If a buyer has asked you for a VPAT and you're not sure what that is, here's the short version.
What does VPAT stand for?
Voluntary Product Accessibility Template.
It's a document format, created by the Information Technology Industry Council, that vendors use to report how accessible their product is.
The terminology trips people up. The blank template is the VPAT. The completed document is technically an Accessibility Conformance Report, or ACR. In practice everyone calls the finished thing a VPAT, and if a buyer asks for one, they mean the completed report.
What does voluntary mean here?
It means no law requires you to produce one.
It does not mean it's optional. Buyers require it. If a US federal agency, a university, a hospital, or a large enterprise is evaluating your product and you can't produce a VPAT, you frequently can't bid.
Voluntary describes the template, not the commercial reality.
Who needs one?
Anyone selling software, a website, or digital content into a buyer with accessibility procurement rules.
Most commonly:
- US federal agencies, under Section 508
- State and local government
- Universities and colleges
- Hospitals and health systems
- Large enterprises with their own accessibility policies
Canadian vendors selling into the US market run into this constantly. It's one of the most common reasons a Canadian organization ends up needing to understand American accessibility law.
What goes in a VPAT report?
The document walks through each criterion in the relevant standard and assigns a conformance level:
- Supports. Meets the criterion.
- Partially Supports. Meets some of it, with exceptions.
- Does Not Support. Doesn't meet it.
- Not Applicable. The criterion doesn't apply to this product.
Every criterion that isn't Supports needs a remark explaining what's going on.
There are different editions of the template depending on which standard you're reporting against: WCAG, Section 508, EN 301 549 for Europe, or an international edition covering all of them.
The mistake people make
Claiming Supports everywhere.
Buyers who take accessibility seriously read the remarks column, not the conformance column. A VPAT claiming full support across the board reads as a document nobody tested. A VPAT that says Partially Supports with a clear explanation and a remediation timeline reads as a vendor who knows their product.
The second one wins deals. The first one gets you disqualified when someone tests the claim.
A VPAT is also a representation about your product. Overstating it is a worse position than a bad score.
How VPAT, Section 508, and WCAG fit together
They stack:
- WCAG is the technical standard. It defines what accessible web content means.
- Section 508 is US law. It requires federal agencies to buy accessible technology, and it incorporates WCAG 2.0 Level AA by reference.
- VPAT is the reporting document. It's how you tell a buyer where you stand against those standards.
WCAG is the ruler. Section 508 is the rule. The VPAT is the report card.
Getting one done
A VPAT is only as good as the testing behind it. Filling one out without auditing the product first produces a document that's wrong, and being wrong in a procurement document is worse than being honest about gaps.
The sequence is: audit, remediate what you can, then document what's left honestly.
Pragmatica has been building websites for Canadian non-profits, charities, and associations since 2004. If you need to understand where your product stands, get in touch.
