Self-service terminals and the European Accessibility Act — the ATM, ticket-machine and kiosk rules

Image description: A row of self-service machines in a transit concourse — a ticketing kiosk with a touchscreen, an ATM, and a check-in terminal — one fitted with a headphone jack and tactile keypad, the accessible-terminal features the European Accessibility Act now expects.

Reading Time: 12 minutes

Most accessibility law is written for the web. The European Accessibility Act (EAA) is unusual because it reaches out into the physical world and names the machines you touch: the cash machine in the bank lobby, the ticket machine on the station platform, the check-in kiosk at the airport, the card terminal on the shop counter. From 28 June 2025, these self-service terminals are in legal scope across the EU — not as a matter of good practice, but as a conformity requirement enforced through the same market-surveillance machinery that governs any other regulated product. This primer sets out exactly which terminals are covered, what “accessible” means for a machine you cannot attach your own screen reader to, how EN 301 549 supplies the test criteria, and why a twenty-year grandfather clause means the law will take most of a generation to fully bite.

What the EAA actually is — and where terminals sit in it

The EAA is Directive (EU) 2019/882 — adopted on 17 April 2019, “on the accessibility requirements for products and services.” Member States had to transpose it into national law by 28 June 2022 and apply those rules from 28 June 2025. Unlike the Web Accessibility Directive, which binds only public-sector bodies, the EAA binds the private market: manufacturers, importers, distributors and service providers across the single market.

The Directive splits its scope into products (Article 2(1)) and services (Article 2(2)). Self-service terminals appear on the products side. Article 2(1)(b) brings into scope “payment terminals” and — to the extent that they are dedicated to providing a service the Directive also covers — four named terminal types: automated teller machines (ATMs), ticketing machines, check-in machines, and interactive self-service terminals providing information. The Directive carves out one category from the information terminals: those “installed as integrated parts of vehicles, aircraft, ships or rolling stock” are excluded, so the seat-back screen on a train is not a covered terminal even though the station ticket machine is.

That drafting has an important structural consequence. Payment terminals are covered outright. The other four types are covered conditionally — only when they serve a covered service. So the question “is this ATM regulated?” is really the question “is it dedicated to a service the EAA covers?”

Which services pull a terminal into scope

Article 2(2) lists the consumer services the Directive covers. Read alongside the terminal list, it is the switch that turns a machine on or off for compliance purposes. The covered services are:

• electronic communications services (excluding machine-to-machine transmission);
• services providing access to audiovisual media services;
• elements of air, bus, rail and waterborne passenger transport services — including e-ticketing and interactive self-service terminals;
• consumer banking services;
• e-books and their dedicated software;
• e-commerce services.

Map that back onto the hardware and the practical footprint is large. Consumer banking activates the ATM in scope. Passenger transport activates the platform ticket machine and the airport check-in kiosk. E-commerce and retail payment activate the counter payment terminal. An “interactive self-service terminal providing information” — a wayfinding kiosk in a shopping centre, a queue-ticket dispenser at a service desk — is caught when it is dedicated to one of those services. The EAA does not regulate every screen in a public space; it regulates the machines that stand between a consumer and a covered service.

What “accessible” means for a machine you can’t plug into

A screen reader user browsing a website brings their own assistive technology to the page. At an ATM they cannot: the machine is closed functionality — sealed hardware a user is not allowed to attach software to. That is the central design problem the EAA’s terminal requirements solve, and it is why the rules read differently from web rules.

The functional requirements for products live in Annex I, Section I of the Directive. (A common misreading places terminal rules in Section III — that section governs services. Section II, which adds requirements for “all products,” expressly excludes self-service terminals, precisely so their bespoke rules in Section I are not double-counted.) Section I sets the general principle first: information a terminal provides must be perceivable through more than one sensory channel, presented in an understandable way, with adequate contrast and adjustable presentation, and it must not depend on a capability a disabled user may not have.

Section I then adds a terminal-specific point — commonly cited as point 2(o) — for machines with closed, self-service functionality. Where a terminal has that character, it must:

• provide text-to-speech output so a blind user can hear every prompt and confirmation;
• allow the use of personal headsets, so the speech output is private;
• where a timed response is required, alert the user through more than one sensory channel that time is running;
• give the user the ability to extend the time allowed;
• present content with adequate contrast and operable, tactile-discernible controls.

The design intent is a machine a blind or low-vision user can complete unaided and in private: plug a headset into a jack, hear the full transaction spoken, confirm without a sighted person reading the screen aloud. That last clause — privacy — is the one operators most often overlook, and the one that most changes the felt experience of using a cash machine when you cannot see the screen.

EN 301 549 — the standard that makes it testable

The Directive states goals; it does not, by itself, give an engineer a pass/fail checklist. That job falls to EN 301 549, the harmonised European standard maintained by ETSI with CEN and CENELEC. Conformance with the harmonised standard gives a “presumption of conformity” with the corresponding legal requirements — so in practice it is the document a vendor is measured against.

The version in force through 2026 is EN 301 549 V3.2.1, published in March 2021, which incorporates WCAG 2.1 Level AA by reference. A draft V4 aligning with WCAG 2.2 and updating real-time-text and hardware provisions was circulating in late 2025, but as of mid-2026 it is not yet the version cited in the Official Journal — so do not treat V4 as the binding text. For terminals, the load-bearing clauses are the ones the web-first world rarely opens: Clause 5 (generic requirements) and Clause 8 (hardware).

