VPAT Explained: What It Is and What It Actually Costs
If someone in procurement just asked you for a VPAT, you probably have two questions: what is it, and how fast can you get one? This article answers both, plus the follow-on questions that tend to surface once you get past the definition.
A VPAT (Voluntary Product Accessibility Template) is a standardized document published by the IT Industry Council (ITI) that vendors use to disclose how their digital product or service conforms to recognized accessibility standards, including Section 508 (US federal), EN 301 549 (EU), and WCAG. When completed for a specific product, it becomes an Accessibility Conformance Report (ACR). A complete engagement — accessibility audit plus ACR document — typically costs between $2,000 and $12,000 depending on product complexity, and takes 2 to 4 weeks for most web applications.
What a VPAT Actually Is (and Is Not)
A VPAT is a blank template. The IT Industry Council, a trade association representing major technology companies, created and maintains it. When a vendor fills out that template for their specific product and publishes it, the completed document is called an Accessibility Conformance Report, or ACR. The two terms are used interchangeably in casual conversation, which causes real confusion when a procurement officer asks for one and the vendor is not sure which document they mean. They mean the ACR.
The ACR/VPAT FAQ on Section508.gov puts it plainly: “A version of the VPAT which has been completed for a specific product is an ACR.” That is the entire distinction. You download the blank VPAT template, fill it in for your product, and the resulting document is your ACR.
There is no submission process and no certification body. You either publish it on your website or provide it to the buyer who asked for it.
There is also no VPAT certification. This is one of the most common misconceptions. No government agency issues a passing grade on a VPAT, no third party certifies conformance, and no badge or seal indicates that a product “has a VPAT.” What you have is a completed document that states your product’s level of conformance, criterion by criterion, across whichever standard the buyer requires.
Who Actually Needs One
The short answer: any company selling ICT — information and communications technology — products or services to the US federal government, and increasingly to state and local governments as well.
Federal agencies are legally required under Section 508 of the Rehabilitation Act to procure accessible ICT. That means if you are bidding on a federal contract and your product is software, a SaaS platform, electronic documents, or a support system, you will almost certainly be asked to provide an ACR. According to Section508.gov, without an ACR, a federal agency may not be able to consider your product at all unless a specific exception applies.
The requirement is expanding. In April 2024, the Department of Justice issued a final rule under Title II of the ADA requiring all state and local governments to meet WCAG 2.1 Level AA for their web content and mobile apps. Critically, that rule extends to their vendors and contractors too. The ADA.gov fact sheet confirms that if a city contracts with a company to manage or update its website, that content must meet WCAG 2.1 Level AA — even if a private firm builds it. Compliance deadlines are April 26, 2027 for public entities serving 50,000 or more people, and April 26, 2028 for smaller jurisdictions and special districts. That deadline is moving toward a large segment of the government contracting market.
Enterprise buyers in the private sector are also increasingly requesting ACRs as part of vendor due diligence, particularly in healthcare, finance, and education. This is not yet a legal mandate in most private-sector contexts, but it is fast becoming a standard procurement expectation.
The Four VPAT Editions
The ITI publishes four separate editions of the VPAT under version 2.5Rev (the current version as of April 2025). Each edition covers a different set of accessibility standards, and choosing the wrong one is a common, avoidable mistake.
| Edition | Standard Covered | When to Use It |
| VPAT 2.5 508 | Revised Section 508 (WCAG 2.0 embedded) | Selling to US federal government agencies |
| VPAT 2.5 EU | EN 301 549 (WCAG 2.1 embedded) | EU public procurement or European clients |
| VPAT 2.5 WCAG | WCAG 2.0, 2.1, and 2.2 | Private sector procurement, general accessibility claims |
| VPAT 2.5 INT | All three standards combined | Vendors operating across US federal and EU markets simultaneously |
The ITI VPAT page makes clear that the WCAG version embedded in each edition differs: WCAG 2.0 is in the 508 edition, WCAG 2.1 is in the EU edition, and WCAG 2.2 is in the WCAG and INT editions. If a buyer asks for a “Section 508 VPAT,” they want the 508 edition. If they ask for a “WCAG VPAT,” they typically want the WCAG or INT edition, especially if WCAG 2.2 conformance is the stated requirement.
