Luxembourg EAA Fines: €500,000, But Only in Court

Luxembourg's €500,000 EAA Fine — and Why Its Regulator Can't Impose It

€500,000, rising to €1,000,000 for a repeat offence, is one of the highest accessibility penalties in the EU. It's also a criminal fine that only a court can hand down. Luxembourg's accessibility regulator cannot fine you for an inaccessible service at all — its powers run to €15,000, and only for getting in its way.

Quick answer

Luxembourg's EAA law (the Loi du 8 mars 2023) splits sanctions in two, and the split is the whole story. Art. 33 sets a criminal fine of €251 to €500,000 for breaching the substantive accessibility obligations, rising to €500 to €1,000,000 on recidivism — imposed by the criminal courts. Art. 32 gives the regulator, a purpose-built agency called OSAPS, administrative fines of €250 to €15,000 — but only for refusing documents, obstructing surveillance, or ignoring its decisions. Being inaccessible is not on OSAPS's fining list. What OSAPS can do directly is prohibit or restrict your product or service on the Luxembourg market, including temporarily while it investigates. No sanctions have been reported under either track.

A top-tier ceiling, and one of the smallest markets it applies to

Luxembourg sits at or near the top of most EAA penalty tables, and unlike the Netherlands or France the figure survives checking — €500,000 is real. Two things about it are routinely missed, and both change what it means for a business.

It's criminal, not administrative. Most member states enforce the EAA through a regulator issuing administrative fines. Luxembourg put its big number in the penal track, where it needs a prosecution and a conviction.

The regulator's own power is a fraction of it — and points somewhere else entirely. Read Arts. 32 and 33 side by side and you find something unusual: there is no administrative fine in Luxembourg for simply failing the accessibility requirements. That breach is criminal or nothing.

Set against all that, Luxembourg has roughly 680,000 residents. It has one of the EU's harshest penalty regimes and one of its smallest consumer markets.

What the law says

The regulator's track — Art. 32:

« (1) L'OSAPS peut infliger une amende de 250 euros à 15 000 euros à tout opérateur économique qui : 1° refuse de fournir les documents et informations ou autres renseignements demandés dans le cadre de la surveillance du marché et dans le cadre de la conformité des services ; 2° fait obstacle à l'exercice de la surveillance du marché et de la conformité des services. (2) L'OSAPS peut infliger une amende de 250 euros à 15 000 euros à tout opérateur économique qui ne respecte pas ses décisions prises en vertu de l'article 24, paragraphe 2, et de l'article 25, paragraphe 3. »

("(1) OSAPS may impose a fine of €250 to €15,000 on any economic operator which: 1° refuses to supply the documents, information or other particulars requested in the course of market surveillance or service-conformity checks; 2° obstructs the exercise of market surveillance or service-conformity checks. (2) OSAPS may impose a fine of €250 to €15,000 on any economic operator which fails to comply with its decisions taken under Article 24(2) and Article 25(3).")

— Loi du 8 mars 2023, Art. 32(1)–(2) (Legilux)

Note what is absent. Both limbs are about your conduct toward the regulator, not toward disabled users. Fines are payable within 30 days of notification even if you appeal, with a recours en réformation to the administrative tribunal within three months (Art. 32(3)), and recovery goes to the Registration Duties, Estates and VAT Authority (Art. 32(4)).

The court's track — Art. 33:

« (1) À l'exception des cas visés à l'article 6, paragraphe 4, et à l'article 16, paragraphe 1er, est puni d'une amende de 251 euros à 500 000 euros tout opérateur économique qui contrevient aux dispositions de l'article 6, paragraphes 1er, 2, 3, 5, 6 et 7, et des articles 9, 11, 12, 13 et 15. Cette amende est proportionnée à l'étendue et la gravité de la non-conformité, du nombre d'unités de produits ou services non conformes et du nombre de personnes concernées. »

("(1) Save in the cases referred to in Article 6(4) and Article 16(1), any economic operator which contravenes Article 6(1), (2), (3), (5), (6) and (7) and Articles 9, 11, 12, 13 and 15 is punished by a fine of €251 to €500,000. That fine is proportionate to the extent and gravity of the non-conformity, the number of non-conforming units of products or services, and the number of persons affected.")

— Loi du 8 mars 2023, Art. 33(1)

Two exceptions are written into the opening words, and they matter: the criminal fine does not reach cases covered by Art. 6(4) — the blanket exemption for micro-enterprises providing services — or by Art. 16(1) — the fundamental-alteration and disproportionate-burden defence. If either applies to you, the €500,000 is not in play at all.

