Does my SaaS company legally need a VPAT?

No law orders you to publish a VPAT. The pressure is commercial. If you sell software to a US federal agency, Section 508 applies and buyers will ask for an ACR before they will consider your product. Enterprise, healthcare, finance, and university buyers increasingly ask for one too, in their RFPs and vendor reviews. Whether your product meets any legal accessibility obligation is a separate question for an attorney.

Which VPAT edition does a SaaS company need?

There are four editions. The WCAG edition is the common default for US commercial SaaS. The 508 edition (or the INT edition) is the one to use when you sell to the US federal government or federally funded bodies, including many public universities. The EU edition reports against EN 301 549 for European buyers. The INT edition combines all three for products sold globally.

Can I write my own VPAT, or does an automated scan cover it?

You can author your own ACR - it is a self-disclosure, not a third-party certification. But you have to test the product first. An automated scan reliably catches only part of the WCAG criteria (commonly estimated around a third), so an accurate ACR also needs manual and assistive-technology testing. The findings from a thorough audit are what let you mark each criterion Supports, Partially Supports, or Does Not Support honestly.

Is a VPAT a certification?

No. ITI, which created the template, states plainly that there is no VPAT certification. An ACR is a vendor's own reported results, not a seal granted by an outside authority. Treat any service that sells you an instant 'VPAT certification' with suspicion - the accuracy of the report rests on real testing, and the claims in it are yours to stand behind.

VPAT for SaaS: What It Is and How to Get One

By Site Brace Research · Published June 23, 2026

A VPAT (Voluntary Product Accessibility Template) is a standard form that documents how your software measures up against accessibility requirements. Once you test your product and fill it in, the completed document is called an Accessibility Conformance Report (ACR). For a SaaS company it has become a sales document: enterprise and government buyers ask for one before they will consider your product, and a weak or missing report stalls deals. It is a self-disclosure, not a certification - there is no body that "certifies" a VPAT - so its value rests entirely on honest testing behind it. This page explains what a VPAT is, why your buyers want one, which edition you need, and how to produce one you can stand behind.

If you sell software to large organizations, you have probably met a procurement form with a line that says "attach your VPAT" or "provide an ACR." It tends to show up late, right when a deal is close, and it can hold the whole thing up. Here is what the document is and how to get an accurate one without overpromising.

What a VPAT is (and what an ACR is)

A VPAT is a free template created and maintained by the Information Technology Industry Council (ITI). It takes a body of accessibility requirements, such as the WCAG success criteria or the Section 508 standards, and lays them out as a checklist you fill in for your product.

The template is the blank form. The finished document, with your testing results written in, is called an Accessibility Conformance Report (ACR). The federal Section508.gov guidance puts the relationship simply: the VPAT is "the most common way an ACR is completed." In everyday use people say "send us your VPAT" when they mean the completed ACR, and that is fine, but the distinction matters when you write one: the value is in the results, not the form.

For each requirement, you record one of three ratings, with a short remark explaining the behavior:

Rating	What it means
Supports	The product meets the criterion.
Partially Supports	The product meets the criterion with some exceptions.
Does Not Support	The product does not meet the criterion.

ITI is direct about one thing people get wrong: there is no VPAT certification. No outside authority signs off on your report. You test your own product and report what you find, which is why Section508.gov says industry "is expected to test its products against the applicable" standards and then report what they support. The honesty of the report is on you.

Why SaaS companies get asked for one

The VPAT started as a federal-procurement document and has spread well beyond it.

Selling to the US government. If your software is bought by a federal agency, Section 508 of the Rehabilitation Act applies. The template itself is optional, but, in Section508.gov's words, "it is not voluntary to complete an ACR if you wish the government to consider purchasing your product." No report, no deal.
Selling to large enterprises. Big buyers, especially in healthcare, finance, and other regulated industries, now fold the same request into their own vendor reviews and RFPs. The ACR has become a routine gate in B2B procurement, not a government-only form.
Selling to universities and public bodies. Public colleges, K-12 districts, and state and local agencies frequently receive federal funding or fall under their own accessibility rules, and they ask for the 508 edition as a matter of course.

For a SaaS team, the ACR is a sales asset. A clear, honest report shortens the security-and-accessibility review and keeps a deal moving. A missing one, or one full of "Does Not Support," becomes a redline that slows the deal or kills it.

Which edition you need

ITI publishes the VPAT in four editions. The current revision is VPAT 2.5 (the 2.5Rev edition, published by ITI in April 2025). Pick the edition by where your buyers are and what they have to evaluate against.

