AODA Compliance: A Web-First Guide for Ontario Businesses

The compliance letters started arriving

For years, most Ontario organizations treated web accessibility as a best practice. Something to get to eventually. Over the last year and a half, that changed. We have seen the biggest influx yet of companies coming to us in the same state: the government has reached out, there is a compliance deadline, the potential fines are eye-watering, and they need a fix now.

That is a rough position to be in. Being told to bring an entire website into compliance under a government timeline is not how anyone wants to run a redesign. The good news is that it is avoidable, and the fix is more manageable than the panic suggests. This is a web-first breakdown of AODA: who it applies to, what the standard actually is, how enforcement works, and where to start.

To pressure-test the legal side, we talked it through with David Fanjoy, a partner at McMillan LLP who works on AODA compliance. His points on enforcement and the law are woven in below. None of this is legal advice, it is what we and David have seen on the ground, and your situation deserves its own review.

Who AODA actually applies to

The Accessibility for Ontarians with Disabilities Act came into force in 2005, well ahead of most of the country. It is Ontario-specific and structured almost entirely around employee count.

The line that matters for web: if you have 50 or more employees in Ontario, the web accessibility requirements apply to all of your publicly available websites, web applications, and the content on them. That is a broad obligation, and it catches a lot of organizations who assumed accessibility was about ramps and physical space.

A few thresholds sit underneath that. Organizations with 20 or more employees have to file an accessibility compliance report every three years. Between 20 and 50 employees, the requirements are lighter and the web content obligations do not fully apply. Under 20, the strictness drops off further. One catch worth flagging: the count includes part-time and seasonal staff, so companies growing through the 40s often cross the 50 line without realizing the obligations came with it. As David put it, clients regularly come in thinking they are at 47, then mention they just hired three more people.

If your organization is federally regulated, a bank, a telecom, an airline, this is a different regime. Roughly 90 percent of business in Ontario is provincially regulated and falls under AODA, but federally regulated entities answer to the Accessible Canada Act instead.

Ontario was early, and for two decades that head start did not ripple out much. That is now changing. British Columbia has legislation covering its public sector and is weighing private-sector rules, Nova Scotia is on a similar path, and Manitoba has requirements that touch web content for businesses. If you operate across provinces, the patchwork is worth watching.

The standard: WCAG 2.0 AA, and why 2.1 matters anyway

AODA points to the Web Content Accessibility Guidelines, and the legal requirement is WCAG 2.0 Level AA. The World Wide Web Consortium, through its Web Accessibility Initiative, publishes these guidelines, and they are built on four principles: content should be perceivable, operable, understandable, and robust. Perceivable means people can take in the information through their senses. Operable means they can navigate and use the site, including through keyboard navigation alone. Understandable means the content is clear and predictable. Robust means it works reliably across assistive technologies like screen readers and voice recognition software.

WCAG has three conformance levels. A is the minimum, AA is the standard almost every law and legal case references, and AAA is the most comprehensive. Triple A tends to be reserved for government infrastructure rather than expected of private businesses, so AA is the number that matters for most of the organizations reading this.

Here is the wrinkle. The law says WCAG 2.0. The guidelines have moved on. WCAG 2.1 was published in June 2018, is backwards compatible with 2.0, and adds success criteria for mobile accessibility and cognitive and learning disabilities. WCAG 2.2 is the current recommendation. So there is a gap between the letter of the law, which is 2.0, and the spirit, which is closer to where the World Wide Web Consortium is actually steering.

You could hit the WCAG 2.0 AA floor, be compliant, and stop there. The problem is that Ontario is falling well behind the recommended international standard, and there is nothing stopping the government from giving notice and bumping the required level. If that happens after you have only built to 2.0, you are back to re-auditing and rehiring. Building to the current WCAG guidelines now is cheaper than getting caught a level behind later. When we scope a build, we treat 2.0 AA as the compliance minimum and the current guidelines as the design target.

How enforcement actually works

For a long time, spot audits were rare. That has shifted, and the mechanism is worth understanding because a lot of organizations trip over it themselves.

