Here are six questions to ask a vendor who hands you one of these reports, to check to see if they did the due diligence they’re claiming.

An Accessibility Conformance Report, or ACR, is the document companies hand over when proof of accessibility is demanded, whether by a demand letter, a procurement checklist, or a board review. They have a logo, a table full of “Supports” ratings, and the reassuring weight of paperwork. 

Unfortunately, an ACR is not an inspection result. It’s a self-reported form, and pages named in your demand letter may not have actually been tested.

Six questions that expose a recycled report

Hand a vendor or an outside firm these six questions before accepting their conformance report as protection. Each has a specific, checkable answer, and a vendor who can’t produce one is telling you something.

  1. Which specific pages, templates, or user flows were tested, and how many URLs does that represent out of the total site?
  2. What share of testing was automated scanning versus manual keyboard and screen reader testing, and which screen reader and browser pairs were used?
  3. Who performed the audit, what is their name or firm, and do they hold an IAAP CPACC or WAS credential?
  4. Can the list of individual issues, including severity ratings, be produced on request?
  5. Did people who use assistive technology daily complete real tasks, such as signing up for an account or checking out, during testing?
  6. What WCAG version and level was tested against, and does it match what’s currently required in the relevant jurisdiction?

If they struggle to answer these questions, you may have been given a template with your name and logo swapped in.

VPAT vs. ACR

The Voluntary Product Accessibility Template, or VPAT, is the blank form. The Information Technology Industry Council maintains it and publishes it in separate editions matched to different standards: one for WCAG, one for Section 508, one for the European EN 301 549, and an international edition that covers all three at once. A vendor picks the edition that matches the market they’re selling into.

An Accessibility Conformance Report is what that form becomes once someone fills it in for a specific product, at a specific version, on a specific date.

Both exist because of a practical problem: Section 508 requires federal agencies to weigh accessibility when they buy technology, and an agency can’t test every candidate product line by line before every purchase. The VPAT gives vendors a standardized way to disclose where a product stands, and the ACR is the disclosure itself. State and local governments, universities, and private companies later adopted the same format for their own procurement, mostly because no better standardized alternative existed, not because it was necessarily the best way to do it.

Untested pages

Auditors don’t test every URL. They test a sample of page templates, usually the homepage, a product or article page, checkout or a contact form, and treat that sample as representative of everything built from the same code. That’s a reasonable shortcut at the budgets most audits run on.

The VPAT’s “Evaluation Methods Used” field exists to disclose what was sampled in the audit. Published ACRs routinely write “representative sample” and stop there, with no page list, no count, no explanation of why those pages were chosen over others. Section508.gov’s guidance for federal buyers treats this field as central to evaluating an ACR’s credibility, precisely because it’s the part vendors most often leave thin.

A vague entry there means the vendor probably can’t say what got checked.

Ask for the literal list of the URLs or templates tested, not a category description. Then compare that list against the paths people depend on to sign in, pay, or book an appointment, and see how they compare.

The 2024 DOJ rule that outdates older reports

The Department of Justice’s Title II final rule, published in the Federal Register on April 24, 2024, sets a codified technical standard that state and local government web content and mobile apps must conform to WCAG 2.1 Level AA. Public entities serving populations of 50,000 or more faced an initial compliance deadline of April 24, 2026, which the Department of Justice extended shortly before it took effect. Smaller entities and special district governments still face an April 26, 2027 deadline, absent a similar extension.

An ACR written before that rule existed was tested against a different bar than the one that now applies.

Vendors built a large share of ACRs still in circulation against WCAG 2.0 or an older Section 508 baseline, or marked “Partially Supports” on criteria specific to 2.1, like reflow and orientation. 

A report a procurement office accepted two years ago may already fail the standard its own agency is now legally bound to. 

This obligation runs through Title II, and it binds public entities only. Private businesses fall under Title III, where litigation still runs on the ADA’s general effective-communication language rather than a codified technical standard like WCAG 2.1 AA. A private-sector vendor citing the 2026 or 2027 deadline as their own compliance clock has either misread the rule or is hoping the reader will.

Continuous monitoring

A conformance report is dated the moment it’s signed, and the site underneath it keeps shipping code (which is simply a fact about software rather than a knock on the auditor’s work).

Every deployment after the report is filed is untested by that report. Layering continuous automated monitoring on top catches new regressions as they enter production, rather than a year later when another audit gets scheduled.

Automated monitoring alone isn’t perfect though, and still misses whether someone can finish a task, so it needs periodic testing with people who use assistive technology daily to check that important user flows still work end to end. Research on continuous monitoring in enterprise systems states the obvious, that catching problems near the point of introduction reduces risk more than periodic point-in-time review alone. 

The vendors that build both automated scanning tools and human-led testing services are usually explicit about which layer catches what, since relying on only one layer has led customers to fail procurement reviews or face litigation anyway.

References

  1. ADA.gov. (2024). Fact sheet: New rule on the accessibility of web content and mobile apps provided by state and local governments. In ADA.gov. https://www.ada.gov/resources/2024-03-08-web-rule/ 
  2. Digital Accessibility, & Zennermann, E. (2024). Key takeaways from WebAIM’s screen reader user survey #10 – digital accessibility. In Digital Accessibility. https://www.rochester.edu/digital-accessibility/key-takeaways-from-webaims-screen-reader-user-survey-10/ 
  3. Extension of compliance dates for nondiscrimination on the basis of disability; accessibility of web information and services of state and local government entities. (2026). In Federal Register. https://www.federalregister.gov/documents/2026/04/20/2026-07663/extension-of-compliance-dates-for-nondiscrimination-on-the-basis-of-disability-accessibility-of-web 
  4. Federal digital accessibility requirements. (2025). In Accessibility. https://accessibility.ncsu.edu/digital-accessibility/federal-digital-accessibility-requirements/ 
  5. Federal register :: Request access. (n.d.). In unblock.federalregister.gov. Retrieved August 12, 2026, from https://www.federalregister.gov/documents/2024/04/24/2024-07758/nondiscrimination-on-the-basis-of-disability-accessibility-of-web-information-and-services-of-state 
  6. Section508.Gov. (2017). In Section508.gov. https://www.section508.gov/sell/acr-vpat-faq/ 
  7. Texas A&M University-Corpus Christi. (2026). Completing an accessibility conformance report. Texas A&M University-Corpus Christi. https://www.tamucc.edu/information-technology/accessibility/vendor/vpat-how-to.php 
  8. W3C. (2025). Web content accessibility guidelines (WCAG) 2.1. In W3.org. https://www.w3.org/TR/WCAG21/ 
  9. Xu, J. (n.d.). Advancing continuous monitoring and auditing: Integrating emerging technologies for enhanced business risk management and financial integrity. Retrieved August 12, 2026, from https://rucore.libraries.rutgers.edu/rutgers-lib/75215/PDF/1/play/