The rule covers large organizations — private companies and non-profits with 50 or more employees in Ontario — and the public sector: every municipality, plus school boards, hospitals, colleges, universities and transit agencies, with no size limit at all. Under 50 staff, you're a “small organization” and this rule doesn't apply to you.

The regulation names WCAG 2.0 — the W3C recommendation from December 2008 — not the newer 2.1 or 2.2. Two small pieces are left out: live captions (SC 1.2.4) and audio descriptions for pre-recorded video (SC 1.2.5). In Ontario, 2.0 AA is the legal reference point.

Since January 1, 2021, all public websites and web content of covered organizations have needed to meet WCAG 2.0 AA (minus those two exceptions). This isn't coming up — it's been the rule for over five years already.

It reaches websites and web apps your organization controls — directly or through a contract — and content published after January 1, 2012. Older content is mostly grandfathered in. It's about your public internet site; a private company's internal intranet isn't covered.

On a conviction under the AODA, fines can reach up to $50,000 a day for an individual and up to $100,000 a day for a corporation, and directors carry their own duty of care. Those are the legal maximums. Day-to-day, penalties for corporations run $500 to $15,000. Ontario's own 2023 review of the law found there's no meaningful enforcement right now, so the real pressure comes from the reporting deadline, government buyers, complaints and lawsuits, and customers who can't use your site.

Start with an automatic scan against WCAG 2.0 AA. It catches the machine-detectable problems — about 57% of issues by volume (Deque, 2021) — things like missing image descriptions, faint text and unlabelled forms. The rest (keyboard flows, screen-reader behaviour, reading order) needs a human. Do the free automatic pass first; it tells you honestly how much work you're looking at.