VPAT and ACR Services: WCAG 2.1 and 2.2 AA, Section 508, and EN 301 549 Accessibility Testing
VPAT services for software, SaaS, websites, mobile apps, and documents. We test your product against every applicable WCAG success criterion with keyboard and screen readers, give your team clear fixes, retest, and write an Accessibility Conformance Report (ACR) in the VPAT edition your buyers ask for: WCAG, Section 508, EU, or INT.
What Is a VPAT, and What Is an ACR?
A VPAT (Voluntary Product Accessibility Template) is a standard template from the Information Technology Industry Council (ITI) for reporting how accessible a product is. Once it is filled in for your product, it becomes an Accessibility Conformance Report, or ACR. Buyers in government, education, healthcare, and large enterprises ask for an ACR before they buy software.
The ACR lists every applicable accessibility criterion and says whether your product Supports, Partially Supports, or Does Not Support it, or whether it is Not Applicable, with remarks explaining each answer. An ACR built from a real test, with honest remarks, is far more useful to a buyer than a page of "Supports" with nothing behind it.
Accredify Global tests the product, logs every issue with fix guidance, retests after your team's fixes, and writes the ACR from the evidence. Your company publishes the ACR; we document the evaluation methods behind it.
Accessibility Rules in 2026: New Deadlines, WCAG 2.2, and a New EU Standard
The template covers WCAG 2.2. ITI's VPAT 2.5 (Rev February 2025) includes WCAG 2.2 success criteria in its WCAG, EU, and INT editions, alongside WCAG 2.0 and 2.1.
US public bodies have more time, but the standard is set. The US Department of Justice's ADA Title II rule requires WCAG 2.1 AA for state and local government web content and apps. An interim final rule of 20 April 2026 moved the deadlines to 26 April 2027 for entities serving 50,000 people or more, and 26 April 2028 for smaller entities and special districts. Their software suppliers are being asked for ACRs now.
Europe has moved to WCAG 2.2. The European Accessibility Act has applied to many products and services since 28 June 2025. EN 301 549 V4.1.1, published on 2 September 2026, adopts WCAG 2.2 AA and adds further requirements. It is expected to be cited in the EU Official Journal around the end of November 2026, after which it carries presumption of conformity.
Sources: ADA Title II extension (Duane Morris) · EN 301 549 V4.1.1 (Deque) · VPAT 2.5 update
VPAT Editions: WCAG, Section 508, EU, and INT
One round of testing can produce the edition each of your buyers asks for.
| Edition | Standards covered | Who usually asks for it |
|---|---|---|
| VPAT WCAG | WCAG 2.0, 2.1, and 2.2, Levels A and AA (AAA optional) | Commercial buyers, universities, and state and local government |
| VPAT 508 | The Revised Section 508 Standards, which incorporate WCAG 2.0 AA plus software, documentation, and support rules | US federal agencies and their contractors |
| VPAT EU | EN 301 549, the European ICT accessibility standard | EU public sector buyers and products under the European Accessibility Act |
| VPAT INT | WCAG, Section 508, and EN 301 549 in one report | Vendors selling in several markets |
WCAG 2.1 vs WCAG 2.2 AA: The Criteria We Test
WCAG is organized under four principles: perceivable, operable, understandable, and robust. Each success criterion is tested on its own and recorded in the ACR.
The numbers
| WCAG 2.1 Level AA | 50 success criteria (30 Level A, 20 Level AA) |
|---|---|
| WCAG 2.2 Level AA | 55 success criteria; 6 new at A and AA, and 4.1.1 Parsing removed |
| Who requires which | ADA Title II: 2.1 AA. EN 301 549 V4.1.1: 2.2 AA. Section 508: 2.0 AA |
New in WCAG 2.2 at Levels A and AA
- 2.4.11 Focus Not Obscured (Minimum), AA
- 2.5.7 Dragging Movements, AA
- 2.5.8 Target Size (Minimum), AA
- 3.2.6 Consistent Help, A
- 3.3.7 Redundant Entry, A
- 3.3.8 Accessible Authentication (Minimum), AA
Testing to WCAG 2.2 AA also covers WCAG 2.1 AA, so most vendors test to 2.2 once and report against whichever version each buyer names.
