VPAT

A Voluntary Product Accessibility Template (VPAT) is a standardised self-declaration in which a vendor documents how their product conforms to accessibility standards. The current template, VPAT 2.5, is published by the Information Technology Industry Council (ITI).

What a VPAT actually is

A VPAT is a structured response, criterion by criterion, to one or more of the major accessibility standards:

• Revised Section 508 — for US federal procurement.
• EN 301 549 — for EU procurement.
• WCAG 2.x — at a specific level (almost always AA).
• Worldwide — the combined view, covering all three.

For each criterion, the vendor records one of these conformance levels:

• Supports — the criterion is met.
• Partially Supports — met for some content or contexts, fails for others, with a description of the gap.
• Does Not Support — fails outright.
• Not Applicable — the criterion doesn’t apply to this product.
• Not Evaluated — only allowed for WCAG AAA criteria.

A useful VPAT vs a defensive VPAT

A vendor who marks every line “Supports” with no commentary is hiding something. A genuinely useful VPAT includes:

• A product description clear enough that a reader can tell what was tested.
• Test methodology — which assistive technologies were used (NVDA
  • Firefox, JAWS + Chrome, VoiceOver + Safari), which sample of pages or features was audited, and when.
• Specific explanations for any “Partially Supports” or “Does Not Support” rating — naming the affected feature and, ideally, the remediation plan and timeline.
• A date of evaluation. A two-year-old VPAT is stale; the product has shipped hundreds of changes since.
• An independent reviewer’s sign-off where available, separate from the developer self-attestation.

The accessibility community has developed informal heuristics for spotting a fluff VPAT: too few “Partially Supports,” no methodology section, no test environment, no named reviewer.

ACR vs VPAT

ITI rebranded the template to clarify two things:

• The VPAT is the blank form.
• The Accessibility Conformance Report (ACR) is the completed document a vendor produces.

In practice the two terms are still used interchangeably. Procurement teams ask for “the VPAT”; vendors deliver “an ACR.” Same artefact.

When you need one

• Selling into US federal agencies. Section 508 procurement requires it.
• Selling into the EU public sector. The EAA and member-state procurement rules now expect an ACR against EN 301 549.
• Selling into US enterprise. Most Fortune 500 IT departments have adopted VPAT-on-request as standard procurement practice, even though Section 508 doesn’t apply to them.
• Selling into higher education. Most US universities and many European ones now require a recent ACR before purchase.

If your product is software being sold B2B, an up-to-date ACR/VPAT is no longer optional — it’s a basic line-item in any RFP response.