Who has to comply
Public-sector since 2018; consumer services from 28 June 2025.
Cyprus is a small island market with a large tourism and international-services sector, so many foreign sellers and platforms reach Cypriot consumers, frequently in both Greek and English. Under the EAA-implementing legislation extending Law 6(I)/2018, a non-EU store selling to Cypriot consumers is covered on the country-of-consumption basis. A Greek-language accessibility statement is mandatory; tourist-facing services commonly add English, but Greek cannot be omitted for a service aimed at Cypriot residents.
What the law actually requires
The technical baseline is WCAG 2.1 Level AA via EN 301 549. EN 301 549 references WCAG 2.1 Level AA in full and adds a few requirements specific to mobile apps and documents. Beyond the technical bar, Cyprus requires the following operational items, which auditors check first because they are simple to verify:
- EN 301 549 / WCAG 2.1 AA
- Greek-language statement
Penalties and how enforcement actually works
Administrative fines under EAA-implementing legislation.
Enforcement runs through the Department of e-Communications within the Deputy Ministry of Research, Innovation and Digital Policy, which administered the 2018 public-sector regime and now extends to covered consumer services. Cyprus's model is centralised and complaint-driven, with administrative fines under the EAA-implementing legislation. As one of the EU's smallest administrations, its first enforcement cycle is likely to concentrate on plainly visible failures and the presence of a compliant Greek-language statement rather than exhaustive technical audits.
Most enforcement starts with a complaint or a routine sweep. The first signal is usually a written notice giving you 30–60 days to remediate before fines kick in.
Practical first steps for a Cyprus site
If you are starting now and want to land before enforcement, run an automated audit, fix the high-impact issues (contrast, labels, keyboard, focus), publish an accessibility statement, and set up a feedback inbox. That sequence covers 80% of what auditors look for in a first sweep.
- Run a baseline scan to know your current score
- Fix critical and serious issues in priority order — these are the ones cited in complaints
- Publish a public accessibility statement on a stable URL (Cyprus regulators expect this discoverable)
- Add a feedback channel and answer within the country-specified window
- Re-scan after every major release; track regressions