Accessibility laws · United Kingdom

UK Equality Act 2010 & PSBAR

UK accessibility law runs in two layers, and the softer one covers almost everybody. Every service provider in Great Britain, public or private, owes disabled customers reasonable adjustments under the Equality Act 2010, and that duty is anticipatory. You are meant to remove the barrier before a disabled person meets it, not after they complain. Northern Ireland runs the same idea under its own older statute. That layer names no standard at all, and as far as any source we could find says, no UK court has ever ruled on website accessibility. Public bodies get the second layer, PSBAR, and since October 2022 that one names WCAG in the regulations themselves.

WCAG levels named in regulation 9: A and AA
Equality Act duty since: 2010
PSBAR made: 2018
To acknowledge a monitoring report: 7 days

What the law is

The Equality Act 2010 asks every service provider in Great Britain, public or private, to avoid discriminating against disabled customers and to make reasonable adjustments for them. Northern Ireland is not covered by that Act and runs the equivalent duty under the Disability Discrimination Act 1995, with its own commission enforcing it. Section 20 sets the test. Where something you do puts a disabled person at a substantial disadvantage compared with people who are not disabled, you have to take the steps it is reasonable to take to avoid that disadvantage. The word doing the most work is anticipatory. The duty applies whether or not you know a disabled person is using your service, so you are supposed to fix the barrier before anyone hits it rather than after somebody tells you. Courts and regulators treat a website as a service like any other, the same as a shop or an office.

Public bodies answer to a second law on top of that, the Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018, known as PSBAR. It came into force on September 23, 2018, transposing the EU's Web Accessibility Directive into UK law, and it has since been amended to cut the European wiring out. PSBAR adds three things the general Equality Act duty never spells out, a named standard, a published accessibility statement, and central monitoring you cannot opt out of. And the two layers are not parallel, they are wired together. Regulation 12 treats a failure to meet the accessibility requirement as a failure to make a reasonable adjustment, which is why the Equality and Human Rights Commission enforces PSBAR rather than some new digital regulator.

Here is the part almost every guide still gets wrong, including guides written this year. Regulation 6 says a public body must comply with the accessibility requirement, which is content that is perceivable, operable, understandable and robust. Regulation 9 then hands you the presumption of conformity, and until October 2022 it did that through the European standard EN 301 549. It does not any more. An amendment made on Brexit powers replaced regulation 9 on October 26, 2022, and struck the definitions of the Directive, the European standard, the harmonised standard and the Official Journal out of the regulations at the same time. What regulation 9 says now is that you are presumed to conform to the extent that you meet the Level A and AA success criteria of the Web Content Accessibility Guidelines, as amended from time to time. No European standard in the middle, and no version number pinned in the text. Those five words at the end are the ones to read twice. The bar moves when W3C moves it, which is why the monitoring switched to WCAG 2.2 Level AA in October 2024 without anyone amending a single line of UK law. If your compliance note still says the route runs through EN 301 549, it is describing law that was replaced four years ago.

This applies to you if…

You provide services to the UK public through a website or an app. The Equality Act's reasonable-adjustments duty reaches you whatever your size and whatever your sector, and there is no turnover threshold and no employee count to hide behind. A one-person business selling online owes the same duty as a bank.
You are a UK public sector body, which puts PSBAR on you directly. Central and local government are always in. A charity is a two-step question and almost every summary collapses it into one. Step one is regulation 3, which asks whether you are a body governed by public law at all. That needs three things at once. You were set up specifically to meet needs in the general interest, without an industrial or commercial character. You have legal personality. And one of three funding or control tests is met, meaning you are mostly financed by public authorities, or under their management supervision, or more than half your board is appointed by them. Fail step one and the regulations never reach you, however much public money you take. Pass it, and step two is regulation 4, which puts non-governmental organizations back out unless what they provide is essential to the public or specifically addresses the needs of disabled people. Public service broadcasters and their subsidiaries are out either way. Schools and nurseries get a partial exemption, and the part that stays in scope is narrower than most heads assume. It is the content relating to essential online administrative functions, so the parent portal for term dates, absence forms and payments is covered while a page of photographs from the school play is not.
You supply digital services to a UK public body. PSBAR binds the body rather than you, so nothing in the regulations lands on your company directly. What reaches you comes through the contract, so read what your client has promised the government before you promise anything to your client.
You run an intranet or an extranet for a public body. Internal systems are in scope too, and intranet and extranet content published before September 23, 2019 stays out until that site undergoes a substantial revision. Substantial is the word to argue about, and a copy edit is not it. So the staff tools nobody ever demos to the public are covered by the same rule as the homepage, from the day you rebuild them.

