In short
- Five checks anyone in the office can run in about half an hour, with no technical skills and free tools.
- Start with the AgID accessibility statement, which must be updated every year by 23 September, and the Amministrazione trasparente (transparency) section.
- Then cookies and privacy, visible security and services that work on a smartphone: these are the things members and the public notice first.
- For each check: why it matters, how to verify it, what to do if something is missing. For regulatory questions, the reference point remains the body’s DPO.
⏱ Reading time: 7 minutes
A scene we see often. A member opens their professional body’s website on their phone during a lunch break, looking for the PEC (certified email) address and the form to update their details. They scroll, open one menu, then another. After a minute, they call the office.
Nobody on the Council notices, because people who know the site already know where to click. Psychologists call this the “curse of knowledge” (Camerer, Loewenstein and Weber, 1989): once we know something, it is hard to imagine how it looks to someone who doesn’t. That is why a body’s website always seems clearer to the people who run it than to the people who use it.
Here are the five checks we suggest running today, looking at the site through the eyes of an ordinary member.
A note for readers outside Italy: regulated professions such as doctors, nurses, engineers and lawyers are organised in public professional bodies called Ordini. This article is about their websites.
1. Accessibility statement: is it there, and is it up to date?
Why it matters. Public administrations must publish or update the accessibility statement for every website and app by 23 September each year, using AgID’s online form (AgID is the Agency for Digital Italy). The statement must list any content that is not accessible and the feedback mechanism anyone can use to report a barrier.
The figures show there is plenty to do: in its end-of-2024 monitoring, AgID checked 29,409 websites and more than 4.7 million pages. The most frequently failed criteria were visible focus, use of colour and minimum contrast.
How to check in 5 minutes.
- Scroll down to the footer: there should be an “Accessibility statement” link (in Italian, “Dichiarazione di accessibilità”) leading to your body’s statement generated with AgID’s form. Check the year.
- The link must open your own statement, i.e. the specific address that AgID’s form generated for your website: a generic link to the form.agid.gov.it home page is not enough.
- Press the Tab key several times from the home page: you should always be able to see where you are. If the cursor “disappears”, visible focus is not working.
- Run the home page through MAUVE++, the tool developed by Italy’s National Research Council (CNR) and also used in AgID’s monitoring, or through WAVE.
If it’s missing. Filling in the statement is the job of the Responsabile per la Transizione al Digitale (the digital transition officer), who logs in to the form with the email address registered on IPA, the official index of Italian public administrations. We have gathered obligations and deadlines in a guide to digital accessibility.
2. Amministrazione trasparente: complete, or just there?
Why it matters. Legislative Decree 33/2013 (D.Lgs. 33/2013), Italy’s transparency code, applies to professional bodies “insofar as compatible” (Article 2-bis), with the simplifications that ANAC, the national anti-corruption authority, set out for Ordini and Collegi in resolution no. 777 of 2021. It is the section council members and members consult when they look for a specific piece of information, and the first one people check when something is disputed.
How to check in 5 minutes.
- The “Amministrazione trasparente” link must be on the home page and easy to find.
- Open three sub-sections at random: consultants and contractors, tenders and contracts, financial statements. Look at the date of the last update.
- Open an attached financial statement or tender: is it a PDF with selectable text or a scan? If it’s a scan, it isn’t accessible.
- Look for empty pages. A sub-section with no content and no explanation always leaves a doubt: if an obligation doesn’t apply to you, it’s worth saying so.
If it’s missing. The internal reference is the RPCT (the officer responsible for preventing corruption and ensuring transparency). Our practical advice is to give each sub-section an owner and a review date, so updates don’t depend on one person’s memory.
3. Cookies and privacy: does the banner do what it says?
Why it matters. The guidelines issued by the Garante, the Italian Data Protection Authority, on 10 June 2021 call for a banner with equally prominent buttons, an X that closes it without setting profiling cookies, and no cookies other than technical ones before the user chooses. Scrolling the page does not count as consent. The GDPR also requires the contact details of the Data Protection Officer to be published (Article 37(7)).