The W3C WAI WCAG overview notes that WCAG 2.2 was published in October 2023 and has since been adopted as an ISO standard (ISO/IEC 40500:2025). All WCAG versions are backwards-compatible, meaning a product that conforms to WCAG 2.2 Level AA also conforms to 2.1 and 2.0. If you are starting fresh, targeting WCAG 2.2 Level AA is the sensible call.
The Four Conformance Levels
Every row in a VPAT table asks you to declare one of four things about your product’s conformance to that specific criterion. Understanding what each level means determines how useful your ACR actually is.
“Supports” means the product meets the criterion without known defects. “Partially Supports” means some functionality does not meet the criterion. “Does Not Support” means the majority of functionality fails to meet it. “Not Applicable” means the criterion is irrelevant to the product’s category.
“Partially Supports” is where most products honestly land on at least a few criteria, and it is not a disqualifier. The Section508.gov guidance on creating an ACR is explicit: if you have an ACR and a competitor does not, you will always appear more conformant in a procurement comparison, even if your ACR shows gaps. An honest, partially-supporting ACR beats no ACR. What damages a vendor is an inaccurate ACR that claims full support for criteria the product does not actually meet. That creates procurement liability and, if later discovered, can terminate a contract.
Self-Reported vs. Third-Party Audited: The Credibility Gap
You can, technically, fill out a VPAT yourself. ITI says the product owner has the most accurate information about the product’s features, and self-reporting is not prohibited. But there is a meaningful practical distinction between a self-reported ACR and one backed by an independent accessibility audit.
A self-reported VPAT relies on your team’s ability to accurately test your product against 50-plus WCAG success criteria and the relevant Section 508 chapters. Most development teams have not been trained in structured accessibility testing. The result is often optimistic conformance claims that do not hold up under a buyer’s own review or an independent check. Several federal procurement processes and many enterprise buyers now either require or strongly prefer third-party audited ACRs precisely because self-reporting bias is well-documented.
The tradeoff is cost and time. A self-reported VPAT can be completed in days and costs only internal labor. A properly audited ACR adds $1,500 to $3,500 for a straightforward web application and takes 2 to 4 weeks. For a complex platform, that audit cost can reach $10,000 or more. If the contract is worth pursuing, the audit is almost always worth the cost.
What a Full VPAT Engagement Actually Costs
This is the question most content on this topic refuses to answer directly. Here is the breakdown, drawn from current market ranges.
| Component | Lower Range | Upper Range | Notes |
| Accessibility audit (third-party) | $1,500 | $10,000+ | Depends on number of screens, test methods, product complexity |
| VPAT document completion | $350 | $950 | Template completion only, no audit included |
| Full engagement (audit + ACR) | $2,000 | $12,500 | Most common range for web apps and SaaS platforms |
| Expedited turnaround (5 business days) | Add 20-40% premium | — | Some providers offer, rarely at base price |
Accessible.org’s cost breakdown puts document completion alone at $350 to $950 depending on the edition and product scope. The audit is the dominant cost driver. A simple 10-screen web application will come in at the lower end. A complex SaaS platform with multiple user roles, document generation, and third-party integrations will push toward the upper end or beyond it.
Timeline expectations: initial contact to scoping typically takes 1 to 3 days; the audit itself runs 1 to 2 weeks for most web products; document completion and review adds another 2 to 5 days. Per Microassist’s VPAT evaluation guidance, most web application engagements complete in 2 to 4 weeks end-to-end under normal conditions. Rush timelines are possible but carry a cost premium.
When Your VPAT Needs to Be Updated
A VPAT is not a one-time document. Section508.gov’s FAQ is clear: every time your product changes — version update, bug fix, new feature — the ACR may need to be revised to reflect any changes in accessibility status. An ACR built against an old version of your product, or against the original 2001 Section 508 standards rather than the 2017 revised standards, is not sufficient for current federal procurement.
In practice, most vendors tie their ACR update cycle to major version releases. A cosmetic UI refresh that touches no interactive elements or content structure probably does not require a new audit. A release that adds new user flows, modifies form interactions, or changes navigation structure should trigger one.
