Accessibility law
Section 508 & VPAT, Explained
Selling to the U.S. government means proving accessibility. Here’s how Section 508, VPATs, and conformance reports actually work.
If you sell software, hardware, or digital services to the U.S. government — or to a company that does — you’ll eventually be asked for two things: Section 508 conformance and a VPAT. They’re closely related and widely misunderstood. This guide explains both in plain terms and how to produce a credible accessibility conformance report.
What Section 508 is
Section 508 of the Rehabilitation Act requires U.S. federal agencies to make their electronic and information technology accessible to people with disabilities — both employees and the public. In practice that obligation flows down to vendors: if the government buys your product, it must be 508-conformant, so procurement asks you to document your accessibility.
Who it applies to
- Federal agencies directly.
- Vendors selling to the federal government — software, SaaS, websites, hardware, documents.
- Contractors and subcontractors whose deliverables become part of a federal system.
- Many state governments and universities adopt 508 or equivalent rules, extending the reach well beyond federal deals.
The standard: WCAG via the “508 Refresh”
The 2017 “Section 508 Refresh” aligned the law with WCAG 2.0 Level AA for web content and software. In practice, target WCAG 2.1 AA (or 2.2 AA) — it’s a superset and matches what modern procurement and the ADA expect. Our WCAG 2.2 checklist covers the criteria.
The throughline
508, the ADA, and the EAA all converge on the same technical yardstick: WCAG AA. Do the WCAG work once and you’re most of the way to all three.
What a VPAT is
A VPAT (Voluntary Product Accessibility Template) is a standardized document, published by the IT industry council ITI, that you fill in to describe how your product meets accessibility standards. It walks through each applicable criterion and asks you to state a conformance level and explain it.
The conformance levels you’ll assign per criterion:
| Level | Meaning |
|---|---|
| Supports | Meets the criterion with no exceptions. |
| Partially Supports | Meets it in part; some functionality doesn’t. |
| Does Not Support | Doesn’t meet the criterion. |
| Not Applicable | The criterion doesn’t apply to the product. |
VPAT vs. ACR — the distinction people miss
A blank VPAT is the template. Once you fill it in for your product, the completed document is properly called an Accessibility Conformance Report (ACR). Buyers often say “send me your VPAT” but mean “send me your completed ACR.” There are also VPAT editions for different standards — WCAG, the EU’s EN 301 549, Section 508 — and an “INT” edition that covers all three.
How to produce a credible VPAT/ACR
- Test thoroughly first. Automated scan for the machine-detectable criteria, then manual testing (keyboard, screen reader, zoom) for the rest. An ACR is only as good as the testing behind it.
- Pick the right edition. WCAG, 508, EN 301 549, or INT depending on who’s buying.
- Be honest per criterion. “Partially Supports” with a clear remarks note is far more credible — and safer — than blanket “Supports”. Overstating conformance is a misrepresentation risk.
- Add useful remarks. Explain how each criterion is met or what the gap is and your remediation plan.
- Keep it current. Re-issue the ACR when the product changes. A stale report dated two years ago undercuts trust — continuous testing keeps it fresh.
Don’t copy-paste “Supports” down the column
Procurement accessibility reviewers test claims. An all-green ACR that doesn’t survive a keyboard test damages credibility and can jeopardize the deal. Accuracy wins contracts; optimism loses them.