Guide
VPAT: what it is, an example, and how to get one
A VPAT is a free template for describing how well a product meets accessibility standards. ITI, the Information Technology Industry Council, publishes it. Once a vendor fills it in for one product, it's called an Accessibility Conformance Report, or ACR. Government agencies, universities and large companies often ask for one before they buy software or a web service. This page explains what goes in it, shows an example, and covers the ways to get one. AuditRush doesn't write VPATs. We do the audit that a VPAT is written from.
VPAT or ACR?
People use the two words as if they were the same, but they aren't. The VPAT, short for Voluntary Product Accessibility Template, is the empty form. You can download it free of charge from ITI's VPAT page. The ACR is that form filled in with test results for one product, one version, on one date. When a buyer asks for "your VPAT", they want your ACR.
The four VPAT editions
The current version is VPAT 2.5Rev, from April 2025. It comes in four editions, one for each set of rules a buyer may ask about.
| Edition | What it covers | Use it when |
|---|---|---|
| 508 | The Revised Section 508 Standards, which use WCAG 2.0 | You sell to US federal agencies |
| EU | EN 301 549, the European standard for public buying, which uses WCAG 2.1 for web content | You sell to public bodies in the EU |
| WCAG | WCAG 2.0, 2.1 and 2.2 | A buyer asks about WCAG only |
| INT | All three of the above | You sell in both the US and the EU, or you aren't sure |
For sales to the federal government, section508.gov points vendors to the 508 or the INT edition.
What is in a VPAT
The first page describes the product: its name and version, the date of the report, a short description, a contact, notes, and how it was tested. Say whether the testing was manual, automated or both, and name the tools.
After that come tables with one row per criterion and three columns: the criterion, the conformance level, and remarks. The conformance level is one of these terms:
- Supports. The product meets the criterion without known defects.
- Partially Supports. Some of the product's functions don't meet it.
- Does Not Support. Most of the product's functions don't meet it.
- Not Applicable. The criterion doesn't apply, such as a captions rule on a product with no video.
- Not Evaluated. Allowed only for the level AAA criteria, which the report doesn't have to cover.
Every Partially Supports and Does Not Support needs a remark that says what fails. Remarks on a Supports row are optional, but they help the reader.
A VPAT example
Here are four rows from the WCAG table of a made-up report for a booking web app.
| Criteria | Conformance Level | Remarks and Explanations |
|---|---|---|
| 1.1.1 Non-text Content (Level A) | Partially Supports | Product photos and icons have text alternatives. The floor plan image on the venue page has none. A text list of the rooms is planned for version 4.3. |
| 1.2.2 Captions (Prerecorded) (Level A) | Not Applicable | The product has no video or audio. |
| 1.4.3 Contrast (Minimum) (Level AA) | Supports | Text on every screen meets the contrast ratios the criterion sets. |
| 2.1.1 Keyboard (Level A) | Does Not Support | Every booking goes through the calendar, which works only with a mouse or a touch screen. A keyboard user can't complete a booking. |
Each remark says what fails, where it is, and when a fix is planned if one is. An honest Partially Supports with a clear remark is worth more than a Supports the buyer can disprove in five minutes with a keyboard.
How to get a VPAT
The vendor is responsible for the report. section508.gov says the product owner has to test the product against the standards, and ITI says the maker is usually the best one to do that testing. There are three ways to get it done.
1. Write it yourself
Download the template from ITI, test the product against every criterion in your edition, and fill in the rows. It costs nothing but time, and it works when someone on your team knows WCAG well. The hard part is the testing, since a row is only as good as the test behind it.
2. Hire a firm that offers VPAT services
Accessibility firms test the product and write the ACR for you, and many re-test each new release. This suits a large application with many screens and user roles, or a buyer who wants an outside company's name on the report.
3. Get an audit, then write the report from it
An audit gives you the test results: every failure, the WCAG criterion it breaks, where it is, and the evidence. Your team, or a writer you hire, then turns those results into a conformance level and a remark for each row. This is where AuditRush fits. The signed audit tests your web pages against WCAG 2.1 AA for a flat $490 for 10 pages or $990 for 25, delivered in 48-72 hours. A certified accessibility specialist reviews and signs it, so the report's testing section can point to a dated, signed audit.
There are limits to what it covers. We don't fill in the VPAT itself. WCAG 2.1 AA includes every WCAG 2.0 criterion the 508 edition asks about, but the 508 and EU editions also have rows that aren't about web content, such as support documentation, and a web audit doesn't answer those. If the buyer wants WCAG 2.2, the six criteria new in 2.2 need testing on top. We audit web pages only, not desktop software, native mobile apps, PDFs or hardware. Pages behind a login aren't in our standard flow yet, so read the FAQ first if your product sits behind one.
What makes a buyer trust an ACR
- It names the product version and the date, and the version matches what the buyer is getting.
- It says how the product was tested and with which tools, screen readers included.
- Remarks say what fails, where, and what a user can do instead.
- It uses only the official terms, and Not Evaluated only for level AAA.
- The report itself is accessible, as section508.gov asks. A tagged PDF or a web page works, and a scanned image doesn't.
Who asks for a VPAT
US federal agencies have to buy accessible technology under Section 508. They use ACRs to judge products during market research and when they evaluate proposals, and section508.gov recommends an ACR for any product a vendor wants to sell to the federal government. State agencies, universities and large companies often ask for one in their own buying process. Public buyers in the EU work from EN 301 549. A customer who asks for a VPAT usually wants it before they sign, so the date on it matters. Our page on accessibility audit services covers the other reasons to audit before anyone asks.
Common questions
Is a VPAT required by law?
No law requires a business to have one. Section 508 puts the duty on federal agencies to buy accessible products, and an ACR is how a vendor shows them where a product stands. In practice, a buyer who asks for one may not go ahead without it.
Is there a VPAT certification?
No. ITI says there is no certification for VPAT and no pass or fail, so no product can be "VPAT certified".
How much does a VPAT cost?
The template is free. What costs money is the testing behind it and the time to write the rows. If you write it yourself from an audit, the cost is the audit plus your team's time. Our signed audit is $490 for 10 pages.
How long is a VPAT valid?
There is no expiry date. An ACR describes one version of a product on one date, so it goes out of date when the product changes. Update it with each major release, and tell the buyer which version it covers.
Does AuditRush write VPATs?
No. We deliver the audit: per-page findings, each mapped to its WCAG criterion, with evidence and the fix. You or your writer complete the ACR from it. If you need someone to write the whole report, a firm that offers VPAT services is the right buy.
Can I use the automated audit?
The $149 automated audit has the same findings without a person's review, and its first page says so. It works well for finding what to fix before you write the report. For an ACR a buyer will rely on, the signed audit is the better base, because a certified accessibility specialist reviewed and signed it.