Section 508 in 2026: where the refresh landed and what's still pending

Image description: The US Capitol Building dome catches warm light at golden hour from a low angle, with a partial American flag and soft-focus spring foliage in the foreground — an institutional anchor for federal-procurement reporting.

Reading Time: 12 minutes

Section 508 of the Rehabilitation Act of 1973 is the federal procurement statute that requires US executive-branch agencies to buy, build and use information and communication technology (ICT) that is accessible to employees and members of the public with disabilities. It is a procurement rule, not a civil-rights statute in the Americans with Disabilities Act sense — it binds the government’s purchasing power rather than the private market. Since the 2017 refresh (the “Section 508 Refresh,” 82 Fed. Reg. 5790, 18 January 2017, effective 18 January 2018), the technical requirements have been harmonised with WCAG 2.0 Level A and AA, aligned with the European EN 301 549 standard, and restructured around functional performance criteria that apply across hardware, software, web content and documentation.

Nine years on, Section 508 is overdue for a second refresh. WCAG 2.0 is now three minor versions behind the current W3C standard (2.1 from 2018, 2.2 from 2023); the federal procurement footprint has expanded to cover AI systems, automated decision tools, and cloud-hosted SaaS that the 2017 rule barely contemplated; and the US Access Board issued a 2025 Request for Information asking how the standard should be updated. This primer covers what Section 508 actually requires in 2026, how it differs from Section 504 (the federally-funded entity rule that HHS substantially rewrote in 2024), and what is pending in the next rule-making cycle.

What Section 508 is in 2026

Section 508 was added to the Rehabilitation Act by the Workforce Investment Act of 1998, replacing an earlier 1986 provision that had little practical bite. The 1998 amendment gave the law two teeth that the 1986 version lacked: it required the Access Board to issue binding technical and functional standards within 18 months, and it gave federal employees and members of the public a private right of action against the procuring agency for non-compliance. The first standards took effect in 2001. They served the federal acquisition system for sixteen years, until the 2017 refresh rewrote them around WCAG.

In its current 2026 form, Section 508 binds every federal executive-branch agency — and, by reference, federal contractors selling to those agencies — to ensure that ICT they develop, procure, maintain or use is accessible to people with disabilities, unless doing so would impose an undue burden or unless the agency claims a national-security exemption. The statute defines ICT broadly: websites, mobile applications, electronic documents, software, hardware, multimedia, telecommunications, kiosks, self-service transaction machines, and increasingly cloud-hosted services. The rule does not apply to ICT used in intelligence activities, cryptologic activities related to national security, command-and-control of military forces, or weapons systems — the so-called national-security exemption codified at 29 USC § 794d(a)(5).

The GSA-led Section 508 program

The General Services Administration (GSA) runs the operational arm of Section 508 through its Office of Government-wide Policy. GSA does not write the standards — that is the Access Board’s role — but it owns the Section508.gov portal, publishes the Accessibility Requirements Tool (ART) used to scope solicitations, maintains the Trusted Tester programme that certifies federal accessibility testers under the DHS Trusted Tester methodology, and convenes the Chief Information Officers Council’s Accessibility Community of Practice (CIO-C Accessibility CoP). The CIO-C body’s annual government-wide Section 508 assessment report, mandated by the OMB Memorandum M-13-09 framework, is the closest thing to a federal accessibility scorecard.

GSA’s day-to-day work is procurement-facing. Federal contracting officers must include Section 508 conformance language in solicitations, evaluate vendor accessibility conformance reports (typically VPAT-format documents based on the ITI VPAT 2.5 Rev 508 template), and address conformance gaps in award decisions. Where conformance is not feasible, the agency must document a market research finding and apply the undue-burden or commercial-non-availability provisions — both of which require written justification and senior-official sign-off. The procurement gate is the place Section 508 has its sharpest practical bite.

