EN 301 549 conformance report #
Last updated: 2026-05-24.
This report is a structured self-assessment of EthicsPortal against the accessibility requirements in EN 301 549 V3.2.3 (and, transitively, WCAG 2.2 Level AA). It is intended for procurement reviewers who need a clause-by-clause answer beyond the accessibility statement .
| Field | Value |
|---|---|
| Product | EthicsPortal — EU whistleblower compliance platform |
| Product version | Continuously deployed; this report describes the state as of the preparation date |
| Standard | EN 301 549 V3.2.3 (incorporating WCAG 2.2 Level AA) |
| Conformance approach | Self-assessment |
| Preparation date | 14 May 2026 |
| Next review | August 2026 (quarterly) |
| Contact | accessibility@ethicsportal.eu |
A PDF copy of this report can be supplied for procurement on request.
Scope #
This report covers three deployment surfaces:
- Web application —
secure.ethicsportal.eu, the authenticated case-handler interface - Public reporting portals —
*.ethicsportal.eu, the whistleblower-facing report submission and case tracking - Marketing website —
ethicsportal.eu, the Hugo-rendered public site (this page included)
It also covers downloadable documents and support services delivered through these surfaces.
EthicsPortal is a web-based SaaS product. It does not provide native mobile apps, kiosk hardware, two-way voice ICT, video output for media, or real-time text. Clauses 6, 7, 8, and 13 of EN 301 549 are therefore largely not applicable.
Summary #
| Clause area | Status |
|---|---|
| §5 Generic requirements | Conforms, with exceptions noted in §5.4 |
| §6 ICT with two-way voice communication | Not applicable |
| §7 ICT with video capabilities | Not applicable |
| §8 Hardware | Not applicable |
| §9 Web | Partially conforms (see §9 details) |
| §10 Non-web documents | Does not conform — see §10.1 |
| §11 Software | Partially conforms (see §11 details) |
| §12 Documentation and support services | Conforms |
| §13 ICT providing relay or emergency service access | Not applicable |
Clause-by-clause assessment #
§5 Generic requirements #
| Clause | Requirement | Status | Notes |
|---|---|---|---|
| 5.1.2.2 / 5.1.3 | Activation of accessibility features | Conforms | The platform exposes accessibility features through standard HTML and ARIA. No proprietary activation step is required |
| 5.2 | Activation of accessibility features | Conforms | Browser- and OS-level accessibility settings (zoom, contrast, reduced motion, screen reader) are respected |
| 5.3 | Biometrics | Not applicable | Authentication is by magic link or one-time code with optional TOTP; no biometric input is required |
| 5.4 | Preservation of accessibility information during conversion | Partially conforms | Application content preserves accessibility information; PDF exports do not (see §10.1) |
| 5.5 | Operable parts | Conforms | All interactive elements are operable by keyboard and pointer; target size meets §2.5.8 |
| 5.6 | Locking or toggle status | Conforms | Toggle states are exposed via aria-pressed / aria-expanded |
| 5.7 | Key repeat | Not applicable | Software does not configure system key-repeat |
| 5.8 | Double-strike key acceptance | Not applicable | Software does not configure system key-acceptance |
| 5.9 | Simultaneous user actions | Conforms | No interaction requires simultaneous user actions |
§9 Web (incorporates WCAG 2.2 Level A and AA) #
EthicsPortal targets WCAG 2.2 Level AA. The new criteria added in WCAG 2.2 are reported individually so reviewers can confirm coverage beyond WCAG 2.1.