How We Test for Accessibility
Automated tools catch only part of the issues. The rest needs a person using the product the way disabled users do.
| Method | What it checks |
|---|---|
| Automated scanning | Contrast, missing labels and alternative text, and code-level errors, across many pages quickly |
| Keyboard-only testing | Every function reachable and usable without a mouse, with visible focus |
| Screen readers | NVDA and JAWS on Windows, VoiceOver on macOS and iOS, and TalkBack on Android |
| Zoom, reflow, and spacing | Content at 200% and 400% zoom, and with text spacing adjusted |
| Forms, errors, and sign-in | Labels, error messages, time limits, and accessible authentication |
| Media and documents | Captions, transcripts, audio description, and PDF accessibility |
How Our VPAT and ACR Service Works
Six steps, from scoping to a published ACR.
A buyer asked for your VPAT and the deal is waiting? Tell us the deadline in a free scoping review.
Book a free scoping reviewWho Needs a VPAT or ACR?
Enterprise procurement and security reviews increasingly include accessibility.
Section 508 applies to the ICT US federal agencies buy.
ADA Title II puts WCAG 2.1 AA into their purchasing.
Universities and school districts routinely ask for ACRs.
E-commerce, banking, e-books, transport, and communications under the EAA.
Patient and customer portals with legal and contract duties.
VPAT vs Accessibility Audit vs Automated Scan
| Option | What you get | Good for |
|---|---|---|
| Accessibility audit | A detailed issue log with fix guidance | Engineering teams fixing issues |
| VPAT / ACR | A standard report of conformance, criterion by criterion | Buyers and procurement teams |
| Automated scan or overlay | A partial view of code-level issues | Monitoring between audits, not proof of conformance |
| "WCAG certification" | There is no official one | Be wary of anyone selling it |
Our service combines the first two: an audit your engineers can act on, and an ACR your buyers can rely on. Buyers that check accessibility often check security too, which is where ISO 27001, SOC 2, and penetration testing come in.
VPAT Cost and Timeline
There is no list price. Effort depends on the size of the product and the platforms tested, and a free scoping review gives you a tailored proposal.
What sets the effort
- Product size — screens, user journeys, and roles
- Platforms — web, iOS, Android, desktop, and documents
- Editions — WCAG, 508, EU, or INT
- WCAG version — 2.1 AA, 2.2 AA, or AAA extras
- Retesting — how many rounds you need
Planning the timeline
| Scoping | Agreed before testing starts |
|---|---|
| Testing and issue log | Set in your proposal |
| Fixes and retest | After your team's changes |
| ACR update | With each major release, or at least yearly |
How to Choose VPAT Services
Questions worth asking any VPAT provider, and how Accredify Global answers them.
| Question to ask | Accredify Global's answer |
|---|---|
| Is the ACR based on a real test? | Yes. Every entry comes from testing, with remarks a buyer can check. |
| Do you test with screen readers? | Yes, on desktop and mobile, plus keyboard-only testing. |
| Can you certify us as WCAG compliant? | No one can. There is no official WCAG certification; you get test results and an ACR. |
| Do you fix the code? | No. Your team fixes issues using our guidance; we retest. |
| Do you recommend overlays? | No. Overlays do not make a product conform. |
| How is it priced? | A tailored proposal after a free scoping review. |
What You Receive
The journeys, screens, platforms, and tools tested.
Each issue with its criterion, severity, location, and fix.
Which issues are closed, and how that was confirmed.
The VPAT 2.5 edition or editions you need, completed from evidence.
Plain-language text for your website, including EAA information.
Remaining issues in priority order, for your next releases.
