> Clause-by-clause conformance self-assessment for EthicsPortal against EN 301 549 V4.1.1 and WCAG 2.2 Level AA.

Source: https://ethicsportal.eu/en-301-549-conformance/
Updated: 2026-09-23

---

# EN 301 549 conformance report

Last updated: 2026-09-20.

This report is a structured self-assessment of EthicsPortal against the accessibility requirements in **EN 301 549 V4.1.1** (and, transitively, **WCAG 2.2 Level AA**). It is intended for procurement reviewers who need a clause-by-clause answer beyond the [accessibility statement](/accessibility/).

| Field | Value |
|---|---|
| Product | EthicsPortal — EU whistleblower compliance platform |
| Product version | Continuously deployed; this report describes the state as of the last updated date |
| Standard | EN 301 549 V4.1.1 (incorporating WCAG 2.2 Level AA) |
| Conformance approach | Self-assessment |
| Preparation date | 14 May 2026 |
| Next review | November 2026 (quarterly) |
| Contact | [accessibility@ethicsportal.eu](mailto:accessibility@ethicsportal.eu) |

A PDF copy of this report can be supplied for procurement on request.

## Scope

This report covers three deployment surfaces:

1. **Web application** — `secure.ethicsportal.eu`, the authenticated case-handler interface
2. **Public reporting channels** — `*.ethicsportal.eu`, the whistleblower-facing report submission and case tracking
3. **Marketing website** — `ethicsportal.eu`, the Hugo-rendered public site (this page included)

It also covers downloadable documents and support services delivered through these surfaces.

EthicsPortal is a web-based SaaS product. It does not provide native mobile apps, kiosk hardware, two-way voice ICT, video output for media, or real-time text. Clauses 6, 7, 8, and 13 of EN 301 549 are therefore largely **not applicable**.

## Summary

| Clause area | Status |
|---|---|
| §5 Generic requirements | Conforms, with exceptions noted in §5.4 |
| §6 ICT supporting real-time bidirectional communication | Not applicable |
| §7 ICT with video capabilities | Not applicable |
| §8 Hardware | Not applicable |
| §9 Web | Partially conforms (see §9 details) |
| §10 Non-web documents | Does not conform — see §10.1 |
| §11 Non-web software | Partially conforms (see §11 details) |
| §12 Information about products and services | Conforms |
| §13 ICT providing relay or emergency service access | Not applicable |

## Clause-by-clause assessment

### §5 Generic requirements

| Clause | Requirement | Status | Notes |
|---|---|---|---|
| 5.1.2.2 / 5.1.3 | Activation of accessibility features | Conforms | The platform exposes accessibility features through standard HTML and ARIA. No proprietary activation step is required |
| 5.2 | Activation of accessibility features | Conforms | Browser- and OS-level accessibility settings (zoom, contrast, reduced motion, screen reader) are respected |
| 5.3 | Biometrics | Not applicable | Authentication is by magic link or one-time code with optional TOTP; no biometric input is required |
| 5.4 | Preservation of accessibility information during conversion | Partially conforms | Application content preserves accessibility information; PDF exports do not (see §10.1) |
| 5.5 | Operable parts | Conforms | All interactive elements are operable by keyboard and pointer; target size meets §2.5.8 |
| 5.6 | Locking or toggle status | Conforms | Toggle states are exposed via `aria-pressed` / `aria-expanded` |
| 5.7 | Key repeat | Not applicable | Software does not configure system key-repeat |
| 5.8 | Double-strike key acceptance | Not applicable | Software does not configure system key-acceptance |
| 5.9 | Simultaneous user actions | Conforms | No interaction requires simultaneous user actions |

### §9 Web (incorporates WCAG 2.2 Level A and AA)

EthicsPortal targets WCAG 2.2 Level AA. The new criteria added in WCAG 2.2 are reported individually so reviewers can confirm coverage beyond WCAG 2.1.

**Principle 1 — Perceivable**

| SC | Title | Level | Status | Notes |
|---|---|---|---|---|
| 1.1.1 | Non-text Content | A | Conforms | Images and SVG icons have alt text or are marked decorative. Icon-only buttons carry `aria-label`. Status indicated by icon alone has an `sr-only` text equivalent |
| 1.2.x | Time-based Media | A/AA | Not applicable | No audio or video content |
| 1.3.1 | Info and Relationships | A | Conforms | Semantic HTML; tables use `<th scope>`; forms use `<label>` |
| 1.3.2 | Meaningful Sequence | A | Conforms | DOM order matches visual order |
| 1.3.3 | Sensory Characteristics | A | Conforms | Instructions do not rely on shape, size, or location alone |
| 1.3.4 | Orientation | AA | Conforms | Layout works in portrait and landscape |
| 1.3.5 | Identify Input Purpose | AA | Conforms | Inputs that match WCAG input purposes use `autocomplete` |
| 1.4.1 | Use of Color | A | Conforms | Color is never the only signal — paired with text or icons |
| 1.4.3 | Contrast (Minimum) | AA | Conforms | Body text ≥ 4.5:1, large text ≥ 3:1, audited internally |
| 1.4.4 | Resize Text | AA | Conforms | Layout reflows at 200 % zoom without loss of content |
| 1.4.5 | Images of Text | AA | Conforms | Brand logo is the only image of text; all UI labels are HTML |
| 1.4.10 | Reflow | AA | Conforms | Reflows at 320 CSS pixels wide (tables and code blocks excepted as permitted) |
| 1.4.11 | Non-text Contrast | AA | Conforms | UI components and graphical objects meet 3:1 |
| 1.4.12 | Text Spacing | AA | Conforms | User text-spacing overrides do not break layout |
| 1.4.13 | Content on Hover or Focus | AA | Conforms | Tooltips dismissible (Escape), hoverable, and persistent until trigger loses focus |

