What Is a VPAT?

What is a VPAT used for?

A VPAT is used by buyers to evaluate whether a vendor's product meets their accessibility requirements before a purchase or contract award.

In practical terms, a VPAT is the primary accessibility due-diligence document in technology procurement. Federal agencies, universities, state governments, and large enterprises typically require vendors to submit a completed VPAT — formally called an Accessibility Conformance Report (ACR) — before a contract is awarded. The document lets procurement officers compare competing products on accessibility without hiring an accessibility auditor for every vendor.

Beyond procurement, organizations use VPATs internally to track their own product accessibility over time, to demonstrate good faith to users who need assistive technology, and to meet disclosure requirements under laws such as Section 508 of the Rehabilitation Act (US federal contractors), the European Accessibility Act (EN 301 549), and the Americans with Disabilities Act (ADA).

The US General Services Administration (Section508.gov) provides authoritative guidance on how to create an ACR using a VPAT for vendors selling to federal agencies.

VPAT vs ACR — what's the difference?

The VPAT is the blank template; the ACR (Accessibility Conformance Report) is the completed document you submit. The terms are often used interchangeably in procurement conversations.

Technically, the Voluntary Product Accessibility Template (VPAT®) refers to the empty form published by ITI. Once a vendor fills in the conformance levels and remarks for their specific product, the resulting document becomes an Accessibility Conformance Report (ACR). Many organizations and procurement offices call the finished document a "VPAT" out of habit, even though "ACR" is the technically correct term for the completed report.

In practice, when a government agency or enterprise asks for a "VPAT," they want the completed ACR — the filled-in document that shows how a specific product version meets each accessibility criterion. VPATify's free VPAT generator automates much of the ACR creation process by mapping scan results to the relevant VPAT 2.5 criteria rows.

What are the VPAT 2.5 editions?

VPAT 2.5 comes in four editions tailored to different regulatory frameworks: Section 508, EN 301 549, WCAG 2.x, and an International edition that combines all three.

The Section 508 edition is required for vendors selling to US federal agencies. It covers the technical standards mandated by Section 508 of the Rehabilitation Act, which was updated in 2017 to reference WCAG 2.0 Level AA as its benchmark.

The EN 301 549 edition addresses the European Accessibility Act (EAA) and related EU public procurement rules. EN 301 549 is the harmonized European standard for digital accessibility and references WCAG 2.1 Level AA as its baseline for web content, with additional criteria for hardware and non-web software.

The WCAG 2.x edition covers the Web Content Accessibility Guidelines published by W3C. It is the most broadly recognized international framework for web accessibility, with Level AA being the widely accepted compliance target for commercial web products. VPAT 2.5 references WCAG 2.2, the current version.

The International edition combines Section 508, EN 301 549, and WCAG criteria into a single document, making it useful for vendors who sell in multiple markets and want to produce one comprehensive ACR. ITI publishes all four templates at itic.org.

How do you create a VPAT?

Creating a VPAT involves choosing the correct edition template, testing your product against each accessibility criterion, and documenting the conformance level and any relevant remarks for each row.

The traditional process is manual: download the appropriate VPAT 2.5 template from ITI's website, run accessibility testing (automated tools plus manual keyboard and screen reader testing), then fill in each criterion row with one of the four conformance levels — Supports, Partially Supports, Does Not Support, or Not Applicable — along with remarks explaining any gaps or limitations.

Automated tools can accelerate the process significantly. A deep accessibility scan can test every page of your site against WCAG 2.2 success criteria and pre-populate the VPAT rows that are verifiable through automation. You then review the auto-filled conformance levels, correct any that require context the scanner cannot determine (such as whether a CAPTCHA has an audio alternative), and complete any criteria that require manual testing, such as keyboard focus order or screen reader announcement quality.

VPATify's free VPAT generator handles the scan-to-template mapping automatically, reducing the time to produce a draft ACR from days to minutes. The accessibility guides cover framework-specific requirements in detail for teams who want to understand the underlying criteria before completing their VPAT.

Who needs a VPAT?

Any technology vendor selling to federal agencies, public universities, state governments, or large enterprises is likely to be asked for a VPAT at some point in the sales process.

Software and SaaS vendors selling to US federal agencies are required under Section 508 of the Rehabilitation Act to provide an ACR for any electronic and information technology they offer. This covers web applications, mobile apps, desktop software, and hardware with software interfaces. The requirement applies to direct sales to agencies and to contractors providing software as part of a larger project.

Vendors selling in the European Union face increasing pressure under the European Accessibility Act (EAA), which came into force in June 2025. The EAA requires that many digital products and services sold to EU consumers and institutions meet EN 301 549 accessibility requirements. A VPAT based on the EN 301 549 edition is the standard way to document and communicate compliance.

EdTech companies selling to universities and K-12 districts frequently encounter VPAT requirements, as most higher education institutions have adopted accessibility procurement policies aligned with WCAG 2.1 or 2.2 AA. Many universities will not sign contracts without a current VPAT.

Even companies that do not face a regulatory mandate find that maintaining an up-to-date VPAT helps close enterprise deals faster — it demonstrates a commitment to accessibility and removes a common procurement objection. If your product does not yet have a VPAT, VPATify's free VPAT generator is the fastest way to produce your first draft ACR.