You got a letter from ACM — a Dutch accessibility response playbook

What this letter actually is

Autoriteit Consument & Markt is not, on the current record, issuing fines for web accessibility. What it has done is run a sweep — testing roughly 100 of the largest Dutch web shops plus the websites of major telecom and energy providers — and publish the result: someone using assistive technology could not complete an order at 61% of the sites tested, citing order buttons that could not be operated and inaccessible CAPTCHAs among the barriers found. ACM said it is giving the worst-performing companies improvement points, and that companies which do not improve sufficiently risk enforcement action.

So the letter in front of you is most likely one of two things: a notice that your site was in the tested sample and scored badly enough to receive improvement points, or a follow-up referencing insufficient progress since an earlier notice. Neither is a fine, a court order, or a final legal finding against you. It is a monitoring result attached to a warning about what happens if nothing changes — closer to a compliance flag than a summons.

Who sent it, and what ACM actually oversees

ACM is the authority the Netherlands designated, under the Implementatiewet toegankelijkheidsvoorschriften producten en diensten (Staatsblad 2024, 87), to supervise accessibility for e-commerce and electronic-communication services. Those obligations took effect on 28 June 2025, the same date the EAA itself started applying. The tested sample also covered energy providers’ sites, alongside the web shops and telecom operators ACM’s mandate names directly.

The test being applied is end-to-end, not a page score

The detail worth sitting with is what ACM actually measured: not a page-level automated accessibility score, but whether a real assistive-technology user could get from browsing to a completed order. A site can pass an automated scanner and still fail that test if the “place order” button cannot be operated by keyboard, or if a CAPTCHA on the way to checkout has no accessible alternative. If you received an improvement-point notice, assume the barrier ACM found sits somewhere on that path, not necessarily on your homepage.

What ACM can actually do next, stated as a maximum

If a company does not improve sufficiently, ACM can move toward enforcement. The ceiling that applies is the general ACM penalty ceiling under article 2.15 of the Wet handhaving consumentenbescherming, which the Implementatiewet brings to bear on accessibility: up to €900,000, or 1% of annual turnover if that figure is higher. This is a statutory maximum for enforcement action generally, not a number written specifically into the accessibility rules, and it is a ceiling — not a fine anyone has actually been ordered to pay. No confirmed EAA fine has been imposed anywhere in the EU as of August 2026.

The clock

ACM has not published a fixed response window that applies to every improvement-point letter — there is no universal “30 days from receipt” clock documented for this process. Read your own letter for whatever date it names. Do not treat silence as safe: “insufficient improvement” is the trigger ACM itself named for moving toward enforcement, and that is a judgment about outcomes over time, not a single missed deadline.

What to send back

The improvement points ACM hands out are about a demonstrated barrier on the order path. A credible response documents, specifically:

• What was tested — ideally the same path ACM tested: browsing, cart, and checkout through to order completion, not just the homepage.
• Against what standard and version — EN 301 549, with the revision stated (v3.2.1, mapped to WCAG 2.1 AA, or the v4.1.0 final draft, mapped to WCAG 2.2 AA). Naming the revision is about precision, not a claim that the EAA itself cites it — no revision is cited under the EAA yet, so this is evidence of conformance, not a presumption under it.
• When it was tested, and by what method (automated, manual, or assistive-technology walkthrough of the order flow).
• What was found — including whether any barrier matches the categories ACM named publicly (order controls that cannot be operated, CAPTCHA with no accessible alternative).
• A remediation plan with dates, prioritized so the order-completion path is fixed first, since that is the test being applied.

If your business is small — fewer than 10 people and turnover or balance-sheet total under €2 million — check the EAA’s microenterprise exemption for service providers before anything else; it may mean the underlying obligation does not reach you, though ACM’s own supervisory mandate and its scope determination are the ones that decide that, not this article.

What not to do

• Do not claim conformity you cannot back with a report. A one-line assurance that “the site is accessible” answers a different question than the one ACM asked.
• Do not send a generic sitewide WCAG score with no connection to order completion. ACM’s test is a task, not a page audit, and a response that ignores that mismatch reads as evasive even when it isn’t meant to.
• Do not ignore the letter. ACM has stated plainly that non-improvers risk enforcement, and that statement is the whole reason the letter exists.

Where an EN 301 549 report fits

A chapter-by-chapter EN 301 549 conformance report, generated against a stated revision, is the kind of documentation that answers what ACM is actually asking: what you tested, against which standard, what you found, and what you are doing about it. Paired with a dated remediation plan focused on the order-completion path, it turns an improvement-point letter into a closeable item rather than an open risk. See how we help, check the wider enforcement record across EU supervisory authorities, or get in touch if you want to talk through what a response should contain.

This article is informational only, not legal advice; how to respond to a specific ACM notice is a determination for your organization and, where appropriate, your own counsel.