Frequently Asked Questions About VPATs and ACRs
Answers on editions, WCAG versions, Section 508, the EAA, testing, and cost.
What is a VPAT?
A VPAT, or Voluntary Product Accessibility Template, is a standard template from the Information Technology Industry Council (ITI) for documenting how well a product meets accessibility standards. The current version is VPAT 2.5, available in WCAG, 508, EU, and INT editions.
What is the difference between a VPAT and an ACR?
The VPAT is the blank template. Once it has been completed for a specific product and version, it is called an Accessibility Conformance Report, or ACR. Buyers usually ask for a VPAT when they mean the completed ACR.
Which VPAT edition do we need?
Use the WCAG edition for most commercial and education buyers, the 508 edition for US federal agencies, the EU edition for EN 301 549 and the European Accessibility Act, and the INT edition if you sell in several markets. One round of testing can produce more than one edition.
Should we report against WCAG 2.1 or WCAG 2.2?
Test to WCAG 2.2 AA where you can. It includes everything in WCAG 2.1 AA except the removed 4.1.1 Parsing criterion, plus six new criteria at Levels A and AA. The ADA Title II rule cites WCAG 2.1 AA, while EN 301 549 V4.1.1 adopts WCAG 2.2 AA.
How many WCAG success criteria are there at Level AA?
WCAG 2.1 has 50 success criteria at Levels A and AA together, 30 at Level A and 20 at Level AA. WCAG 2.2 has 55 at Levels A and AA, after adding six new criteria and removing 4.1.1 Parsing.
What does Section 508 require?
Section 508 requires US federal agencies to make the information and communication technology they develop, buy, or use accessible. The Revised 508 Standards incorporate WCAG 2.0 Level AA for web content and documents, and add requirements for software, hardware, and support documentation.
What changed with the ADA Title II deadlines?
An interim final rule of 20 April 2026 moved the deadlines for state and local governments to meet WCAG 2.1 AA to 26 April 2027 for entities serving 50,000 or more people, and 26 April 2028 for smaller entities and special districts. The standard itself did not change.
Does the European Accessibility Act apply to us?
It can, even if you are based outside the EU. Since 28 June 2025 it has applied to many products and services sold in the EU, including e-commerce, consumer banking, e-books, transport ticketing, and electronic communications. EN 301 549 sets the technical requirements, and V4.1.1 adopts WCAG 2.2 AA.
Is there an official WCAG or VPAT certification?
No. There is no official WCAG certification, and an ACR is a report, not a certificate. What makes an ACR credible is that it comes from a real test with clear evaluation methods and honest remarks.
Can we write our own VPAT?
Yes. Vendors can complete their own ACR, and many do. Buyers increasingly ask how it was tested, however, so an ACR based on an independent test with screen readers and keyboard testing usually carries more weight.
How do you test for accessibility?
We combine automated scanning with manual testing of each success criterion, keyboard-only use, screen readers such as NVDA, JAWS, VoiceOver, and TalkBack, zoom and reflow checks, and review of forms, media, and documents.
Do accessibility overlays make a product compliant?
No. Overlays and widgets cannot fix most underlying issues, and they do not make a product conform to WCAG. Issues need to be fixed in the product itself.
How long is an ACR valid?
An ACR describes a specific product version. Update it with each major release or significant design change, and at least once a year, so buyers see a current picture.
Do you fix the accessibility issues?
No. Your team fixes them using the guidance in our issue log. We then retest and complete the ACR from the retested results.
How much does a VPAT cost?
There is no list price. Effort depends on the size of the product, the platforms tested, the VPAT editions, and the number of retest rounds. A free scoping review gives you a tailored proposal.
Give Buyers an ACR They Can Trust, Backed by a Real Test
Tell us about your product, platforms, and the buyer asking. We'll confirm the right VPAT edition and WCAG version, and send a tailored proposal.
Book your free scoping review →Last reviewed by the Accredify Global compliance team. VPAT is a registered service mark of the Information Technology Industry Council (ITI).