Who needs this
Who needs a VPAT right now
A VPAT is not a badge. It is a form a buyer reads to decide whether your product will put their own compliance at risk. The people who ask for one are usually working to a date, and the situations below are the ones that land in my inbox most weeks.
A United States federal buyer asked
Federal agencies must buy technology that meets the Revised Section 508 standards, and the contracting officer needs a conformance report on file before the order goes through. They want the Section 508 edition, and they want it to look like it was completed by somebody who understands the test process.
A state agency, university or school district asked
Public bodies covered by the ADA Title II web rule are now checking every vendor they onboard. The request often arrives inside a vendor questionnaire, with a deadline that was set by somebody else's procurement calendar rather than yours.
An enterprise sent a security and accessibility questionnaire
Large private buyers increasingly ask for a VPAT alongside their security review, because their own legal team has told them to. A missing or obviously template-filled report is enough to lose the deal to a vendor who has one.
You sell to Europe, the UK, Canada or Australia
European public buyers work to EN 301 549, and since June 2025 the European Accessibility Act extends that to a wide range of private products and services. Canadian buyers cite AODA. The EU or INT edition of the VPAT answers all of them at once.
Editions
Which VPAT edition you need
The template is published by the Information Technology Industry Council and the current version is VPAT 2.5. It comes in four editions, and asking the buyer which one they want before anybody starts writing saves a great deal of rework, because moving a finished report to another edition is not a small edit. The completed document is properly called an Accessibility Conformance Report, or ACR, though almost everybody still calls it the VPAT.
| Edition | What it covers, and who wants it |
|---|---|
| VPAT 2.5 508 | The Revised Section 508 standards, which incorporate WCAG 2.0 Level A and AA, plus the functional performance criteria and the hardware, software and documentation chapters. United States federal buyers and their contractors. |
| VPAT 2.5 WCAG | WCAG 2.0, 2.1 and 2.2 at Levels A, AA and AAA. State and local government, universities, and enterprise buyers whose questionnaire simply says "WCAG conformance". |
| VPAT 2.5 EU | EN 301 549, the European standard for ICT procurement and the basis of the European Accessibility Act. European public bodies, and private buyers covered by the Act. |
| VPAT 2.5 INT | All three in one document: Section 508, WCAG and EN 301 549. Multinationals and any vendor who sells in more than one market and does not want to maintain three reports. |
Every criterion in the report is answered with one of five conformance levels: Supports, Partially Supports, Does Not Support, Not Applicable, or Not Evaluated. The remarks column beside each one is where a report earns or loses trust, and it is the part I spend the most time on.
What is included
Exactly what the VPAT service includes
A report is only as good as the testing underneath it. So the service is the testing first, and the document second, in that order.
Manual testing of every criterion in scope
Each success criterion in the chosen edition is tested by hand on the product and version that will be named in the report: JAWS and NVDA on Windows, VoiceOver on macOS and iOS, TalkBack on Android, keyboard alone, 200 and 400 percent zoom, and Windows High Contrast. Automated scans run as a first pass and are never treated as the answer.
The completed ACR in the edition your buyer named
Delivered as an accessible Word document and a tagged PDF, using the current ITI template, with the product name, version, evaluation date, testing methods and scope stated on the first page. A report without those is treated as out of date the moment it is opened.
A remarks column that says something
For every criterion that is not a clean Supports, the remark states what fails, where, and for whom. "Partially Supports: the date picker on the booking form cannot be operated by keyboard; all other date fields can" is a remark a buyer can work with. A page of "Supports" with empty remarks is what gets a vendor caught.
A one-page summary for the buyer
Procurement officers rarely read forty pages. The summary says what was tested, what conforms, what does not yet, and when the open items will be addressed. It goes in front of the ACR, and it is usually the only page a non-specialist reads.
An issue list your developers can act on
Everything marked Partially Supports or Does Not Support, restated as a developer task with the page, the component and the fix. If you want the failures corrected before the report is issued, that is accessibility remediation, and the same testing feeds both, so you do not pay for it twice.
A re-issue when the product changes
A VPAT describes one version on one date. When you ship a release that touches any criterion, the report needs updating, and I re-test only what changed rather than starting over. Most vendors settle into a yearly refresh plus a re-issue after major releases.
Sample documents
- Sample accessibility conformance report, VPAT 2.5 Revised Section 508 edition (PDF, 241 KB): 13 pages covering WCAG 2.0 Level A and AA, the Section 508 functional performance criteria and the chapters that do not apply, each stated as such with a reason.
- Sample accessibility audit report (PDF, 1.8 MB): the testing behind an ACR. 86 pages, 151 barriers, each with its WCAG criterion, severity, the test that found it and the fix.
Both are real client deliverables shared as public samples. E-mail addresses, keys, screen recording links and internal tracking columns have been removed. Both PDFs are tagged and have bookmarks, so they read properly with a screen reader.
How the work happens
How a VPAT is produced, step by step
Four stages, each ending in something written that you can forward. Nothing here needs a meeting to move forward, which matters when a buyer's deadline is measured in days.
