What is the difference between a VPAT and an ACR?

The VPAT is the blank template; the ACR (Accessibility Conformance Report) is the completed document. Colloquially, almost everyone says VPAT for both, and buyers asking for "your VPAT" mean the finished report.

Is a VPAT legally required?

The template itself is voluntary, but Section 508 conformance is mandatory in US federal procurement, and the VPAT/ACR is the standard way to demonstrate it. No VPAT usually means no federal deal. State, education, and enterprise buyers increasingly mirror the requirement.

How much does a VPAT cost?

The template is free. Third-party audit firms typically charge $3,000-15,000 to test and author one, depending on product size. Doing it in-house costs testing time; continuous scanning plus targeted manual testing brings the effort down dramatically for updates.

How often should a VPAT be updated?

After any major release that changes the UI, and at least annually. A VPAT dated three years ago reads as stale to procurement reviewers and invites re-testing demands.

Can automated scanning alone produce a VPAT?

No. Automated checks cover roughly a third of WCAG criteria (though the majority of real-world issues by volume). A credible ACR states which criteria were verified automatically, which manually, and with what assistive technology.

What is a VPAT, and who needs one?

A VPAT (Voluntary Product Accessibility Template) is a standardized document that describes how well a software product or website conforms to accessibility standards. If you sell software to the US government, to public universities, or to large enterprises, procurement teams will ask for one before they sign.

The completed document is formally called an ACR (Accessibility Conformance Report). In practice, people use "VPAT" for both the blank template and the finished report. The template itself is published by the Information Technology Industry Council (ITI) and is free to download; the work is in testing your product honestly and filling it in accurately.

The four VPAT editions, and which one you need

VPAT 508 maps your product against the Revised Section 508 standards and is what US federal procurement expects. VPAT EU maps against EN 301 549, the European standard the EAA and public-sector rules point at. VPAT WCAG maps directly against WCAG 2.x success criteria. VPAT INT combines all three and is the safe choice if you sell internationally: fill it once, answer everyone.

How to fill one in without creating legal exposure

Every row asks for a conformance level: Supports, Partially Supports, Does Not Support, or Not Applicable. The most common mistake is marking everything Supports without testing; procurement reviewers see through it, and a false claim in a procurement document is far worse than an honest Partially Supports. Test each criterion, record what you found, and describe known gaps in the remarks column with a remediation timeline. An honest, specific VPAT wins deals against a perfect-looking one that cannot survive questions.

What testing should back a VPAT

A defensible ACR combines automated scanning (covers criteria like contrast, alt text, ARIA validity, and name/role/value at scale), manual keyboard and screen-reader testing for the criteria automation cannot judge, and dated records of both. Keeping a timestamped scan history means your next VPAT update is an afternoon of review instead of a from-scratch audit.

Compliance checklist

Download the current VPAT edition from ITI (use INT if you sell in both the US and EU)
Run an automated WCAG scan across representative screens of your product
Manually test keyboard navigation and a screen reader on your core flows
Mark each criterion honestly: Supports, Partially Supports, Does Not Support, or Not Applicable
Use the remarks column to describe gaps and remediation plans specifically
Date the report, name the evaluation methods used, and set a reminder to refresh it after major releases

Frequently asked questions

What is the difference between a VPAT and an ACR?: The VPAT is the blank template; the ACR (Accessibility Conformance Report) is the completed document. Colloquially, almost everyone says VPAT for both, and buyers asking for "your VPAT" mean the finished report.
Is a VPAT legally required?: The template itself is voluntary, but Section 508 conformance is mandatory in US federal procurement, and the VPAT/ACR is the standard way to demonstrate it. No VPAT usually means no federal deal. State, education, and enterprise buyers increasingly mirror the requirement.
How much does a VPAT cost?: The template is free. Third-party audit firms typically charge $3,000-15,000 to test and author one, depending on product size. Doing it in-house costs testing time; continuous scanning plus targeted manual testing brings the effort down dramatically for updates.
How often should a VPAT be updated?: After any major release that changes the UI, and at least annually. A VPAT dated three years ago reads as stale to procurement reviewers and invites re-testing demands.
Can automated scanning alone produce a VPAT?: No. Automated checks cover roughly a third of WCAG criteria (though the majority of real-world issues by volume). A credible ACR states which criteria were verified automatically, which manually, and with what assistive technology.