On repeat offences, the law is not permissive:

« (2) Tout opérateur économique ayant été condamné à une amende prévue au paragraphe 1er sera condamné à une amende de 500 euros à 1 000 000 euros à titre de récidive. »

("(2) Any economic operator which has been sentenced to a fine under paragraph 1 shall be sentenced to a fine of €500 to €1,000,000 for recidivism.")

— Art. 33(2)

Sera condamné, not pourra être condamné. Once you have one conviction, the higher band is mandatory, not a discretion the court may decline to exercise.

And the provision we haven't found anywhere else in the 27 transpositions — a conviction that travels:

« (3) Les condamnations définitives prononcées dans un État membre de l'Union européenne sont prises en considération aux fins d'établissement de la récidive pour autant que les infractions ayant donné lieu à ces condamnations sont également punissables suivant les dispositions de la directive (UE) 2019/882 telle qu'elle a été transposée par l'État membre de l'Union européenne concerné. »

("(3) Final convictions handed down in a European Union member state are taken into account for the purpose of establishing recidivism, provided that the offences giving rise to those convictions are also punishable under Directive (EU) 2019/882 as transposed by the member state concerned.")

— Art. 33(3)

An accessibility conviction anywhere in the EU can put you straight into Luxembourg's €1,000,000 band. Finally, Art. 33(4) allows courts to order « la confiscation et la destruction des biens ayant servi à l'infraction ainsi que la confiscation des bénéfices illicites » — confiscation and destruction of the goods used in the offence, and confiscation of the illicit profits.

What OSAPS can do to you without going near a court

This is the commercially relevant part, and it involves neither fine. Art. 28 gives OSAPS direct power over your access to the market — including a temporary ban imposed while it is still checking:

« 1° interdit ou restreint la fourniture d'un service qui n'est pas conforme aux conditions prévues dans la présente loi... ; 2° interdit temporairement, pendant la période nécessaire aux différents contrôles, de fournir ou de proposer de fournir un service lorsqu'il existe des indices précis et convergents concernant leur non-conformité... »

("1° prohibits or restricts the provision of a service which does not comply with the conditions laid down in this law...; 2° temporarily prohibits, for the period necessary for the various checks, the provision or the offering of a service where there are precise and converging indications of non-compliance...")

— Art. 28(2)

The product-side equivalent in Art. 28(1) goes further still, adding recall, withdrawal, modification and destruction. Decisions are lifted once OSAPS confirms you've fixed the problem within its deadline (Art. 28(4)), and are appealable to the administrative tribunal within three months (Art. 28(5)).

Three further features make Luxembourg's surveillance unusually sharp for a country this size:

• You pay for the inspection that catches you. « En cas de constatation d'un manquement... les frais de surveillance du marché ou de la vérification de la conformité des services qui ont été à la base de cette constatation de non-conformité sont à charge du fabricant ou de son mandataire » — falling to the EU importer, or failing that the reseller, where there is no EU-established manufacturer (Art. 30(5)).
• OSAPS officers are judicial police officers. Art. 29 gives category A and B officers that status after special training and an oath sworn before the Luxembourg district tribunal, and makes the Penal Code's professional-secrecy article applicable to them. Art. 30 extends entry to premises « de jour et de nuit » where there are serious indications of an infringement, with dwellings requiring an investigating judge's warrant and confined to 6:30am–8pm. Inspectors need not announce themselves in the publicly accessible parts of a retail outlet when checking markings or visually obvious conformity criteria (Art. 30(3)).
• Anyone can report you. « Toute personne physique ou morale peut également signaler la non-conformité d'un produit à l'OSAPS » (Art. 22(1)), with the identical rule for services in Art. 25(2). Not just customers — competitors, campaigners, anyone. OSAPS can also open a case on its own motion.

A regulator built from scratch

Most member states handed the EAA to an existing body. Luxembourg created one. The Office de la surveillance de l'accessibilité des produits et services (OSAPS) exists only for this law, sits under the minister responsible for disability policy, and is headed by a director appointed by the Grand Duke on the government's proposal (Art. 3).

Its remit under Art. 4 is mostly not punitive: verifying that claimed derogations are justified, providing guidance and tools specifically for micro-enterprises, publishing indicative examples of compliant solutions, collecting statistics tied explicitly to Article 31 of the UN Convention on the Rights of Persons with Disabilities, and consulting the Conseil supérieur des personnes handicapées. A small, advice-first agency that also carries police powers and a market kill-switch — that combination is the thing to understand about Luxembourg, more than the €500,000.

