Anatomy of an accessibility-aware RFP — five real procurement-language sections, clause by clause

A request-for-proposal lives or dies in the accessibility section the way a contract lives or dies in the indemnity clause. We pulled five real RFP excerpts from public-tender archives and corporate procurement portals, anonymised the issuing entities, and tore each one down clause by clause. The strongest section — a US federal solicitation citing Section 508 with explicit WCAG 2.1 AA reference — ran to 612 words. The weakest — a Fortune 1000 boilerplate that asked vendors to be “compliant with applicable laws” — ran to 31. Across the five samples, three loopholes appeared in four of the five documents. One Member State’s tender required a VPAT but did not require it be filled out by a third party. This is the teardown.

How the five RFPs were sampled and anonymised

The five documents in this teardown were drawn from three public sources and two corporate procurement portals. The federal solicitation came from a SAM.gov posting closed in 2025; the state RFP from a midwestern state’s open-procurement portal closed in 2024; the EU Member-State tender from TED (Tenders Electronic Daily); the Fortune 500 corporate RFP from a vendor-NDA-released excerpt shared by a respondent who chose to remain anonymous; the boilerplate from a Fortune 1000 supplier-onboarding pack that ships with every supplier agreement at that company.

We removed contract numbers, agency names, and any phrasing that uniquely identified the issuer. We did not paraphrase. Every clause quoted below is verbatim from the source, with redaction limited to identifying nouns (“[Agency]”, “[State Department]”, “[Member State]”). The point of the teardown is the language; the language is preserved.

Sample A: the US federal solicitation

The federal sample is the strongest of the five and sets the upper benchmark for the dataset. It runs 612 words across nine numbered subclauses. It cites Section 508 of the Rehabilitation Act, references the 2018 ICT Refresh, and incorporates WCAG 2.0 AA by reference (per the Refresh) while explicitly upgrading the floor to WCAG 2.1 AA for any web or mobile deliverable. The acceptance criteria are concrete: a VPAT 2.5 ACR prepared or independently reviewed by an accessibility-qualified party, testing with at least one named screen reader, and a remediation commitment for post-award defects.

This clause is strong because it does three things at once. It names the deliverable (VPAT 2.5 ACR). It names the qualification (CPACC, WAS, or equivalent). And it names the testing surface (one screen reader, one voice-input, keyboard-only). The clause leaves no room for a vendor to file a checkbox-completed ACR and call it done.

The single weakness in Sample A: the remediation timeline. The federal section references “prompt remediation” and “within a reasonable period” — neither defined. A vendor with a defect notice can argue indefinitely about what “reasonable” means. The model section at the end of this teardown closes that gap.

Sample B: the US state procurement

The state sample is competent but thinner than the federal. It runs 287 words across five subclauses. It cites Section 508 by reference, anchors to WCAG 2.1 AA, and requires a VPAT — but does not require the VPAT be independently reviewed. It also does not name any assistive technology for testing. The clause is anchored in the right standards but does not enforce the discipline that produces a useful artefact.

“May be prepared by the Vendor or its agents” is the loophole sentence. The state has, in writing, accepted a vendor-completed self-attestation as a substitute for an independently-prepared conformance report. The state has also reserved a right (“may request remediation”) without a corresponding obligation on the vendor (“shall remediate within N days”). Reserved rights without timelines are not enforceable schedules.

Sample C: the EU Member State tender

The EU Member State sample is the most interesting of the five. It cites EN 301 549 v3.2.1 — the harmonised European standard for ICT accessibility — and references Directive (EU) 2019/882 (the European Accessibility Act) and Directive (EU) 2016/2102 (the Web Accessibility Directive). It is also the only RFP in the dataset that ties a payment milestone to a conformance deliverable.

Clause 9.5 is the strongest single sentence in the entire dataset. A 15 percent payment-withholding mechanism keyed to independent verification is what turns a written acceptance criterion into an enforceable one. The vendor cannot collect final payment until the report is filed and verified. This is the model the federal and state samples should have written.

