Someone asked you for a VPAT

A Voluntary Product Accessibility Template is the document a buyer asks for before they are allowed to purchase your software. It states, criterion by criterion, how your product measures against WCAG. Without one, a lot of procurement processes stop before anyone has looked at what you built.

Who asks for one

Federal and state government

Section 508 applies to anything they buy, and a VPAT is how a vendor evidences it.

Universities and school districts

Procurement policies almost always require conformance documentation before a contract.

Hospitals and health systems

Patient-facing software is bought under the same accessibility rules.

Large enterprises

Increasingly a standard line in vendor security and compliance reviews.

All four editions

A VPAT 2.5 comes in four editions and they are not interchangeable. Ask a federal procurement officer for the document they need and they will say Section 508; ask a European buyer and they will say EN 301 549. Hand either one the WCAG edition and you have not answered the question.

WCAG

The success criteria on their own. What most commercial buyers ask for.

Section 508

Adds the Functional Performance Criteria and the chapters on software, hardware and support services. US federal and state procurement.

EU (EN 301 549)

Adds the thirteen chapters of the European standard. What the European Accessibility Act is enforced against.

International

All of it in one document, for selling into more than one market.

How ours is built

The WCAG table carries every Level A and AA success criterion — 50 for WCAG 2.1, 55 for WCAG 2.2. Each gets a conformance level — Supports, Partially Supports, Does Not Support, Not Applicable, or Not Evaluated — plus the remarks a reader needs to believe it. The 508 and EU editions add their own chapters on top.

The European editions are tabled against WCAG 2.2, because EN 301 549 v4.1.1 — published 2 September 2026 — references it. A report generated against 2.1 is a version behind the standard it claims to answer.

Where the scan found a failure, the criterion is filled in from that evidence. Everything else starts at Not Evaluated, and stays there until a person says otherwise.

The questions it asks you

17 questions on the success criteria, in plain language, covering what automation cannot judge: whether the page can be operated by keyboard alone, whether the reading order makes sense, whether alt text actually describes the image, whether error messages explain how to fix the problem. Answer what you know.

The 508 and EU editions add up to 11 more, about your product and your support desk rather than your markup: does the product include hardware, can someone reach your support without a telephone, does your documentation describe the accessibility features. Answering them turns rows that would read assumed into rows a procurement reviewer can accept.

The Functional Performance Criteria are deliberately not asked. Whether a product can be used without vision needs someone driving it with a screen reader, and a guess at that is the one answer worse than an admitted gap.

“Not sure” is a real answer and always leaves the criterion at Not Evaluated. A VPAT with honest gaps is a document you can defend. One that claims conformance you have not checked is a liability with your signature on it.

What this is not

It is not an audit, and it is not a certification. Nobody can certify WCAG conformance from a scan, and a document that says otherwise is worth less than the time it took to download. If your buyer requires an independent third-party audit, you need an auditor — this produces the report you fill in and stand behind yourself, which is what the large majority of procurement requests actually ask for.