What it technically requires

In the private sector no statute names WCAG, and there is no reported UK judgment telling you what a court would accept. The honest answer is that WCAG 2.2 Level AA is the best-defined standard available, and it is the one the UK government tests itself against. That makes it the sensible thing to build to and the sensible thing to be measured on. What the Equality Act asks of you is reasonable adjustments, not conformance. WCAG is how you show your work.
In the public sector you have to meet the accessibility requirement, which the regulations state as content that is perceivable, operable, understandable and robust, and which regulation 9 lets you satisfy by meeting WCAG Level A and AA, currently 2.2. You also have to publish an accessibility statement in the format the regulations set out, not a general statement of goodwill. The statement carries its own enforcement route under regulation 14, so a body can be pursued over its statement separately from being pursued over its site. Get the statement wrong and you have created a second problem, not a smaller one.
That statement has four required contents, and regulation 8 sets the frame around them first. Follow the model statement, keep it under regular review, publish it in an accessible format, and put it on the website itself, or for an app either on your website or beside the download information. Regulation 8(4) then says what goes inside. An explanation of the parts of your content that are not accessible, and the reasons why. Where appropriate, a description of the accessible alternatives you provide instead. A description of, and a link to, a contact form that lets somebody both report a failure and ask you for the content you have excluded. And a link to the enforcement procedure in Part 5, for the person your answer did not satisfy. Read those last two again, because between them they turn a statement into a route. The form is how a member of the public asks for the thing you left out. The link is where they go when you say no. Which makes an exclusion a doorway rather than a door.
Regulation 9 is where the presumption of conformity lives, and the whole of it now fits in one sentence. You are presumed to be in conformity with the accessibility requirement to the extent that you conform to the Level A and AA success criteria of the Web Content Accessibility Guidelines, as amended from time to time. Two phrases in that sentence do the work. To the extent that is the limit, so conforming buys you a presumption for what the guidelines cover and nothing beyond it, and regulation 6 is still the duty underneath. As amended from time to time is the engine, because it points at whatever version W3C currently recommends rather than at a number frozen in 2018. Today that means WCAG 2.2 Level AA, which is also what the monitoring tests you against.
If the Government Digital Service, the team that runs the monitoring, sends you a report, two clocks start. You have seven days to email them and confirm you received it. You have 12 weeks to fix the accessibility issues. After that they ask for the detail, which issues you fixed, which ones you cannot, and a timeline for whatever's left. The report and that information then go to the Equality and Human Rights Commission, or to the Equality Commission for Northern Ireland.
A public body can claim disproportionate burden where fully meeting the requirements is more than the organization can reasonably cope with, weighed against the benefit of making things accessible. Three things explicitly do not count, a lack of time, a lack of knowledge, and a decision that accessibility is not a priority right now. Those are the usual reasons a site stays broken. The government has ruled all three out.

All roads lead to WCAG. Start with Level AA, the legal standard or the full 55-rule library. Unfamiliar term along the way? The A to Z glossary decodes it.

This law expects a published accessibility statement, and regulators check for it first. Generate yours free →

How it is enforced

On the private side, a disabled customer brings a discrimination claim under section 114 of the Equality Act, and where they bring it depends on where you are. England and Wales means the county court. Scotland means the sheriff court. Northern Ireland sits outside the Equality Act altogether and runs its claim under the Disability Discrimination Act 1995 instead. Remedies include declarations, orders, and compensation, and that compensation can cover injury to feelings rather than only money lost. And now the part that rarely gets said. No source we could find identifies a decided UK court judgment on website accessibility. The RNIB took action against bmibaby over an inaccessible website in 2012 and the matter settled out of court, which is what has happened to the others too. So the UK private-sector duty is real, old, broad, and untested.

On the public side the monitoring produces numbers, and the numbers are public. Regulation 10 puts the monitoring duty on the Secretary of State and requires a published report every three years, and the Government Digital Service is the team that does the testing. Between January 2022 and September 2024 it monitored 1,203 public sector websites and 21 mobile apps. Of those, 85% had published an accessibility statement, though plenty were out of date and had not been reviewed in the previous 12 months. The four failures that came up most were insufficient color contrast, a missing visible focus indicator, keyboard operation problems, and content that does not reflow to fit the browser or device. Public sector teams fixed most of what was found. GDS published its second report in December 2024 and publishes one every three years, sampling every year in between.

UK exposure does not work like the American model, where statutory damages stack up per violation. The pressure here is steadier and it arrives from several directions. That means a complaint from a customer, a monitoring report with your name on it, a question in the next procurement round, or press coverage when a public body gets named. None of those is a court case.

Key dates

Sep 23, 2019 and 2020PSBAR deadlines for new and existing public-sector websites
Jun 23, 2021PSBAR deadline for public-sector mobile apps
Oct 26, 2022Regulation 9 is replaced: the presumption of conformity stops running through EN 301 549 and names WCAG Level A and AA directly, as amended from time to time
Oct 2024Monitoring moves to WCAG 2.2 AA, with no change to the regulations needed

What to do about it

Every obligation on this page is measured against WCAG, so the first step is knowing where you actually stand. Run the free 10-page scan for the machine-checkable slice. For the rest, we review the key journeys with an expert and a real blind screen-reader user, then attach a screenshot and a fix to every finding. $499, 5 business days.

Order your audit Run the free scan

Primary sources

Other laws

Related on this site

What to read next, and the terms this page uses.

Orientation only, current as of August 2026. Not legal advice, and no attorney-client relationship is created. For your specific situation, talk to your own lawyer.