What Is a VPAT and How to Get One: Steps, Cost, Red Flags

Short answer: to get a VPAT, you test your product against the accessibility standard your buyer cares about (usually WCAG), fix the worst gaps, then fill in the free VPAT template from ITI with honest results. The filled-in template is called an ACR (Accessibility Conformance Report), and it is what the buyer's procurement team reads before they sign.

VPAT stands for Voluntary Product Accessibility Template. The current version is VPAT 2.5Rev (April 2025), published free by the Information Technology Industry Council (ITI). The template is free. The testing behind it is the real work.

Not sure how far your product is from a report you could send? Get a free VPAT Gap Check: a senior engineer sends back a written gap read within 2 business days.

A Customer Asked for Your VPAT: What to Do This Week

Your buyer is not being difficult. US federal agencies must buy accessible technology under Section 508, and universities, healthcare groups and large companies often have their own accessibility rules. The VPAT is how they show they checked. So the request lands on you, usually inside an RFP, a security questionnaire or a renewal.

What to do now:

1. Reply with a date, not silence. Tell the buyer you are preparing an audit-backed ACR and when they can expect it. A clear plan keeps the deal moving better than a rushed document.
2. Ask which edition they need. Many buyers name it in the RFP. If not, ask (see the next section).
3. Decide what the report covers. Name the product, version and platforms (web app, mobile app, admin area). A VPAT that covers only part of the product is a red flag for reviewers, so be clear about scope.
4. Do not send a template you filled in from memory. More on why below.

Which VPAT Edition You Need

ITI publishes four editions of VPAT 2.5 (ITI):

• 508 edition: for US federal buyers. The Revised Section 508 Standards point to WCAG 2.0 Level A and AA (US Access Board).
• EU edition: for buyers in Europe. It reports against EN 301 549, the standard behind the European Accessibility Act. See EAA compliance for US SaaS for which version applies.
• WCAG edition: reports against WCAG only. Common for US companies and universities that ask for "WCAG 2.1 AA" or "2.2 AA."
• INT edition: covers 508, EN 301 549 and WCAG in one report. Useful if you sell to government, EU and private buyers at once.

If you test against WCAG 2.2 AA, you cover the WCAG 2.0 and 2.1 criteria too, so one good audit can feed any edition.

How to Get a VPAT, Step by Step

1. Audit first. Test every applicable criterion against your real product. Use a scanner to speed things up, but do the manual checks too: keyboard-only use, a screen reader, forms, focus order and contrast. Scanners miss a lot of what a reviewer will check.
2. Fix the blockers. Anything that would read "Does Not Support" on a core flow (sign-in, main task, checkout, forms) is worth fixing in the code before you publish.
3. Re-test what you fixed. The report should describe the product as it is now, not as it was before the fixes.
4. Write the ACR honestly. For each criterion, pick Supports, Partially Supports, Does Not Support or Not Applicable, and explain it in plain words. Specific remarks beat vague ones.
5. Publish and date it. Add the product version, report date and a contact name. Then re-issue it when the product changes in a big way.

Want this done for you? Our Accessibility Audit & WCAG Remediation covers all five steps: a manual audit against WCAG 2.2 AA / EN 301 549, fixes in your own code, then a VPAT/ACR and accessibility statement you own. Not ready to commit? Start with the free VPAT Gap Check.

What a VPAT Costs

The template costs nothing. You pay for the audit and the writing. Two public reference points:

• One accessibility vendor lists VPAT writing at $350 (WCAG edition), $550 (508), $650 (EU) and $950 (INT), with the audit priced separately at $1,250 to $2,750 "for most clients" (accessible.org, vendor pricing, read October 2026).
• CodesSavvy accessibility audits start from $1,500, with the final price set on a written scope. Fixes are quoted at a fixed price on a written scope too.

The real cost driver is your product: how many screens and flows, how many custom components (charts, editors, drag and drop), and how much needs fixing before the report reads well. Ask any vendor whether the audit, the fixes and the report are priced together or apart. See audit pricing and scope.

How Buyers Grade Your VPAT

Procurement teams do not just file your VPAT. Many score it. The University of Arizona's public VPAT review guide is a good example of what reviewers look for (University of Arizona):

• Age. They ask if it is within 18 months and whether the product has changed a lot since.
• Score. They target 80% or more of applicable criteria at Supports or Partially Supports.
• Red flags:
• every criterion marked "Supports" (they treat this as unrealistic, since every product has some issues)
• vague remarks like "generally accessible"
• the same remark copied across many criteria
• whole sections marked Not Applicable with no reason
• no author or contact, or a report that covers only part of the product

So "Partially Supports" will not kill your deal by itself. An honest Partially Supports with a clear explanation reads better than a wall of Supports that a reviewer will not believe.

Can You Fill In the VPAT Yourself?

Yes. ITI does not review or approve VPATs, and a third-party review is optional unless the buyer's solicitation requires one (ITI).

The catch is credibility. A self-written report with no testing behind it tends to show exactly the red flags above. And if a buyer's team, or later a plaintiff's lawyer, finds it wrong, you have put an inaccurate claim in writing. If you write it yourself, test first and keep your test notes.

What a VPAT Is Not

• Not a certification. ITI says plainly that there is no VPAT certification and no conformance logo (ITI). WCAG is a standard you conform to, not a certificate someone hands you. Be wary of anyone selling a "VPAT certified" or "WCAG certified" badge.
• Not a guarantee. A VPAT documents where your product stands. It does not promise the buyer will sign, and it does not make you legally safe on its own.
• Not something an overlay widget can produce. Overlays do not change the code a VPAT reports on. In April 2025 the FTC finalized an order requiring the overlay vendor accessiBe to pay $1 million over its compliance claims (FTC).

Get Your VPAT Moving

If a buyer is waiting on your VPAT, start here:

1. Free VPAT Gap Check. A senior engineer reviews your product and sends a written gap read within 2 business days: a red/amber/green rating across the areas a VPAT covers, your top blockers in plain English, and an honest path to a report you can defend. No card, no obligation.
2. Accessibility Audit & WCAG Remediation. From $1,500, final price on a written scope. We audit against WCAG 2.2 AA / EN 301 549, fix the real source code (your repo, you keep every line), and author the VPAT/ACR and accessibility statement.

VPAT requests often arrive in the same packet as a security questionnaire. If that is your situation, see cybersecurity and SOC 2 readiness.