Public-sector websites in the EU: what the accessibility rules require
For a public body, the website is no longer an optional communication channel. It is where residents check opening hours, download forms, find the right person to contact and read decisions that affect them. Across the EU, the websites and mobile apps of public-sector bodies also fall under one shared set of accessibility rules: Directive (EU) 2016/2102 of 26 October 2016, which every Member State has written into national law. In Ireland that is S.I. No. 358 of 2020; in Malta it is the Accessibility of the Websites and Mobile Applications of Public Sector Bodies Regulations (S.L. 418.03, Legal Notice 89 of 2019).
This article opens our series on public-body websites. It explains who the rules cover and what they require, then points to the articles on what a good public-body website should publish and where.
Who the rules cover
Both the Irish and the Maltese regulations define a public-sector body broadly: the State, regional and local authorities, bodies governed by public law, and associations formed by them. In practice that includes government departments, local authorities, agencies, and many schools, libraries, museums, arts centres and health and social-care bodies funded or controlled by the State.
There are a few exclusions. Neither set of regulations applies to public service broadcasters, or to non-governmental organisations that do not provide services essential to the public or services aimed at people with disabilities. Malta also excludes the websites of schools, kindergartens and nurseries, except for content relating to essential online administrative functions. The Irish regulations do not list that school exclusion.
Since 23 September 2020 the rules apply to all public-sector websites in both countries, and since 23 June 2021 to public-sector mobile apps.
What the website must do
The core requirement is that the website and apps are perceivable, operable, understandable and robust. Content that meets the harmonised European standard is presumed to conform. In practice websites are checked against EN 301 549, whose web requirements follow WCAG 2.1 Level AA: sufficient colour contrast, full keyboard use, meaningful link text, text alternatives for images, captions for video, correct headings and forms that work with screen readers.
Some content is out of scope, for example office documents published before 23 September 2018 that are not needed for active administrative processes, live video, third-party content the body neither funds nor controls, and archives that are no longer updated. A body may also claim that a specific requirement would be a disproportionate burden, but only after assessing its size, resources, costs and the benefit to users. The Maltese regulations state plainly that lack of priority, time or knowledge are not legitimate reasons.
The accessibility statement and feedback mechanism
Every public-sector website must publish a detailed, comprehensive and clear accessibility statement and update it regularly. It must explain which content is not accessible and why, describe the accessible alternatives, and give a description of and a link to a feedback mechanism so that anyone can report a problem or ask for inaccessible content in another form. It must also link to the enforcement or complaint procedure.
The response time differs by country. In Malta, a body must give an adequate response within 15 working days. In Ireland, the regulations require an adequate response within a reasonable period, and the statement must link to the redress provisions of the Equal Status Act 2000 and the Disability Act 2005.
Monitoring
Compliance is checked periodically by a national monitoring body: the National Disability Authority in Ireland and the Malta Communications Authority in Malta. In Malta the Authority can also investigate complaints, publish the name of a body that does not comply and, as a last step, impose an administrative fine. We cover this in more detail in the consequences of non-compliance with website accessibility rules.
One website or several?
The rules do not say how many websites a body should run. An organisation with regional offices, or a local authority with several libraries, museums or social-care units, can use one shared website, as long as each unit is easy to find: its own contacts, opening hours, services and responsible staff, no more than a few clicks from the home page. A shared platform makes consistent structure and accessibility easier to maintain, but only if navigation stays clear and every unit keeps its content up to date.
GDPR and cookies
An accessible website still has to respect data protection. Enquiry forms, event registrations and newsletter sign-ups collect personal data, so the site needs a clear privacy notice on what is collected, why and for how long. Non-essential cookies, including analytics, need consent before they are set, and a cookie banner must not nudge visitors towards accepting: in Ireland, the Data Protection Commission expects an option to reject, or to manage cookies, to be as prominent as the accept button. See GDPR requirements for public-sector websites.
The series: what a public-body website should publish
Beyond the legal accessibility duties, residents expect to find the same core information on every public-body website. The following articles describe good practice, section by section:
- The home page: what it should show
- Structure and contacts
- Integrity and whistleblowing
- Governance and accountability documents
- The Services section
- The Links section
- What happens when a website is not accessible
- Why public-sector websites often fail the people who use them
- Three best practices for building a public body’s website
A website that meets the accessibility rules and publishes this information clearly does more than tick a legal box. It makes the public sector easier to understand, easier to reach and easier to trust for every user.