Legal framework

Ley 11/2023 or Real Decreto 1112/2018: which rule applies?

Ley 11/2023 and Real Decreto 1112/2018 do not cover the same stakeholders or activities. Since 28 June 2025, the former has extended accessibility requirements to certain private-sector products and services, while the latter primarily governs public-sector websites and applications.

Two Spanish texts arising from distinct European frameworks

Real Decreto 1112/2018 transposes into Spanish law Directive (EU) 2016/2102 on the accessibility of the websites and mobile applications of public sector bodies. It therefore primarily establishes the digital obligations of public entities: public authorities, public bodies, and other organisations falling within its scope. Its purpose is specifically focused on websites and mobile applications, with rules covering compliance, accessibility statements, monitoring, and the handling of user communications.

Ley 11/2023 follows a different approach. In particular, it transposes Directive (EU) 2019/882, often referred to as the European Accessibility Act, and introduces accessibility requirements applicable to a specified list of products and services. Since 28 June 2025, it may apply to private operators offering, among other things, certain e-commerce, banking, passenger transport, electronic communications, or audiovisual media access services.

These texts are therefore not two successive versions of the same rule. Ley 11/2023 does not repeal Real Decreto 1112/2018 in its entirety or replace it for digital public services. The appropriate approach is to identify the entity concerned, the precise activity, and the medium provided before selecting the legal framework to be analysed.

When does Real Decreto 1112/2018 apply?

Real Decreto 1112/2018 is the starting point when a website or mobile application falls within the remit of a Spanish public sector body. However, the legal definition of the entities covered must be checked rather than relying on their name, apparent status, or mere involvement in a mission of general interest. Certain categories of content, services, or organizations may be subject to exclusions or specific rules.

The legislation requires accessibility based on the principles of perceivability, operability, understandability, and robustness. In practice, technical assessments generally rely on harmonized standards and frameworks recognized at the European level, but compliance cannot be reduced to automatically checking a list of criteria. Keyboard navigation, rendering by assistive technologies, content structure, forms, and error messages also require human review.

An accessibility statement must inform users of the level of compliance, inaccessible content, and the means available to report a difficulty. The framework also provides communication, complaint, and monitoring mechanisms. A public administration should therefore not treat the publication of a statement as an isolated formality: it must reflect the actual state of the service, be maintained, and form part of a documented improvement process.

When does Ley 11/2023 become relevant?

Ley 11/2023 must be considered when a business places a covered product on the market or provides consumers with a service expressly covered by the Spanish framework arising from Directive (EU) 2019/882. The question is therefore not whether every private business has a website, but whether its product or service actually falls within one of the regulated categories.

In the digital sphere, e-commerce is a common case. An interface that enables a consumer to enter into a distance contract may be subject to the accessibility requirements applicable to the service concerned. Other categories are covered, including certain consumer banking services, electronic communications, access to audiovisual media services, certain aspects of passenger transport, as well as e-books and their dedicated software.

The requirements may concern the information provided, interfaces, identification, payment or support features and, more broadly, the ability of persons with disabilities to use the service. Their precise scope depends on the relevant legal category. An audit must therefore link each screen and each user journey to the relevant obligation, rather than presenting every technical non-compliance as an automatic breach of Ley 11/2023.

Public sector, private provider and overlapping situations

The private status of a provider is not always sufficient to determine which legislation applies to the final service. An agency or software publisher may design a platform for a public administration without itself becoming the body subject to Real Decreto 1112/2018. Nevertheless, the public contract, specifications and delivery obligations may require it to produce a compliant service so that the public entity can meet its own obligations.

Conversely, a private company offering one of the services covered by Ley 11/2023 may be directly subject to this legislation, even if it performs no public function. However, the mere fact that a service is accessible online does not establish that it falls within the scope of e-commerce or another specified category. The classification of the user journey, the contract and the intended recipient remains decisive.

A functional overlap may also arise when the same group operates several interfaces: an institutional portal, a transactional area, a mobile application or a service provided on behalf of an authority. Each scope must be mapped separately. The safest approach is to link each service to its legal operator, users, function and potentially applicable legislation, and then document any areas of uncertainty.

Exemptions and transitional measures to verify

Ley 11/2023 notably provides an exemption for certain microenterprises providing services. This concept is based on European criteria relating to staff numbers and financial thresholds; it must not be confused with a commercial designation or with an entrepreneur’s national tax regime. The exemption must be assessed based on the company’s actual circumstances and the nature of its activity.

Even when an exemption appears possible, it does not necessarily mean that accessibility is unnecessary. Other rules may apply, including anti-discrimination legislation, consumer protection, contracts, public procurement, or requirements imposed by a partner platform. A company may also voluntarily choose to make its service accessible to expand its market, improve the quality of the user experience, and limit the cost of late-stage corrections.

Disproportionate burden and fundamental alteration are also regulated concepts, not automatic exemptions. Invoking them requires a case-specific, documented assessment based on the applicable criteria. Transitional provisions may also apply to certain products, contracts, or terminals already in service. The dates and conditions must be verified in the consolidated version of the legislation before any operational conclusion is reached.

A decision tree for choosing the right framework

First question: is the service operated by an entity within the scope of the Spanish public sector? If so, and if it is a covered website or mobile application, Real Decreto 1112/2018 is generally the primary reference. Any potential exclusions, statement requirements, and feedback or complaint procedures must then be examined.

Second question: does the activity correspond to a product or service expressly covered by Ley 11/2023? If so, the organization’s role, whether manufacturer, importer, distributor, or service provider, must be identified, along with the requirements specific to that category. For a service, it is also necessary to determine whether the company may qualify for an exemption and whether a transitional provision applies.

Third question: do several scopes coexist? In that case, a single legal text should not be selected for the entire organization. A public portal may fall under Real Decreto 1112/2018, while a separate commercial service falls under Ley 11/2023. Mapping each interface and user journey, as can be structured with Inclaria, helps preserve the legal justification and associated evidence without confusing the frameworks.

Compliance, Monitoring and Penalties: Avoiding Shortcuts

Both frameworks require more than a score produced by an automated tool. A meaningful audit combines an inventory of interfaces, technical testing, manual checks, content reviews and testing of representative user journeys. Issues must be classified according to their actual impact, linked to the applicable requirements and tracked until they are corrected. Dated documentation demonstrates the approach taken without turning a report into an absolute guarantee of compliance.

For the public sector, Real Decreto 1112/2018 notably establishes monitoring, accessibility statements and mechanisms allowing users to report a defect or request accessible information. For products and services covered by Ley 11/2023, monitoring and the consequences of non-compliance depend on the field, the competent authority and how these rules interact with sector-specific or consumer protection frameworks.

It is therefore unwise to state that a single fine applies to all forms of digital non-compliance in Spain. The level of risk depends on the applicable legislation, the party involved, the severity and persistence of the non-compliance, and the procedure initiated. Any sensitive decision, including determining whether an exemption applies, responding to an authority or assessing a penalty, must be confirmed against the consolidated legislation and, where necessary, by a Spanish lawyer.