Italy EAA Fines: €40,000, or 5% of Turnover Above €500m

Italy's EAA Fine Is €40,000 — Unless You Turn Over €500m, When It Becomes 5% of Turnover

Italy's EAA decree caps fines at €40,000. But AgID's own guidelines say that for large providers it applies a different sanction to the very same breaches: up to 5% of turnover. Here are both texts, and the trigger that switches between them.

Quick answer

Italy's EAA transposition (D.Lgs. 82/2022) sets an administrative fine of €5,000–€40,000 for breaching the accessibility obligations, plus €2,500–€30,000 for ignoring the regulator's orders or obstructing an inspection (Art. 24). But if you offer services to the public through a website or app and your average turnover over the last three years exceeds €500 million, AgID's published guidelines state that it applies the Stanca Law sanction instead — up to 5% of turnover — for breaching those same Art. 24(1) obligations. That sanction only bites if you ignore a formal notice to fix the problem. One regulator (AgID) runs both, under a sanctions procedure adopted in May 2026.

The €40,000 that isn't the whole story

Almost every "EAA fines by country" list gives Italy as €5,000–€40,000 and moves on. That figure is correct, and for most businesses it's the one that applies. It just isn't the ceiling.

Italy runs two accessibility laws in parallel — the same structural setup as France, but the mistake runs the opposite way. In France, people quote the other law's number and get a figure that's far too high. In Italy, people quote the EAA law's number and get a figure that's far too low for anyone large.

• The EAA track — D.Lgs. 82/2022. In force 16 July 2022, obligations applying from 28 June 2025. Covers the standard EAA menu: e-commerce, consumer banking, electronic communications, access to audiovisual media, e-books and e-readers, passenger transport services, self-service terminals, consumer computing hardware.
• The Stanca track — Legge 4/2004. Italy's original accessibility law, amended in 2018 to transpose the Web Accessibility Directive and extended to large private companies. Covers websites and mobile apps, and carries the 5%-of-turnover sanction.

What makes Italy unusual is that AgID has explicitly joined them: the 5% sanction from the older law is applied to breaches of the newer one.

What the law says

Start with the EAA decree's own penalty, Art. 24(1):

"...l'operatore economico che contravviene alle disposizioni di cui agli articoli 3, 6, commi da 1 a 8, 8 commi da 1 a 7, 9, commi da 1 a 4, 10 e 12, commi da 1 a 4, è punito con la sanzione amministrativa pecuniaria da 5.000 euro a 40.000 euro."

("...an economic operator who contravenes the provisions of Articles 3, 6(1)–(8), 8(1)–(7), 9(1)–(4), 10 and 12(1)–(4) is punished with an administrative pecuniary sanction of €5,000 to €40,000.")

— D.Lgs. 27 maggio 2022, n. 82, Art. 24(1) (Gazzetta Ufficiale)

Art. 24 then adds a second band of €2,500 to €30,000, in two separate commi: one for failing to comply with an order from the supervisory authority, one for failing to cooperate with an inspection. Art. 24(4) carves out breaches occurring inside public-procurement procedures, which are handled under the procurement code instead.

Now the Stanca Law. Its scope provision, Art. 3(1-bis), is what pulls large private companies in:

"La presente legge si applica altresì ai soggetti giuridici diversi da quelli di cui al comma 1, che offrono servizi al pubblico attraverso siti web o applicazioni mobili, con un fatturato medio, negli ultimi tre anni di attività, superiore a cinquecento milioni di euro."

("This law also applies to legal entities other than those referred to in paragraph 1 which offer services to the public through websites or mobile applications, with an average turnover, over the last three years of activity, exceeding five hundred million euro.")

— Legge 9 gennaio 2004, n. 4, Art. 3(1-bis)

And its penalty, Art. 9(1-bis), which is worth reading in full because the sequence matters:

"L'inosservanza delle disposizioni della presente legge da parte dei soggetti di cui all'articolo 3, comma 1-bis, è accertata e sanzionata dall'AgID... Se a seguito dell'istruttoria l'AgID ravvisa violazioni della presente legge, fissa il termine per l'eliminazione delle infrazioni stesse da parte del trasgressore. In caso di inottemperanza alla diffida di cui al periodo precedente, l'AgID applica la sanzione amministrativa pecuniaria fino al 5 per cento del fatturato."

