VPAT and ACR Explained: How to Win Enterprise and Government Deals

If you sell software or digital services to large companies, universities or government agencies, sooner or later a procurement form will ask for a VPAT. Without one, deals stall. With a vague or inaccurate one, you risk failing a technical review later. This guide explains what a VPAT is, what an Accessibility Conformance Report (ACR) contains, and how to produce one buyers trust.

What is a VPAT?

VPAT stands for Voluntary Product Accessibility Template. It is a standard document format published by the Information Technology Industry Council (ITI) that describes how well a product meets recognised accessibility standards.

The blank template is the VPAT. Once you complete it for your product, the finished document is called an Accessibility Conformance Report (ACR). In practice, buyers use both terms to mean the completed report.

Which VPAT edition do you need?

ITI publishes several editions of the template. Choose the one that matches the standards your buyers care about:

• WCAG edition: reports against the Web Content Accessibility Guidelines only. A good fit for most private-sector buyers.
• Section 508 edition: for US federal agencies and the contractors who sell to them. Section 508 incorporates WCAG 2.0 Level A and AA.
• EU edition: reports against EN 301 549, the European standard behind public-sector procurement and the European Accessibility Act.
• INT (international) edition: combines WCAG, Section 508 and EN 301 549 in one document. Useful if you sell in several markets.

What’s inside an ACR

A completed report has three main parts:

1. Product details: the product name and version, the date, contact information and the evaluation methods used (for example automated scanning plus manual testing with screen readers).
2. Conformance tables: one row per success criterion or requirement, each with a conformance level and remarks.
3. Legal disclaimer: optional notes about scope and limitations.

Each criterion gets one of these conformance levels:

Why the remarks column matters most

Procurement reviewers read the remarks closely. “Supports” with no explanation looks like guesswork. Good remarks explain what was tested and, for anything less than full support, what doesn’t work and when it will be fixed. For example:

1.4.3 Contrast (Minimum): Partially Supports. Body text and controls meet 4.5:1. Placeholder text in the search field measures 3.2:1. A fix is scheduled for the next release.

Honest, specific remarks build trust. Over-claiming “Supports” everywhere tends to backfire when the buyer’s own accessibility team tests the product.

Common VPAT mistakes

• Filling it in from memory. An ACR must be based on actual testing, including manual testing with assistive technology.
• Testing only the marketing site. Buyers want to know about the product they will use: dashboards, forms, emails and documents.
• Using an outdated edition or standard. If your buyer expects WCAG 2.2, a report against WCAG 2.0 leaves gaps.
• Never updating it. An ACR describes a specific version. Update it when you ship significant changes.
• Hiding known issues. “Partially Supports” with a clear remediation date is far better than a claim that a reviewer disproves in minutes.

How to create an ACR, step by step

1. Define the scope. List the product areas, user roles and platforms you are reporting on.
2. Run automated scans. Scan every in-scope page and template against WCAG 2.2 to find the measurable issues quickly.
3. Test manually. Check keyboard access, focus order, screen reader output, zoom and reflow on your key journeys.
4. Map findings to criteria. Record each finding against the relevant success criterion and decide the conformance level.
5. Write clear remarks. Describe what works, what doesn’t, and your plan to fix it.
6. Fix the quick wins first. Many “Partially Supports” rows can become “Supports” with small changes before you publish.
7. Review and publish. Have someone independent review the report, then share it with buyers or publish it on your trust page.

Frequently asked questions

Is a VPAT legally required?

The VPAT itself is voluntary, but US federal agencies must consider accessibility when buying technology under Section 508, and many state agencies, universities and enterprises now require an ACR before they sign.

How often should I update my VPAT?

Whenever you release significant changes, and at least once a year. Buyers often ask for a report dated within the last 12 months.

Can I write a VPAT myself?

Yes, if you have the testing skills. Many teams combine automated scanning with an expert review so the report is accurate and credible.

Generate your ACR with Reguweb

Reguweb’s VPAT generator turns your audit results into an Accessibility Conformance Report, and our accessibility specialists can review it or carry out the manual testing for you. Combined with daily monitoring, your report stays accurate as your product changes. Talk to an expert about a VPAT, or run a free scan to see where your site stands today.