Two Luxembourg-specific details worth knowing

You can file in English. Safety instructions accompanying a product must be in at least one of the three administrative languages (Art. 9(7)), but the documents you hand to OSAPS, Customs or the Police to prove conformity may be « dans au moins une des trois langues administratives... ou en anglais » (Arts. 9(9), 11(9)), and the technical documentation behind the EU declaration of conformity likewise (Art. 18(2)). Distributors get no English option on the instructions they pass on (Art. 12(2)) — worth knowing if you're the last link in the chain.

Terminals get up to twenty years. Self-service terminals already lawfully in use before the law took effect may continue in service « jusqu'à la fin de leur durée de vie économiquement utile, cette période ne pouvant dépasser vingt ans après leur mise en service » (Art. 34(3)). This is an option the Directive itself offers member states, and Luxembourg took it in full: a cash machine or ticket kiosk commissioned in early 2025 can legitimately remain inaccessible into the mid-2040s. So a non-compliant terminal in Luxembourg is not, by itself, evidence of a breach. The general service transition is shorter: pre-existing products used to deliver services, and contracts signed before the law, run to 28 June 2030 at the latest (Art. 34(2)).

Has it been enforced yet?

No sanctions have been reported under either track. OSAPS became operational with the law on 28 June 2025 and its public posture so far is guidance, exemption-validation and inspection rather than penalties. And because the €500,000 sits in the criminal track, a first Luxembourg case needs a prosecutor to take it up — slower and higher-threshold than a regulator writing a fine.

The realistic near-term risk is therefore not the headline number. It's a temporary prohibition under Art. 28(2) while OSAPS checks, a €15,000 obstruction fine if you're unhelpful, and a bill for the testing.

What this means for your business

Don't budget against €500,000 — budget against being told to stop selling, possibly before any finding has been made. The sequence that threatens a business in Luxembourg is: someone reports you (anyone can), OSAPS opens a check, temporarily prohibits the service on precise and converging indications, charges you for the testing, and adds up to €15,000 if you obstructed it.

Which makes the advice unusually concrete:

1. Get to EN 301 549 / WCAG 2.1 AA, and keep the conformity documentation — in English if you prefer.
2. Cooperate with OSAPS, because obstruction is the only thing it can fine you for directly.
3. If you're a micro-enterprise providing services, check Art. 6(4) first — Luxembourg applies the EAA's full exemption cleanly, and Art. 33(1) expressly carves those cases out of the criminal fine.
4. If you're relying on disproportionate burden, note that Art. 16(6) removes the defence entirely where you received outside funding to improve accessibility, and Art. 16(5) requires you to redo the assessment when the service changes, on OSAPS request, and at least every five years.

Frequently asked questions

What is the EAA fine in Luxembourg?

A criminal fine of €251 to €500,000, rising to €500 to €1,000,000 for a repeat offence (Art. 33), imposed by the courts. Separately, OSAPS can impose administrative fines of €250 to €15,000 (Art. 32) for obstruction or for ignoring its decisions.

Does the €500,000 double for repeat offences?

Not exactly. Recidivism moves you into a different band — €500 to €1,000,000 — rather than doubling whatever you were fined the first time. And under Art. 33(2) the court shall impose it, not may.

Can the regulator fine me €500,000 for an inaccessible website?

No. OSAPS's ceiling is €15,000, and it cannot fine you for the accessibility breach itself at all — only for obstructing it or ignoring its decisions. The substantive breach is a criminal matter for the courts.

Does a conviction in another EU country affect me in Luxembourg?

It can. Art. 33(3) counts final convictions in other member states toward establishing recidivism, provided the conduct is punishable under that state's own EAA transposition.

What's the most likely thing to happen?

A prohibition or restriction on providing your service in Luxembourg — available temporarily even while checks are ongoing — plus the cost of the market-surveillance testing.

Do I have to submit documents in French?

No. Conformity documentation for OSAPS, Customs or the Police may be in French, German, Luxembourgish or English.

Related

• ← Back to EAA Fines by Country — the full 27-state comparison
• Official text: Loi du 8 mars 2023 (Legilux)
• Ireland's EAA fines — the other criminal regime, with prison and director liability
• Italy's EAA fine — where a percentage of turnover beats even Luxembourg's ceiling