If you sell software, SaaS, hardware, or digital services to US federal agencies, state governments, universities, or large enterprise organizations, you have almost certainly been asked for a VPAT. If you haven't yet, you will be.
Many vendors treat VPATs as a procurement checkbox — something to produce on demand and then forget. That approach is both legally risky and commercially costly. A well-prepared VPAT backed by genuine testing accelerates enterprise sales cycles, reduces legal exposure, and signals product maturity to buyers who care about accessibility.
See how 321 websites scored →
View the 2026 ReportVPAT stands for Voluntary Product Accessibility Template. It is a document structure developed by the IT Industry Council (ITI) that provides a standardized way for vendors to describe how their product conforms to established accessibility standards — primarily Section 508 (for federal procurement) and WCAG 2.1 (for web-based products).
When completed, a VPAT becomes an Accessibility Conformance Report (ACR). The terms are often used interchangeably: "VPAT" refers to the blank template, "ACR" refers to the completed document.
The "voluntary" in the name means vendors are not legally required to publish VPATs — but buyers are often legally required to request them before purchasing. Federal agencies must perform a Section 508 conformance evaluation before buying ICT (Information and Communications Technology), and requesting a VPAT from the vendor is the standard way to do that.
ITI publishes and updates the official VPAT template. The current major version is VPAT 2.4, released to align with WCAG 2.1 and the current Revised Section 508 standards. There are four editions:
| Edition | Standards Covered | Use Case |
|---|---|---|
| VPAT 2.4 Section 508 | Revised Section 508 (which incorporates WCAG 2.0 Level A and AA) | US federal government procurement |
| VPAT 2.4 WCAG | WCAG 2.x (Level A, AA, and optionally AAA) | General web/software accessibility claims |
| VPAT 2.4 EU | EN 301 549 (European accessibility standard, incorporates WCAG 2.1) | European public sector and enterprise procurement |
| VPAT 2.4 INT (International) | All three of the above combined | Selling globally; enterprise/government in multiple jurisdictions |
For most US-focused vendors, the Section 508 edition or the WCAG edition is sufficient. If you sell internationally or into European public sector contracts, use the INT edition or the EU edition.
A completed VPAT (ACR) has five main parts:
Product name, version, vendor contact, evaluation date, notes on testing methodology and evaluation environment.
Any important context about the product's scope, known limitations, evaluated features, or testing caveats. This section is often overlooked but matters — it lets you clarify what was and was not tested.
A table for each applicable WCAG success criterion or Section 508 requirement, with a conformance level and remarks. This is the bulk of the document.
Additional tables covering hardware, software, support documentation, and other ICT components beyond web content.
Standard language clarifying that the VPAT represents the vendor's assessment at a point in time and does not constitute a warranty.
The most important field in every success criterion row is the Conformance Level. The VPAT 2.4 uses these values:
| Level | Meaning | When to Use |
|---|---|---|
| Supports ✓ | The product fully meets this criterion | You have tested and confirmed conformance without exception |
| Partially Supports ~ | The product meets this criterion in some areas but not all | Known gaps exist; must describe in Remarks column |
| Does Not Support | The product does not meet this criterion | Known violation; must describe what fails and remediation timeline if known |
| Not Applicable | The criterion does not apply to this product | For example, "captions for pre-recorded audio" on a product with no audio content |
| Not Evaluated | The criterion has not been tested | Acceptable for initial VPATs; buyers may request evaluation before signing |
Before you can fill out any conformance level, you need to know your current violation state. An automated scan against WCAG 2.1 AA criteria will surface the majority of detectable failures. This is your baseline — it identifies which criteria you definitely fail, which you probably pass, and which require manual investigation.
The Accessalyze $19 report gives you a complete WCAG 2.1 scan for a URL, mapped to specific WCAG success criteria — exactly the structure you need to populate your VPAT tables.
Define what is being evaluated. A VPAT covers a specific product or version — not your company broadly. If you have a web app, a mobile app, and a documentation site, you may need separate VPATs for each, or a single VPAT that clearly defines what's included and what's excluded.
Write your scope in the Notes section. Be specific: "This evaluation covers the browser-based application at app.example.com as of version 4.2.1, tested in Chrome 124 with NVDA 2024.1 screen reader."
Download the official template from the ITI website (itic.org). Do not create your own table format — buyers and procurement systems expect the standard VPAT structure. Choose the edition appropriate for your buyer's requirements (Section 508, WCAG, EU, or INT).
Fill in product name, version, vendor name, vendor contact email, and the date the VPAT was evaluated. This date matters — VPATs go stale as products change. Most procurement guidelines recommend updating your VPAT with each major release and at least annually.
