Medius Accessibility Statement

Legal Framework

As of June 28, 2025, the European Accessibility Act (EAA) establishes binding accessibility requirements for digital products and services made available in the EU.

The applicable technical standard under the EAA is EN 301 549 (Accessibility requirements for ICT products and services), which incorporates the Web Content Accessibility Guidelines (WCAG) and extends them to cover additional ICT contexts. Compliance with EN 301 549 is the required basis for demonstrating EAA conformance. In France, the implementing frameworks are RGAA 4.1 (web) and RAAM 1.0 (mobile applications), both of which are national transpositions of EN 301 549.

In the United States, digital accessibility is separately governed by the Americans with Disabilities Act (ADA) and Section 508 of the Rehabilitation Act.

Accessibility Commitment and Standards

Medius is committed to ensuring digital accessibility for all users, including individuals with disabilities. Our objective is to deliver a seamless and inclusive experience across our spend management and accounts payable automation products, our websites (Medius.com and Expensya.com), and any publicly controlled digital platforms where Medius maintains control.

We aim to conform with EN 301 549 and its incorporated WCAG 2.1 Level AA criteria, and are progressively aligning with the updated WCAG 2.2 Level AA standard. These efforts are integrated into our ongoing user interface modernization program and our strategy to make accessible, user-friendly experiences the default across all Medius products.

Scope of Coverage

This statement covers the following Medius digital services and platforms:

• Expensya web application: app.expensya.com (transitioning to expense.medius.com)
• Expensya mobile applications: Expensya Next on iOS (App Store) and Android (Google Play)
• Medius AP Automation platform: cloud.mediusflow.com
• Medius.com (corporate website)
• Expensya.com (product website)
• Publicly available documentation and portals where Medius maintains control

This statement also covers interfaces used by Medius customers’ suppliers and employees where those interfaces are under Medius’s control.

While some Medius interfaces are accessible via mobile browsers, most core workflows are designed for desktop use. Native mobile applications are available for specific use cases, including expense reporting and approvals. We are committed to improving mobile accessibility in supported use cases as part of our product development roadmap.

Some third-party embedded tools or legacy interfaces may have inconsistent accessibility support. These are identified and addressed as part of our modernization program.

Compliance Status

Medius is partially conformant with EN 301 549 / WCAG 2.1 Level AA and is actively working toward full compliance.

Expensya audit results — October 2025

An accessibility audit of Expensya was conducted in October 2025 against RGAA 4.1 (web) and RAAM 1.0 (iOS and Android). Both frameworks are national implementations of EN 301 549. The audit combined automated tool analysis, structured manual testing, and evaluation with assistive technologies, following the methodology defined by RGAA and RAAM.

Platform	Framework	Conformance (Oct 2025)
Expensya web (app.expensya.com)	RGAA 4.1	27.9%
Expensya iOS (Expensya Next)	RAAM 1.0	62.77%
Expensya Android (Expensya Next)	RAAM 1.0	63.44%

Newer modules built on our current design system, such as Medius Payments, are designed and tested to meet accessibility standards and are not subject to the same legacy constraints as older modules.

Legacy areas that rely on custom-coded user interfaces may not fully meet EN 301 549 / WCAG 2.1 AA requirements. As we continue expanding adoption of our design system across the platform, accessibility improvements are prioritised in each release. An annual accessibility action plan for 2026 has been published and is available on request.

Medius/Expensya is currently conducting a VPAT assessment to evaluate the accessibility of our websites and establish a prioritized remediation roadmap. The VPAT is expected to be completed by July 15, 2026, with the accompanying remediation roadmap finalized by July 24, 2026. Once both are complete, our accessibility statement will be updated to reflect the findings and planned improvements.

In parallel, we are implementing the UserWay accessibility widget across our websites as an interim measure to support improved accessibility while we continue advancing the long-term accessibility of our digital properties.

Known Limitations and Remediation Plan

The October 2025 audit identified the following issues. Issues are classified as blocking (preventing task completion for users of assistive technology) or non-blocking (impairing usability but not preventing core task completion).

Expensya web (RGAA 4.1):

Blocking:

• Keyboard navigation: interactive elements lack visible focus indicators, preventing keyboard-only users from tracking their position within the interface
• Form accessibility: mandatory fields are not programmatically identified, and error messages are not consistently associated with their respective input fields
• Missing or inadequate text alternatives on informative images

Non-blocking:

• Heading hierarchy and semantic page structure require adjustment
• Colour contrast ratios fall below WCAG 2.1 AA thresholds in certain interface components

Expensya mobile — iOS and Android (RAAM 1.0):

Blocking:

• Interactive elements (menus, dialogs, dropdowns, toggles, buttons) lack accessible labels, preventing identification by screen reader and switch access users
• Assistive touch navigation is incomplete in certain views

Non-blocking:

• Colour contrast on certain text and graphic elements requires improvement
• Interface translation gaps requiring correction

These issues are being addressed through a phased remediation program aligned with our design system rollout. Our 2026 annual accessibility action plan sets targets of ≥50% web conformance and ≥75% mobile conformance (RGAA/RAAM) by end of 2026, with a quarterly remediation roadmap. Full conformance may not be achievable in all areas within this timeframe, but accessibility remains a product development priority.

