What is a VPAT? The template, the report it becomes, and what to do when a buyer asks for one

A buyer's procurement office writes: "Please send your VPAT." You have never heard the word, or you have heard it and assumed it was a form you could fill in over lunch. This article is the explanation we wish every vendor had before that email arrived: what the word means, what the document is, who asks for it and why, what a good one looks like, what a bad one costs you, and the three ways to get one.

The word, and the document it points at

VPAT stands for Voluntary Product Accessibility Template. The Information Technology Industry Council (ITI), a trade association of technology companies, publishes it as a free Word document. "Voluntary" means no law requires a vendor to fill one in; "template" means it is blank. It is a form, with a fixed set of tables, that asks one question per accessibility criterion: does this product meet it, partly meet it, or not meet it, and what are the details?

The thing your buyer actually wants is the filled-in version. ITI calls that an Accessibility Conformance Report, an ACR. The ACR is the vendor's declaration, for one product at one version on one date, of how that product performs against a named accessibility standard. In practice the two words are used interchangeably. Procurement officers say "VPAT" when they mean "your ACR", and nobody will correct you if you send a document with "Accessibility Conformance Report" on the cover. We say VPAT when we mean the template and ACR when we mean the report, and this article keeps that distinction because it makes the rest clearer.

The template has been through several versions. The current one is VPAT 2.5Rev, dated April 24, 2025, and it comes in four editions that differ only in which standards their tables cover:

Every edition has the same shape: a product-information section, a section of defined terms, the tables, and an optional legal disclaimer. Our guide to reading an ACR walks through each part from the buyer's side.

Why buyers ask for it

Accessibility obligations sit on the buyer, not on you. A U.S. federal agency must, under Section 508 of the Rehabilitation Act, buy information and communication technology that people with disabilities can use. A public university has the same duty under Section 504 and, from 2027, under the Department of Justice's ADA Title II web rule. An EU ministry has it under the Web Accessibility Directive, and a bank or an online shop in the EU has had it since June 28, 2025 under the European Accessibility Act. None of those buyers can test every product they consider. So they push the question down to the vendor and ask for the vendor's answer in a standard format they can compare across bids.

That is the whole purpose of the template: comparability. Three vendors, three reports in the same tables with the same five conformance labels, and a procurement officer can put them side by side in an afternoon. A report in a different format, or a vendor who answers "we take accessibility very seriously" instead of sending one, loses the comparison by default.

The buyer's reviewer, who may be an accessibility specialist or may be a contracts officer with a checklist, is looking for four things in roughly this order: that the report exists; that it is recent and names the product version in front of them; that its conformance levels are believable; and that its remarks explain the gaps. The last two are where most vendor-written reports fail.

What the tables actually ask

Each table row is one success criterion of the standard. For WCAG 2.2 there are 55 criteria at Levels A and AA, the levels buyers care about, plus 31 at AAA that are rarely required. For each row the report gives one of five conformance levels, defined by the template itself:

Beside every level is a remarks column. The template asks for remarks on every row, and it asks specifically that a Partially Supports or Does Not Support row explain which functionality fails and how. The remarks are the report. A reviewer who sees fifty rows of Supports with empty remarks has learned nothing except that the vendor did not want to say anything, and treats the report accordingly.

One more thing the tables ask for, and that most vendors skip: the evaluation methods. The product-information section has a field for how the report was produced. Who tested, with what tools, on which pages or screens, with which assistive technologies, on what date. A report that states its method honestly, including what it did not do, is worth more to a reviewer than one that claims everything and documents nothing.

What a credible ACR looks like

Having prepared and reviewed a good many of these, here is what separates a report a procurement office accepts from one it sends back:

• It names the product and version, and the date. A report for "Acme Platform" with no version and no date is a report for nothing.
• It names the standard and the edition. WCAG 2.2 Level A and AA, or the Revised 508 Standards, or EN 301 549. Not "accessibility guidelines".
• It states the evaluation method. Pages tested, tools used, whether manual assistive-technology testing was done and with what. If it was not done, the report says so.
• It has a mix of levels. Real products have gaps. A report with Partially Supports on contrast, target size, focus visibility and form labels, with specific remarks, reads as true. A report with Supports on every row reads as unexamined.
• Its remarks are specific. "Partially Supports: the date picker in the booking flow cannot be operated by keyboard; all other controls can" is a remark. "Minor issues" is not.
• It uses Not Applicable sparingly and explains it. A product with no audio has nothing to caption, and the row says so. A product with video marked Not Applicable on captions is hiding something.
• It uses Not Evaluated only at Level AAA. The template permits nothing else, and a Level A or AA row marked Not Evaluated is a defect in the report.
• It is signed by the vendor. Even when a third party prepared it, the vendor adopts it and publishes it under its own name, because it is the vendor's declaration to the buyer.

The myths that cost vendors deals

"VPAT certification." People search for this phrase every month, and companies sell it, and it does not exist. Nobody certifies ACRs: not ITI, which publishes the template, not the U.S. Access Board, which writes the 508 Standards, not the GSA, which runs Section508.gov. A report records what an evaluation found on a date. The right word for a third-party report is "prepared by", and the report should say who.

"A VPAT makes us legally safe." It does not. An ACR is a statement of fact about a product. If the statement is false, it is worse than no statement, because the buyer relied on it. The protection a vendor gets from an honest ACR is commercial: the deal closes, and the buyer knows what it is getting.

"We only need it once." Buyers expect a report for the version they are buying and treat anything older than a year, or older than the last major release, as stale. The report has a date on it for that reason.

"All Supports is the goal." The goal is a true report. A vendor who ships an all-Supports report for a product with visible gaps has told a procurement office something it can disprove with one screen reader session, and vendors do get caught that way.

"The VPAT is just for websites." The template covers every kind of information and communication technology: software, SaaS, mobile apps, hardware, documents. Websites are the most common subject today, but a buyer will ask for a report on a desktop application or a PDF manual just as readily.

The three ways to get one

Fill it in yourself. The template is free and the standard is public. The cost is time and expertise: fifty-five criteria, each of which has to be tested against the real product, with remarks written for the ones that fail. Done honestly by someone who knows WCAG, it takes days. Done dishonestly in an afternoon, it produces the all-Supports report above, and it is the vendor's name on it. If you take this route, our article on filling out a VPAT honestly is the method.

Hire an accessibility consultancy. The large vendors do thorough work and usually bundle the report into an annual platform contract that opens with a discovery call. If you need a programme, that is the right buy. If you need one document this month, it is a slow and expensive way to get it.

Order a report at a fixed price. This is what we do. Every page of the product in scope is tested in a real browser, every WCAG criterion is assessed from the evidence with remarks, and an accessibility analyst reviews the report before it is released, in three business days, from $749 for the WCAG edition. The report states exactly what was tested and what was not, including that manual assistive-technology testing is not part of the method, so the buyer can trust what it reads. You adopt the report and publish it as your own declaration, which is what the template intends. The sample reports show what you would receive.

Whichever route you take, the test of the result is the same one the buyer will apply: does this report tell me, specifically and truthfully, how this version of this product performs against this standard on this date? If it does, send it with confidence. If it does not, you do not have a VPAT yet; you have a form with words in it.