Section 508 compliance checker: why buyers keep asking for a VPAT
Section 508 of the Rehabilitation Act requires U.S. federal agencies to buy and use information and communications technology (ICT) that's accessible. Since the Revised 508 Standards took effect on January 18, 2018, that requirement has a concrete technical definition: per Section508.gov, "the Revised 508 Standards incorporate by reference the WCAG 2.0 Level AA Success Criteria, and apply the WCAG 2.0 Level AA success criteria and conformance requirements to both web and non-web electronic content." In plain terms: if your product or site meets WCAG 2.0 A and AA, you meet the technical bar federal buyers check against.
That's why a section 508 vpat shows up in so many procurement processes. If you sell ICT to a federal agency, filling one out isn't optional — Section508.gov puts it bluntly: "It is not voluntary to complete an ACR if you wish the government to consider purchasing your product." The requirement doesn't stop at the federal line either. Plenty of state and local governments, school districts, and public colleges and universities have adopted their own IT procurement policies modeled on Section 508, and their purchasing offices routinely ask vendors for a VPAT before a contract gets signed. Beyond the public sector, the Information Technology Industry Council (ITI), which maintains the VPAT template, describes the completed ACR as "the leading global reporting format for assisting buyers and sellers in identifying" accessible ICT — which is a large part of why enterprise procurement and vendor-risk teams now ask for one as standard due diligence, even outside a strict legal 508 obligation.
From scan to a VPAT draft you can actually defend
Filling out a VPAT by hand usually means opening the ITI template, reading through roughly 50 WCAG 2.0 success criteria, and guessing — or manually testing — whether your product supports each one. Abledly starts from the other direction:
- We scan your real, rendered pages with two independent engines (axe-core + IBM Equal Access) plus an AI review layer, checked against WCAG 2.0/2.2 AA and the Section 508 criteria it maps to.
- We map each finding to its WCAG success criterion and the matching Section 508 provision, so the evidence behind every VPAT row traces back to something we actually found on your site.
- We pre-fill your VPAT / ACR — conformance level and remarks — from those findings, instead of handing you a blank template.
- You review and finalize it. A person should still read the draft, adjust language, note anything automation can't judge, and sign it before it goes to a buyer. We draft; we don't auto-certify.
Click to enlarge
An actual Abledly scan report — the same per-criterion findings that populate your VPAT draft's remarks column.
| Filling out a VPAT by hand | VPAT drafted from an Abledly scan |
|---|---|
| Starting point: a blank ITI template and a checklist of ~50 WCAG 2.0 criteria | Starting point: your actual scan results, already mapped to each criterion |
| Evidence: whatever you remember testing, or nothing at all | Evidence: the specific issue found, its location, and its WCAG reference |
| Staying current: re-checked only when someone remembers to | Staying current: re-scan any time to refresh the draft with a new date |
| Effort: hours of manual review per release | Effort: review and finalize a pre-filled draft |
| Sign-off: still yours | Sign-off: still yours — we don't auto-certify anything |
What your Section 508 VPAT draft includes
- A conformance level per WCAG 2.0 A/AA success criterion — Supports, Partially Supports, Does Not Support, or Not Applicable — backed by your scan
- Remarks tied to the actual issue found and where it lives on your site, not boilerplate text
- Section 508 provisions mapped alongside WCAG, since that's the format federal and public-sector buyers expect
- A companion accessibility statement for your public-facing site — generated from the same scan, via our accessibility statement generator
- A dated version so repeat scans show progress over time instead of one static snapshot
- Guidance on the criteria automation can't fully judge — roughly 30-40% of WCAG success criteria still need human review
Section 508 is the public-sector procurement standard, but if you're weighing it against private-sector lawsuit risk, see our ADA compliance checker. And since the Revised 508 Standards currently reference WCAG 2.0 rather than the newer 2.2, many buyers and vendors choose to go further — our WCAG 2.2 checklist covers what's changed since 2.0 if you want to get ahead of it.
Frequently asked questions
What does Section 508 compliance actually require?
Section 508 of the Rehabilitation Act requires U.S. federal agencies to procure and use information and communications technology (ICT) that's accessible. The Revised 508 Standards, in effect since January 18, 2018, incorporate by reference the WCAG 2.0 Level AA success criteria and apply them to both web and non-web electronic content, per Section508.gov. In practice, "Section 508 compliant" means your ICT — website, software, documents — meets WCAG 2.0 Level A and AA.
What is a VPAT, and how is it different from an ACR?
The VPAT (Voluntary Product Accessibility Template) is the standard blank template, maintained by the Information Technology Industry Council (ITI), for documenting how a product conforms to Section 508, EN 301 549 and WCAG. Once you fill it out with real testing results, that completed document is called an Accessibility Conformance Report (ACR). People often use the two terms interchangeably, but technically VPAT is the form and ACR is the finished report.
Who actually needs a Section 508 VPAT?
Anyone selling ICT products or services to a U.S. federal agency needs one — Section508.gov is direct about this: "It is not voluntary to complete an ACR if you wish the government to consider purchasing your product." Beyond federal contracts, many state and local governments, school districts and public colleges and universities run their own procurement policies modeled on Section 508 and routinely ask vendors for a VPAT. ITI also describes the completed ACR as the leading global format buyers and sellers use generally to document accessible ICT, so plenty of enterprise procurement teams request one even without a legal 508 obligation.
Does a VPAT need a perfect score to be useful?
No. A VPAT reports a conformance level per criterion — Supports, Partially Supports, Does Not Support, or Not Applicable — and Section508.gov says plainly that "your product will still be considered for purchase even if all of the Section 508 Technical Standards are not met." Buyers generally want an honest, specific account of gaps, not a claim of flawless conformance.
Can Abledly's scan or VPAT draft guarantee legal Section 508 compliance?
No, and we wouldn't claim it does. A VPAT/ACR is a self-reported document — vendors, not a third-party certifier, determine and stand behind each conformance level. Abledly scans your site against WCAG 2.0/2.2 with two engines plus AI review and pre-fills a VPAT draft from those findings, but you (or your developer, or legal counsel) still need to review, adjust and finalize it before you sign and send it. No automated tool can certify legal compliance, including ours.
Ready to draft your Section 508 VPAT?
Run a free scan of your actual site — two engines plus AI review against WCAG 2.0/2.2, mapped to Section 508 — then pre-fill your VPAT draft from the results.
Run your free Section 508 scan →