("Non-compliance with this law by the entities referred to in Article 3(1-bis) is established and sanctioned by AgID... If, following its investigation, AgID finds violations of this law, it sets a deadline for the offender to eliminate them. In the event of failure to comply with that formal notice, AgID applies an administrative pecuniary sanction of up to 5 per cent of turnover.")

— Legge 9 gennaio 2004, n. 4, Art. 9(1-bis)

The sentence that connects the two

Here is the part that isn't in any English-language summary we've found. AgID's own service accessibility guidelines — the ones notified to the European Commission before adoption — state directly that the 5% sanction is what it applies to breaches of the EAA decree's obligations, once you're over the threshold:

"Ai soggetti erogatori che offrono servizi al pubblico attraverso siti web o applicazioni mobili, con un fatturato medio, negli ultimi tre anni di attività, superiore a cinquecento milioni di euro AgID applica la sanzione amministrativa pecuniaria fino al 5 per cento del fatturato in relazione alla violazione degli obblighi di cui all'articolo 24, comma 1, del decreto."

("For providers offering services to the public through websites or mobile applications, with an average turnover in the last three years of activity of more than five hundred million euro, AgID applies the administrative pecuniary sanction of up to 5 per cent of turnover in relation to the breach of the obligations referred to in Article 24(1) of the decree.")

— AgID, Linee guida sull'accessibilità dei servizi, § 4.2 (as notified to the Commission, TRIS notification 2026/27163)

Read that against Art. 24(1) and the effect is clear: the same breach, by the same company, is a €40,000 offence below the threshold and a 5%-of-turnover offence above it. At €500 million, 5% is €25 million — over 600 times the headline figure, and comfortably the largest accessibility exposure in the EU.

Two honest caveats. The 5% sanction's statutory home is the Stanca Law, and applying it to Art. 24(1) breaches is AgID's stated interpretation — one published in guidelines and notified to the Commission, but not yet tested in an Italian court. And the text says fatturato without specifying global or Italian turnover, which no case has yet resolved. Treat 5% as the stated ceiling for large providers, not a predicted bill.

The trigger: it's the notice you ignore, not the bug you shipped

The sequencing in Art. 9(1-bis) is the most practically useful thing in Italian accessibility law. The 5% is not a first-instance penalty. AgID investigates, and if it finds violations it sets a deadline to fix them. The sanction becomes available only "in caso di inottemperanza alla diffida" — on failure to comply with that formal notice.

So the event that produces a percentage-of-turnover fine in Italy is not an inaccessible checkout. It's an inaccessible checkout plus a missed AgID deadline. That is an entirely controllable risk, and it puts a premium on having someone who opens the regulator's correspondence.

One regulator, one procedure — new since May 2026

Italy's enforcement machinery was the gap until recently. Art. 21(1) of the EAA decree names the authority:

"L'Agenzia per l'Italia Digitale, in qualità di Autorità di vigilanza sui servizi, qualora sia in possesso di sufficienti elementi per ritenere che un servizio non sia conforme ai requisiti di accessibilità applicabili, ne valuta la conformità."

("The Agency for Digital Italy, as the Supervisory Authority for services, where it holds sufficient evidence to consider that a service does not comply with the applicable accessibility requirements, assesses its conformity.")

— D.Lgs. 82/2022, Art. 21(1)

And on 15 May 2026 AgID adopted Determinazione n. 84/2026, a regulation on how violations are established and the sanctioning power exercised, published in the Gazzetta Ufficiale on 23 May 2026. It consolidates two earlier regulations (Det. 357/2019 and 355/2022) into one framework covering both laws. It sets out:

• How a case starts. Complaints filed through AgID's platform, AgID's own periodic monitoring, or third-party reports — with preliminary investigation handled by the Difensore civico per il digitale (Digital Rights Ombudsman) inside AgID.
• Two phases. Phase one is pre-enforcement: AgID raises the issue, requests documentation, sets a proportionate deadline. Cases can close here with no penalty. Phase two starts only if non-compliance persists — formal contestation, right to submit observations, final decision by AgID's Director General.
• Defined clocks. Roughly 30 days to open sanction proceedings once non-compliance is confirmed, and around 90 days to conclude them.