What the 2017 refresh actually changed

The 2017 refresh was a structural rewrite, not a parameter tweak. It changed three things at the same time, and it is worth keeping the three apart because they have aged differently.

Harmonisation with WCAG 2.0 AA

First, the refresh replaced the 2001 “1194.22” web-content requirements (a custom set of sixteen provisions written before WCAG 1.0 was widely deployed) with a direct incorporation of WCAG 2.0 Level A and AA as the technical standard for web content, electronic documents and software with user interfaces. The Access Board did not rewrite WCAG into its own language: it incorporated WCAG 2.0 by reference. That move had three practical effects. Federal accessibility testing converged on the same success criteria the private market was already using. Vendors selling to federal agencies stopped maintaining two parallel conformance reports. And the standard inherited WCAG 2.0’s stability — but also its limitations, including the absence of the touch-target, dragging-motion and authentication-cognition success criteria added in WCAG 2.1 and 2.2.

Alignment with EN 301 549

Second, the refresh aligned the structure of the US standard with the European EN 301 549 standard for ICT procurement, which ETSI, CEN and CENELEC had published in 2014 as the technical backbone of the EU’s procurement-accessibility regime and which is now the technical reference for the European Accessibility Act. The two standards do not match clause-for-clause, but they share the same architecture: WCAG 2.0 (now WCAG 2.1 in EN 301 549 v3.2.1) for web and software with user interfaces, functional performance criteria covering the disability dimensions (vision, hearing, speech, manipulation, reach, cognition), and chapters covering hardware, support documentation and biometrics. The alignment matters because most global vendors selling into both federal procurement and EU procurement can now ship one accessibility conformance posture rather than two.

Functional performance criteria

Third, the refresh introduced functional performance criteria at Chapter 3 — eleven outcome-based statements describing what an ICT product must be able to do for users without one or more specific abilities. The functional criteria operate as a backstop: even when a product passes all the WCAG and chapter-specific clauses, it must still be usable by a person without vision, without hearing, with limited reach, with limited cognition, and so on. In practice the functional performance criteria are how agencies evaluate technologies WCAG was not written for — kiosks, voice-only interfaces, hardware peripherals — and how they capture the “spirit” of the standard when no specific clause applies. The 2017 refresh is the source of those eleven statements, and they are likely to expand in the next revision to cover AI interaction patterns specifically.

Section 508 vs Section 504: the procurement-vs-recipient distinction

It is worth holding Section 508 next to Section 504 of the same Rehabilitation Act because the two are routinely confused. Section 504, enacted in 1973 and substantially older than Section 508, prohibits discrimination on the basis of disability by any program or activity receiving federal financial assistance — universities, hospitals, state and local government bodies that take federal grants, transit authorities funded by FTA, public-school districts receiving Title I funds, and so on. Section 504 is a civil-rights statute. Its enforcement is brought through the federal funding agencies’ Offices for Civil Rights and, ultimately, through private litigation by affected individuals.

In May 2024 the Department of Health and Human Services (HHS) finalised a long-pending update to its Section 504 regulations (89 Fed. Reg. 40066, 9 May 2024). The HHS 504 rule is the most consequential domestic disability-rights regulation since the ADA Amendments Act of 2008. It explicitly applies Section 504 to medical-treatment decisions (overruling the Buck v Bell-era treatment hierarchy that some state hospitals had read into earlier law), to value-of-life judgments in organ transplantation and crisis-standards-of-care protocols, to web content and mobile applications of federally-funded health programmes (incorporating WCAG 2.1 AA), to medical diagnostic equipment, and to the design of integrated community-based services under the Olmstead framework. Other federal agencies — Education, Justice, Transportation, HUD — have either updated or are updating their own 504 implementing regulations on a similar pattern.

The simplest mental model: Section 508 binds what the federal government buys; Section 504 binds what federally-funded entities do with their grants. Both anchor in the same statute. Both reference WCAG. They do different jobs in different parts of the regulatory architecture.

