Most Australian small business owners hear "your website has to comply with the Disability Discrimination Act" and assume it's like fire extinguishers — a one-off compliance item, tick a box, move on. It isn't. It's an ongoing legal obligation that applies to every commercial website in the country, has applied since 1992, and was reinforced by the Australian Human Rights Commission in April 2025 with new guidelines that explicitly cover websites, mobile apps, SaaS platforms and AI tools.

The strong opinion first, then the nuance: if your website sells anything, books anything, or lets a customer enquire about anything, you have a legal duty to make it usable by people with disabilities. That duty doesn't disappear because you're a sole trader. It doesn't disappear because your accountant said your website is "just brochureware." And it absolutely does not disappear because you bolted an accessibility widget onto the homepage.

The good news — and there is some — is that meeting the obligation isn't as expensive or as scary as the legal-services industry sometimes makes it sound. Most SMBs can get to substantial compliance during a normal build or a normal redesign, with no special add-on cost. The catch is that the people building your website have to actually know what they're doing.

What the DDA actually says (and doesn't say)

The Disability Discrimination Act 1992 doesn't contain the word "website." It was written before the modern web existed. What it does contain is Section 24, which makes it unlawful to discriminate against a person on the ground of disability when providing goods, services or facilities.

The courts and the Australian Human Rights Commission have repeatedly held that a commercial website is a "service" for the purposes of Section 24. That principle was settled in 2000 in Maguire v Sydney Organising Committee for the Olympic Games, when Bruce Maguire — who is blind — complained that the official Sydney 2000 Olympics website was unusable with a screen reader. He won. SOCOG was ordered to fix the site. When they only partially complied, the Commission awarded Maguire $20,000 in damages.

That case is 26 years old and still the foundational Australian authority on web accessibility. Every guidance note the AHRC has ever published cites it. Every Australian web accessibility lawyer cites it. If your business gets a complaint in 2026, Maguire is the starting point of the response.

The other thing the DDA does is define "unjustifiable hardship" as a defence. A respondent can argue that the cost or effort of making something accessible would be so disproportionate that the law doesn't require it. SOCOG tried this defence in 2000 and lost — and that was for a site built before WCAG 2.0 existed. For a small business in 2026, with modern frameworks and 30+ years of accessibility tooling available, the unjustifiable hardship defence is functionally dead.

What the AHRC's 2025 guidelines added

In April 2025 the Commission released the Guidelines on Equal Access to Digital Goods and Services, replacing a 2014 advisory note that was barely relevant to the modern web. Three changes matter for SMBs.

Scope expanded

The 2014 note focused on websites. The 2025 guidelines explicitly cover SaaS platforms, mobile apps, AI tools, IoT devices, kiosks, and chatbots. If you run a booking system on Cliniko, an e-commerce site on Shopify, a member portal on Squarespace, or any kind of AI assistant on your homepage — all of it falls under the DDA. The platform vendor isn't the only party on the hook; you, as the business deploying the service, share responsibility.

WCAG 2.2 Level AA is now the minimum

For more than a decade the AHRC pointed at WCAG 2.0 as the de facto Australian benchmark. The 2025 guidelines name WCAG 2.2 Level AA as the current standard. That moved the bar — there are nine new success criteria in WCAG 2.2 that weren't in 2.0, including target size, focus visibility, and consistent help. We'll cover those in more detail in our plain-English WCAG checklist. Centre For Accessibility Australia confirmed the formal adoption in mid-2025.

Accessibility is now an "organisational risk"

This is the bit most people miss. The AHRC's framing has shifted from "comply with this checklist" to "treat accessibility as a governance risk." That means the regulator expects board minutes, procurement processes, vendor contracts and audit schedules to mention accessibility. For a sole trader that mostly translates to "have a documented accessibility statement and an annual review." For a 50-person business it means accessibility lives in your risk register alongside cyber and privacy.

What an Australian SMB actually has to do

Strip out the consulting-speak and the actual obligations boil down to five things.

1. Build to WCAG 2.2 Level AA

This is the technical floor. It's 87 success criteria in total, of which roughly 50 apply at the AA level. A competent developer hits most of them by default if they know what they're doing: proper semantic HTML, sufficient colour contrast, keyboard navigation, focus indicators, alt text on images, form labels, no auto-playing audio. The criteria that often get missed are around focus visibility, target size on mobile, and consistent help — the new 2.2 stuff.

The cost of building to AA on a new custom site is approximately zero, because it's the same effort as building correctly. The cost of retrofitting AA onto an existing site is between $2,000 and $40,000, depending on how broken the original code is. Templated platforms tend to be the worst because the theme markup is often inaccessible at the source and you can't fix it without abandoning the theme.

