The standard
What Section 508 asks for
The 2017 refresh restructured Section 508 around WCAG rather than its own separate checklist. That simplified the web part considerably, and added obligations beyond the page itself.
| Area | What the standard requires |
|---|---|
| Web content | WCAG 2.0 Level AA, incorporated by reference. Test to WCAG 2.2 AA and you satisfy this comfortably, because 2.2 includes everything in 2.0 and adds criteria buyers increasingly ask about. |
| Electronic documents | PDFs, Word files, spreadsheets and presentations you distribute must themselves be accessible: tagged structure, correct reading order, alternative text and real table headers. |
| Software and applications | Desktop and mobile applications must expose names, roles, states and values to platform accessibility APIs, and must be operable by keyboard alone. |
| Support and documentation | Help content, training material and support channels must be accessible too, and product accessibility features must be documented for the buyer. |
Process
How testing runs
Scope and versions
We agree exactly what is being reported on: which product, which version, which user roles and which platforms. This goes at the top of the report, and it is the first thing a procurement officer checks.
Manual testing against every criterion
Each criterion evaluated by hand, including the ones you pass, because a conformance report has to state a position on all of them. JAWS and NVDA on Windows 11, VoiceOver on macOS and iOS, TalkBack on Android, keyboard alone, 200 and 400 percent zoom, and forced colours.
Draft report and gap list
You receive the conformance report plus a separate developer-facing list of the gaps, so you can decide what to fix before the report is finalised. Many clients fix two or three items at this stage and improve their ratings.
Final report, dated and signed
The finished Accessibility Conformance Report, ready to attach to a bid, with an independent tester named on it. Re-testing later updates it as your product changes.
The document
What the report contains
A VPAT is not a marketing sheet. It is a criterion-by-criterion statement, and experienced buyers read the remarks column far more carefully than the ratings.
Supports, partially supports, does not support
Each criterion gets one of these ratings plus an explanatory note. “Not applicable” is also valid where a criterion genuinely does not arise. What experienced buyers look for is consistency: a report claiming full support on every criterion, including the difficult ones, reads as untested rather than excellent.
The remarks column, where trust is won
For anything less than full support, the note should say what the limitation is, who it affects, whether a workaround exists and when it will be addressed. A clear, specific note about a known gap builds more confidence than a vague claim of compliance.
The right VPAT edition for your buyer
Editions exist for Section 508, EN 301 549, WCAG alone, and an international edition covering all three. Federal buyers usually want the 508 edition; European public bodies want EN 301 549. If you sell to both, the international edition saves producing two reports.
A date and a scope statement
The report must say what was tested, at what version, with which assistive technology, and when. An undated report against an unspecified version is worth very little to a procurement officer.
Credentials
Verifiable, not claimed
Every figure below points to a public record you can open yourself: the certification, the plugin listings, the published case studies.
- DHSTrusted Tester certified
- IAAPCertified colleagues
- 97Published case studies
- 2003M/S. Anblik founded
Why independent
What an outside tester adds
A self-completed VPAT is permitted, and for some products it is the sensible choice. For a competitive bid, an independent report carries more weight.
- Credibility with the buyer. A named external tester with a recognised certification is harder to discount than a vendor assessing itself. DHS Trusted Tester is the certification the federal testing process itself is built around.
- Findings you cannot see. Teams testing their own product know how it is meant to be used. An outside tester drives it the way an unfamiliar user does, which is where most real barriers surface.
- A defensible position later. If accessibility is ever challenged, an independent dated report showing what was tested and what was disclosed is a materially better position than an internal claim.
- One report, several standards. The same testing supports Section 508, EN 301 549 and WCAG 2.2 AA, so selling into the United States and Europe does not mean paying twice.
Questions
Section 508 and VPAT, answered
Who has to comply with Section 508?
Federal agencies, and in practice anyone selling information and communication technology to them. The obligation sits on the agency, but it is passed to vendors through procurement, which is why you are usually asked for a conformance report before a contract is signed.
What is the difference between Section 508 and WCAG?
Section 508 is United States federal law. Since the 2017 refresh it incorporates WCAG 2.0 Level AA by reference for web content, and adds requirements covering hardware, software, documentation and support. WCAG is the technical core, and 508 wraps procurement and support obligations around it.
What is a VPAT, and do I need one?
A Voluntary Product Accessibility Template is the standard form used to write an Accessibility Conformance Report. It states, criterion by criterion, whether your product supports, partially supports or does not support each requirement, with explanatory notes. If an agency or a large enterprise asks for your accessibility documentation, this is what they mean.
Can I fill in a VPAT myself?
You can, and the template is free. The risk is that a self-completed report claiming full support on every criterion invites scrutiny, and an inaccurate one damages your credibility with the buyer. The honest partial-support entries are usually what earn trust.
Does partial support lose us the contract?
Usually not. Buyers expect some partial support entries; what they are assessing is whether you understand your own product and have a plan. A report that is honest about three gaps with dates against them reads far better than one claiming perfection.
What about EN 301 549?
EN 301 549 is the European equivalent, used for public procurement across the EU and referenced by the European Accessibility Act. It also builds on WCAG, so one body of testing supports both. Reports are often produced covering 508 and EN 301 549 together.
How long does 508 testing take?
For a web application, typically two to three weeks to test and write the conformance report, depending on how many components and user roles exist. If you have a bid deadline, tell me the date first and I will say plainly whether it is achievable.
Next step
Tell me your bid deadline first
Send the product address and the date the conformance report is due. Within one working day I will reply in writing saying whether it is achievable, what the testing covers and what it costs. If the deadline is not achievable I will tell you that rather than take the work.