Penalties · Spain
Spain
España
Three-tier framework: light €301–€30,000; serious €30,001–€300,000; very serious €300,001–€1,000,000 — the highest EAA-transposition ceiling in the EU. AC-level penalties, procurement exclusion and civil damages stack on top.
Spain's accessibility regime is the EU's heaviest and most layered. A single non-compliant product or service can attract an administrative fine of up to €1,000,000 under Ley 11/2023 — the highest "very serious" ceiling of any EU European Accessibility Act transposition — and the national framework is replicated, and in places sharpened, across 17 autonomous-community accessibility acts with their own penalty schedules. Underneath sits the consolidated General Act on the Rights of Persons with Disabilities (Real Decreto Legislativo 1/2013, the LGDPD), itself a 2013 codification of two decades of disability-rights statutes. Spain transposed the EAA inside the EU deadline; Real Decreto 193/2023 operationalises the goods-and-services dimension; substantive obligations on businesses have been live since 28 June 2025.
The constitutional and treaty floor
Article 49 of the 1978 Spanish Constitution (Constitución Española) commits the public powers to "carry out a policy of prevention, treatment, rehabilitation and integration" of persons with disabilities and to provide them with the specialised care they require for the exercise of their rights. The constitutional reform of 15 February 2024 — the second-ever amendment to the 1978 text — modernised the article's terminology, replacing the original "disminuidos físicos, sensoriales y psíquicos" with "personas con discapacidad" and reframing the State obligation in language explicitly aligned to the UN Convention on the Rights of Persons with Disabilities. The reform was promoted across the political spectrum and was the first concrete constitutional response to CERMI's two-decade campaign to align the constitutional text with CRPD vocabulary.
Spain ratified the UN Convention on the Rights of Persons with Disabilities on 3 December 2007 — among the first wave of EU member states to do so — and ratified the Optional Protocol on the same date. The CRPD has the force of internal law under Article 96 of the Constitution. The 2018 amendments to the LGDPD were drafted explicitly to align the domestic terminology and conceptual framework with the CRPD's social model of disability; the CRPD Committee's 2019 and 2022 Concluding Observations on Spain are reflected in the National Accessibility Plan and in successive reforms of the disability-certification regime. Spain's next periodic report to the CRPD Committee is due in 2027 and is expected to focus heavily on EAA implementation, autonomous-community harmonisation, and the accessibility of the built environment.
The national-public-sector path: RD 1112/2018 and the LGDPD
Directive (EU) 2016/2102 — the Web Accessibility Directive (WAD) — was transposed into Spanish law through Real Decreto 1112/2018, adopted on 7 September 2018 and replacing the earlier Real Decreto 1494/2007 (which itself had been Spain's first dedicated web-accessibility regulation, predating the WAD by nearly a decade). RD 1112/2018 obliges every Spanish public-sector body — central General State Administration, the autonomous communities themselves in their administrative-act capacity, local entities, universities, and the publicly-owned bodies caught by the EU's expanded public-sector definition — to make their websites and mobile applications conform to the technical standard set out in Article 6.
The decree imposes three concrete obligations. First, conformance to the harmonised European standard EN 301 549 (currently v3.2.1, the version that incorporates WCAG 2.1 Level AA): the national implementing methodology fixes the conformance bar at WCAG 2.1 AA pending formal EN 301 549 alignment to WCAG 2.2. Second, publication of an accessibility statement in Spanish (and, where applicable, in the co-official language of the autonomous community where the body operates) covering conformance status, content outside the directive's scope, third-party widgets, archived materials and a complaint mechanism. Third, a feedback and enforcement procedure: users may complain directly to the in-scope body, and unresolved complaints can be escalated to the supervisory authority and ultimately to the Office of Care for Disability (Oficina de Atención a la Discapacidad, OADIS).
The monitoring methodology in Spain is aligned to Commission Implementing Decision (EU) 2018/1523 on the model accessibility statement and to Commission Implementing Decision (EU) 2018/1524 on the monitoring methodology. The General Secretariat for Digital Administration (within the Ministry for Digital Transformation and Civil Service) runs the periodic simplified-scan and in-depth-scan rounds and publishes results into the national accessibility-statement registry. Bodies failing the simplified scan first receive corrective-action requests; only persistent non-conformance escalates into the LGDPD's administrative-penalty machinery via OADIS.