2. Publish an accessibility statement

Every commercial website should have a public accessibility statement: what standard you target (WCAG 2.2 AA), what known issues exist, how someone with a disability can request an alternative format, and how to lodge a complaint. The W3C provides a generator you can use as a starting point.

The statement does two things. First, it signals good faith — which matters enormously if a complaint is ever lodged, because the Commission's conciliation process heavily favours organisations that demonstrate they're trying. Second, it gives users a path to ask for help, which often resolves issues before they become formal complaints.

3. Have a contact path that doesn't require completing your website

This sounds obvious. It's the single most overlooked obligation. If the only way to enquire about your service is through an inaccessible online form, and a person with a disability can't complete the form, you've discriminated against them by denying access to your service. A phone number, an email address, and a postal address — clearly displayed on every page — covers this. It's the cheapest part of compliance and the most often missed.

4. Audit annually (or after any significant change)

The AHRC expects ongoing review, not a one-time build. A reasonable cadence for an SMB is: full audit at launch, automated scan monthly, manual audit after any major content or feature change, full re-audit yearly. Tools like axe DevTools, WAVE, and Lighthouse catch about 30% of issues automatically. The rest requires a person with screen reader experience.

5. Train whoever updates the site

The site is only compliant on the day it ships. The minute a staff member uploads a PDF with no text layer, posts an image with no alt text, or embeds a video with no captions, compliance slips. The fix is a short — 30 minutes is plenty — content-author training that covers the four or five things that go wrong most often. Document it. Repeat it whenever you onboard someone new.

What you don't have to do

A lot of what the "accessibility compliance" industry sells is theatre. Three things you can safely ignore.

You don't need an accessibility overlay widget. They don't fix anything and the Federal Trade Commission fined accessiBe USD $1 million in 2025 for misrepresenting what they do.

You don't need a paid certification. Nobody in Australian law cares whether a third party "certified" your site. The AHRC looks at whether the site is actually accessible, not whether you paid for a badge.

You don't need to make your site "perfect." WCAG AA is the legal benchmark, not AAA. AAA is aspirational and impractical for most commercial sites. AA is what the regulator expects.

The realistic enforcement landscape in Australia

Here's the honest assessment: Australian web accessibility enforcement is significantly less aggressive than the United States, where there are roughly 4,000 ADA Title III website lawsuits per year. The Australian system funnels complaints through the AHRC's conciliation process first, which resolves the majority of matters confidentially without litigation. Only a small fraction reach the Federal Court.

But that's not "no risk." The Coles case — Gisele Mesnage's 2014 complaint over Coles' online grocery ordering site — settled out of court but only after Coles spent considerable money on lawyers and remediation. The Commonwealth Bank had to redesign aspects of its online banking after a 2018 complaint. The reputational hit of a published AHRC decision is meaningful.

The risk profile for an Australian SMB is: low likelihood of a lawsuit, moderate likelihood of a complaint, very high likelihood that an inaccessible site is also losing you customers you didn't know you had. About 20% of Australians have a disability of some kind. A significant share of that group will leave a site that doesn't work for them and never tell you why.

The practical 90-day plan for an existing SMB site

If you're reading this and you've never thought about any of it, here's the order of operations.

Week 1: Run a free WAVE scan and a Lighthouse audit on your top five pages. Note the errors. Most will fall into colour contrast, missing alt text, and form labelling.

Week 2-4: Fix the automated-scan issues. This is usually a half-day to two days of developer time on an existing site.

Week 5-6: Publish an accessibility statement and add a clearly-visible phone number and email to the header and footer.

Week 7-10: Engage someone with manual accessibility experience to test the site with a screen reader, keyboard-only, and a screen magnifier. Vision Australia's consulting team does this work. So do specialist agencies. Budget $1,500 to $4,000 depending on site size.

Week 11-12: Fix the manual-audit findings. Brief whoever maintains the site on what to watch for going forward.

That's it. Not free, not painless, but achievable for any business that's serious about it.

Where this leaves you

The Disability Discrimination Act isn't going away and the regulator's 2025 update made the obligations more explicit, not less. The cost of building to WCAG 2.2 AA from scratch is negligible if your developer knows the standards. The cost of retrofitting is real but bounded. The cost of doing nothing is a risk of complaint, a probable loss of customers you can't see, and — increasingly — exposure when your competitors start treating accessibility as a competitive advantage.

If you'd like us to run an accessibility audit on your existing site and tell you what compliance would actually take, book a free audit. We'll give you a real list with priorities, time estimates and costs, and we'll point you at a specialist if the work isn't ours to do.

DDA Website Compliance: What AU Businesses Must Do (2026)