If you sell SaaS to enterprise buyers, government agencies, universities, or healthcare systems, you almost certainly need a VPAT. Procurement teams ask for an Accessibility Conformance Report (ACR) early in the evaluation process, and not having one can stop a deal cold. The VPAT is the template. The ACR is the completed document a buyer actually reads. For most enterprise SaaS companies selling into regulated or large-scale buyers, an ACR has become a standard procurement requirement, not a nice-to-have.
| Question | Answer |
|---|---|
| Who asks for a VPAT? | Enterprise procurement, government, higher ed, healthcare, financial services, and large nonprofits. |
| Which edition? | WCAG edition is the default. Section 508 or INT when buyer specifies federal or international scope. |
| Standard to evaluate against | WCAG 2.1 AA is the most common request. Some buyers now ask for WCAG 2.2 AA. |
| What backs the ACR? | A manual accessibility evaluation of the product. Scans alone cannot support an accurate ACR. |
| When to update | After significant product changes or major release cycles. |
Why Enterprise Buyers Ask for a VPAT
Enterprise procurement teams have accessibility obligations of their own. Public sector buyers map to Section 508. European buyers map to EN 301 549 and EAA requirements. Private enterprise buyers often have internal accessibility policies tied to ADA risk and vendor due diligence.
The ACR is how they verify your product can meet those obligations. Without one, the procurement file is incomplete. Some buyers will pause the deal. Others will move to a competitor who already has documentation in hand.
When Is a VPAT Actually Required?
Most B2B SaaS companies hit the VPAT request around the time they move upmarket. The first request usually comes from a government agency, a university, a hospital system, or a Fortune 1000 buyer. After that, requests become routine.
If your sales motion includes any of the following, expect a VPAT request: federal, state, or local government contracts; higher education and K-12 procurement; healthcare systems and payer organizations; financial services and large enterprise IT; and RFPs that include accessibility or Section 508 language.
VPAT vs. ACR: What Buyers Actually Want
The VPAT is a blank template published by ITI. The ACR is what you produce after evaluating your product against the standards in the template. When a buyer says “send us your VPAT,” they mean the completed ACR.
An ACR with vague answers, missing remarks, or blanket “Supports” claims across every criterion gets flagged. Procurement and accessibility reviewers know what an honest report looks like. A thin ACR raises more questions than it answers.
What Goes Into a Credible ACR
A credible ACR is built on a manual accessibility evaluation of the product. The auditor evaluates each WCAG success criterion against the actual interface, identifies issues, and writes remarks that document what was reviewed and where issues exist.
Scans cannot produce this. Scans only flag approximately 25% of issues, and they cannot evaluate context, keyboard flows, screen reader output, or content meaning. A scan-driven ACR is not a real ACR. It is a marketing document, and enterprise reviewers can tell the difference.
Which VPAT Edition Should You Use?
For most SaaS companies, the WCAG edition is the right default. It evaluates the product against WCAG 2.1 AA (or 2.2 AA when requested) and works for most commercial enterprise buyers.
The Section 508 edition adds the federal Revised 508 Standards and is appropriate when selling to U.S. federal agencies. The EN 301 549 edition covers European public sector and EAA-aligned buyers. The INT edition combines all three. If a buyer specifies an edition, follow their lead. If they don’t, WCAG edition covers most enterprise SaaS sales.
How a VPAT Moves the Deal Forward
An honest ACR does three things in a sales cycle. It satisfies the procurement requirement so the deal can move to the next stage. It signals that your company takes accessibility seriously, which matters to buyers with legal exposure. And it gives the buyer’s accessibility team something concrete to evaluate, which speeds up review.
The companies that win enterprise deals consistently treat the ACR as a sales asset, not a compliance afterthought. They keep it current, they map it to a real evaluation, and they’re ready to send it the moment a buyer asks.
Frequently Asked Questions
Can we fill out a VPAT ourselves without an evaluation?
You can, but the result will not hold up. Without a manual accessibility evaluation, you don’t have evidence to support the conformance claims in each row. Enterprise reviewers, especially in government and higher ed, ask for the underlying evaluation or push back on vague remarks. An ACR backed by a real evaluation is what closes deals.
How long does it take to get a VPAT for a SaaS product?
The timeline depends on product scope. A focused web app evaluation and ACR can be completed in a few weeks. Larger platforms with multiple user roles, admin areas, and connected mobile apps take longer. The evaluation is the longest part. The ACR itself is produced after the findings are documented.
Do we need a separate VPAT for our mobile app?
If the mobile app is part of what the buyer is purchasing, yes. The evaluation and ACR should cover every interface in scope, including web app, mobile app, admin console, and any connected products the buyer will use.
How often should we update the ACR?
ACRs don’t have a formal expiration. The recommended practice is to update the ACR after significant product changes, major releases, or when the buyer asks for a current document. Many SaaS companies refresh the evaluation and ACR annually to keep pace with product changes.
Will a VPAT prevent an accessibility lawsuit?
A VPAT is a procurement document, not legal protection. What reduces legal risk is the underlying work: a real evaluation, remediation of identified issues, and ongoing accessibility practice. The ACR documents that work. It is not a substitute for it.
If you’re selling SaaS into enterprise accounts and procurement is asking for a VPAT, the path is clear: get an accessibility evaluation, produce an honest ACR, and make it part of how you sell.
Contact Kris for help with your VPAT and enterprise SaaS accessibility strategy.