A customer asked for a VPAT: what small businesses need to know about accessibility conformance reports

If you sell software, an online service or a website build to a school district, a public body or a larger company, sooner or later someone in procurement asks: "Can you send your VPAT?" Here is what that means in plain English, so you can answer honestly and without paying for something you don't need.

VPAT vs ACR

The VPAT® (Voluntary Product Accessibility Template) is a free Word template from the Information Technology Industry Council (ITI). Once you've tested your product and filled the template in, the finished document is called an Accessibility Conformance Report, or ACR. When a buyer asks for "a VPAT" they almost always mean your completed ACR.

Which edition to use

ITI publishes four editions of the current version, VPAT 2.5Rev (April 2025):

• 508: the revised US Section 508 standards, used by US federal agencies (it includes WCAG 2.0).
• EU: EN 301 549, used for public procurement in Europe (it includes WCAG 2.1).
• WCAG: WCAG 2.0, 2.1 and 2.2.
• INT: all three of the above in one report.

If the request or solicitation names a standard, use the edition that matches it. If it doesn't, ask the buyer which one they want rather than guessing. Download the templates from ITI's VPAT page.

What goes in it

For each criterion you mark one of four levels: Supports, Partially Supports, Does Not Support or Not Applicable, and you explain each one in a remarks column. There is also a product description, an "evaluation methods used" field and notes. "Partially Supports" with a clear, specific remark ("Two icon buttons on the settings page have no accessible name; fix planned for the March release") is far more useful to a buyer than a report that says "Supports" everywhere.

Who fills it in, and is there a certification?

According to ITI, the product owner is usually the best person to complete it, ITI does not review or approve VPATs, and there is no VPAT certification, pass mark or logo. A third-party review is optional, unless the buyer's solicitation requires one, so read the request and ask the buyer if it's unclear. Be wary of anyone selling a "VPAT certificate".

What testing it needs

An honest ACR rests on real testing of each criterion, which means a mix of:

• Automated checks (axe-core, Lighthouse, WAVE) for things a tool can measure, such as missing alt text, unlabelled fields, unnamed buttons, contrast it can compute, page language and titles.
• Keyboard testing: can you reach and use everything with Tab, Enter, Space and Escape, and see where you are? See our keyboard test.
• Screen reader testing with NVDA, VoiceOver or JAWS. See our screen reader guide.
• Zoom and reflow at 200% and 400%, and on a small phone screen.
• Manual review of things no tool can judge: whether alt text is accurate, whether error messages make sense, captions, documents and logins.

Automated tools catch only part of what WCAG asks for, so an ACR built only on a scan will overstate how accessible a product is. Write in "evaluation methods used" exactly what you tested, with which tools and on which pages or screens.

A simple plan for a small team

1. List the pages or screens the buyer will actually use (sign-up, login, the main workflow, help pages).
2. Run an automated scan of those pages and fix what it finds first. They're usually the quickest wins.
3. Do the keyboard, screen reader and zoom checks on the same pages and note each problem.
4. Fill in the template edition the buyer asked for, criterion by criterion, with honest levels and specific remarks.
5. Date it, name the product version, and update it after major changes.

Where Altwise fits, and where it doesn't

Our $149 Fix-Pack is an automated axe-core scan of up to 10 pages with copy-paste fixes for your platform. It can help with step 2: finding and fixing the automated issues before you test by hand. It is not an ACR, it doesn't fill in the VPAT for you, and it doesn't cover the keyboard, screen reader and manual checks above. If a buyer needs a full third-party ACR, you'll want an accessibility firm that does manual testing.

Start with a free homepage snapshot to see what an automated scan picks up, or read what an accessibility audit includes and what audits cost.

This is general technical information, not legal or procurement advice. It does not certify compliance with Section 508, the ADA, EN 301 549 or any law. VPAT is a registered service mark of the Information Technology Industry Council.

Related guides

• GoDaddy website builder accessibility fixes (Websites + Marketing)
• WCAG 2.2 explained for small-business websites
• Squarespace accessibility fixes: alt text, contrast, forms and more
• Wix accessibility fixes: a practical checklist

All guides

This guide is general technical information, not legal advice. Following it does not certify ADA or any legal compliance. Automated checks find only part of accessibility barriers.