Principle 1 — Perceivable
| SC | Title | Level | Status | Notes |
|---|---|---|---|---|
| 1.1.1 | Non-text Content | A | Conforms | Images and SVG icons have alt text or are marked decorative. Icon-only buttons carry aria-label. Status indicated by icon alone has an sr-only text equivalent |
| 1.2.x | Time-based Media | A/AA | Not applicable | No audio or video content |
| 1.3.1 | Info and Relationships | A | Conforms | Semantic HTML; tables use <th scope>; forms use <label> |
| 1.3.2 | Meaningful Sequence | A | Conforms | DOM order matches visual order |
| 1.3.3 | Sensory Characteristics | A | Conforms | Instructions do not rely on shape, size, or location alone |
| 1.3.4 | Orientation | AA | Conforms | Layout works in portrait and landscape |
| 1.3.5 | Identify Input Purpose | AA | Conforms | Inputs that match WCAG input purposes use autocomplete |
| 1.4.1 | Use of Color | A | Conforms | Color is never the only signal — paired with text or icons |
| 1.4.3 | Contrast (Minimum) | AA | Conforms | Body text ≥ 4.5:1, large text ≥ 3:1, audited internally |
| 1.4.4 | Resize Text | AA | Conforms | Layout reflows at 200 % zoom without loss of content |
| 1.4.5 | Images of Text | AA | Conforms | Brand logo is the only image of text; all UI labels are HTML |
| 1.4.10 | Reflow | AA | Conforms | Reflows at 320 CSS pixels wide (tables and code blocks excepted as permitted) |
| 1.4.11 | Non-text Contrast | AA | Conforms | UI components and graphical objects meet 3:1 |
| 1.4.12 | Text Spacing | AA | Conforms | User text-spacing overrides do not break layout |
| 1.4.13 | Content on Hover or Focus | AA | Conforms | Tooltips dismissible (Escape), hoverable, and persistent until trigger loses focus |
Principle 2 — Operable
| SC | Title | Level | Status | Notes |
|---|---|---|---|---|
| 2.1.1 | Keyboard | A | Conforms | All functionality is keyboard-operable |
| 2.1.2 | No Keyboard Trap | A | Conforms | Modals trap focus only while open and restore it on close |
| 2.1.4 | Character Key Shortcuts | A | Not applicable | No single-character shortcuts implemented |
| 2.2.1 | Timing Adjustable | A | Conforms | Session inactivity timeout is 30 days, satisfying the 20-hour exception |
| 2.2.2 | Pause, Stop, Hide | A | Conforms | No auto-updating content moves, blinks, or scrolls for more than 5 seconds without a control to pause |
| 2.3.1 | Three Flashes or Below | A | Conforms | No flashing content |
| 2.4.1 | Bypass Blocks | A | Conforms | Skip-link to main content present on every layout |
| 2.4.2 | Page Titled | A | Conforms | Every page has a localised, descriptive <title> |
| 2.4.3 | Focus Order | A | Conforms | Focus follows DOM order |
| 2.4.4 | Link Purpose (In Context) | A | Conforms | Link text describes the destination |
| 2.4.5 | Multiple Ways | AA | Conforms | Site search, navigation, and breadcrumbs are available |
| 2.4.6 | Headings and Labels | AA | Conforms | One <h1> per page; headings descend without skipping |
| 2.4.7 | Focus Visible | AA | Conforms | :focus-visible is enabled globally; focus rings are not disabled |
| 2.4.11 | Focus Not Obscured (Minimum) | AA (new in 2.2) | Conforms | Focused elements are not entirely covered by sticky headers or other author content |
| 2.5.1 | Pointer Gestures | A | Conforms | No multi-point or path-based gestures are required |
| 2.5.2 | Pointer Cancellation | A | Conforms | All click actions complete on up-event |
| 2.5.3 | Label in Name | A | Conforms | Accessible names contain the visible label |
| 2.5.4 | Motion Actuation | A | Not applicable | No device-motion inputs |
| 2.5.7 | Dragging Movements | AA (new in 2.2) | Conforms | No drag-only flows; uploads accept click and keyboard alternatives |
| 2.5.8 | Target Size (Minimum) | AA (new in 2.2) | Conforms | Interactive targets ≥ 24×24 CSS px |
Principle 3 — Understandable
| SC | Title | Level | Status | Notes |
|---|---|---|---|---|
| 3.1.1 | Language of Page | A | Partially conforms | Application and portal pages set <html lang> to the active locale. Static fallback error pages are English-only — see accessibility statement |
| 3.1.2 | Language of Parts | AA | Conforms | Inline foreign-language strings use lang attributes where required |
| 3.2.1 | On Focus | A | Conforms | Focus does not trigger a context change |
| 3.2.2 | On Input | A | Conforms | Input does not trigger a context change without warning |
| 3.2.3 | Consistent Navigation | AA | Conforms | Navigation order is consistent across the application |
| 3.2.4 | Consistent Identification | AA | Conforms | Icons and components are used consistently |
| 3.2.6 | Consistent Help | A (new in 2.2) | Conforms | Support contact and help links appear in the same location on every authenticated page (sidebar footer area) and in the portal footer |
| 3.3.1 | Error Identification | A | Conforms | Errors are surfaced via role="alert" and described to the user |
| 3.3.2 | Labels or Instructions | A | Conforms | Inputs are labelled; hints use aria-describedby |
| 3.3.3 | Error Suggestion | AA | Conforms | Errors say what is wrong and how to fix it |