Clause 5’s “closed functionality” requirements (clause 5.1) are the heart of the matter. Where ICT is closed — operable without the user attaching their own assistive technology — the standard requires that all information and operation needed to complete and verify the transaction be available non-visually, typically through speech output covering prompts, entered values, error messages, and the final confirmation. Clause 8 governs the physical machine: reach ranges, operable parts that do not require tight grasping or pinching, tactile keys, and the presence of a standard headphone connection. A terminal that speaks every prompt but hides its headphone jack behind a service flap fails the spirit and, read carefully, the letter of both.

The twenty-year grandfather clause

Here is the provision that reshapes the entire timeline. Article 32 of the Directive lets service providers keep using terminals that were lawfully in service before 28 June 2025 — “until the end of their economically useful life, but no longer than 20 years after their entry into use.” The recitals justify it by “the cost and long life-cycle of self-service terminals”: a bank that installed a fleet of ATMs in 2020 is not required to rip them out on the application date.

That gap is not a loophole in the pejorative sense — it is a deliberate transitional design that trades speed for capital realism. But it is the single most important fact to understand about terminal compliance, and the reason enforcement in the first years will centre on new deployments and procurement, not on the legacy estate.

Enforcement and penalties

Terminals are products, so they are policed through the EAA’s market-surveillance regime: conformity assessment, CE marking, and designated national market-surveillance authorities empowered to test, order corrections, and remove non-compliant products from the market. This is the same enforcement backbone we tracked in the first-year enforcement report.

Article 30 governs penalties. It requires Member States to set penalties that are “effective, proportionate and dissuasive,” accompanied by “effective remedial action in case of non-compliance,” and calibrated to the extent and seriousness of the breach, the number of non-compliant units, and the number of people affected. Crucially, Article 30 does not itself set amounts — each Member State fixes the levels in transposition, which is why penalty exposure for the same non-compliant terminal differs sharply depending on where it stands. One drafting detail worth flagging: Article 30 explicitly does not apply to procurement procedures, which are governed by the public-procurement directives instead.

The US mirror — ADA §707 and Section 508

The EU did not invent accessible-terminal rules from scratch, and the comparison sharpens what the EAA is doing. In the United States, the 2010 ADA Standards for Accessible Design have required accessible ATMs and fare machines for over a decade. Scoping section §220 requires that where ATMs or self-service fare machines are provided, at least one of each type at each location comply with the technical section §707. Those §707 requirements are strikingly specific: speech output delivered through a private-listening mechanism such as a 3.5mm headphone jack; tactilely discernible input controls with defined symbols (a raised circle for Enter, a raised left arrow for Clear, a raised letter X for Cancel); braille instructions for initiating speech mode; and screen legibility and privacy equivalent to what a sighted user gets.

For US federal ICT, Section 508 reaches kiosks through its “closed functionality” clause (§402 of the Revised 508 Standards), which — like EN 301 549 — requires speech output covering instructions, prompts, user-input verification, error messages, and all displayed information needed to use the machine. And in 2022 the US Access Board opened rulemaking to extend federal guidelines beyond ATMs and fare machines to self-service transaction machines and kiosks generally. The direction of travel on both continents is the same: the closed touchscreen, unaccompanied by speech and tactile controls, is being written out of the acceptable-design space.

What operators should do now

For a bank, transport operator or retailer with a terminal estate, the EAA turns an abstract obligation into a procurement and audit programme. The following is an illustrative worked sequence, not a legal checklist — but it maps to how compliant operators are approaching it in 2026:

1. Inventory and date the estate. Article 32 turns on the entry-into-use date of each machine. An operator that cannot say when a terminal entered service cannot claim the transitional protection for it.
2. Freeze new procurement on the standard. Every terminal ordered after 28 June 2025 should be specified against EN 301 549 Clauses 5 and 8 in the tender itself — speech output, headset jack, tactile controls, time-extension, contrast — so accessibility is a contractual acceptance criterion, not a retrofit.
3. Test the closed-functionality flow end to end. The failure mode is rarely “no speech” — it is a speech path that breaks at one step: an unspoken error, a timeout with no audible warning, a confirmation screen that stays silent. Test the whole transaction with headphones and eyes closed.
4. Publish the accessibility information. The EAA requires that the accessibility characteristics of a product be documented and made available; a terminal fleet needs a maintained conformity record, not a marketing claim.
5. Plan the legacy retirement curve. Twenty years is a ceiling, not a target. Operators treating the grandfather clause as a deadline rather than a floor will find the accessible-by-default replacement wave arriving faster than the legal minimum.

If any of this touches your digital estate as well — and for banking and transport it always does, because the terminal is one node in a service that also runs on the web and in an app — a monitoring baseline across the whole journey is the sane starting point. You can begin with a free automated pass of the connected web surfaces via the accessibility scanner, then layer the manual, hardware-level terminal testing that no automated tool can do on top. Automated scanning catches the web half; the machine on the concourse still needs a human with a headset.

The machine on the concourse

The EAA’s terminal rules matter precisely because they are unglamorous. A cash machine that speaks, a ticket machine with a headphone jack and a tactile keypad, a check-in kiosk that gives you more time when you need it — none of it trends. But for a blind traveller who has spent years asking a stranger to read the ATM screen, or a Deaf-blind commuter locked out of a touchscreen ticket wall, the difference between a covered machine and an accessible machine is the difference between independence and dependence at the most ordinary moments of a day. The law now names the machines. The twenty-year clock, and the operators who choose to beat it, will decide how quickly the machines catch up.

The legal provisions summarised here are drawn from Directive (EU) 2019/882 (Articles 2, 30 and 32; Annex I, Section I), EN 301 549 V3.2.1, and the 2010 ADA Standards §220/§707. For any compliance decision, confirm the operative wording against the consolidated text on EUR-Lex and the current EN 301 549 version cited in the Official Journal, since a WCAG-2.2-aligned revision was in late-stage drafting as of mid-2026.