skip to content

Accessibility Compliance Reporting

Buyers ask for a VPAT, a Section 508 conformance report and an accessibility statement as though they were the same document. They are three different things with three different readers. This page tells you which one you are actually being asked for, and what each has to contain to survive scrutiny.

DHS Trusted TesterFederal testing process
IAAP certified teamColleagues on every audit
97 case studiesPublished, not claimed

Start here

Which one are you being asked for

Buyers use these names loosely, and often ask for the wrong one. Find the sentence you received in the left column, and the right column tells you what they actually need.

What a buyer says, and the document that answers it.
What they saidWhat they actually need
Send us your VPATA completed VPAT in the edition their procurement team uses, filled in criterion by criterion with real remarks rather than a wall of “Supports”. The VPAT service.
We need Section 508 conformanceTesting against the Revised Section 508 standards, and a dated conformance report you can attach to a bid. Section 508 testing.
Where is your accessibility statement?A public page on your own site saying what conforms, what does not yet, and how somebody reports a barrier to a human being. The statement service.
Are you WCAG 2.2 AA compliant?None of the three on its own. That question is answered by an audit first, and then by whichever of the three documents the person asking will actually read. Start with the audit.

The three documents

Different readers, different jobs

They are not interchangeable, and none of them replaces the other two. Each has one reader in mind.

VPAT

Read by a procurement officer comparing vendors. A standard form, one row per criterion, with a rating and a remark. The remarks column is where trust is won or lost.

Section 508 conformance report

Read by a federal agency or a contractor bidding to one. Tested against the Revised 508 standards, dated, signed, and specific about what was in scope.

Accessibility statement

Read by your own visitors, and by a lawyer deciding whether you are acting in good faith. Published on your site, honest about what does not work yet, with a way to report a problem.

Order of work

Nothing can be written before the testing

Every one of these documents is a report on findings. If there are no findings, there is nothing honest to write, which is why a VPAT filled in from a questionnaire is worth nothing to the buyer who reads it carefully.

  1. Audit

    Manual testing against WCAG 2.2 AA, criterion by criterion, on the product and version that will be named in the document.

  2. Fix what can be fixed

    Remediate in priority order. Anything still outstanding does not disappear. It gets stated plainly in the document, with a date by which it will be addressed.

  3. Write the document the reader needs

    Procurement officer, federal buyer or your own visitors. The findings are the same. The form they are presented in is not.

  4. Date it, and retest when the product changes

    An undated conformance document is treated as out of date on sight. A dated one that admits two open issues is stronger than an undated one claiming everything passes.

Questions

Compliance reporting, answered

Can you write a VPAT without auditing the product?

Technically yes, and plenty of firms do. It is filled in from a questionnaire the vendor answers about itself. It is also the fastest way to lose a contract, because the first procurement officer who opens the product and finds a failure marked “Supports” has caught you in writing. I will not produce one that way.

Which VPAT edition do we need?

It depends entirely on who is asking. A United States federal buyer wants the Section 508 edition. A European buyer wants the EN 301 549 edition. A multinational usually wants the INT edition, which covers all of them and is longer. Ask the buyer which one they want before anybody starts writing, because redoing it in another edition is not a small edit.

Does the statement really have to admit what fails?

Yes, and it helps you rather than hurting you. A statement claiming full conformance is disproved by one visitor with a screen reader. A statement that names two known issues and gives a date shows a process, which is exactly what a regulator or a lawyer is looking for.

How often do these need updating?

Whenever the product changes in a way that affects any criterion, and at least once a year even if it does not. A document more than twelve months old invites the question of what has changed since, and you want a better answer than silence.

Can one document do all three jobs?

No, although they share a single set of findings underneath. One audit can feed all three, which is where the saving is. Trying to hand a procurement officer your public accessibility statement, or publishing your VPAT as a web page, tends to satisfy nobody.

Next step

Tell me who is asking

Forward the email or the tender clause, and the address of the product. Within one working day you get a written reply saying which document you actually need, which edition, what the testing behind it involves and what it costs. If the deadline is not achievable I will say so rather than take the work.