The broader LGDPD obligations on the public administration — Articles 22 through 30 on conditions of accessibility for goods and services, transport, ICT and the built environment — apply alongside RD 1112/2018 and reach further than the WAD's website-and-mobile-app scope. They are the legal basis for accessibility requirements in public procurement (now bound also by Ley 9/2017 de Contratos del Sector Público), for the accessibility of state-funded cultural infrastructure, and for the digital-services provided by autonomous-community administrations operating in the residual scope not covered by RD 1112/2018.
The private-sector path: Ley 11/2023 and RD 193/2023
The European Accessibility Act — Directive (EU) 2019/882 — was transposed into Spanish law as Title V of Ley 11/2023, de 8 de mayo, a multi-directive omnibus transposition law. The substantive obligations on businesses took effect on the EU-wide application date of 28 June 2025. The companion Real Decreto 193/2023, adopted on 21 March 2023 under the LGDPD, sets the basic accessibility conditions for goods and services available to the public and operationalises the framework on a wider scope than the EAA's harmonised list — it reaches across goods and services in scope of the LGDPD's Article 22 even where the EAA does not specifically apply.
Title V of Ley 11/2023 covers the directive's full product and service scope: products include computer hardware and operating systems, self-service terminals (ATMs, ticket machines, check-in kiosks), consumer terminal equipment with interactive computing capability used for audiovisual media services, consumer terminal equipment for electronic communications services, and e-readers; services include electronic communications services, services providing access to audiovisual media, passenger-transport elements in air, rail, road and waterborne carriers, consumer banking services, e-books and dedicated software, and e-commerce services. Technical conformance is assessed against EN 301 549 as the harmonised standard, supplemented by sector-specific UNE standards where they have been adopted by AENOR.
The act borrows the directive's micro-enterprise carve-out: businesses with fewer than 10 employees and an annual turnover or balance-sheet total not exceeding €2 million are exempt from the service-side obligations (the product-side obligations run on a different test and capture manufacturers regardless of employer size). The transitional period for terminals already in use on 28 June 2025 extends until 28 June 2045, calibrated to the depreciation cycle of bank-branch ATMs and ticketing infrastructure. Existing service contracts may continue under their original terms until 28 June 2030.
Spain's chosen conformity-assessment mechanism follows the EAA Annex IV procedure: internal production control plus self-declaration by the manufacturer, evidenced by a technical file and accompanied by an EU Declaration of Conformity. The CE marking interaction is the standard route for in-scope hardware. The National Authority for Accessibility Compliance (Autoridad Nacional para el Cumplimiento de la Accesibilidad) is the designated market-surveillance authority under Ley 11/2023; the practical day-to-day work sits with OADIS and the relevant sectoral regulators — the Banco de España on consumer banking, the Comisión Nacional de los Mercados y la Competencia (CNMC) on electronic communications, the State Aviation Safety Agency (AESA) on air-transport accessibility, and the corresponding bodies for rail, road and waterborne transport.
The seventeen autonomous communities
The federal-style territorial structure of Spain means the national framework is mirrored — and in some areas tightened — by 17 autonomous-community accessibility acts, each with its own sanction schedule. The national LGDPD floor cannot be undercut; autonomous communities may impose stricter or more sector-specific obligations. For multi-region operators the practical consequence is that a single act of non-compliance can trigger parallel proceedings under both the national regime and the autonomous-community regime where the violation occurred.
Representative profiles. Catalonia's Llei 13/2014, de 30 d'octubre, d'accessibilitat is the most-cited autonomous-community accessibility act and the most aggressively enforced by the Generalitat; it covers the built environment, transport, communication and goods and services, with a three-tier penalty schedule reaching €90,000 for very serious infringements. Andalusia's Ley 4/2017 on the rights and care of persons with disabilities consolidates earlier regional statutes and adds a regional disability-rights commissioner. Madrid's Ley 8/1993 on the promotion of accessibility and the suppression of architectural barriers — substantially amended in 2020 — remains the framework for the built-environment dimension in the autonomous community of Madrid. Basque Country's Ley 20/1997 on the promotion of accessibility is one of the longest-standing regional acts. Galicia's Ley 10/2014, Valencia's Ley 1/1998, Aragon's Ley 3/1997, Asturias's Ley 5/1995, Cantabria's Ley 9/2018, Castilla y León's Ley 3/1998, Castilla-La Mancha's Ley 1/1994, Extremadura's Ley 11/2014, Balearic Islands's Llei 8/2017, Canary Islands's Ley 8/1995, La Rioja's Ley 5/1994, Navarra's Ley Foral 5/2010, and Murcia's Ley 4/2017 each contribute their own technical conditions, complaint mechanisms and sanction tables.