Certain legacy components present significant technical and architectural challenges that make short-term remediation impractical. Following internal assessment of technical feasibility, cost, and long-term roadmap alignment, these areas are scheduled for full replacement as part of planned product upgrades.

In addition to Expensya, non-compliant areas in the broader Medius platform currently include invoice exception handling, manual supplier onboarding workflows, and select administrative configuration pages.

Feedback and Contact

We welcome feedback on the accessibility of Medius products and services. If you encounter an accessibility barrier or have a suggestion, please contact us at

accessibility@medius.com.

We aim to acknowledge accessibility-related requests within 5 business days and to provide a substantive response or resolution within 20 business days.

If you have not received a response within 20 business days, or if you are not satisfied with our response, you may escalate your concern to the relevant national enforcement authority in your country. Enforcement authority contacts are listed in the Country-Specific Addenda section below.

If you require this statement in an alternate accessible format, please contact us by email.

Statement Preparation

This statement was originally prepared on 14 August 2025 and updated on 4 June 2026. It is based on an accessibility audit conducted in October 2025 using RGAA 4.1 (web) and RAAM 1.0 (mobile), both of which implement EN 301 549. It is reviewed every six months to reflect current status and progress.

Compatibility with Assistive Technologies

Medius interfaces are designed to work with the latest versions of major web browsers (Chrome, Firefox, Microsoft Edge, Safari) and commonly used assistive technologies including NVDA, JAWS, and VoiceOver.

Enforcement Procedure

If you are not satisfied with our response to an accessibility-related request, you may contact the relevant market surveillance authority in your country under the European Accessibility Act. For a directory of enforcement bodies, see: https://ec.europa.eu/social/main.jsp?catId=1202.

Country-Specific Addenda

The enforcement authorities listed below are provided for reference. This list may be updated as national regulators evolve or publish new guidance.

Sweden

In Sweden, accessibility obligations are defined in the Act on Accessibility to Digital Public Services (Lag 2018:1937). Medius follows its principles, which are based on WCAG 2.1 Level AA. Guidance from the Swedish Agency for Digital Government (DIGG) informs our accessibility work and roadmap priorities.

Enforcement authority: Agency for Digital Government (DIGG) — https://www.digg.se

France

This accessibility statement is also made available in French, in accordance with Law N° 2005-102 of 11 February 2005 and its subsequent decrees, and the requirements of the Référentiel Général d’Amélioration de l’Accessibilité (RGAA).

Medius accessibility evaluations for the French market are conducted against RGAA 4.1 (web) and RAAM 1.0 (mobile), both of which implement EN 301 549. Our audit and modernisation work is designed to progressively achieve compliance with these frameworks.

Enforcement authority for private sector digital services under the EAA in France: Autorité de Régulation de la Communication Audiovisuelle et Numérique (ARCOM) — https://www.arcom.fr

Note: The Défenseur des droits may handle general disability rights complaints but is not the designated EAA enforcement authority for private sector digital services.

Denmark

Enforcement authority: Agency for Digital Government (Digitaliseringsstyrelsen) — https://digst.dk

Germany

This statement is made in accordance with the German Accessibility Strengthening Act (Barrierefreiheitsstärkungsgesetz – BFSG), which came into force on 28 June 2025, and the accompanying BFSG Ordinance (BFSGV).

Core modules built on our standardised design system are designed and tested in line with WCAG 2.1 Level AA. Ongoing modernisation focuses on progressively updating legacy components to meet the BFSGV requirements for perceivability, operability, understandability, and robustness.

Enforcement authority: Joint Market Surveillance Authority for the Accessibility of Products and Services (MLBF) — https://www.behindertenbeauftragter.de

MLBF c/o Ministry of Labour, Social Affairs, Health and Equality Saxony-Anhalt, P.O. Box 39 11 55, 39135 Magdeburg. Phone: +49 (0)391 567 6970. Email: MLBF@ms.sachsen-anhalt.de

Netherlands

Enforcement authority: Netherlands Authority for Digital Infrastructure (RDI) — https://www.rdi.nl

Belgium

Enforcement authorities include FPS Economy, BIPT, and relevant federal and regional agencies — https://economie.fgov.be

Italy

This statement is made in accordance with Legislative Decree no. 106 of 10 August 2018, implementing EU Directive 2016/2102.

Enforcement authorities: Ministry of Enterprises and Made in Italy (MIMIT) and the Agency for Digital Italy (AgID) — https://www.agid.gov.it

Spain

This statement is made in accordance with Law 11/2023, which transposed the European Accessibility Act into Spanish law.

Enforcement responsibilities in Spain are decentralised. Under Article 27.3 of Law 11/2023, enforcement authorities are determined by each autonomous community. No central coordinating authority has been established at present.

General information: https://administracionelectronica.gob.es

Austria

Enforcement authority: Federal Ministry of Social Affairs, Health, Care and Consumer Protection — https://www.sozialministerium.at

Ireland

Enforcement authority: Competition and Consumer Protection Commission (CCPC) — https://www.ccpc.ie

Escalation: Office of the Ombudsman, 6 Earlsfort Terrace, Dublin D02 W773 — https://www.ombudsman.ie — 01 639 5600

Norway

Norway is not an EU Member State but has aligned with the principles of the European Accessibility Act under its Anti-Discrimination Accessibility Act.

Enforcement authority: Norwegian Agency for Public Management and eGovernment (Digdir) — https://www.digdir.no