Scope, edition, and a written quote in one working day
Send the address of the product, which edition the buyer asked for, the version you will be naming, and the date the buyer needs it by. If you are not sure which edition, forward the buyer's email and I will tell you. Within one working day you receive a written scope and price. If the deadline is not achievable I say so rather than take the work.
Test every criterion by hand
Each criterion in the edition is tested on the real product, in the environments listed above, following the same disciplined process used for federal Section 508 testing. Findings are recorded as they are found, with the page, the component and the assistive technology that exposed the problem.
Write the report honestly, and you review it
The ACR is completed criterion by criterion with real remarks. You see a draft before it is final, and if something reads as unfair to the product we look at it together in writing. What does not happen is a "Does Not Support" quietly becoming a "Supports" because a deal is close.
Issue, date, and plan the next one
The final ACR is dated and issued in Word and PDF, with the one-page summary and the developer issue list. If you want the failures fixed and the report re-issued as cleaner, that is scheduled next. Either way you know exactly when the report next needs looking at.
Standards
Standards a VPAT can report against
These are the standards the template maps to, and the laws behind the buyers who ask. A report that names the wrong one is worse than no report, because it shows the vendor did not read the request.
| Standard | Where it comes from |
|---|---|
| Revised Section 508 | United States federal law for technology bought, built or used by federal agencies. The Revised standards took effect in 2018 and incorporate WCAG 2.0 Level A and AA. See Section 508 compliance testing. |
| WCAG 2.0, 2.1 and 2.2 | The W3C guidelines. The ADA Title II web rule names 2.1 AA. Most private contracts now say 2.2 AA. The WCAG edition reports all three so one document satisfies whichever version the buyer wrote down. |
| EN 301 549 | The European harmonised standard, version 3.2.1. Required in EU public procurement and referenced by the European Accessibility Act, which has applied to many private products and services since 28 June 2025. |
| AODA | Ontario's law, which requires WCAG 2.0 Level AA. Canadian buyers usually accept the WCAG edition with a note confirming the 2.0 AA rows. |
Turnaround and cost
What a VPAT costs, and how long it takes
The price is the price of the testing, because the document itself is the easy part. Here is what moves it, and you will have a written figure within one working day of sending the details.
The edition
The WCAG edition has fewer rows than the 508 edition, and the INT edition has the most. The number of criteria that must be tested and written up is the single biggest factor.
The size of the product
A marketing website with eight templates is one afternoon of testing per screen reader. A web application with a dashboard, a checkout and an admin area is a different job. Templates and journeys, not page count, set the scope.
Whether you fix first
A report on a product with forty failures is honest but not helpful in a bid. Fixing the failures first costs more up front and produces a report that wins. Many clients do the audit, fix the blockers, then issue the VPAT.
Timing
A small marketing site can be tested and documented in a few days. Large applications take longer, and the written scope gives you the date. Because I work from India, a report you approve at the end of your day is often issued before you start the next one.
Questions
VPAT accessibility, answered
What is a VPAT, and what is an ACR?
A Voluntary Product Accessibility Template is a blank form published by the Information Technology Industry Council. When it is filled in for a specific product it becomes an Accessibility Conformance Report. Buyers, government departments and enterprises read it to confirm that a website, application or piece of software will not put their own compliance at risk. In practice everybody calls the finished report a VPAT.
Is there such a thing as VPAT certification?
No. There is no certifying body, and nobody can award one. A VPAT is a self-declaration by the vendor. Its value comes entirely from the honesty of the answers and the competence of the person who did the testing, which is why the report names the methods and the tester. Anyone selling you "VPAT certification" is selling the word, not the substance.
Can you write a VPAT without testing the product?
Technically yes, and plenty of firms do, from a questionnaire the vendor answers about itself. It is also the fastest way to lose a contract, because the first procurement officer who opens the product and finds a failure marked Supports has caught you in writing. I do not produce reports that way.
Which edition do we need?
It depends entirely on who is asking. A United States federal buyer wants the 508 edition. A European buyer wants the EU edition. State, university and enterprise buyers usually want the WCAG edition. A vendor selling in several markets wants INT. If the buyer's request does not say, forward it to me and I will tell you which one they mean.
What happens if our product has failures?
They go in the report as Partially Supports or Does Not Support, with a remark saying exactly what fails and for whom, and ideally a date by which it will be fixed. A report that admits two open issues and gives a plan is stronger in a procurement review than one that claims everything passes, because the reviewer has seen the second kind before.
How often does a VPAT need updating?
Whenever the product changes in a way that affects any criterion, and at least once a year even if it does not. A report more than twelve months old invites the question of what has changed since, and you want a better answer than silence. I re-test what changed rather than starting again, so a refresh costs a fraction of the first report.
Next step
Forward the buyer's request
Send the product address, the buyer's email or the clause from the tender, and the date they need the report by. Within one working day you get a written reply naming the edition, the scope, the price and the delivery date. If the date cannot be met I will tell you that instead.
Not ready for a quote? Start with the free WCAG checklist PDF: all 55 criteria with how to check each one.