The co-official languages (Catalan in Catalonia, the Balearic Islands and the Valencian Community; Basque in the Basque Country and Navarra; Galician in Galicia) carry through into the accessibility-statement and consumer-information obligations: in-scope bodies must publish in the co-official language alongside Spanish where the autonomous-community rules so require. The harmonisation of the seventeen regional frameworks is a long-running policy debate; the National Accessibility Plan 2025–2030 contemplates a coordinating mechanism rather than substantive harmonisation, leaving the multi-jurisdictional compliance burden largely intact.
The cross-cutting backstop: LGDPD discrimination provisions and the Defensor del Pueblo
Beyond the sector-specific WAD and EAA tracks, the LGDPD's Title II creates a cross-cutting right to equal treatment and non-discrimination. Discrimination on grounds of disability — including the failure to provide reasonable accommodation and the placing on the market of products or services that systematically exclude persons with disabilities — is actionable in the civil courts under the LGDPD's tort-law provisions. There is no statutory cap on moral damages; awards in disability-discrimination cases have historically fallen in the €1,000–€30,000 range per claimant, with the higher end reserved for cases involving a documented class effect or particularly egregious conduct.
The Defensor del Pueblo (Ombudsman of Spain) operates a dedicated disability-rights work stream and is a routine escalation route for unresolved complaints against public administrations. Although the Ombudsman's recommendations are not legally binding, they carry significant weight in administrative-court appeals and feed directly into the annual report to the Cortes Generales. CERMI maintains a parallel monitoring function under the CRPD's Article 33 framework; CERMI's strategic-litigation arm has supported a string of accessibility cases reaching the Supreme Court (Tribunal Supremo), most notably in the banking-services and public-administration-portal spheres. The Tribunal Supremo's Contentious-Administrative Chamber has progressively interpreted accessibility failures as actionable discrimination, lowering the evidential bar for claimants who can demonstrate a systemic accessibility deficit.
Technical standards and conformance
Both the WAD and the EAA tracks anchor on the same EU harmonised standard, EN 301 549, currently v3.2.1, which imports WCAG 2.1 Level AA as its baseline web-content conformance requirement. The Spanish national standard UNE-EN 301 549, published by AENOR (the Spanish Association for Standardisation), is the Spanish-language adoption of the European standard and is the version cited in administrative practice. AENOR additionally certifies conformity through its accessibility-certification scheme, which has become a de facto market expectation in public-procurement tenders.
RD 193/2023 sets out the implementing technical conditions for goods and services across the LGDPD scope: it covers physical accessibility of premises serving the public, accessibility of ICT in retail and consumer environments, accessibility of consumer-facing documentation, and the cross-cutting obligation of reasonable accommodation. The decree introduces a graduated implementation calendar for legacy environments and aligns the conformity-assessment vocabulary used by Ley 11/2023 for EAA-regulated products and services with the broader LGDPD universe of "goods and services available to the public".
For accessibility statements under RD 1112/2018, the Commission Implementing Decision (EU) 2018/1523 model is followed in Spanish — and, where applicable, in the co-official languages. For private-sector accessibility information under Ley 11/2023, a structured consumer-information notice covering how the product or service was made accessible, where to direct accessibility complaints and which conformance standard underpins the declaration is the standard format.
Penalties — the full exposure stack
Spain's penalty regime is the heaviest in the EU EAA spectrum and operates on five layers. The administrative-fine table under the LGDPD as amended by Ley 11/2023 reaches the EU's highest ceiling; an autonomous-community fine schedule may run in parallel for the same act; procurement disqualification under Ley 9/2017 is often the dominant economic exposure; civil damages under the LGDPD's anti-discrimination provisions are uncapped; and EU Commission infringement procedures sit outside the national regime as state-level exposure. Figures in euros throughout.
