Guide · Section 508
Selling software to US government buyers? What Section 508 asks of you
US federal agencies have to buy accessible technology, so before they buy, they ask vendors for an Accessibility Conformance Report, usually written on a template called the VPAT. Here's what that means for a small software company, and how to produce one that holds up.
By Kevin McCalley · Published 25 October 2026
What Section 508 is
Section 508 of the US Rehabilitation Act requires federal agencies to develop, buy, maintain and use information and communication technology that disabled people can use. The law applies to the agencies, but it reaches vendors through procurement: if your product isn't accessible, it's harder for an agency to buy it.
The current Section 508 standards (published in January 2017, in force since January 2018) adopt WCAG 2.0 level A and AA for websites, web apps, software and documents. Many public buyers now also ask about WCAG 2.1 AA; US state and local governments have to meet WCAG 2.1 AA under an ADA rule from 2024.
This is general information, not legal or procurement advice.
What an Accessibility Conformance Report is
An Accessibility Conformance Report (ACR) describes how well your product meets each accessibility requirement. Most are written on the VPAT, a free template from the Information Technology Industry Council (ITI). It comes in four editions: Section 508, WCAG, EU (EN 301 549) and International, which covers all three.
One row per requirement
Each WCAG success criterion (and each 508 software and documentation requirement) gets its own row.
An honest level
Each row is marked Supports, Partially Supports, Does Not Support or Not Applicable.
Remarks that explain
Where something is only partly supported, the remarks say what fails and where, so the buyer can judge the impact and plan around it.
How it was tested
The report names the product version, the date, and the methods and tools used, such as keyboard testing and specific screen readers.
Mistakes that make buyers stop trusting a report
"Supports" on every row
Almost no real product supports every criterion. A report with no exceptions reads as untested, and an agency that checks will find out.
No test method or date
Without them, the buyer can't tell whether the report describes the product they're buying today.
An old template or the wrong edition
Use the current VPAT, and the edition the buyer asked for. The International edition covers Section 508, WCAG and EN 301 549 in one document.
Vague remarks
"Some images may lack alt text" helps nobody. "Chart images on the reports page have no text alternative; a data table is planned for version 4.2" does.
How I produce one
I test your product by hand with a keyboard and screen readers, and with automated checks (axe-core, Lighthouse), then write the ACR on the current VPAT edition you need, with specific remarks for every partly supported row. You also get a plain-language fix list ranked by impact, and a re-test and updated report after the fixes. Send me the product and I'll reply with a fixed quote within one working day.
Questions
Do I legally need a VPAT to sell to the US government?
The law doesn't name a document, but agencies have to buy accessible products, so they routinely ask for an Accessibility Conformance Report during procurement. In practice, not having one puts you at a disadvantage.
Can I write the ACR myself?
Yes, and many vendors do. What matters is that it's based on real testing and is honest about what fails. A report that overclaims can cost you trust, and the contract, if an agency tests your product.
How often should I update the report?
Whenever the product changes significantly, and at least once a year. Each report should name the version it describes.
Does Section 508 apply to private companies?
Only through selling to federal agencies. Private businesses in the US face accessibility lawsuits under the ADA instead, and WCAG 2.1 or 2.2 AA is the usual benchmark there.
Which WCAG version should I test against?
Section 508 itself requires WCAG 2.0 AA, but WCAG 2.2 AA includes everything in 2.0 and 2.1. Testing against 2.2 AA covers federal buyers, state and local governments and the EU in one pass.
More guides
Is my Lovable or Bolt app safe to launch? · The European Accessibility Act for small online shops