Section 508 Compliance: Requirements, VPATs, and Testing
Section 508 of the Rehabilitation Act requires US federal agencies to make their information and communications technology accessible — and because agencies must buy accessible technology, it effectively binds every vendor that sells software, hardware, or content to the federal government. Here is what the standards require, how VPATs and ACRs work, and how conformance is actually tested.
Not legal advice. This guide is educational information about Section 508, not legal advice. Procurement obligations and agency-specific requirements vary; consult a qualified attorney or your contracting officer for decisions about specific solicitations or complaints.
What Section 508 is
Section 508 is a provision of the Rehabilitation Act of 1973, added in 1986 and given real teeth by the Workforce Investment Act amendments of 1998. It requires that when federal agencies develop, procure, maintain, or use information and communications technology (ICT), that technology must be accessible to people with disabilities — both federal employees and members of the public — comparably to the access available to everyone else.
“ICT” is deliberately broad: public websites, internal web applications, desktop and mobile software, electronic documents, multimedia, kiosks, copiers, phones, and the support documentation and services that come with them.
The 2017 refresh: WCAG 2.0 AA becomes the baseline
The US Access Board published the Revised 508 Standards in January 2017, with compliance required from January 18, 2018. The refresh did three important things:
- Incorporated WCAG 2.0 Level A and AA by reference as the technical standard for web content — aligning US federal requirements with the international standard instead of maintaining a separate checklist.
- Extended WCAG beyond the web. The refresh applies WCAG 2.0 success criteria to non-web electronic documents (PDFs, Word files, spreadsheets, presentations) and to software, not just websites.
- Reorganized around functionality. Requirements follow what the technology does rather than rigid product categories, with functional performance criteria as a backstop where technical provisions do not address a barrier. The same rulemaking also refreshed the Section 255 guidelines for telecommunications equipment.
How Section 508 relates to WCAG 2.1, 2.2, and the ADA
The legal baseline is still WCAG 2.0 AA, but the ecosystem has moved on. The DOJ's 2024 ADA Title II rule requires WCAG 2.1 AA for state and local government web content, agencies increasingly write WCAG 2.1 or 2.2 into solicitations, and WCAG 2.x versions are backwards-compatible — content that conforms to 2.2 AA also conforms to 2.0 AA. Testing against the WCAG 2.2 AA checklist therefore satisfies today's 508 baseline while covering the criteria buyers are starting to demand.
Section 508 vs. the ADA
| Dimension | Section 508 | ADA |
|---|---|---|
| Who it binds | Federal agencies + vendors via procurement | State/local governments (Title II), businesses open to the public (Title III) |
| Technical standard | WCAG 2.0 AA (Revised 508 Standards, 2017) | WCAG 2.1 AA for Title II (2024 DOJ rule); no codified standard for Title III |
| What is covered | All ICT: web, documents, software, hardware, support services | Websites, mobile apps, and other services of covered entities |
| How it is enforced | Administrative complaints, private suits, procurement leverage, agency oversight | DOJ enforcement and private lawsuits (thousands filed per year) |
Private businesses are sued under the ADA, not Section 508 — see our accessibility lawsuit tracker for the litigation data, and the ADA compliance guide for that side of US law.
VPATs and ACRs: the paperwork of 508 compliance
If you sell to the federal government, the question you will hear is “can you send us your VPAT?” The Voluntary Product Accessibility Template (VPAT) is a standardized template maintained by the Information Technology Industry Council (ITI). A vendor fills it in — criterion by criterion: Supports, Partially Supports, Does Not Support, or Not Applicable, with remarks — and the completed document is an Accessibility Conformance Report (ACR) for that product and version.
A credible ACR is based on actual testing, names the evaluation methods used, is specific in its remarks, and is updated for each major release. Agencies compare ACR claims against their own testing, so an inflated report is worse than an honest one that documents known gaps and a remediation plan.
The four VPAT editions
| Edition | Standard covered | Typical audience |
|---|---|---|
| VPAT 508 | Revised Section 508 Standards (incorporating WCAG 2.0 AA) | US federal procurement |
| VPAT WCAG | WCAG 2.0 / 2.1 / 2.2 (Level A, AA, AAA) | Commercial buyers, states, global customers |
| VPAT EU | EN 301 549 (EU harmonized ICT standard) | EU public procurement, EAA-covered markets |
| VPAT INT | All of the above in one report | Vendors selling into multiple jurisdictions |
Selling into the EU as well? The VPAT EU edition maps to EN 301 549, the standard behind the European Accessibility Act.
How Section 508 conformance is tested
DHS Trusted Tester (manual)
A standardized, repeatable manual process (v5) aligned with the ICT Testing Baseline, using the free ANDI tool. Certification available through DHS. The de facto benchmark for validating 508 conformance claims.
Automated scanning
Automated tools catch roughly a third of WCAG failures — missing alt text, contrast, form labels — quickly and at scale. Essential for regression coverage, insufficient alone for a conformance claim.