| 3.3.4 | Error Prevention (Legal, Financial, Data) | AA | Conforms | Reversible operations or explicit confirmation for destructive actions |
| 3.3.7 | Redundant Entry | A (new in 2.2) | Conforms | Information previously entered (email, organization) is auto-filled where re-required in the same session |
| 3.3.8 | Accessible Authentication (Minimum) | AA (new in 2.2) | Conforms | Authentication uses magic links and one-time codes that can be pasted; no cognitive function tests are required |
Principle 4 — Robust
| SC | Title | Level | Status | Notes |
|---|---|---|---|---|
| 4.1.2 | Name, Role, Value | A | Conforms | Controls expose name, role, and state |
| 4.1.3 | Status Messages | AA | Conforms | Flash messages, notifications, and async results use aria-live regions |
§10 Non-web documents #
| Clause | Requirement | Status | Notes |
|---|---|---|---|
| 10.1 | Non-web documents (PDFs) | Does not conform | Compliance reports, certificates, policy templates, posters, the case-handler manual, and case exports are produced as untagged PDFs. Accessible HTML alternatives are available on request via accessibility@ethicsportal.eu . A tagged-PDF pipeline is on the roadmap. |
| 10.2 | DOCX policy templates | Partially conforms | Generated DOCX files (whistleblower policy, privacy notice) carry their structure but have not been audited against PDF/UA-equivalent expectations for editable documents. HTML alternatives are available on request. |
§11 Software #
The web application qualifies as software under §11. §11 incorporates WCAG (assessed above under §9) plus software-specific clauses:
| Clause | Requirement | Status | Notes |
|---|---|---|---|
| 11.5 | Interoperability with assistive technology | Conforms | Built on semantic HTML and ARIA; tested with VoiceOver, NVDA, and platform keyboard navigation |
| 11.6 | Documented accessibility usage | Conforms | This page and the accessibility statement document accessibility features and known limitations |
| 11.7 | User preferences | Conforms | OS-level preferences (reduced motion, color scheme, text scaling) are respected |
| 11.8 | Authoring tools | Partially conforms | Case-handler UI is an authoring tool under §11.8 because handlers create content consumed by whistleblowers. Attachment uploads accept descriptions; rich-text features (when introduced) will be assessed against ATAG 2.0 |
§12 Documentation and support services #
| Clause | Requirement | Status | Notes |
|---|---|---|---|
| 12.1.1 | Accessibility and compatibility features | Conforms | This report and the accessibility statement describe the supported assistive technologies and platform combinations |
| 12.1.2 | Accessible documentation | Conforms | Documentation is delivered as semantic HTML on the marketing site and through in-app help |
| 12.2.2 | Information on accessibility features | Conforms | Support staff and the published statement can answer accessibility queries |
| 12.2.3 | Effective communication | Conforms | Accessibility feedback channel is monitored each working day; acknowledgement within 2 working days |
| 12.2.4 | Accessible documentation (support) | Partially conforms | Documents delivered in response to support requests inherit the same status as the underlying artifacts — PDFs are flagged; HTML alternatives are available |
Known limitations #
The items below are tracked, not hidden:
- Untagged PDFs. Largest gap. Mitigated today by accessible HTML alternatives on request; planned to be replaced by a tagged-PDF or HTML-canonical pipeline.
- Static error pages in English only. Encountered rarely; the same information is presented in the user’s language inside the application.
- Third-party embeds (Crisp, Stripe-hosted pages) sit outside our direct control; provider accessibility documentation is reviewed annually.
Test methodology #
The self-assessment combined:
- Automated:
axe-core-capybararuns against the public whistleblower portal flows (home, report submission, lookup) in CI viatest/system/portal_accessibility_system_test.rb; any violation fails the build. Extending automated coverage to the authenticated case-handler flows is on the roadmap - Manual keyboard testing across the portal report submission flow, the case-handler workflow, account management, and authentication
- VoiceOver (macOS, Safari) and NVDA (Windows, Firefox) screen-reader passes on the same flows
- 200 % zoom reflow check on every layout at 1280×800
- Reduced motion verified by enabling the OS preference
- Color blindness simulation using Coblis
- Code review against the internal accessibility engineering guide
Contact and feedback #
Accessibility concerns, requests for alternative formats, and procurement queries:
- accessibility@ethicsportal.eu — monitored each working day
- See the accessibility statement for the full feedback and enforcement procedure
Standards and references #
- EN 301 549 V3.2.3
- EN 301 549 V3.2.1 (harmonized version)
- Directive (EU) 2016/2102
- Directive (EU) 2019/882 — European Accessibility Act
- Implementing Decision (EU) 2018/1523
- WCAG 2.2 Level AA
- ATAG 2.0
Last updated: