If you sell software, web apps, or digital products to federal agencies, state governments, or public institutions, a VPAT is almost always part of the procurement process. Agencies use the resulting Accessibility Conformance Report (ACR) to verify your product meets Section 508 requirements before they buy. Without one, your bid is often disqualified before the technical review even begins.
The VPAT itself is the template. The completed document is the ACR. Government buyers ask for a “VPAT” but what they actually evaluate is the ACR you submit alongside it.
| Question | Answer |
|---|---|
| Required for federal contracts? | Yes, in nearly all cases involving ICT (information and communication technology). |
| Which VPAT edition? | Section 508 edition for U.S. federal procurement. INT edition if multiple standards apply. |
| Standard referenced | Revised Section 508, which incorporates WCAG 2.0 Level A and AA for web content. |
| State and local contracts? | Often required. Many states adopt Section 508 or their own accessibility standards. |
| Audit needed first? | Yes. A credible ACR is backed by a manual accessibility evaluation. |
Why Do Government Contracts Require a VPAT?
Section 508 of the Rehabilitation Act requires federal agencies to procure ICT that is accessible to people with disabilities. The VPAT is the documentation vendors use to demonstrate how their product maps to those requirements.
Procurement officers are not accessibility evaluators. They rely on the ACR to confirm a product meets the standard before signing a contract. If the ACR is missing, vague, or self-graded with weak evidence, the bid loses credibility fast.
The federal government spends billions on software and digital services every year. Agencies have to defend their purchasing decisions against accessibility issues raised by employees and the public. A vendor’s ACR becomes part of that defense.
Which VPAT Edition Applies to Government Contracts?
For U.S. federal procurement, the Section 508 edition is the standard request. It maps your product against the Revised Section 508 standards, which reference WCAG 2.0 Level A and AA for web content.
State and local government contracts vary. Some states adopt Section 508 directly. Others reference WCAG 2.1 AA or have their own accessibility statutes. If you sell to multiple jurisdictions, the INT edition covers Section 508, EN 301 549, and WCAG in one document.
When a state RFP says “VPAT required” without specifying an edition, ask the contracting officer. Submitting the wrong edition can stall the review.
What Makes a Government-Ready ACR?
An ACR backed by a real evaluation looks different from one filled out by an internal team guessing at conformance. Government buyers can spot the difference.
A credible ACR includes clear scope statements identifying which product version, pages, or screens were evaluated. It uses honest conformance ratings (Supports, Partially Supports, Does Not Support, Not Applicable) with specific remarks explaining partial support or nonconformance. The evaluation methods reference manual review, not only automated scans. Author attribution and date are included.
Self-rated ACRs that mark every criterion as “Supports” without evidence are a red flag. Procurement teams have seen enough of these to know when one lacks substance.
Do You Need an Evaluation Before the VPAT?
Yes. The ACR documents conformance, but the evaluation is what produces the findings the ACR references. Without an evaluation, the ratings are guesses.
A manual accessibility evaluation identifies issues against each WCAG success criterion. The evaluator reviews each page or screen with assistive technology, keyboard navigation, and code inspection. Automated scans flag approximately 25% of issues, which is why a scan-only approach cannot support a credible ACR.
Once the evaluation is complete, the findings map directly to the VPAT template. Each criterion gets a rating supported by the evaluation data.
What Happens If You Submit an Inaccurate ACR?
Inaccurate ACRs create downstream issues. If the agency buys your product based on claims that turn out to be false, you risk contract termination, removal from approved vendor lists, and reputational damage that affects future bids.
Some agencies require remediation commitments when partial support is documented. An honest ACR with a remediation roadmap is far stronger than an inflated one that sets unrealistic expectations.
Frequently Asked Questions
How much does a VPAT cost for a government contract bid?
Pricing depends on the size and complexity of the product being evaluated. A small web app with a handful of templates costs less than a full SaaS platform with dozens of authenticated screens. The evaluation drives most of the cost; the ACR documentation is a smaller portion.
How long does it take to get a VPAT for a federal contract?
From evaluation kickoff to delivered ACR, expect two to four weeks for most products. Larger applications with more pages or screens take longer. If your bid deadline is close, start the process the moment the RFP is released.
Can a vendor fill out their own VPAT?
Technically yes. Practically, an independently issued ACR carries more weight with procurement teams. A self-issued ACR without supporting evaluation evidence is often discounted or rejected.
Does a VPAT expire?
ACRs do not have a formal expiration date. The recommendation is to update after significant product changes or annually, whichever comes first. An ACR dated three years ago for a product that has shipped major releases since then loses credibility.
What is the difference between a VPAT and Section 508 compliance?
Section 508 is the legal standard. The VPAT is the template used to document how a product maps to that standard. Section 508 compliance is the goal; the ACR is the evidence.
Government procurement is one of the clearest use cases for a VPAT. If you want to win the contract, the ACR needs to be accurate, current, and backed by a real evaluation.
Need a VPAT for an upcoming government bid? Contact Kris Rivenburgh to discuss your project.