In the previous lesson we mentioned "legal risk" as one of the reasons to invest in accessibility. Now we develop it: we offer a map of the legal and regulatory framework that mandates or recommends web accessibility, focused on Europe, Spain, and the United States. You will see that almost all of these laws share the same common denominator, a reference technical standard called WCAG, which they almost always require at its AA level. The goal of the lesson is for you to know which standards exist, who they bind, and what they ask for, so you can place any project—including Cursalia's—in its legal context. We will not go into how WCAG is structured internally: that is the topic of the next lesson (01-04).

1. WCAG: the reference technical standard
2. The European framework: EN 301 549 and the European Accessibility Act (EAA)
3. The Spanish framework: RD 1112/2018 and transposition of the EAA (Law 11/2023)
4. The United States framework: ADA and Section 508
5. Comparative table of the regulatory framework
6. A caution: the legal framework evolves

Before talking about laws, it is worth understanding their common technical basis. WCAG (Web Content Accessibility Guidelines) is an international standard published by the W3C that defines, in a measurable way, what it means for web content to be accessible. It is not a law: it is the yardstick that laws adopt.

The key point for this lesson is that most regulations in the world do not reinvent the technical requirements: they simply say "you must comply with WCAG, usually at level AA." That is why WCAG appears again and again in the comparative table. How WCAG works internally (its POUR principles, its criteria, and its A/AA/AAA levels) we will look at in lesson 01-04; here it is enough to know that it is the technical reference.

EN 301 549 is the European technical standard for accessibility of information technology products and services (including websites and apps). In practice, its web section incorporates the WCAG criteria (as of today, WCAG 2.1 level AA). It is the standard that European laws cite when they want to require "measurable" accessibility.

The European Accessibility Act (EAA), Directive (EU) 2019/882, is the major recent development. It is a directive that harmonizes accessibility requirements across the entire EU and, very significantly, extends the obligation to the private sector for a list of products and services considered key: e-commerce, banking, transport, e-books, electronic communications, and so on.

Its date of application is 28 June 2025. From that point on, many private companies that until then had no explicit digital accessibility obligations must comply with them. For a service like Cursalia (online learning with payments/enrollments), the EAA is a strong reason not to leave accessibility for later.

Spain brings these European directives into its legal system with two main pieces:

Royal Decree 1112/2018 transposes Directive (EU) 2016/2102 and regulates the accessibility of websites and mobile applications in the public sector (administrations, bodies, and entities that receive public funding). It requires accessibility compliance in line with EN 301 549 (and therefore WCAG), and it adds specific obligations such as publishing an accessibility statement and offering a communication/complaint mechanism for users.

Law 11/2023 (and its implementing regulations) is the piece that transposes the European Accessibility Act in Spain, extending accessibility obligations to the private sector for the products and services covered by the EAA, with an application reference of 2025. In other words: what RD 1112/2018 did for the public sphere, this transposition does for much of the private one.

The ADA is a 1990 civil rights law that prohibits discrimination on the basis of disability. Although it predates the modern web and does not mention a specific technical standard, U.S. courts have consistently interpreted that the websites of businesses open to the public (Title III) must be accessible, and in practice WCAG 2.x AA is taken as the reference criterion. This has generated a great deal of litigation: the U.S. is the country with the most web-inaccessibility lawsuits.

Section 508 of the Rehabilitation Act requires that the technology (including websites) of U.S. federal agencies—and of their vendors—be accessible. Its technical standard is aligned with WCAG 2.0 AA (through the "508 Refresh").

This table is the operational summary of the lesson. Look at the right-hand column: almost all of them converge on WCAG, level AA.

Quick read: if you are building a digital product today and don't know what level will be required of you, aim for WCAG 2.1 level AA. It is the common denominator across almost the entire planet and puts you in compliance in most jurisdictions. What exactly "2.1" and "AA" mean you will see in lesson 01-04.

