgID published detailed private-sector technical compliance guidelines in March 2026. Germany's MLBF has been operational since September 2025. Sweden's PTS has 39 e-commerce services under investigation. None of these authorities have issued public sanctions yet. All of them have built the machinery to do so.
The Auchan case in France is the live case that will determine whether mid-market companies need to operate at Level 3 or whether something lower is tolerated. On 5 May 2026, the Tribunal judiciaire de Lille dismissed the case on a disputed domestic revenue threshold. The French disability associations apiDV and Droit Pluriel appealed on 7 May 2026 to the Cour d'appel de Douai. The judge noted accessibility failures on 13 of 19 audited sections; the dismissal was on threshold, not substance. The appeal will determine whether the EAA's own €2 million microenterprise threshold overrides France's older €250 million domestic one. If it does, most mid-market mobile app companies operating in the EU are inside the obligation.
No company has been fined under any EAA transposition in the EU yet. The machinery is built, the cases are active, and the first company to receive a formal regulatory order will not be the last.
Place yourself on the model
The model is only useful if you can locate yourself on it honestly. A back-of-envelope self-rating is fine for a first pass. A structured assessment is better, because the gap between "I think we're at Level 3" and "we are at Level 3" is exactly the kind of gap a regulator finds.
The AUDITSU EAA Readiness Quiz takes about ten minutes. It scores you across the dimensions the levels are built on: whether the accessibility statement exists and is in scope, whether the programme cadence is reactive or planned, whether evidence of remediation is documented, and whether the feedback loop is real. At the end you get an overall readiness score, a maturity level, a risk rating, and a per-dimension breakdown that points to the specific gap to close first.
If you have ten minutes today, that is the right ten minutes to spend.
GAAD as the programme cadence anchor
Here is a concrete use for Global Accessibility Awareness Day that goes beyond the social post.
Run GAAD week each May as the annual accessibility programme checkpoint. In the week of GAAD, do four things:
Run the annual re-audit. Use GAAD week as the moment to re-audit the app against the current EN 301 549 standard. Last year's findings have shipped or rotted; this year's start now. The findings feed straight into the statement refresh and the customer-facing report.
Refresh the accessibility statement. Update the date, review the compliance status, update the non-conformances list to reflect the current product state. Publish the updated version at the same discoverable URL.
Publish a customer-facing report. A plain-English summary of what changed in the last 12 months: what the audit found, what was fixed, what is still being worked on, and what the next 12 months' roadmap looks like. This converts a social post from "we care about accessibility" (which everyone says) into "here is our evidence" (which very few companies can show).
Sign off next year's roadmap. What will be audited, when, and to what standard. Who owns it. What the budget is. Written down, dated, and owned.
That is a one-week annual investment that turns GAAD from a prompt into a programme. The social post becomes the announcement of the published report, not the work itself.
The next move
Most mid-market mobile teams reading this sit somewhere between Level 1 and Level 3. The steps are not complicated.
The first one is the published accessibility statement. Without it, nothing else is visible to a regulator. The AUDITSU statement generator builds it from live audit findings, scoped to the app, with the right EN 301 549 and WCAG 2.1 AA references, and the feedback mechanism included. The statement stays current as the product changes.
Levels 3 through 4 are where the audit toolkit does the work: grading the six elements, producing the findings, linking remediation items to the specific clauses they relate to, and building the evidence trail that holds up when a regulator asks for it.
GAAD is tomorrow. The programme is the other 364 days. The question is whether, by GAAD 2027, you are the company publishing a customer-facing accessibility report, or the company posting a social message that still says "we are committed to making our products accessible to everyone."
Both companies believe what they are saying. Only one of them can prove it.