Loading...
Guide • Procurement Documentation
When a buyer asks for your VPAT, they are really asking a harder question: do you actually know how accessible your product is, and can you prove it? This guide explains the template, the report it becomes, the four editions, how buyers read one, and how to produce one that survives procurement scrutiny.
VPAT Editions
4
508, EU, WCAG, and INT
A Filled-In VPAT =
ACR
The template becomes the report
Conformance Answers
5
Supports through Not Evaluated
Quality Signal
Remarks
Thin remarks mean a weak report
The VPAT (Voluntary Product Accessibility Template) is a free template published by ITI, the Information Technology Industry Council. On its own it is a blank form: a structured list of accessibility criteria with empty columns waiting for answers.
An ACR (Accessibility Conformance Report) is what the VPAT becomes once a vendor fills it in for a specific product: a completed report stating, criterion by criterion, whether the product supports each requirement, with remarks explaining each determination. The template is the blank form; the ACR is the report.
In practice the vocabulary is sloppy. Buyers say “send me your VPAT” when they mean the completed ACR, and most vendors answer in kind. That is fine as shorthand, as long as you understand what is actually being requested: not an empty template anyone can download, but a filled-in, dated, product-specific report backed by real testing.
Each criterion in an ACR gets one of a fixed set of conformance answers: Supports, Partially Supports, Does Not Support, Not Applicable, and Not Evaluated, the last of which is allowed only at WCAG Level AAA. Every answer needs a remark explaining how the determination was made. Empty remark columns are the single clearest mark of a low-quality ACR.
The current VPAT 2.x family comes in four editions, each mapping a different accessibility standard. Choosing the right one is not a technical decision so much as a market decision: the edition you need is determined by who is asking.
| Edition | Standard | Who asks for it |
|---|---|---|
| VPAT 508 | US Revised Section 508 | US federal agencies and their contractors |
| VPAT EU | EN 301 549 (European standard) | European public-sector and EAA-era buyers |
| VPAT WCAG | WCAG only | Commercial and enterprise buyers |
| VPAT INT | All three combined | Vendors selling across multiple markets |
US federal buyers want the 508 edition, because Section 508 is the standard their procurement rules reference. European buyers increasingly want the EU edition mapping EN 301 549. Commercial buyers with no statutory hook often accept a WCAG edition. If you sell into more than one of these markets, the INT edition lets you maintain a single report instead of three parallel ones.
An ACR is only useful to a buyer who reads it critically. Vendors write these documents to win deals, and the format makes optimism easy. A practical checklist:
If accessibility documentation is becoming part of your purchasing process more broadly, our accessible procurement guide covers how to build these checks into RFPs and vendor reviews.
The order of operations matters more than anything else: testing comes first, and the document comes second. An ACR without testing behind it is fiction.
One more credibility lever: who did the testing. Third-party-produced ACRs carry more weight with buyers than self-reported ones, because the incentives are cleaner. Our accessibility audit service produces exactly the automated, manual, and assistive technology testing an ACR needs behind it.
The VPAT conversation is often framed as a purely American, Section 508 story. That framing is out of date. The VPAT EU edition maps EN 301 549, the European accessibility standard, and European public procurement references that standard directly.
The European Accessibility Act raises the stakes further. As EAA obligations flow through supply chains, accessibility documentation is moving beyond government tenders into private-sector purchasing: companies that must meet accessibility requirements themselves start demanding evidence from their software vendors. The VPAT EU edition, as a structured EN 301 549 conformance report, is a natural format for answering those requests.
For vendors, the practical takeaway is simple: if European customers are on your roadmap, an ACR that speaks only Section 508 will not be enough. Either produce a VPAT EU edition alongside your US report, or use the INT edition and cover both markets, plus WCAG, in one document.
A VPAT or ACR is disclosure, not certification. There is no official accessibility certification body for WCAG, so no report, badge, or seal can formally certify conformance. An ACR does not make a product compliant with any law; it documents where the product stands, including where it falls short.
That limit is also the document's strength. An honest ACR that says “Partially Supports” in ten places, with specific remarks and a remediation plan, is worth more to a serious buyer than a perfect-looking report nobody believes. The goal is an accurate map of the product, not a marketing artifact.
It is also worth distinguishing the ACR from its public-facing sibling. An ACR is procurement-facing: a detailed, criterion-level report handed to buyers on request. An accessibility statement is public-facing: a page on your website telling users what to expect and how to get help. Most organizations selling software eventually need both; our accessibility statement guide covers the other half.
The VPAT (Voluntary Product Accessibility Template) is the blank template, published free of charge by the Information Technology Industry Council (ITI). An ACR (Accessibility Conformance Report) is what you get when a vendor fills that template in for a specific product: a completed report stating, criterion by criterion, how the product conforms. In everyday procurement conversation the words blur together, and a buyer who says 'send me your VPAT' almost always means the completed ACR, not the empty form.
No statute says 'you must publish a VPAT.' The pressure is contractual. Section 508 obliges US federal agencies to buy accessible information and communications technology, so agency procurement teams ask vendors for ACRs as evidence, and Section508.gov documents that process. State and local governments, universities, and large enterprises make similar demands in RFPs and vendor reviews. In Europe, public procurement references EN 301 549, and the European Accessibility Act is pushing accessibility documentation into private-sector purchasing too. In practice, if you sell software to these buyers, you will be asked for one.
It depends on who is asking. US federal buyers want the VPAT 508 edition, which maps the Revised Section 508 standards. European buyers increasingly want the VPAT EU edition, which maps EN 301 549. Commercial buyers with no statutory hook often accept the VPAT WCAG edition, which reports against WCAG alone. If you sell into several of these markets, the VPAT INT edition combines all three standards in one document, so you maintain a single report instead of three.
Yes. The template is free, and nothing stops a vendor from completing it internally. The catch is credibility: a self-reported ACR is only as good as the testing behind it, and experienced buyers know that. Third-party-produced ACRs, based on independent testing, carry more weight in procurement review than self-assessments. If you do self-report, document your testing methodology and write specific remarks; a self-produced ACR with named components, known defects, and a described test process reads far better than a vague one.
Enough to actually know the answers you are writing down: automated scanning, manual testing against each criterion, and assistive technology testing with tools such as screen readers. An ACR written without testing behind it is fiction, and it tends to show. Automated tools alone cannot evaluate most WCAG criteria, so a report generated purely from a scanner is incomplete by construction. The testing is the substance; the ACR is just the format that reports it.
An ACR should be dated and versioned against a specific product release, and updated whenever the product changes materially: a redesign, a new module, a framework migration, or significant remediation work. A report that names no product version, or that is several years and many releases old, tells a careful buyer very little about the product they would actually be licensing. Treat the ACR as living documentation that tracks the product, not a one-time artifact.
No. A VPAT or ACR is disclosure, not certification. There is no official accessibility certification body for WCAG, so no document can 'certify' WCAG conformance in any formal sense. An ACR documents where the product stands, including where it falls short, and that honesty is precisely what makes a good one useful. It does not make the product compliant with any law, and it does not immunize the vendor; it gives buyers the information they need to evaluate and gives the vendor a defensible record of transparency.
This page is provided for general educational purposes only and does not constitute legal advice. Procurement requirements, Section 508 obligations, EN 301 549, and the European Accessibility Act all involve legal questions that depend on your specific situation and jurisdiction. For advice about your obligations, consult an attorney experienced in accessibility law.
Comprehensive tools, checklists, and guides to help you create inclusive digital experiences