**Principle 2 — Operable**

| SC | Title | Level | Status | Notes |
|---|---|---|---|---|
| 2.1.1 | Keyboard | A | Conforms | All functionality is keyboard-operable |
| 2.1.2 | No Keyboard Trap | A | Conforms | Modals trap focus only while open and restore it on close |
| 2.1.4 | Character Key Shortcuts | A | Not applicable | No single-character shortcuts implemented |
| 2.2.1 | Timing Adjustable | A | Conforms | Session inactivity timeout is 30 days, satisfying the 20-hour exception |
| 2.2.2 | Pause, Stop, Hide | A | Conforms | No auto-updating content moves, blinks, or scrolls for more than 5 seconds without a control to pause |
| 2.3.1 | Three Flashes or Below | A | Conforms | No flashing content |
| 2.4.1 | Bypass Blocks | A | Conforms | Skip-link to main content present on every layout |
| 2.4.2 | Page Titled | A | Conforms | Every page has a localised, descriptive `<title>` |
| 2.4.3 | Focus Order | A | Conforms | Focus follows DOM order |
| 2.4.4 | Link Purpose (In Context) | A | Conforms | Link text describes the destination |
| 2.4.5 | Multiple Ways | AA | Conforms | Site search, navigation, and breadcrumbs are available |
| 2.4.6 | Headings and Labels | AA | Conforms | One `<h1>` per page; headings descend without skipping |
| 2.4.7 | Focus Visible | AA | Conforms | `:focus-visible` is enabled globally; focus rings are not disabled |
| 2.4.11 | Focus Not Obscured (Minimum) | AA *(new in 2.2)* | Conforms | Focused elements are not entirely covered by sticky headers or other author content |
| 2.5.1 | Pointer Gestures | A | Conforms | No multi-point or path-based gestures are required |
| 2.5.2 | Pointer Cancellation | A | Conforms | All click actions complete on `up-event` |
| 2.5.3 | Label in Name | A | Conforms | Accessible names contain the visible label |
| 2.5.4 | Motion Actuation | A | Not applicable | No device-motion inputs |
| 2.5.7 | Dragging Movements | AA *(new in 2.2)* | Conforms | No drag-only flows; uploads accept click and keyboard alternatives |
| 2.5.8 | Target Size (Minimum) | AA *(new in 2.2)* | Conforms | Interactive targets ≥ 24×24 CSS px |

**Principle 3 — Understandable**

| SC | Title | Level | Status | Notes |
|---|---|---|---|---|
| 3.1.1 | Language of Page | A | Partially conforms | Application and portal pages set `<html lang>` to the active locale. Static fallback error pages are English-only — see [accessibility statement](/accessibility/#non-accessible-content) |
| 3.1.2 | Language of Parts | AA | Conforms | Inline foreign-language strings use `lang` attributes where required |
| 3.2.1 | On Focus | A | Conforms | Focus does not trigger a context change |
| 3.2.2 | On Input | A | Conforms | Input does not trigger a context change without warning |
| 3.2.3 | Consistent Navigation | AA | Conforms | Navigation order is consistent across the application |
| 3.2.4 | Consistent Identification | AA | Conforms | Icons and components are used consistently |
| 3.2.6 | Consistent Help | A *(new in 2.2)* | Conforms | Support contact and help links appear in the same location on every authenticated page (sidebar footer area) and in the portal footer |
| 3.3.1 | Error Identification | A | Conforms | Errors are surfaced via `role="alert"` and described to the user |
| 3.3.2 | Labels or Instructions | A | Conforms | Inputs are labelled; hints use `aria-describedby` |
| 3.3.3 | Error Suggestion | AA | Conforms | Errors say what is wrong and how to fix it |
| 3.3.4 | Error Prevention (Legal, Financial, Data) | AA | Conforms | Reversible operations or explicit confirmation for destructive actions |
| 3.3.7 | Redundant Entry | A *(new in 2.2)* | Conforms | Information previously entered (email, organization) is auto-filled where re-required in the same session |
| 3.3.8 | Accessible Authentication (Minimum) | AA *(new in 2.2)* | Conforms | Authentication uses magic links and one-time codes that can be pasted; no cognitive function tests are required |

