Who delivers EU compliance audits for WordPress?
WP Poland is one senior developer, Mariusz Szatkowski, working with WordPress since 2006 from Gdynia. I run each EU compliance audit myself, on WooCommerce stores, regulated-sector portals and sites sold into public procurement, without bringing in anyone else. I sit on the WordCamp Europe organising team (2024-2027), which keeps my practice tied to accessibility and security practitioners across Europe, not just directive summaries.
What does the EU compliance audit include?
One purchase, three regimes on the WordPress layer:
- Accessibility (EAA / WCAG 2.2 AA) - storefront, checkout, forms, media
- Cybersecurity and supply chain (NIS2 / DORA) - plugins, hosting, ICT integrations, incident path
- AI Act - labelling of AI-generated content, on-site model usage policies
Deliverables: written report, prioritised remediation backlog, procurement evidence pack.
Where is the audit available?
I work remotely for clients in Poland, Germany, the Nordics, Portugal, Spain, and the wider EU. Report languages: English and Polish. The audit needs staging access or a production copy with read-only restrictions where possible.
How much does the EU compliance audit cost?
Individual quote - depends on how many regimes apply, store or portal size, plugin and integration count, and whether P0 remediation runs in parallel with the audit.
| Scope | Price | Notes |
|---|---|---|
| Baseline audit (one regime) | individual quote | E.g. EAA only on a WooCommerce store |
| Full audit (EAA + NIS2/DORA + AI Act) | individual quote | Consolidated report and single backlog |
| Post-audit remediation | individual quote | Optional, separate timeline |
I do not publish fixed public price lists because regime scope differs between a micro-store and a financial portal.
What is an EU compliance audit for WordPress?
EU procurement teams increasingly score accessibility, cybersecurity, and AI on the same supplier sheet. You already have articles on WCAG, BFSG, and EAA, NIS2 and DORA on WordPress, and AI Act content labelling. What was missing is a service that closes all three threads on one WordPress install without three vendors and three inconsistent reports.
The EU compliance audit is a consolidated technical review: what on your site breaches or risks breaching obligations under Directive 2019/882 (EAA), Directive 2022/2555 (NIS2), Regulation 2022/2554 (DORA), and Regulation 2024/1689 (AI Act). I do not re-explain the directives here - links point to my blog posts and EUR-Lex.
Deadlines drive traffic: EAA applies to new services from 2025-06-28, NIS2 is transposed in member states with duties for essential and important entities, DORA covers financial services from 2025-01-17, and the AI Act phases in from 2025. If a buyer asks for evidence before you sign, this audit answers in a format procurement can file.
Audit scope for EAA, NIS2, DORA and the AI Act
The table below is the technical scope on WordPress. Legal detail and implementation checklists live in the linked articles - here I only state what I measure on your install.
| Regime | Audit scope on WordPress | Deeper reading |
|---|---|---|
| Accessibility / EAA | WCAG 2.2 AA on purchase paths, forms, keyboard navigation, contrast, media, accessibility statement | WCAG, BFSG, and EAA compliance stack |
| NIS2 / DORA | Plugin and ICT integration register, hardening, 24h/72h incident path, DORA register-of-information fields, third-party risk | NIS2 and DORA: 2026 compliance stack |
| AI Act | AI-generated content labelling, model usage policy, auto-summarisation forms, on-site chatbots | AI Act: labelling AI-generated content |
The audit does not replace legal counsel or a formal VPAT. It does give a technical gap map that external lawyers or auditors can fold into a broader assessment without rescanning code.
What do you get after an EU compliance audit?
At the end of the engagement you receive three artefacts procurement actually reads:
- Written report (PDF) split across the three regimes. Each finding has a P0-P3 priority, evidence (screenshot, code excerpt, log), and remediation instructions a WordPress developer can implement without back-and-forth.
- Remediation backlog in a format ready for Jira, Linear, or a spreadsheet - task dependencies, effort hints, and whether the fix belongs in theme, plugin, or hosting configuration.
- Procurement evidence pack - ICT supplier map (hosting, CDN, payments, email, analytics), plugin versions, update policy, incident notification path sketch aligned with NIS2 expectations.
Plus a 30-minute video walkthrough for engineering and compliance. I answer follow-up questions for 30 days while you work through the backlog.