Assistive technology testing
Hands-on testing with screen readers (JAWS, NVDA, VoiceOver), magnification, and keyboard-only navigation confirms that content is usable, not just technically conformant.
Document and software review
Section 508 uniquely applies WCAG to non-web documents and software, so PDFs, Office files, and installed applications need their own test passes.
A defensible ACR combines all four: automated coverage for scale, Trusted Tester-style manual evaluation for rigor, assistive technology passes for real-world usability, and document/software review for the non-web scope that makes Section 508 unusual.
Preparing an ACR or a federal bid?
Get a documented WCAG audit you can stand behind in procurement, scan your product for the failures automated checks can find, and check your PDFs — Section 508 covers documents too.
Frequently asked questions
Who is required to comply with Section 508?
Section 508 directly binds US federal agencies: any information and communications technology (ICT) they develop, procure, maintain, or use must be accessible. It reaches the private sector through procurement — vendors selling ICT to the federal government must show their products conform, because agencies are required to buy accessible technology and write accessibility into contracts through the Federal Acquisition Regulation (FAR). Many state governments and universities also adopt Section 508 or equivalent standards, often as a condition of federal funding under the Assistive Technology Act, so the standard's practical reach is much wider than the federal government itself.
What standard does Section 508 actually require?
The Revised 508 Standards — the 2017 refresh published by the US Access Board — incorporate WCAG 2.0 Level A and Level AA by reference. Uniquely, they apply those criteria not just to websites but also to non-web electronic documents (PDFs, Word files, presentations) and software. The standards also include hardware requirements, functional performance criteria for cases the technical requirements do not cover, and requirements for support documentation and services. Compliance with the refresh became required on January 18, 2018.
What is the difference between Section 508 and the ADA?
They cover different actors. Section 508 (part of the Rehabilitation Act of 1973) applies to federal agencies and, via procurement, their vendors — with an explicit technical standard (WCAG 2.0 AA). The ADA applies to state and local governments (Title II) and businesses open to the public (Title III), and is enforced largely through DOJ action and private lawsuits. The DOJ's 2024 Title II rule requires WCAG 2.1 AA for state and local government web content, and courts routinely reference WCAG in Title III cases, so the two regimes are converging on the same technical family — but a private business is sued under the ADA, not Section 508.
What is a VPAT and how is it different from an ACR?
A VPAT (Voluntary Product Accessibility Template) is the blank template published by the Information Technology Industry Council (ITI) for reporting how a product conforms to accessibility standards. Once a vendor fills it in with conformance results for a specific product and version, the completed document is an ACR (Accessibility Conformance Report). In practice people say 'VPAT' for both, but procurement officers increasingly ask for the ACR by name. The template comes in four editions: VPAT 508 (Revised 508 Standards), VPAT WCAG, VPAT EU (EN 301 549), and VPAT INT, which combines all three.
Do I need a VPAT to sell software to the federal government?
There is no law that says 'you must have a VPAT,' but in practice you will not get far without one. Agencies must evaluate ICT accessibility during procurement, and a current, credible ACR is the standard evidence they request in solicitations. A vague or obviously inflated ACR is a real liability: agencies compare claims against their own testing (often using the DHS Trusted Tester process), and misrepresenting conformance can disqualify a bid or create contract disputes. The strongest position is an ACR based on documented testing by qualified evaluators, refreshed for each major release.
Does Section 508 require WCAG 2.1 or 2.2?
Formally, no — the Revised 508 Standards still incorporate WCAG 2.0 Level AA, and that remains the legal baseline unless and until the Access Board updates the rule. In practice, many agencies ask for WCAG 2.1 or 2.2 conformance in solicitations, the DOJ's ADA Title II rule requires WCAG 2.1 AA for state and local governments, and WCAG 2.x is backwards-compatible: content that meets 2.2 AA also meets 2.0 AA. Building and testing against WCAG 2.2 AA is the pragmatic way to satisfy Section 508 today and stay aligned with where requirements are heading.
What is the Trusted Tester program?
Trusted Tester is a standardized manual test process created by the Department of Homeland Security (DHS) for evaluating conformance with the Revised 508 Standards. Version 5 of the process is aligned with the ICT Testing Baseline for Web and uses defined test steps and the free ANDI browser tool, so two certified testers evaluating the same page should reach the same result. DHS offers free online training and certification, and many agencies require or prefer Trusted Tester results when validating vendor ACRs. It is a conformance-testing method, not a substitute for usability testing with people with disabilities.
What happens if a federal agency's technology is not accessible?
Section 508 gives individuals with disabilities the right to file an administrative complaint with the agency concerned, using the same complaint process as Section 504 of the Rehabilitation Act, and to bring a private lawsuit for injunctive relief and attorney's fees. Federal employees can raise accessibility barriers through internal EEO processes. Agencies also report on 508 conformance to the General Services Administration and OMB, so persistent failures carry oversight and reputational consequences in addition to legal ones. For vendors, the practical penalty is commercial: inaccessible products lose federal deals.