What is pending: the 2025 RFI and the next refresh

On 1 May 2025 the US Access Board published a Request for Information (90 Fed. Reg. 18420) opening the public-comment phase for the next update to the Section 508 standards and the related Section 255 telecommunications guidelines. The RFI is not yet a Notice of Proposed Rulemaking — it is the earlier consultation stage where the Board asks targeted questions to shape the eventual proposed rule. The comment window closed in early August 2025; the Board has indicated that an NPRM is unlikely before late 2026 and a final rule unlikely before 2028, given the standard pace of Access Board rule-making.

The RFI organises its questions around four major topics, each of which signals a likely direction for the eventual proposed rule.

WCAG 2.1 or 2.2 update

The headline question is whether to update the incorporated WCAG version from 2.0 AA to 2.1 AA or directly to 2.2 AA. The technology landscape has shifted significantly since 2017: most touch-first interfaces, single-page applications, and mobile-app patterns are now better captured by WCAG 2.1 (mobile, touch-target, orientation, status messages) and 2.2 (focus appearance, dragging movements, target size minimum, redundant entry, accessible authentication, consistent help). The Board’s stated concern is regulatory stability — agencies and vendors built their 2018–2025 conformance ecosystem around 2.0 AA — balanced against falling behind both EN 301 549 (which moved to WCAG 2.1 in 2019) and the HHS Section 504 rule (which incorporates 2.1).

The probable outcome, based on comments filed by GSA’s CIO-C Accessibility CoP, the ITI industry association and major DPO submitters, is direct adoption of WCAG 2.2 Level A and AA, with a transition window of 18 to 24 months for agencies to update procurement documentation. Skipping 2.1 has the advantage of moving once rather than twice, since WCAG 2.2 incorporates all of 2.1.

Scope expansion for AI procurement

The second pending question is the largest in substantive terms: how Section 508 should apply to AI-based systems federal agencies are increasingly procuring. The 2017 refresh predates the deployment of large-language-model chatbots, automated decision systems in benefits adjudication, AI-driven document-processing tools, and AI-mediated identity verification. OMB Memorandum M-24-10 (March 2024) required agencies to designate Chief AI Officers and inventory their AI use cases; the inventories now run to several thousand systems across the federal government. The Section 508 question is whether AI systems trigger new functional performance criteria (e.g. understandability of AI-generated outputs, user control over AI-mediated interactions, transparency of automated decisions), whether they require new conformance reporting categories beyond the VPAT, and whether procurement officers should be required to test AI outputs across user disability profiles before award.

The Access Board’s RFI specifically asks about screen-reader compatibility of conversational AI outputs, captioning of AI-generated multimedia, accessibility of AI-generated alt text, and conformance posture for AI-driven assistive technologies that federal agencies deploy on their own behalf. None of these have settled technical standards in the W3C track; the WCAG 3.0 working group is exploring some of the same questions but is unlikely to deliver before 2028. The Access Board’s options are to write US-specific functional criteria, to defer to W3C, or to issue interim guidance through a non-binding “best practices” document. The early comments are split.

Cloud, SaaS and continuous-delivery products

A third pending question is how Section 508 conformance applies to SaaS and cloud-hosted products that update continuously. The 2017 refresh assumed a product release model where a VPAT documents a specific version, and a procurement decision turns on that version. For continuously-delivered cloud products, the version under evaluation at procurement may differ within weeks from what the agency is actually using. The RFI asks about continuous-conformance attestations, vendor self-certification regimes, and the relationship between the procurement-stage Section 508 decision and ongoing post-award monitoring. This is the question where the gap between the rule’s drafting and the deployment reality is widest.