Less than six months old, in other words: Italy has only just published exactly how it intends to fine people.

The Italian deadline nobody outside Italy knows about: 23 September

Separate from any fine, the Stanca Law carries an annual filing duty. Public administrations and the large private companies inside Art. 3(1-bis) must publish an accessibility statement (dichiarazione di accessibilità) through AgID's form every year by 23 September. It's dated, public, and trivially checkable — which makes a missing one the easiest possible way to appear on a regulator's list.

Who enforces it

AgID (Agenzia per l'Italia Digitale) — and that's the entire list. Its remit under Art. 21 extends even to consumer banking, the sector nearly every other member state hands to a financial regulator. Set that against the Netherlands (five regulators), Ireland (six) or Spain (up to 19 regional authorities): Italy is a single-regulator market, meaning one complaint channel, one interpretation, one set of guidelines.

Those guidelines landed in March 2026 (Determinazione n. 38/2026), built on an "accessibility by default and by design" standard — accessible in the ordinary configuration, without the user switching anything on, addressed across the whole service lifecycle rather than bolted on at the end. Reporting on them indicates a sceptical stance toward overlays and accessibility widgets as a compliance route.

Has it been enforced yet?

No confirmed sanctions under D.Lgs. 82/2022 have surfaced. But Italy is further along than "nothing has happened": the two missing pieces both arrived this year — the technical guidelines in March 2026, the sanctions procedure in May 2026. A regulator that has just documented its own fining process, and that already publishes a public complaint channel, is not one planning to leave the power unused.

What this means for your business

Answer one question first: is your average turnover over the last three years above €500 million?

• If yes, your Italian exposure is not €40,000 — it's a percentage-of-turnover sanction on the same breaches, plus an accessibility statement due every 23 September, and the Stanca obligation applies to your website and app whether or not anything you sell is on the EAA list.
• If no, Art. 24's €5,000–€40,000 band is your ceiling, with the €2,500–€30,000 cooperation penalty stacking on top of it.

Either way, the escalation trigger is the same and it's procedural: AgID gives you a deadline before it fines you. Get to EN 301 549 / WCAG 2.1 AA, keep dated documentation, and make sure a named person is watching for correspondence from AgID — because in Italy, the difference between a closed file and a percentage-of-turnover sanction is whether anyone answered the notice.

Frequently asked questions

What is the EAA fine in Italy?

€5,000 to €40,000 for breaching the accessibility obligations, plus €2,500 to €30,000 for failing to comply with the supervisory authority's orders or obstructing an inspection — Art. 24, D.Lgs. 82/2022.

Is it true Italy can fine 5% of turnover?

Yes, for large providers. Under Legge 4/2004 Art. 9(1-bis), AgID can impose up to 5% of turnover on entities offering services to the public via websites or apps with average turnover above €500 million — and AgID's published guidelines apply that sanction to breaches of the EAA decree's Art. 24(1) obligations. It only becomes available after a formal notice to fix the problem is ignored.

Who enforces accessibility in Italy?

AgID, for both laws — including consumer banking, which most member states route to a financial regulator. Complaints are investigated by the Difensore civico per il digitale.

Is my company inside the Stanca Law?

If your average annual turnover over the last three years exceeds €500 million and you offer services to the public through a website or app, yes — independently of whether the EAA covers what you sell.

What happens on 23 September?

It's the annual deadline for publishing the accessibility statement, for public administrations and for the large private companies in Stanca Law scope.

Related

• ← Back to EAA Fines by Country — the full 27-state comparison
• Official text: D.Lgs. 27 maggio 2022, n. 82 (Gazzetta Ufficiale)
• France's EAA penalty — the other two-law country, where the confusion runs the opposite way
• Poland's EAA fine — the other formula country, where turnover lowers the cap instead of raising it