A VPAT — Voluntary Product Accessibility Template — is a standardized form, published by the Information Technology Industry Council (ITI), that documents how a product or service measures up against accessibility standards like WCAG and Section 508. A completed VPAT is called an ACR: an Accessibility Conformance Report. You need one whenever a buyer's procurement process requires accessibility documentation — U.S. federal contracts under Section 508, and increasingly state agencies, universities, healthcare systems, and large private enterprises. If you sell software or digital services to organizations, expect the request, and expect it to be read closely.
What is a VPAT, exactly?
The VPAT is a fill-in-the-blanks template. Each row lists an accessibility requirement — a WCAG success criterion, a Section 508 provision, or an EN 301 549 clause, depending on the edition — and the vendor states how the product performs against it, with remarks explaining any gaps. The point is standardization: a procurement officer comparing five vendors can read five reports in the same format instead of five marketing pages.
Two things a VPAT is not. It is not a certificate — no government body issues, approves, or stamps one, and completing the form does not make anything accessible. And voluntary does not mean accessibility is optional; it refers to the self-reported format. The obligations behind the paperwork — Section 508, the ADA, the European Accessibility Act — are anything but voluntary.
What's the difference between a VPAT and an ACR?
A VPAT is the blank template; an ACR is the finished document once someone has actually tested the product and filled the template in. In everyday use the terms blur — when a buyer asks for "your VPAT," they want your completed ACR. The distinction matters in one direction: an empty template has zero value, so the real question is never "do you have a VPAT?" but "who tested the product, how, and how recently?"
Who demands a VPAT, and why?
Federal buyers
Section 508 applies to U.S. federal agencies and federal procurement. If you want your software on a federal contract, an ACR is table stakes — agencies use it to evaluate whether a purchase meets their Section 508 obligations before money moves.
State and local government
The Department of Justice published a final rule on April 24, 2024 adopting WCAG 2.1 AA for state and local government web content and mobile apps. In April 2026 the DOJ extended the deadlines — entities serving 50,000 or more people now have until April 26, 2027, and smaller entities until April 26, 2028 — but the direction is set, and agencies are pushing the obligation down onto every vendor whose product touches their websites or services. Our breakdown of the DOJ web accessibility rule covers what that means in practice.
European buyers
European Accessibility Act enforcement began June 28, 2025, and it explicitly covers e-commerce and digital services sold to EU consumers — including by U.S. companies. The technical standard is EN 301 549, which incorporates WCAG 2.1 AA, and there is a VPAT edition built for exactly that. If you sell across the Atlantic, read our guide to what the European Accessibility Act means for U.S. companies.
Enterprise procurement
No statute forces a private company to collect ACRs — risk does. More than 5,000 digital-accessibility lawsuits were filed in 2025, up roughly 20% over 2024, and an enterprise that embeds your product in its website inherits your accessibility gaps. Procurement teams now request ACRs the same way they request security questionnaires: to document vendor risk before signing.
Which VPAT edition do you need?
ITI publishes the template in editions matched to different standards:
- VPAT 508 — maps to the Section 508 requirements. Use for U.S. federal buyers.
- VPAT WCAG — maps directly to WCAG success criteria, currently up through WCAG 2.2 (a W3C Recommendation since October 5, 2023). The common choice for commercial and education buyers.
- VPAT EU — maps to EN 301 549 for European procurement.
- VPAT INT — the international edition combining all of the above, useful when one product sells into every market.
When in doubt, ask the buyer which edition their process expects. Whichever you choose, the substance underneath is WCAG conformance — and Level AA is the benchmark every one of these frameworks points at. If the levels are new to you, start with our explainer on what WCAG Level AA actually means.
How do you complete a VPAT honestly?
For each criterion you record a conformance level — Supports, Partially Supports, Does Not Support, or Not Applicable — plus remarks. The remarks column is where credibility lives: "Partially Supports — date-picker is not keyboard operable; fix scheduled for Q3" tells a reviewer you actually tested. A report that marks "Supports" on every row tells them you didn't.
That testing cannot be a scan alone. Automated tools can detect only roughly a third of WCAG success criteria; the rest — keyboard operability, screen-reader behavior, focus order, meaningful alt text — require a human. An ACR filled in from an automated scan is guesswork formatted as documentation, and experienced reviewers recognize it. The honest workflow is: test with real assistive technology, record what you found, and say so in the report's methodology section. If you have never had the product evaluated, a free accessibility audit is the fastest way to find out what an ACR would actually have to disclose.
Can a bad VPAT hurt you?
Yes. Overstated accessibility claims now draw regulatory attention: on January 3, 2025 the FTC announced a $1 million action against overlay vendor accessiBe, alleging it deceptively claimed its widget could make any website WCAG-compliant, and the final order bars unsubstantiated compliance claims. The full story is in our post on the FTC's accessibility overlay fine. One distinction worth keeping sharp: a user-preference widget — contrast and text-size controls on a site that is already accessible at the code level, making no compliance claims — is a legitimate feature. A surface-layer overlay sold as making a broken site compliant is a different product entirely, and it cannot be the basis of an honest ACR, because it does not change the code the report describes.
There is contract risk too. ACRs are routinely attached to purchase agreements, and a materially false one can become a misrepresentation or breach problem when the buyer's own testing contradicts it. A candid report with a remediation roadmap wins more deals — and keeps them — better than a padded one.
The order of operations matters: fix first, document second. ADA Fail's engineers remediate at the code level against WCAG 2.2 AA and then produce documentation that reflects verified human testing. Start with a free accessibility audit and find out exactly where your product stands before a procurement team does it for you.
Frequently asked questions
Who should write a VPAT — the vendor or a third party?
Either is allowed; the template is self-reported by design. But an ACR based on independent expert testing carries more weight with procurement reviewers than one the product team graded itself, for the same reason financial audits aren't done in-house. At minimum, whoever completes it must have run real human testing — keyboard, screen reader, contrast, forms — not just an automated scan, which covers only about a third of WCAG success criteria.
How often should a VPAT be updated?
Treat an ACR as a versioned document tied to a specific product release. Update it whenever a major release changes the user interface, and review it at least annually even without one. Buyers increasingly reject reports that are several versions or several years stale, because the product being sold no longer matches the product that was tested.
Does having a VPAT protect you from ADA lawsuits?
No. An ACR is disclosure, not a legal shield — it describes your accessibility posture, it doesn't change it. An honest report paired with actual remediation can help demonstrate good faith, but a report that overstates conformance cuts the other way: it hands a plaintiff or regulator written evidence that you knew the standard and claimed to meet it. The protection comes from making the product accessible; the paperwork just proves you checked.