Hardware refresh and ICT medical-diagnostic equipment

A fourth question concerns hardware: kiosks, self-service transaction machines, network printers and copiers, telecommunications terminals, and the long tail of physical devices the federal government buys. Several hardware-specific clauses in Chapter 4 of the 2017 standard cite older ANSI and TIA referenced standards that have since been revised. The RFI asks whether to update the incorporated hardware standards, whether to broaden the chapter to cover newer device categories (voice-assistant hardware, AR/VR headsets, biometric kiosks), and how Section 508 should relate to the Access Board’s separate Medical Diagnostic Equipment (MDE) accessibility standards published in 2017 under the Affordable Care Act framework. The cross-walk between Section 508 and the MDE standards has been an unresolved question for nine years.

Practical implications for 2026 procurement

Until the next final rule is published — probably 2028 — Section 508 in 2026 remains the 2017 refresh as adopted, with WCAG 2.0 AA as the controlling web-and-software standard. Federal contracting officers should continue to require VPAT-2.5-Rev-508 conformance reports from vendors, evaluate gap statements in those VPATs, and document undue-burden findings where they apply. The Access Board’s 2025 RFI does not change the operative law, but it does signal where vendors should prepare to be measured next.

For agency Section 508 programme managers, the practical posture for 2026 is: maintain WCAG 2.0 AA conformance as the floor, treat WCAG 2.1 and 2.2 conformance as a procurement-preference factor (consistent with the HHS 504 rule), incorporate AI-system accessibility questions into the agency’s Chief AI Officer inventory under M-24-10, and update VPAT review checklists to capture continuous-delivery posture for cloud products. For federal vendors, the implication is that VPATs should already be drafted against WCAG 2.2 even if Section 508 still cites 2.0 — the cost of dual posture is low and the regulatory direction of travel is clear.

What this means for the next decade

Section 508 has done two things well since 2017: it harmonised federal procurement with the global accessibility standards track, and it embedded WCAG conformance into the federal contracting workflow at the point where it has the most leverage. It has done two things less well: it has not kept pace with the technology federal agencies actually procure, and it has not addressed the continuous-delivery and AI-augmented systems that make up a growing share of the federal IT spend. The Access Board’s 2025 RFI is the start of a multi-year update cycle that will not produce a final rule before 2028 and may not produce a fully operational rule before 2030, given the typical lag between final rule and OMB-issued implementation guidance.

For now, Section 508 in 2026 is a stable standard with an overdue refresh on the horizon. The federal procurement system has internalised the 2017 framework. The pending questions — WCAG version, AI scope, cloud conformance, hardware coverage — will shape the next refresh, but they will not change what contracting officers are doing this fiscal year. Read more from Disability World on the European EN 301 549 standard, on the WCAG 2.2 adoption picture, on the full WCAG 2.2 success-criteria reference, on the monitoring buyer’s guide for continuous coverage, on the free WCAG 2.2 scanner for a quick baseline, and on the US disability-rights regulatory landscape.

Primary sources

1. US Access Board. Information and Communication Technology (ICT) Standards and Guidelines, final rule, 82 Fed. Reg. 5790 (18 January 2017), effective 18 January 2018. access-board.gov/ict
2. US Access Board. Section 508 Standards and Section 255 Guidelines: Request for Information, 90 Fed. Reg. 18420 (1 May 2025).
3. US General Services Administration. Section508.gov programme materials, Accessibility Requirements Tool (ART), and Trusted Tester programme. section508.gov
4. US Department of Health and Human Services. Nondiscrimination on the Basis of Disability in Programs or Activities Receiving Federal Financial Assistance, final rule, 89 Fed. Reg. 40066 (9 May 2024).
5. Office of Management and Budget. Memorandum M-24-10: Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence (28 March 2024).
6. ETSI / CEN / CENELEC. EN 301 549 v3.2.1: Accessibility requirements for ICT products and services (2021).
7. World Wide Web Consortium. Web Content Accessibility Guidelines (WCAG) 2.2, W3C Recommendation, 5 October 2023.
8. Information Technology Industry Council. VPAT 2.5 Rev 508 template.
9. 29 USC § 794 (Section 504) and 29 USC § 794d (Section 508), Rehabilitation Act of 1973 as amended.