For each WCAG success criterion in the table, assign a conformance level and add remarks explaining your assessment. The remarks column is critical — a bare "Supports" with no explanation is less credible than "Supports — tested with NVDA 2024.1 and Chrome 124; all interactive elements have accessible names."
For any criterion where you choose "Partially Supports" or "Does Not Support," the remarks column must describe specifically what fails and, if known, when it will be fixed.
Automated tools find roughly 30–40% of WCAG violations. A credible VPAT requires at minimum keyboard-only navigation testing and ideally screen reader testing (NVDA/JAWS on Windows, VoiceOver on macOS/iOS, TalkBack on Android). Document your test methodology in the Notes section.
Section 508 covers more than web content. The full template includes tables for:
For web-only products, many Chapter 4 (Hardware) rows will be "Not Applicable." For software with a UI, Chapter 5 requires careful evaluation.
Have a legal or compliance reviewer sign off on the document before publishing. Many vendors publish their VPAT/ACR on their website (usually on a dedicated accessibility or legal page), making it easy for buyers to access without a custom request. This is increasingly expected by enterprise buyers.
The $19 Accessalyze report gives you a complete WCAG 2.1 AA violation map — organized by success criterion — so you know exactly which rows to mark "Supports" and which need further evaluation.
Get the $19 Accessibility ReportThis is the most common and most damaging mistake. A government buyer with an accessibility expert on staff will often test 5–10 criteria after receiving your VPAT. If they find violations where you claimed full support, you have both a credibility problem and a potential procurement problem. Honesty, combined with a remediation plan, is far better received than an inflated claim.
Some vendors mark criteria as "Not Applicable" because they don't want to investigate them. This is inappropriate. "Not Applicable" has a specific meaning: the criterion genuinely cannot apply to the product (e.g., "captions for live audio" on a product that has no live audio feature). If a criterion might apply but you haven't tested it, use "Not Evaluated."
Products change. A VPAT with a date from two major versions ago is often considered worthless by sophisticated buyers. Treat your VPAT as a living document that updates alongside your product, particularly after accessibility-related fixes or significant feature additions.
The Remarks column is where a VPAT gains credibility. "Supports — verified with keyboard-only navigation and NVDA screen reader; all form inputs have associated labels" communicates a fundamentally different level of rigor than a blank "Supports."
Error states, modal dialogs, dynamic content loaded asynchronously, and mobile views are often more inaccessible than the primary UI flow. Test edge cases before assigning conformance levels, not just the landing page and main feature.
| Context | VPAT Required? | Notes |
|---|---|---|
| US Federal government purchase | Yes (effectively) | Section 508 requires agencies to evaluate ICT accessibility before purchasing. VPAT is the standard evaluation vehicle. |
| State government contracts | Usually | Most states have Section 508-equivalent laws. Many state procurement processes mirror federal requirements. |
| K–12 and higher education | Often | Title II and Title III requirements apply. Many universities require VPATs for all software purchases above a threshold. |
| Enterprise SaaS (large corporations) | Frequently requested | Enterprise procurement teams often include accessibility review. Fortune 500 buyers may require VPAT for data security and compliance sign-off. |
| EU public sector contracts | Yes (EN 301 549) | Use the EU or INT edition of VPAT 2.4. |
| Small business / consumer products | Rarely required | Still valuable as a signal of product quality and to avoid litigation. |
Time depends on product complexity and how much prior testing has been done:
Many organizations hire a third-party accessibility auditor to complete the VPAT — third-party evaluations carry more weight with procurement reviewers than vendor self-assessments, particularly for high-value contracts.
| Document | Audience | Format | Legal Context |
|---|---|---|---|
| VPAT / ACR | Procurement teams, legal reviewers | Structured table (ITI standard) | Section 508, EN 301 549 procurement |
| Accessibility Statement | End users, the public | Narrative web page | ADA good faith, WCAG guidance, EU Web Accessibility Directive |
Both documents are important, but they serve different purposes. Your accessibility statement lives on your public website and tells users how to request accommodations. Your VPAT is a technical procurement document shared with buyers. You need both if you sell to enterprise or government customers.
The most common reason VPAT completion stalls is that teams don't have a clear picture of their current violation state before they start filling in tables. Running an Accessalyze scan gives you:
Many teams find that after running the scan and fixing high-severity violations, they can complete the WCAG conformance table honestly and quickly, rather than spending time trying to guess at conformance levels they have never measured.
Accessalyze scans your site against WCAG 2.1 AA and maps every violation to the exact success criteria your VPAT tables need. $19 for a complete report — or start with a free scan to see what you're working with.
Scan Your Site — Free or $19 Full ReportThis guide is for informational purposes only. VPAT completion requirements vary by buyer and contract. For legal or procurement advice, consult qualified counsel. Official VPAT templates must be downloaded from itic.org.
Try it yourself
Enter your website URL to get a free accessibility score.