**Principle 4 — Robust**

| SC | Title | Level | Status | Notes |
|---|---|---|---|---|
| 4.1.2 | Name, Role, Value | A | Conforms | Controls expose name, role, and state |
| 4.1.3 | Status Messages | AA | Conforms | Flash messages, notifications, and async results use `aria-live` regions |

### §10 Non-web documents

| Clause | Requirement | Status | Notes |
|---|---|---|---|
| 10.1 | Non-web documents (PDFs) | Does not conform | Compliance reports, certificates, posters, the case-handler manual, and case exports are produced as untagged PDFs. The policy template and privacy notice are DOCX and are covered at 10.2. Accessible HTML alternatives are available on request via [accessibility@ethicsportal.eu](mailto:accessibility@ethicsportal.eu). A tagged-PDF pipeline is on the roadmap. |
| 10.2 | DOCX policy templates | Partially conforms | Generated DOCX files (whistleblower policy, privacy notice) carry heading structure with explicit outline levels, reading order, a document title, and the document language of the locale they were generated in. Not independently audited. |

### §11 Non-web software

The web application qualifies as software under §11. §11 incorporates WCAG (assessed above under §9) plus software-specific clauses:

| Clause | Requirement | Status | Notes |
|---|---|---|---|
| 11.5 | Interoperability with assistive technology | Conforms | Built on semantic HTML and ARIA; tested with VoiceOver, NVDA, and platform keyboard navigation |
| 11.6 | Documented accessibility usage | Conforms | This page and the [accessibility statement](/accessibility/) document accessibility features and known limitations |
| 11.7 | User preferences | Conforms | OS-level preferences (reduced motion, color scheme, text scaling) are respected |
| 11.8 | Authoring tools | Partially conforms | Case-handler content uses plain-text fields and labelled native file inputs. Rich-text features, if introduced, will be assessed against [ATAG 2.0](https://www.w3.org/TR/ATAG20/) |

### §12 Information about products and services

| Clause | Requirement | Status | Notes |
|---|---|---|---|
| 12.1.1 | Accessibility and compatibility features | Conforms | This report and the [accessibility statement](/accessibility/) describe the supported assistive technologies and platform combinations |
| 12.1.2 | Accessible documentation | Conforms | Documentation is delivered as semantic HTML on the marketing site and through in-app help |
| 12.2.2 | Information on accessibility features | Conforms | Support staff and the published statement can answer accessibility queries |
| 12.2.3 | Effective communication | Conforms | Accessibility feedback channel is monitored each working day; acknowledgement within 2 working days |
| 12.2.4 | Accessible documentation (support) | Partially conforms | Documents delivered in response to support requests inherit the same status as the underlying artifacts — PDFs are flagged; HTML alternatives are available |

## Known limitations

The items below are tracked, not hidden:

1. **Untagged PDFs.** Largest gap. Mitigated today by accessible HTML alternatives on request; planned to be replaced by a tagged-PDF or HTML-canonical pipeline.
2. **Static error pages in English only.** Encountered rarely; the same information is presented in the user's language inside the application.
3. **Third-party embeds (Stripe-hosted pages)** sit outside our direct control; provider accessibility documentation is reviewed annually.

## Test methodology

The self-assessment combined:

- **Automated**: `axe-core-capybara` runs against public reporting, authentication, and representative authenticated case-handler flows in CI; any violation fails the build
- **Manual keyboard testing** across the portal report submission flow, the case-handler workflow, account management, and authentication
- **VoiceOver (macOS, Safari)** and **NVDA (Windows, Firefox)** screen-reader passes on the same flows
- **200 % zoom** reflow check on every layout at 1280×800
- **Reduced motion** verified by enabling the OS preference
- **Color blindness simulation** using Coblis
- **Review** against the internal accessibility engineering guide, available during procurement review

## Contact and feedback

Accessibility concerns, requests for alternative formats, and procurement queries:

- [accessibility@ethicsportal.eu](mailto:accessibility@ethicsportal.eu) — monitored each working day
- See the [accessibility statement](/accessibility/) for the full feedback and enforcement procedure

## Standards and references

- [EN 301 549 V4.1.1](https://www.etsi.org/deliver/etsi_en/301500_301599/301549/04.01.01_60/en_301549v040101p.pdf)
- [EN 301 549 V3.2.1](https://www.etsi.org/deliver/etsi_en/301500_301599/301549/03.02.01_60/en_301549v030201p.pdf) (harmonized version)
- [Directive (EU) 2016/2102](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016L2102)
- [Directive (EU) 2019/882](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L0882) — European Accessibility Act
- [Implementing Decision (EU) 2018/1523](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32018D1523)
- [WCAG 2.2 Level AA](https://www.w3.org/TR/WCAG22/)
- [ATAG 2.0](https://www.w3.org/TR/ATAG20/)