WCAG 2.2 is now ISO/IEC 40500:2025
The Web Content Accessibility Guidelines 2.2 were formally ratified as an international standard in October 2025. For most EU agencies and their clients, this looks like procedural news — but it changes a few specific things about procurement contracts, EU baseline standards, and what your audit reports should reference. Here's what shifted, what didn't, and what to update before the next client engagement.
On This Page
What changed in October 2025
On October 1, 2025, the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) approved WCAG 2.2 as ISO/IEC 40500:2025. This follows the same path WCAG 2.0 took back in 2012 (becoming ISO/IEC 40500:2012) and gives the W3C's 2.2 specification identical formal status as a recognized international standard.
The substance of the standard didn't change. WCAG 2.2 was published as a W3C Recommendation in October 2023 with nine new success criteria on top of WCAG 2.1. What changed is who recognizes it, and which procurement language can now reference it formally.
TL;DR:ISO ratification is procedural. WCAG 2.2 didn't get harder. But procurement teams in regulated industries can now cite it as an international standard, which matters for some EU contracts.
ISO vs W3C: why both matter
The W3C is a member-led web standards body. ISO is the global standards body that governments, regulators, and procurement offices reference when they need a formal, internationally recognized standard. They co-exist:
- W3C WCAG 2.2: the authoritative source. The W3C maintains it, runs the Accessibility Guidelines Working Group, and publishes the techniques and understanding documents that practitioners actually use day to day.
- ISO/IEC 40500:2025: the same content under an international standard number. When a procurement contract says “must conform to ISO/IEC 40500” it means WCAG 2.2 — but it's a legal hook some contracting frameworks need.
Practical implication: if you've been writing audit reports that cite “WCAG 2.2”, you're still correct. If a client's legal or procurement team comes back asking for “ISO 40500”, you can now reference both names without changing scope.
Does this change EAA compliance?
Short answer: no, not yet. The European Accessibility Act doesn't reference WCAG directly — it references EN 301 549, the harmonized European standard. EN 301 549 currently bases its web requirements (clause 9) on WCAG 2.1 Level AA.
So as of right now (mid-2026):
- EAA compliance is assessed against WCAG 2.1 AA via EN 301 549.
- WCAG 2.2 AA is backward compatible with WCAG 2.1 AA — meeting 2.2 means you also meet 2.1.
- Auditing to WCAG 2.2 AA is therefore safe: you cover the current EAA bar plus the upcoming one.
The interesting question is whether and when EN 301 549 upgrades its WCAG reference to 2.2. ETSI, CEN, and CENELEC (the bodies that maintain EN 301 549) are working on a revised version. The current published version is V3.2.1 (March 2021). A V4 with WCAG 2.2 alignment has been in draft for some time and is expected in 2026 — but no firm public release date yet.
EN 301 549 update timeline
Here's the realistic timeline EU agencies should plan for:
EAA compliance bar = WCAG 2.1 AA. EN 301 549 V3.2.1 in force. Audit reports should reference WCAG 2.1 AA at minimum. Calling out WCAG 2.2 AA conformance is a strong-but-not-required signal.
EN 301 549 V4 expected to publish, aligning to WCAG 2.2 AA. Once published and harmonized in the EU Official Journal, the EAA technical bar effectively shifts to 2.2 AA — though existing engagements stay on the version they were audited against unless re-scoped.
WCAG 3.0 may emerge as a W3C Recommendation. ISO ratification of 3.0 (if the working group produces it) would follow some years later. EAA technical references will lag behind W3C by 3 to 6 years as a structural matter — that lag is not a bug, it's how regulatory standards work.
Procurement and RFP impact
The biggest practical change since October 2025 is in procurement contracts and RFPs. Several EU public-sector buyers and large enterprises have started referencing both names in their boilerplate:
- “Vendor must demonstrate conformance to WCAG 2.2 Level AA / ISO/IEC 40500:2025 across all customer-facing digital surfaces.”
- “Deliverables shall include an accessibility conformance report aligned to ISO/IEC 40500:2025 and EN 301 549.”
If you're bidding on EU public-sector tenders or enterprise contracts that route through formal procurement, check the latest version of the procurement language. The ISO number is now a practical filter — RFPs that reference it expect a vendor that knows what it means.
For agency-resold work, this affects the mid-market less directly. A boutique agency selling a 1,500 € audit to a fashion D2C brand isn't going to see ISO/IEC 40500 in the contract. But a 5,000 € public-sector tender will name it.
What EU agencies should do this quarter
Concrete moves to make in your delivery and sales motion:
- 1Update audit report templates to mention both names
Add ISO/IEC 40500:2025 alongside WCAG 2.2 AA in your conformance section. One sentence: “This report assesses conformance to WCAG 2.2 Level AA, also published as ISO/IEC 40500:2025.” That's the entire change.
- 2Quote against WCAG 2.2 AA, not 2.1
If you've been quoting EAA-driven audits against WCAG 2.1 AA, switch to 2.2 AA going forward. Same effort, broader coverage, future-proofed when EN 301 549 V4 lands.
- 3Watch for the 9 new criteria in your audits
Target Size (Minimum), Focus Not Obscured, Dragging Movements, Consistent Help, Redundant Entry, Accessible Authentication. These show up most in checkout flows, dashboards, and authenticated areas.
- 4Add an ISO/IEC 40500 mention to your trust page
Procurement teams searching for vendors increasingly include the ISO number in their queries. A short mention on your trust or capabilities page gets you into shortlists you weren't in before.
- 5Don't panic-rerun old reports
Audits delivered before the ISO ratification are still valid. They reference WCAG 2.2 (or 2.1, if older). You don't need to reissue anything. Add the ISO note for the next engagement onward.
Common questions
Do I need to re-audit sites that were tested against WCAG 2.1 AA?
No. WCAG 2.1 AA conformance from before the ISO ratification is still a valid finding for EAA purposes (EN 301 549 V3.2.1 still references 2.1). Re-audit when the underlying site changes substantially or when EN 301 549 V4 publishes — not because of the ISO number.
Should I tell clients we’re ‘ISO certified’?
No. There’s no such thing as an ISO certification for an audit firm under 40500. The standard is a content standard (criteria for the website to meet), not a process standard like ISO 9001. You audit websites against ISO/IEC 40500:2025; you yourself are not certified to it.
Does the EAA reference ISO/IEC 40500:2025?
Not directly. The EAA references EN 301 549 as the harmonized European technical standard. EN 301 549 then references WCAG (currently 2.1, expected to update to 2.2). The ISO number doesn’t appear in EAA enforcement — but it appears in many adjacent procurement contexts.
Will EU member states update their national laws?
BFSG, RGAA, Ley 11/2023, Legea 232/2022, and other national transpositions all reference EN 301 549, not WCAG directly. They’ll automatically inherit the WCAG 2.2 reference once EN 301 549 V4 is harmonized. No legislative change required at the national level.
Audit a client site against WCAG 2.2 AA
Every paid audit ships with a cover page that names the conformance bar — WCAG 2.2 AA / ISO/IEC 40500:2025, EN 301 549, and the EAA national transposition relevant to the client's home market. Free scan if you're still qualifying.