Applied to Cursalia: since it is an online learning platform operating in Spain/the EU with enrollments and payments, it falls within the type of services that the EAA (and its Spanish transposition) push toward mandatory compliance for the private sector from 2025. Its reasonable target is therefore WCAG 2.1 AA.

An essential precaution in any lesson on legislation:

The legal framework changes continuously. New laws are published, technical standards are updated (WCAG evolves toward newer versions), and specific dates and details (for example, thresholds by company size, exceptions, or microenterprises in the EAA) have nuances that are simplified here for teaching purposes.

This course gives you the general background needed to understand the landscape and speak about it accurately, but it is not legal advice. For any decision with legal consequences—determining whether your product is bound, which exceptions apply, or which specific deadlines govern—always consult a legal professional or your compliance team and check the current text of the standard. The dates and references in this lesson reflect the state of affairs at the time of writing and must be confirmed.

• Believing "I'm not the public sector, nothing binds me." With the EAA (2025) and its transposition, many private companies in key services already have obligations. Don't take it for granted: verify it.
• Thinking the U.S. ADA "doesn't affect me from Europe." If you sell to a U.S. audience, ADA litigation can reach you. Geographic scope matters based on where your users are.
• Confusing the technical standard (WCAG/EN 301 549) with the law. The law mandates; the standard defines what to comply with. Laws rely on the standards.
• Setting the AAA level "just in case." Hardly any law requires it and it is usually unattainable for an entire site; the standard target is AA (we'll see this in 01-04).
• Tip: document your conformance. An accessibility statement is not only mandatory in the public sector: it is a good practice that demonstrates due diligence.

Exercise 1. Cursalia is a private e-learning platform based in Spain with users in Spain. Which standards from the European/Spanish landscape affect it most directly, and what WCAG level should it adopt as a target? Justify it in 3-4 sentences.

Exercise 2. Match each standard with its scope of application:

1. RD 1112/2018 · 2. Section 508 · 3. EAA (Dir. 2019/882) · 4. ADA Title III
   • a) U.S. federal agencies and their vendors.
   • b) The Spanish public sector.
   • c) The EU private sector for key services.
   • d) Businesses open to the public in the U.S.

Exercise 3. A manager states: "Since we comply with WCAG, we don't need to consult anyone on the legal side." What would you tell them, bearing in mind the caution from this lesson?

Solution 1. As a private online learning service with enrollments/payments operating in Spain-EU, it is affected by the European Accessibility Act and its Spanish transposition (Law 11/2023), which push accessibility onto the private sector from 2025; the technical reference is EN 301 549, which incorporates WCAG 2.1 AA. The reasonable target for Cursalia is therefore WCAG 2.1 level AA. (RD 1112/2018 would affect it directly only if it received public funding or provided services to the public sector.)

Solution 2. 1-b · 2-a · 3-c · 4-d.

Solution 3. Complying with WCAG covers the technical requirement, but the legal framework evolves and has nuances (exactly who each standard binds, exceptions, deadlines, formal obligations such as the accessibility statement). Determining the specific legal scope requires checking the current standard and consulting legal/compliance. Meeting WCAG AA is an excellent baseline, but it does not replace legal advice.

We have walked through the legal and regulatory framework of accessibility: WCAG as the reference technical standard; in Europe, EN 301 549 and the European Accessibility Act (application 2025) that reaches the private sector; in Spain, RD 1112/2018 (public) and the transposition of the EAA / Law 11/2023 (private); and in the U.S., the ADA and Section 508. The pattern is clear: almost all of them converge on WCAG 2.1 AA, so that is the default target of any project, including Cursalia. And don't forget the caution: the framework changes, and legal decisions must be confirmed with a professional.

All these laws point to a single technical standard, so it is time to open it up and understand it from the inside. In the next lesson, "Introduction to WCAG," we will look at what exactly WCAG is, how it is organized (principles, guidelines, criteria, and techniques), what the A/AA/AAA levels mean, and how its 2.0, 2.1, and 2.2 versions differ.