Layer 1 — administrative fines under the LGDPD (as amended by Ley 11/2023)
The LGDPD's Title III, Chapter IV (Articles 81 to 95) operates a three-tier severity framework. Ley 11/2023 brought EAA-product and EAA-service infringements into this same framework, with the result that the EAA penalty ceilings in Spain are anchored on the LGDPD's pre-existing structure — itself the heaviest disability-rights administrative-fine regime in the EU.
| Tier | Typical violations | Range | Aggravators |
|---|---|---|---|
| Light (leve) | Procedural or documentation failures; missing accessibility statement on a public-sector site; minor technical-file gaps in an EAA product file | €301 – €30,000 | Combined with mandatory corrective-action order |
| Serious (grave) | Substantive non-conformance of a public-sector website or mobile app; substantive non-conformance of an EAA-regulated product or service; failure to remedy a corrective-action order | €30,001 – €300,000 | Recurrence doubles within the tier; can trigger procurement disqualification |
| Very serious (muy grave) | Repeated or systemic non-compliance affecting a class of consumers; false declarations of conformity; refusal to cooperate with market-surveillance authorities; recidivism within four years | €300,001 – €1,000,000 | Product recall; market-access bans; full procurement exclusion; public publication of the sanction decision |
| RD 1112/2018 (WAD) | Channelled through LGDPD tier framework for public-sector site and mobile-app non-conformance | Tiered as above | OADIS escalation; Defensor del Pueblo recommendation; CRPD reporting visibility |
Spain's €1,000,000 ceiling is the highest in the EU EAA-transposition spectrum. By comparison, Germany's BFSG §37 caps single-incident fines at €100,000; France's 2023 transposition ordinance allows administrative fines up to €50,000 per non-conforming product, with daily penalties for ongoing non-compliance; Italy's D.Lgs. 82/2022 caps at €40,000; the Netherlands has signalled exposure of up to 5% of annual turnover; Bulgaria's ZHU tops out at €100,000+ at the very-serious tier. Spain's choice to channel EAA penalties through the LGDPD's pre-existing very-serious ceiling reflects both the political weight CERMI carried in the transposition debate and a policy preference for headline-grade deterrence over a broader fine ladder.
Layer 2 — autonomous-community parallel penalties
Each of the 17 autonomous-community accessibility acts operates its own administrative-penalty schedule. For violations occurring within a single autonomous community, the regional regulator typically takes the lead and the national OADIS coordinates without imposing a parallel sanction. For violations that span multiple autonomous communities — common for digital services with national reach — parallel proceedings under each regional regime are legally possible. The non bis in idem principle constrains double-punishment for the same factual conduct under the same legal interest, but Spanish administrative-court jurisprudence has allowed parallel sanctions where the regional and national regimes protect distinct legal interests or where the conduct produces distinguishable effects in each jurisdiction. Catalonia's Llei 13/2014 sanction ceiling of €90,000 is illustrative of the regional ladder.
Layer 3 — public-procurement disqualification under Ley 9/2017
The Spanish Public Sector Contracts Act (Ley 9/2017 de Contratos del Sector Público) requires contracting authorities to incorporate accessibility from the technical-specification stage and treats serious LGDPD-penalty findings as grounds for exclusion from public-procurement tenders. For vendors selling into the Spanish public sector — which procures across €60 billion annually in central, autonomous-community and local-administration tenders combined — the loss of bid eligibility on an active tender (contract values typically €500,000 to several tens of millions of euros) routinely exceeds the triggering administrative fine by one to two orders of magnitude. Procurement disqualification is, for many regulated entities, the genuinely dispositive exposure layer.
Layer 4 — civil discrimination damages (uncapped)
The LGDPD's anti-discrimination provisions, combined with the general tort-law framework of the Civil Code, allow claimants to pursue civil claims for material and non-material damages in the ordinary courts. There is no statutory cap on moral damages. Awards have historically fallen in the €1,000–€30,000 range per claimant; class-effect cases and cases involving particularly vulnerable claimants have reached substantially higher figures. The Tribunal Supremo's recent jurisprudence has increasingly recognised web-accessibility failures as actionable disability discrimination — most prominently in cases against major Spanish retail banks over inaccessible online-banking services, against the State Tax Agency (Agencia Estatal de Administración Tributaria, AEAT) for inaccessible tax-filing portals, and against transport operators (RENFE, Adif) for inaccessible journey-planning systems.
