Why does a customer need my VPAT?

Because they have their own legal obligation to buy accessible software. US government agencies (Section 508), universities, healthcare organizations, and large enterprises must document accessibility due diligence, and the VPAT is how they do it. They push the requirement down to their vendors, so without a credible VPAT the purchase usually stalls.

Can I just fill in the free VPAT template myself?

You can, but it's risky. The blank template is free, but a VPAT that isn't backed by a real audit is a liability — if a buyer's security team or a plaintiff's lawyer finds it inaccurate, you've documented in writing that you misrepresented conformance. A credible VPAT requires actually testing every applicable criterion against your product first.

Is a VPAT the same as being 'certified' accessible?

No. There is no official WCAG or ADA certification, and a VPAT is not a certificate — it's an honest conformance report, and 'Partially Supports' with a clear explanation is perfectly normal and often stronger than a dishonest 'Supports.' No certificate reduces your legal liability; an accurate, audit-backed VPAT plus real remediation is what actually helps.

How often do I need to update my VPAT?

Re-issue it on major releases. A VPAT reflects your product at a point in time, and accessibility conformance drifts as you ship changes — new features can introduce new barriers. Buyers increasingly expect a VPAT dated within the last year, so treat it as a living document tied to your release cycle, not a one-time deliverable.

Accessibility

What Is a VPAT — and How Do You Actually Get One? (2026)

Q: What is a VPAT?

A VPAT (Voluntary Product Accessibility Template) is a standardized document that, once completed, becomes an Accessibility Conformance Report (ACR). It states how your software product conforms to accessibility standards — WCAG, Section 508, or EN 301 549 — criterion by criterion, rating each as Supports, Partially Supports, Does Not Support, or Not Applicable, with an explanation. Procurement teams require it before buying software.

A customer asked for your VPAT and you have no idea what that means. Here's what a VPAT/ACR is, why procurement demands it, and how to get one that survives scrutiny.

July 28, 20262 min readAccessibility

Short answer: a VPAT (Voluntary Product Accessibility Template) is a standard document that, once filled in, becomes an ACR (Accessibility Conformance Report) — the report a buyer's procurement team requires before purchasing your software, stating how your product conforms to accessibility standards (WCAG, Section 508, or EN 301 549), criterion by criterion. If a customer just asked for yours and you don't have one, the deal is usually blocked until you produce a credible one. Here's what it is and how to get one that actually holds up.

Why a Customer Asked for Your VPAT

Your buyer isn't being difficult — they have their own legal obligation. US government agencies (Section 508), universities, healthcare organizations, and large enterprises are required to buy accessible software, and the VPAT is how they document that they did their due diligence. So they push the requirement down to you: no VPAT, no purchase. It shows up in RFPs, security questionnaires, and contract renewals.

What's Actually In It

A VPAT walks through each applicable success criterion (for WCAG 2.1/2.2, that's dozens of them across Perceivable, Operable, Understandable, Robust) and rates your product's conformance: Supports, Partially Supports, Does Not Support, or Not Applicable — with a plain-language explanation for each. The four editions cover WCAG, Section 508, EN 301 549 (EU), or all three (the "INT" edition).

The Trap: the Template Is Free, the Credibility Isn't

The blank VPAT template is free from ITI, so many founders assume it's a paperwork exercise, fill it in optimistically, and send it off. That's the mistake. A VPAT that isn't backed by a real audit is a liability — if a buyer's security team (or worse, a plaintiff's lawyer) scrutinises it and finds it inaccurate, you've documented, in writing, that you misrepresented conformance. A credible VPAT requires actually testing every applicable criterion against your product.

How to Get One That Holds Up

Audit first. Test your product against WCAG 2.1/2.2 AA — manually, not just with an automated scanner (automation catches only ~20–40% of issues).
Remediate the blockers. Fix the real code for anything that would read "Does Not Support" on something critical — keyboard access, screen-reader support, forms, contrast.
Author the VPAT honestly. "Partially Supports" with a clear explanation is far stronger than a dishonest "Supports." Buyers respect candor; they punish inaccuracy.
Keep it current. A VPAT goes stale as your product changes — re-issue it on major releases.

What a VPAT Is Not

It is not a certification — there is no such thing as WCAG or ADA certification, and no certificate reduces your liability. It's also not something an accessibility overlay widget can produce for you — overlays don't change the underlying code a VPAT reports on, and in 2025 the FTC fined the largest overlay vendor $1M for false compliance claims (FTC, 2025).

We audit your product, remediate the real code, and author a defensible VPAT/ACR you own — see Accessibility Audit & WCAG Remediation, or get a free read on where you stand with a VPAT Gap Check.