Section 508 and the VPAT: A Guide to Accessibility Conformance Reports for Software Vendors

Section 508 of the Rehabilitation Act requires U.S. federal agencies to make the information and communication technology (ICT) they develop, buy, maintain or use accessible to people with disabilities. It does not bind private companies directly. If you sell software to federal agencies, however, you will be asked for an Accessibility Conformance Report (ACR), usually written on the VPAT® template. The technical standard behind it is the Revised 508 Standards, which incorporate WCAG 2.0 Level A and AA.

Last reviewed: November 15, 2026. This article explains the law in general terms and is not legal advice.

Section 508 at a glance
Law	Section 508 of the Rehabilitation Act of 1973, 29 U.S.C. 794d
Who must comply	Federal departments and agencies, when they develop, procure, maintain or use ICT
Technical standard	Revised 508 Standards, 36 CFR part 1194, with WCAG 2.0 Level A and AA incorporated by reference
Required since	January 18, 2018
Procurement rules	Federal Acquisition Regulation (FAR), subpart 39.2
What vendors provide	An ACR, usually on the VPAT® 2.5Rev template published by ITI (April 2025)
Certification	None. ITI does not review or approve VPATs, and there is no VPAT certification.

What does Section 508 require?

The statute requires every federal department or agency that develops, procures, maintains or uses electronic and information technology to make sure that people with disabilities have access comparable to that of people without disabilities. It protects two groups: federal employees, and members of the public who seek information or services from an agency.

An agency may claim that compliance would impose an undue burden. When it does, it must still give people with disabilities the information and data by an alternative means, and it must explain in its procurement documentation why compliance creates an undue burden. National security systems are exempt.

Does Section 508 apply to private companies?

Not directly. The obligations in the statute fall on federal departments and agencies only. Section 508 reaches companies through federal purchasing:

ICT that a contractor acquires only incidentally to a contract is excepted.

Some states apply Section 508 to their own agencies as well. Section508.gov lists examples such as California, where Government Code section 7405 directs state governmental entities to follow Section 508, and Missouri and Oklahoma, whose laws also reach public colleges and universities. State and local governments have their own deadline too: under the ADA Title II rule, web content and mobile apps they provide "directly or through contractual, licensing, or other arrangements" must conform to WCAG 2.1 Level AA from 2027 or 2028. Read more in our guide to the ADA Title II web accessibility rule and in the overview of state web accessibility laws.

What are the Revised 508 Standards?

The U.S. Access Board published the Revised 508 Standards on January 18, 2017, and compliance has been required since January 18, 2018. They live in 36 CFR part 1194 and cover far more than websites.

WCAG 2.0 for web content, documents and software

The standards incorporate WCAG 2.0 by reference. Electronic content must conform to the Level A and Level AA success criteria and conformance requirements of WCAG 2.0 (section E205.4), and so must software user interfaces and the content of platforms and applications (section E207.2). This applies to non-web documents such as PDFs and office files and to non-web software too. They are exempt from four criteria that only make sense for websites: 2.4.1 Bypass Blocks, 2.4.5 Multiple Ways, 3.2.3 Consistent Navigation and 3.2.4 Consistent Identification.

Requirements beyond WCAG

Functional performance criteria (Chapter 3). They apply where the technical requirements do not address a function. For example, ICT must offer at least one mode of operation that does not require vision.
Hardware (Chapter 4). Requirements for devices, such as kiosks and phones.
Software (Chapter 5). Interoperability with assistive technology, applications and authoring tools. A web application that neither has nor includes components with access to platform accessibility services is exempt from the interoperability and application sections, provided it conforms to WCAG 2.0 Level A and AA.
Support documentation and services (Chapter 6). Documentation must list and explain the accessibility and compatibility features. Electronic documentation, including web-based self-service support, must meet WCAG 2.0 Level A and AA. Help desks, call centers and training services must accommodate the communication needs of people with disabilities.

Existing ICT that met the earlier standard and has not been altered since January 18, 2018, does not have to be modified (the legacy safe harbor).

Why WCAG 2.0 and not 2.1 or 2.2?

The Revised 508 Standards still reference WCAG 2.0. As of November 2026 the Access Board has published no proposal to update them. Buyers often ask about newer versions anyway: the ADA Title II rule for state and local governments requires WCAG 2.1 Level AA, and the European standard EN 301 549 is aligned with WCAG 2.1. A practical approach is to test against WCAG 2.2 Level AA, which includes almost every Level A and AA criterion of the earlier versions. The exception is 4.1.1 Parsing: WCAG 2.2 removed it, but a Section 508 report still lists it under WCAG 2.0.

What is the difference between a VPAT and an ACR?

The VPAT® (Voluntary Product Accessibility Template) is a template published by the Information Technology Industry Council (ITI). The VPAT name and report form are ITI registered service marks, and the template asks you to write the name as "VPAT®". A VPAT filled in for a specific product is an Accessibility Conformance Report, or ACR.