The single weakness in Sample C: it anchors to EN 301 549 v3.2.1, which incorporates WCAG 2.1 — not 2.2. The success criteria added in 2.2 (focus appearance, dragging movements, target size minimum) are therefore not contractually required even on tenders dated 2026.

Sample D: the Fortune 500 corporate RFP

The Fortune 500 corporate sample is the second-strongest in the dataset and the second-longest. It runs 421 words. It requires a VPAT 2.5 ACR, anchors to WCAG 2.1 AA, and references the company’s internal “Accessible Procurement Standard” (anonymised). It does not name assistive technology by product, but it does require “compatibility with widely-used screen readers and voice-input solutions.”

The corporate section is interesting for what it adds and what it omits. It adds an indemnity clause: the vendor indemnifies the company against any third-party accessibility-discrimination claim arising from the vendor’s deliverable. This is a procurement-flavoured equivalent of the contractual risk-shift used in data-processing agreements. It omits, however, any payment-withholding mechanism. The indemnity is the lever, not the milestone.

Sample E: the boilerplate

The boilerplate is one sentence. We quote it in full.

“All applicable laws” is the everywhere-and-nowhere clause. It anchors to no standard. It names no deliverable. It cites no testing surface. It is a placeholder that satisfies the legal team and binds the supplier to nothing actionable. A vendor in breach can argue that no specific obligation was identified, and the procurement team has no evidence engine to produce.

The boilerplate clause is everywhere because it has zero cost to write and zero friction to negotiate. It is also worth approximately nothing.

The three loopholes that appear in four of five

Across the five samples, three patterns recurred. First: self-attested VPAT acceptance (4 of 5). Second: missing remediation timeline (5 of 5). Third: silence or vagueness on assistive-technology testing (4 of 5, only the federal sample names AT by product). These three gaps are the holes through which a non-conforming deliverable can pass into production.

A model accessibility-aware RFP section

Combining the strongest clauses from the five samples produces a section that no single document in the dataset actually contains. It runs approx. 350 words and closes the three loopholes identified above.

This model clause does five things the dataset’s strongest single sample, the federal one, does only three of. It anchors to WCAG 2.2 (not 2.1). It names assistive technology by product. It requires independent VPAT review. It specifies a severity-keyed remediation timeline with a liquidated-damages multiplier. And it ties the final payment tranche to verified conformance. Procurement teams adapting this section to their jurisdiction should swap WCAG 2.2 for WCAG 2.1 only if their governing standard has not yet upgraded; otherwise the 2.2 anchor is correct.

What the dataset tells procurement teams to do next

The headline finding from this teardown is unflattering and operationally useful. Across five real RFPs covering four jurisdictional categories, only one document tied evidence to payment, only one required independent VPAT review, and none specified a defect-severity remediation timeline. The standards exist. The contract language to enforce them does not.

For procurement teams writing their next accessibility-aware RFP, the dataset suggests three concrete edits and one strategic shift. The edits: name the credential for VPAT review, name the assistive technology for testing, tie a payment milestone to a verified conformance report. The shift: stop mirroring the standard. Anchor to WCAG 2.2 AA today; revisit to WCAG 3.0 when the first formal Recommendation lands.

And the boilerplate sentence — “compliant with all applicable laws” — has no place in an accessibility-aware RFP. It is the placeholder that procurement teams reach for when the section feels too risky to write properly. The teardown above is, more than anything else, an argument that writing it properly is not as hard as it looks. Five clauses, three loopholes closed, one payment lever attached. That is the work.

Procurement teams adapting this language: anchor the standard reference to the full WCAG 2.2 success-criteria index, ask vendors to run a free WCAG 2.2 scan on the demo URL they cite in their response, require a manual audit by testers with disabilities as the verified-conformance check, and treat ongoing post-award compliance as a continuous obligation covered in the monitoring buyer’s guide.