Edition	Reports against	Use it when
WCAG	WCAG 2.0, 2.1, and 2.2	General US commercial SaaS. The flexible default.
508	Revised Section 508 standards	Selling to US federal agencies or federally funded bodies, including many public universities.
EU	EN 301 549	Selling to European buyers or EU public-sector bodies.
INT	All three of the above	Sold globally, with buyers spanning US federal, EU, and commercial markets.

The editions are keyed to different WCAG versions: per ITI, the 508 edition maps to WCAG 2.0, the EU edition to WCAG 2.1, and the WCAG and INT editions to WCAG 2.2. If you are weighing which WCAG version to test against, the difference between WCAG 2.2 and 2.1 is a short read, and the European Accessibility Act page covers what changes for US companies selling into the EU.

How to get an accurate VPAT

The hard part of a VPAT is not the form. It is that the form is only as good as the testing behind it, and a "Supports" you cannot back up is exposure, not an asset.

Pick the right edition for your buyers, from the table above.
Test every applicable criterion. Run an automated scan to catch the machine-detectable failures, then add manual and assistive-technology testing for the criteria a tool cannot judge, like keyboard operation, focus order, and meaningful sequence.
Fix the failures before you write the report. A "Supports" rating is only true once the barrier is gone, so the fixing comes first.
Document each criterion honestly, with a remark that explains the behavior. Buyers and their accessibility reviewers read the remarks, not just the ratings.
Keep it current. Re-test and update the ACR when you ship a significant release or move to a newer WCAG version.

One honest limit worth stating plainly: an automated scan catches only part of the WCAG criteria, commonly estimated at around a third. It is the fast, repeatable layer that finds the machine-detectable failures, but a complete ACR also needs a person to check the rest. Anyone who tells you a tool alone produces a finished, defensible VPAT is overselling it.

Where Site Brace fits

We do not write or sign your VPAT, and we do not sell a "certification," because no such thing exists. What we do is the testing layer that the report has to stand on.

A Site Brace audit tests your pages against the 30 Level A and 20 Level AA success criteria of WCAG 2.1 and returns a clear pass-or-fail report for each one. That gives you the conformance evidence to fix what is broken and to fill in the WCAG-edition tables of your VPAT accurately. Because the audit is automated, it is the starting layer, not the whole job: you still need manual and assistive-technology testing for the criteria a tool cannot reach, and if your buyers require the WCAG 2.2 tables, note that our audit covers WCAG 2.1, which is most but not all of 2.2. We tell you exactly what we measured and what we did not.

The fastest way to see where you stand is the free check: it scans your home page and lists every automated WCAG failure in about a minute, which is enough to know whether your ACR is close or a long way off. For the full picture, an audit covers up to 25 pages, and monitoring catches the regressions that creep back in every time you ship.

A word on shortcuts: do not reach for an accessibility "overlay" widget that promises instant compliance, and do not let one near your VPAT. Overlays do not make a site conform, and they carry their own exposure - in 2025 the Federal Trade Commission fined the overlay vendor accessiBe one million dollars over claims that its tool could make any site meet WCAG. We explain why overlays fall short in detail. A VPAT built on an overlay's promises is a report you cannot defend.

What a VPAT can and cannot tell a buyer

A good ACR tells a buyer how your product behaves against each criterion, in your own words, backed by testing. It cannot, by itself, prove your product is "legally compliant." Conformance to WCAG is a technical measure of specific success criteria; whether your product meets a legal obligation is a question for a qualified attorney, and it depends on the buyer, the jurisdiction, and the use. We measure conformance to WCAG and report exactly what we measured. The legal conclusions are for your counsel and your buyer's.

Common questions

What is a VPAT, and how is it different from an ACR? The VPAT is the blank template from ITI. The ACR is your completed report, with testing results filled in. People use "VPAT" to mean both.

Does my SaaS legally need one? No law requires you to publish a VPAT. The pressure is commercial: federal, enterprise, and university buyers ask for an ACR before they buy. Legal compliance is a separate question for an attorney.

Which edition? WCAG for general US commercial sales, 508 or INT for the federal government, EU for European buyers under EN 301 549.

Can a scan do it for me? A scan does the automated layer, not the whole report. An accurate ACR also needs manual and assistive-technology testing, and the claims are yours to stand behind.

Is it a certification? No. ITI states there is no VPAT certification. An ACR is self-reported, so its worth comes from honest testing.

Get the evidence for your VPAT

You cannot fill in a VPAT honestly without knowing where your product stands, and the quickest way to find out is to look. Run a free check on your home page for an automated read in about a minute, or get a full audit across up to 25 pages for the conformance evidence your ACR rests on. If accessibility is part of how you win enterprise deals, see how a SaaS accessibility audit fits the rest of your product, and how monitoring keeps your report true as you ship.