The current version is VPAT 2.5Rev, released in April 2025, in four editions:

VPAT 2.5Rev editions
Edition	Covers	Typical use
508	Revised 508 Standards, including WCAG 2.0	U.S. federal sales
EU	EN 301 549 and WCAG 2.1	European public procurement
WCAG	WCAG 2.0, 2.1 and 2.2	Buyers who ask only about WCAG
INT	All of the above, with WCAG 2.2	One report for several markets

For U.S. federal sales, Section508.gov tells vendors to use the Revised Section 508 edition or the INT edition.

Is a VPAT legally required?

No statute, regulation or FAR clause requires the VPAT template. In practice, an ACR is expected. Section508.gov puts it plainly: "While the use of the VPAT® itself is not required, it is not voluntary to complete an ACR if you wish the government to consider purchasing your product." It also notes that an updated ACR may be required every time your product changes.

Agencies use ACRs during market research and when they evaluate proposals. For commercial products, GSA's guidance tells buyers to require a complete ACR together with a description of the evaluation methods used to produce it.

What do the conformance levels mean?

Each row of an ACR reports one criterion with one of these terms, as ITI defines them:

Conformance levels in a VPAT
Term	Meaning
Supports	The functionality of the product has at least one method that meets the criterion without known defects, or meets it with equivalent facilitation.
Partially Supports	Some functionality of the product does not meet the criterion.
Does Not Support	The majority of product functionality does not meet the criterion.
Not Applicable	The criterion is not relevant to the product.
Not Evaluated	The product has not been evaluated against the criterion. Allowed only for WCAG Level AAA criteria.

"Partially Supports" is an honest answer, not a pass: for that criterion, the product does not conform. Remarks are required for every "Partially Supports" and "Does Not Support" row.

What makes an ACR credible?

The template requires a report title, the template version, the product name and version, the report date, a product description, contact information, notes, the evaluation methods used, the applicable standards, the definitions of terms and the conformance tables. A legal disclaimer is optional.

Federal buyers read these reports with growing skepticism. GSA's sample solicitation language asks vendors to explain every "Not Applicable" answer and to say whether conformance covers the whole product or only limited areas. If the government finds that the claims overstate the real level of conformance, it can require the contractor to remediate. GSA also advises purchasers to validate vendor claims with their own testing and warns that "not evaluated" provides no assurance of accessibility.

Your evaluation method matters most. GSA notes that automated scanning tools "cannot apply human subjectivity" and either produce many false positives or test only a small portion of the requirements. The common federal testing approach is the DHS Trusted Tester process (version 5.1.3), which follows the ICT Testing Baseline for Web (version 3.1). Both are mapped to the Section 508 requirements and WCAG 2.0.

How to prepare an ACR, step by step

Define the scope. Name the product version, the platforms and the parts you report on: the web application, mobile apps, documents, documentation and support.
Pick the edition. Use 508 or INT for U.S. federal buyers, and INT if you also sell in Europe.
Test the whole product. An automated scan quickly finds repeated technical issues across many pages. Then test every criterion manually, with a keyboard and screen readers, along your key user journeys. A manual WCAG audit report lists each issue with its WCAG criterion, location, impact and fix: the evidence the WCAG tables and remarks are built on.
Fill in the tables honestly. Write a remark for every partial or failed criterion that says what does not work, who it affects and any workaround. Explain each "Not Applicable".
Do not stop at the WCAG table. Cover the functional performance criteria, the software chapter and your documentation and support services.
Describe your methods. List the tools, the assistive technologies and browsers, and who performed the testing.
Date and version the report. Update it when the product changes, and keep an eye on regressions between releases with continuous monitoring.

Why buyers are paying closer attention

The FY 2025 Governmentwide Section 508 Assessment, based on reports from 212 federal agencies and components, found an average accessibility conformance outcome of 1.96 on a 5 point scale. Less than half of agencies' most viewed or used ICT was fully conformant, and about half of agencies said they do not routinely test ICT. Only 48% almost always include accessibility requirements in solicitations, and 30% almost always verify deliverables. The report also states that "vendor accessibility claims remain difficult to validate." Agencies are responding with more specific contract language and their own testing, so an ACR backed by a documented audit is a real advantage.

FAQ

Is Section 508 the same as the ADA?

No. Section 508 is part of the Rehabilitation Act and covers technology of federal agencies. The ADA covers state and local governments (Title II) and businesses open to the public (Title III). Read more in ADA website compliance in 2026.

Does Section 508 require WCAG 2.1 or WCAG 2.2?

No. As of November 2026 the Revised 508 Standards incorporate WCAG 2.0 Level A and AA. Many buyers still ask about WCAG 2.1 or 2.2, so testing against WCAG 2.2 Level AA covers the most ground.

Is a VPAT a certification?

No. A completed VPAT is your own statement about your product. ITI does not review or approve VPATs, and there is no VPAT certification.

Can I create an ACR from an automated scan?

Not a credible one. Automated tools test only part of the criteria, and many rows of an ACR depend on human judgment. Use automated results as a starting point and confirm every criterion manually.

Which VPAT edition should I use for U.S. federal sales?

The Revised Section 508 edition or the INT edition, as Section508.gov recommends.

Does an accessibility widget make software Section 508 conformant?

No. Conformance depends on the product's own code, content and documentation. See what accessibility widgets and overlays can and cannot do.

Sources

Still looking for answers?

Ask our experts using online chat