Skip to content
Adrythm
Websites, domains and hosting

VPAT

Voluntary Product Accessibility Template

In short

A VPAT, or Voluntary Product Accessibility Template, is a free form from the Information Technology Industry Council for reporting how a product meets accessibility standards. Completed for one product, it becomes an Accessibility Conformance Report, or ACR. A federal agency may not buy without an ACR unless the agency claims a special use case exception.

The word voluntary misleads sellers. The federal government must buy accessible technology under Section 508 of the Rehabilitation Act. Without an Accessibility Conformance Report, or ACR, it may not proceed with a purchase unless the government claims a special use case exception, which a seller can never claim. Section508.gov, run by the General Services Administration, calls the VPAT the most common method for completing an ACR and says using the VPAT is optional. Completing an ACR is required of any seller that wants the government to consider its product. For federal agencies, Section508.gov says an ACR should also be created for technology they develop internally.

No one certifies the result. The Information Technology Industry Council (ITI), which publishes the VPAT, does not review or approve VPATs. There is no submission process and no VPAT certification. The report is the account of whoever completed it. ITI says the original manufacturer is likely the best source for the testing, though a reseller can also complete one. A buyer's solicitation may require a third party audit or review on top of it.

ITI offers the VPAT free of charge and translates accessibility standards into testing criteria. There are four editions, currently VPAT 2.5Rev from April 2025. The 508 edition covers the Revised Section 508 federal standards and uses WCAG 2.0. The EU edition covers EN 301 549 and uses WCAG 2.1. The WCAG edition covers the Web Content Accessibility Guidelines up to WCAG 2.2, and the INT edition covers all three.

For each criterion, the report records one of four conformance levels: Supports, Partially Supports, Does Not Support or Not Applicable. A Partially Supports or Does Not Support entry should carry a remark explaining how the standard is missed. Section508.gov reads Partially Supports as non-conformance. It separately describes a Not Evaluated note, outside the four levels, for a standard the vendor has not assessed. Such a note provides no assurance of accessibility and should prompt questions about the vendor's evaluation plans.

Each product update may call for an updated report. A report built on the original 2001 standards must be redone against the Revised standards published in 2017.

In practice

A company that makes scheduling software is asked for an accessibility report by a federal agency buyer. It completes the 508 edition, testing the software against WCAG 2.0 Level A and Level AA and Chapter 5 on software. Its help pages are tested against Chapter 6 on support documentation. One screen does not work with a screen reader, so that row says Partially Supports with a remark explaining the failure. The agency can still consider the product and compare it with similar products.

Not the same as

Accessibility Conformance Report (ACR)
An ACR is the completed report for one product. A VPAT is the most common template for building one, and Section508.gov says the government does not require that template.
Section 508
Section 508 of the Rehabilitation Act requires federal agencies to procure and use accessible information and communication technology. The VPAT is a reporting template, and its 508 edition is one way a seller documents conformance to those standards.

Why it matters to you

For a seller, a report with gaps keeps a product in the running for a federal purchase, and a missing report can stop one. For a buyer, the report is a claim made by the seller. Section508.gov tells purchasers to run independent testing whenever possible to verify those claims. ITI adds that even a product that conforms can still be hard to use for some people with disabilities.

What to ask or check

  1. 01Which VPAT edition does your report use, and does it match the standard the buyer named?
  2. 02Which version of your product was tested, and has the product changed since the report was written?
  3. 03For a report handed to the business, what do the Partially Supports and Does Not Support remarks say fails, and what is marked Not Evaluated?
  4. 04Has the business tested the product itself before relying on the seller's report?

What people get wrong

That a VPAT is a certificate proving a product is accessible. ITI does not review or approve VPATs and says there is no VPAT certification. A completed report is the account of whoever completed it.

Red flags

  • A seller offering a VPAT certificate, a VPAT certified badge or a conformance logo, none of which ITI makes available.
  • An accessibility report with Not Evaluated notes and no stated plan to assess those standards.
  • A report still built on the original 2001 Section 508 standards.

Web accessibility

Web accessibility means people with disabilities can use your site. The Department of Justice says the ADA's requirements apply to what a business offers online, while stating it has no regulation setting out detailed standards for how. A separate rule does set one, WCAG 2.1 Level AA, but it binds state and local government.

Definition of done

A definition of done is the written list of conditions every piece of work must meet before anyone calls it finished. The Scrum Guide treats it as a gate: work that misses it cannot be released or even shown at the review. Agile Alliance warns that an unwritten one loses most of its value.

Version control

Version control is the permanent record of software as it changes. Microsoft describes it as taking a snapshot of the files and saving it so it can be recalled later. For a business paying for the work, it is where the asset lives, and access to it is a separate question from owning it.

301 redirect

A 301 redirect is a server instruction saying a page has permanently moved to a new address. Google treats it as a signal that the new address is the real one and should be the version shown in search results. A 302 says the move is temporary, so Google keeps showing the old address instead.

DNS

DNS is the system that turns a domain name into the address of the machine that answers for it. Your records live on an authoritative server named in the domain's NS record. Changes are not broadcast; old answers simply sit in caches until the TTL you set expires.

SSL certificate

An SSL or TLS certificate is the file that lets a browser confirm it is really connected to your domain, and it turns on encryption for the connection. It binds your keys to your domain name. It says nothing about whether the business behind the domain is trustworthy, and it is usually free.

Want this explained against your own numbers?

Twenty minutes, a straight answer, and no follow-up sequence if you decide not to work with us.