The three-year compliance report is the trigger. If you are over 20 employees, you file it through the government portal, and it asks you to declare your status. If you check that you have 50 or more employees and that you are not web compliant, you are effectively putting yourself on the ministry's radar. Organizations that file as non-compliant have been getting an auditor assigned within a few weeks. The next reporting deadline is December 31, so if you are above the threshold and behind on the web side, now is the time to get ahead of it rather than out yourself with a report and no plan.

Once you are audited, a compliance officer reviews your site and your documentation and asks whether you have met the checklist. The fines can be significant. In our experience, and David's, the officers are not trying to raise revenue. They give reasonable deadlines, they accept sensible explanations, and they respond well to an organization that says, we know we are not there, here is our plan, here is who we hired, here is the timeline. What they do not accept is silence, missed simple requests, or months of internal deliberation before anyone does anything. A request for your existing policy should not take a year to answer.

There is also a detail people misread. The web content rules include a provision that you do not have to comply where it is not practical. Clients latch onto that and assume their situation qualifies. It rarely does. The provision is read in light of available software, tools, and consultants. It is not practical for you to do it in-house is not the same as it cannot reasonably be done. As David noted, that clause is not the escape hatch people hope it is.

Remediation is not a redesign

The reason the December deadline causes panic is a mismatch in timelines. A compliance officer might reasonably expect movement in 30 to 60 days. Nobody rebuilds an enterprise website in 60 days.

The way through is to separate the two things. Remediation is targeted repair: fixing the specific barriers that put you out of compliance. That is the work you can move on quickly, in that 30 to 60 day window, to demonstrate progress. A full redesign is a different project on a different clock, roughly six to eight months for a mid-sized site and twelve to sixteen for something enterprise-scale. In our experience, as long as you have engaged someone and can show a credible plan and timeline, compliance officers accept the longer redesign horizon. The failure mode is spending 90 days pushing a decision up the chain and another 60 running an RFP before anyone starts.

Web compliance also touches far more than the visible design, which is where redesigns quietly fail. It is the content structure, the semantic HTML, the forms, the colour contrast, the alt text and link text, keyboard operability. And PDFs. Teams rebuild the whole site, launch it accessible, and forget the library of PDFs sitting behind it, none of which pass. Scope those in from the start.

If you sell into the United States

For Tennis clients doing business across the border, the ADA is a separate obligation from AODA, with its own risk profile. The Americans with Disabilities Act prohibits discrimination against people with disabilities, and its application to websites has driven a steady stream of litigation. Title III, which covers public accommodations, has been the basis for thousands of website accessibility lawsuits filed each year. The ADA does not name a specific technical standard the way AODA does, but WCAG has become the practical benchmark courts and settlements lean on, so building to WCAG AA serves you on both sides of the border.

The takeaway for a Canadian company expanding into the US market is simple: meeting AODA does not automatically clear you for ADA exposure, but a site built properly to WCAG covers most of the ground for both. If US sales are on your roadmap, factor that in before you launch, not after the first demand letter.

Start with an audit

Whatever your employee count, the sensible first move is an audit. Know where you stand. It tells you whether you are compliant, and if not, exactly what needs remediation and in what order. Automated scans are a fast way to surface issues, and an accessibility checker should be paired with manual testing, because automated tools will miss things that screen reader users would catch immediately.

The compliance case for an audit is obvious. The better case is quieter. Accessibility barriers cut real people out of your business. Someone we spoke with recently skipped a prominent annual Toronto event entirely because the organizers listed the venues but never said which were accessible, so she could not tell where she could actually go. Engaged, willing to show up, and cut out by a missing line of information. That is a customer, a member, or an attendee you lose without ever seeing it happen, fines or no fines.

So run the audit first. Not because the government might come knocking, though it might. Run it because at a certain point this stops being about compliance and becomes about whether your business is quietly turning people away.

At Tennis, we help teams design and rebuild sites and platforms with accessibility built in from the start, so you are not retrofitting under a deadline. If a compliance report is coming and you are not sure where you stand, an audit is the place to begin.