How are audit findings documented and closed?
Every finding receives an identifier, affected URL or template, environment, reproduction steps, expected behaviour and a supporting artefact such as a screenshot, code excerpt, response header or configuration export. Credentials and unnecessary personal data are removed before evidence enters the report.
Automated scanners are used for coverage, not as the final verdict. Accessibility samples include keyboard operation, focus order, error recovery and selected screen-reader checks on critical paths. Security and resilience work compares the installed plugin and integration inventory with ownership, update and incident procedures. AI controls are checked against the tools actually used, their data paths and the disclosure visible to users.
A finding closes only when one of three states is recorded:
- Remediated and retested using the original reproduction method, with new evidence attached.
- Compensating control accepted with an owner, review date and explanation of the remaining limitation.
- Risk accepted in writing by the client, separate from my technical recommendation.
Access follows least privilege. Read-only accounts and a production copy are preferred where practical, access removal is confirmed at handover and working copies follow the agreed project-retention period. The final report states its technical scope and date; it is not presented as permanent certification or legal advice.
Who needs an EU compliance audit for WordPress?
Not every WordPress site needs the full three-module scope. Most often commissioned by:
- WooCommerce stores selling to EU customers after the EAA effective date - especially checkout, product filters, and contact forms.
- Regulated-sector firms (finance, insurance, critical infrastructure) or their ICT suppliers, where NIS2 and DORA land in the same RFP as accessibility.
- Public sector and government contractors who must show WCAG and supply chain evidence before signing a framework agreement.
- Agencies selling WordPress to EU buyers who want one reference audit instead of three subcontracted offers.
If you are a micro-enterprise with a narrow EAA exemption, I say so on the first call and do not invoice for out-of-scope modules.
How does the EU compliance audit work step by step?
Five steps from the howTo frontmatter - in practice:
Step 1 - brief. Describe site type, countries, sector, and integrations (payments, CRM, AI tools). Without this, regime scope is guesswork.
Step 2 - regime scoping. On the call I confirm whether EAA, NIS2/DORA, AI Act, or a subset applies. I point to blog posts if your internal team needs legal context before signing.
Step 3 - proposal. Individual quote, timeline, required access (staging, read-only SFTP, plugin list).
Step 4 - audit. Automated WCAG scan on representative URLs, manual sample of critical paths, plugin review for NIS2/DORA, AI labelling check. I can close P0 gaps in parallel if contracted.
Step 5 - report and handover. PDF, backlog, evidence pack, recording. Optionally I move into remediation or ongoing WordPress maintenance with quarterly re-audit of selected modules.
EAA audit example on a WooCommerce store
In Q2 2026 I completed EAA scoping for an anonymised WooCommerce store (40+ products, standard block theme, three payment and marketing plugins). Within two weeks of kick-off I delivered a WCAG report with 23 findings, seven marked P0 on checkout (field labels, mini-cart focus trap, pay button contrast). The backlog went to the client team as ready tickets; I closed P0 remediation in the following sprint. No client name, no invented metrics - typical post-EAA project shape.
Related deep-dives and service pillars
This audit aggregates three pillars. If you need a deeper dive on one regime, standalone services exist:
| Service | When separate | Link |
|---|---|---|
| Accessibility audit WCAG | EAA only, without NIS2 and AI | Theme remediation philosophy |
| NIS2 and DORA readiness | Financial sector, ICT supplier register | Deeper DORA Article 28 mapping |
| WordPress security audit | Incident, malware, hardening without compliance framing | Cleanup and hardening after breach |
Blog deep-dives (detail lives here, not repeated above):
- WCAG 2.2, BFSG, and EAA: 2026 compliance stack
- EAA and WCAG 2.1: scope, deadlines, and exemptions
- Accessibility statement for WordPress: template and EN 301 549 mapping
- NIS2 and DORA on WordPress: 2026 compliance stack
- NIS2 vs DORA: scope overlap for WordPress agencies in 2026
- AI Act: labelling AI-generated content
- AI transparency policy
Primary sources (EUR-Lex): EAA 2019/882, NIS2 2022/2555, DORA 2022/2554, AI Act 2024/1689.
Ready to commission the audit? Send a brief via the contact form with your site type, sector, and the deadline by which you must show compliance evidence.