Layer 5 — EU Commission infringement procedures
Spain has been the subject of open Commission proceedings on WAD transposition in earlier cycles. The 2025 Commission communication on financial sanctions sets the indicative minimum lump-sum payment for member-state non-compliance with a CJEU judgment at €6,832,000 for Spain, with daily penalty payments calculated from a base in the €4,000–€20,000 per day range multiplied by severity and duration coefficients. An open Commission procedure in the EAA space against any member state in 2026–28 remains a credible policy-pressure mechanism — and historically translates into more aggressive enforcement of existing administrative-fine powers by the national regulator.
Enforcement record and outlook
OADIS publishes an annual report on disability-rights complaints and accessibility supervision; the 2024 edition recorded a continued upward trend in digital-accessibility complaints, with the largest single category concerning public-administration portals (AEAT, Seguridad Social, and the autonomous-community e-government platforms in Catalonia and Madrid). CERMI's CRPD shadow report for the 2022 cycle catalogued enforcement gaps across the autonomous-community framework and pressed for the designation of a single national accessibility authority with binding enforcement powers — a request partially met by the Ley 11/2023 designation of the National Authority for Accessibility Compliance, although the institutional fit between the new authority and OADIS is still being worked out in practice.
High-profile enforcement matters in the last enforcement cycle have included accessibility findings against major Spanish retail banks over online-banking services, against AEAT for the accessibility of the Renta (annual tax return) filing portal, against RENFE and Adif over journey-planning and ticketing accessibility, and against several autonomous-community e-government platforms. Catalonia's enforcement record under Llei 13/2014 has been the most active among the autonomous-community frameworks; the Generalitat has used the regional procedure to impose sanctions in the upper part of the €90,000 ceiling on multiple occasions since 2020.
The European Commission's 2023–2024 WAD implementation review placed Spain in the second tier of member states — broadly compliant on transposition, with monitoring methodology aligned to Decisions 2018/1523 and 2018/1524, but with persistent concerns over the depth of in-depth-scan coverage and the consistency of enforcement responses across the autonomous communities.
What's coming in 2026–27
Three developments to watch. First, the first full enforcement cycle under RD 193/2023 and Title V of Ley 11/2023 runs from June 2025 through mid-2027; OADIS and the National Authority for Accessibility Compliance are expected to issue their first wave of administrative-penalty decisions on EAA-product and EAA-service non-compliance through the second half of 2026, with appeals reaching the Audiencia Nacional and the Tribunal Supremo in 2027. Second, the Plan Nacional de Accesibilidad 2025–2030, adopted in early 2025, sets concrete milestones for autonomous-community coordination, technical-standards harmonisation and CRPD-aligned reporting. Third, Spain's next periodic CRPD report falls due in 2027 and will measure progress against the CRPD Committee's 2022 Concluding Observations — with accessibility, deinstitutionalisation and the constitutional reform's downstream implementation as the three headline themes.
The practical compliance checklist for 2026
If you operate a Spanish national or autonomous-community public-sector website or mobile application: publish or refresh your accessibility statement against the Decision (EU) 2018/1523 model in Spanish (and the relevant co-official language); verify WCAG 2.1 AA conformance via EN 301 549 v3.2.1; submit to the national monitoring methodology rounds; route unresolved complaints through OADIS.
If you place an EAA-regulated product or service on the Spanish market under Ley 11/2023: assemble the technical file required under Title V; affix the CE mark where applicable; issue the EU Declaration of Conformity in Spanish; align your service to EN 301 549; designate a single point of contact for accessibility complaints; cooperate with OADIS and the relevant sectoral regulator (Banco de España, CNMC, AESA).
If you operate cross-autonomous-community — e.g. selling into both Catalonia and Madrid: overlay your national-floor compliance with the Catalan Llei 13/2014 requirements (including Catalan-language consumer information) and the Madrid Ley 8/1993 requirements; treat each autonomous community as an independent compliance jurisdiction with its own complaint and sanction route.
The through line
Spain combines the EU's heaviest national EAA penalty ceiling with a federal-style territorial structure that multiplies compliance jurisdictions by seventeen. The 2023 transposition closed the formal gap inside the EU deadline; the first enforcement cycle through 2026–27 will test whether the headline €1,000,000 figure gets used at the top of its range or remains a deterrence number — and whether the seventeen autonomous-community regimes converge on harmonised practice or continue to operate as parallel compliance burdens.
Read more from Disability World on the European Accessibility Act, the Web Accessibility Directive, WCAG 2.1, EN 301 549, and the UN CRPD.