If your product operates across both US federal and EU markets, you will need to track two standards timelines: the US Section 508 revised standards and EN 301 549. The EU standard currently references WCAG 2.1, with the next version expected to align with WCAG 2.2. Managing two separate ACRs or a single INT edition ACR is a scoping decision worth making with a specialist.
What Accessibility Actually Requires in the Build
A VPAT documents what already exists in your product. It does not create accessibility. This is a distinction that matters operationally: if your product does not meet WCAG 2.1 Level AA, completing a VPAT will only surface that gap, not fix it. Remediation has to happen first, or the ACR will honestly reflect a partially or non-supporting product.
The implications for a web development project are specific. WCAG 2.1 Level AA conformance requires, among other things, sufficient color contrast ratios (4.5:1 for body text, 3:1 for large text), keyboard navigability for all interactive elements, meaningful alt text on all non-decorative images, proper heading hierarchy, accessible form labels, focus indicators, and captions or transcripts for any time-based media. These are not styling decisions — they are structural ones that affect how HTML is written, how ARIA attributes are used, how tab order is managed, and how a component library is built.
A site built on a WordPress theme that was not designed with accessibility in mind will often fail on several of these criteria out of the box. A custom build, or a carefully audited theme with accessibility remediation, gives you cleaner ground to complete an honest ACR from. At BetaTech, we build in WordPress most of the time, and when a client has known procurement requirements, we scope accessibility testing into the build rather than treating it as an afterthought. Our distributed team in Bangladesh and the US means remediation cycles that surface in a US business day are often addressed and pushed to staging before the next morning — which compresses the pre-audit cleanup timeline meaningfully.
FAQ
What is the difference between a VPAT and an ACR?
A VPAT is the blank template maintained by the IT Industry Council. An ACR (Accessibility Conformance Report) is what you call the VPAT once you have filled it in for your specific product. The two terms are used interchangeably, but technically the VPAT is the form and the ACR is the completed document.
Is there a VPAT certification?
No. There is no certification, no passing grade, and no government body that approves or rejects VPATs. You complete the template, publish or distribute the resulting ACR, and buyers use it to evaluate your product’s accessibility against comparable alternatives. A product that partially supports some criteria is still evaluable; a product with no ACR is often not.
Which VPAT edition do I need?
If you are selling to US federal agencies, use the 508 edition. If you are selling to EU public sector clients, use the EU edition. If you need to cover both, use the INT edition. If a private-sector buyer is asking for WCAG conformance documentation, use the WCAG edition, and target WCAG 2.2 Level AA as the standard if you are starting a new build.
Can I fill out a VPAT myself without an outside audit?
Yes, you can. The product owner is technically the best-positioned party to complete it, as ITI itself acknowledges. The practical risk is that internal teams tend to overstate conformance because they are not trained in structured WCAG testing methodology. In competitive federal procurement, an optimistic self-report that does not hold up under review is worse than an honest ACR that shows partial support with clear explanations.
How often does a VPAT need to be updated?
Whenever your product changes in a way that could affect accessibility. Major version releases, new user flows, significant UI restructuring, and new integrations all typically warrant a revised ACR. ACRs built against the 2001 Section 508 standards must be updated to reflect the 2017 revised standards before they are valid for current federal procurement.
Does having a VPAT guarantee my product is accessible?
No. A VPAT documents conformance claims; it does not guarantee them and does not create accessibility where it does not exist. A product with a VPAT that overstates conformance is not accessible — it is misrepresented. Genuine accessibility requires the right build decisions at the development stage, followed by structured testing, before a VPAT accurately reflects the result.
Get an Accessibility Scoping Conversation Before You Commission an Audit
If you have been asked for a VPAT and you are not sure whether your current site or application would support an honest ACR, the right first step is a technical scoping conversation, not an audit. An audit you cannot act on because the remediation budget is not set is an expensive document.
We scope accessibility requirements into web development projects from the start. If you want a realistic read on where your product stands and what it would take to complete a credible ACR, contact BetaTech and we will tell you what we see — including if the answer is that you do not need us for this.