How to check in 5 minutes.
- Open the site in a private (incognito) window. Does the banner appear? Are “Reject” and “Accept” equally visible? Is there an X?
- Before choosing, check whether the page already loads embedded videos, maps or external fonts: this is one of the most common cases on public bodies’ websites.
- The footer should include a link to review your cookie choices, and the privacy notice should give the DPO’s contact details.
If it’s missing. Talk to the body’s DPO: we handle the technical side (banner, blocking scripts until consent), while the legal assessment stays with them.
4. Visible security: what visitors see when they land on the site
Why it matters. According to the Clusit Report 2026 (Clusit is the Italian information security association), in 2025 Italy suffered 9.6% of the serious incidents recorded worldwide, and 28% of Italian cases hit the government, military and law enforcement sector. A neglected website is often the easiest way in, even when it holds no sensitive data.
How to check in 5 minutes.
- The site must open in HTTPS in the address bar, even if you type “http://”. The free SSL Labs test grades your certificate.
- Ask your provider for the date of the last update of the CMS and plugins. If nobody knows, that is already your answer.
- Try the contact forms: after submitting, no other users’ data should appear and attachments must not end up on public pages.
- The body’s PEC address must be shown clearly and match the one registered on IPA.
If it’s missing. No need to panic: plan the work with your provider, starting with updates. For a broader view of the body’s data, our article on interoperability for professional bodies may also help.
5. Services and contacts: can you find them on a smartphone in seconds?
Why it matters. Members mostly visit the site from their phones. Google considers a page load good when the main content appears within 2.5 seconds (Largest Contentful Paint). Beyond that, patience runs out and the office phone starts ringing.
How to check in 5 minutes.
- Enter the address in PageSpeed Insights and look at the mobile result.
- Try the 10-second test: ask a colleague who doesn’t work on the site to find, on their phone, the PEC address and opening hours, how to request a certificate, how to pay the annual fee with pagoPA and how to log in to the members’ area with SPID or CIE (Italy’s public payment platform and digital identity systems), where the body offers these services.
- Note where they get stuck. That is the first thing to fix.
If it’s missing. Targeted fixes are often enough: lighter images, a shorter menu, the most requested services highlighted on the home page.
How we work
In the projects we run for public bodies, we always start with a snapshot: the same five checks, done methodically, plus the manual checks that automated tools cannot cover. The result is a list of priorities with realistic timescales, to share with the digital transition officer, the RPCT and the DPO. Then we step in where needed and schedule a periodic review before 23 September, so the statement doesn’t turn into a last-week rush.
Frequently asked questions
Who has to fill in the professional body’s accessibility statement?
The Responsabile per la Transizione al Digitale (the digital transition officer), through AgID’s form, using the official email address registered on IPA.
Are automated tools enough to check accessibility?
No. They find many technical errors, but some checks, such as keyboard navigation or the clarity of the text, have to be done by hand.
Does any cookie banner make us compliant?
What counts is how it is built and what it loads before consent. The banner should be checked on the live site and assessed with the body’s DPO.
How long do these five checks take?
About half an hour for a first check. The real work is deciding who fixes what, and by when.
Where should we start if we find several problems?
With what is visible and quick to fix: accessibility statement, cookie banner, HTTPS. Then updates and mobile services.
Free webinar: “Digital accessibility for professional bodies, between legal obligation and opportunity”
Thursday 26 November 2026, 11:00-12:00 (CET), on Zoom, in Italian. An hour designed for administrative staff, offices and contact persons of professional bodies: what the rules require, how to prepare for the next statement, which mistakes to avoid.
Anyone who attends at least 80% of the session receives a certificate of attendance.
Registration: sign up for the webinar on this page
Would you rather start from your own website? Request a free check-up: we analyse it and send you the priorities.
Let’s talk
If these checks leave you with a list of questions, we’re happy to talk them through. Book a 30-minute call or write to posta@swdweb.it.
Leonardo Pantaleo, CEO of SWD Group
