Legal & Compliance

What Is a VPAT? Voluntary Product Accessibility Templates Explained

A VPAT (Voluntary Product Accessibility Template) is a standardized document format in which a vendor reports how their product or service conforms to recognized accessibility standards — WCAG, Section 508, and EN 301 549 — one success criterion at a time. It originated as a Section 508 procurement tool for federal government purchasing, and has since become a common due-diligence document requested well beyond federal contexts, including by enterprise customers doing their own vendor accessibility review.

The current version and its scope

VPAT 2.5Rev is the current template, published by the IT Industry Council (ITI). It comes in four editions, and each incorporates a standard that carries its own WCAG baseline:

Edition	Standard it incorporates	WCAG baseline of that standard
VPAT 2.5 WCAG	W3C WCAG	WCAG 2.0, 2.1 and 2.2
VPAT 2.5 508	Revised Section 508	WCAG 2.0 Level A and AA
VPAT 2.5 EU	EN 301 549	WCAG 2.1 Level A and AA
VPAT 2.5 INT	all three of the above	each keeps its own; WCAG 2.2 is represented through the WCAG portion

The INT edition is the most commonly requested by vendors selling into US and EU markets simultaneously. Note what it does not mean: including WCAG 2.2 through the WCAG portion does not turn Section 508 into a WCAG 2.2 standard, or EN 301 549 into WCAG 2.2. A vendor is free to evaluate against WCAG 2.2 in addition to the baseline — that is useful and increasingly expected — but the baseline a buyer is legally held to is the one the standard names.

VPAT or ACR?

The words are used interchangeably and shouldn't be. The VPAT is the blank template. Once it is completed for a product with actual evaluation results, the completed document is an Accessibility Conformance Report (ACR). When a procurement team asks for "your VPAT", what they want is your ACR.

What's actually inside one

A VPAT is structured as a large table, one row per applicable success criterion, with columns for:

• The criterion itself (e.g., "1.4.3 Contrast (Minimum) — Level AA")
• Conformance level, one of four defined values for Level A/AA rows (see below)
• Remarks and explanations — specific notes on what was tested, what wasn't, and any known limitations

The conformance-level values

Level	Meaning
Supports	The functionality meets the criterion, possibly with equivalent facilitation
Partially Supports	Some functionality does not meet the criterion
Does Not Support	The majority of the functionality does not meet the criterion
Not Applicable	The criterion doesn't apply to this product (e.g., video-related criteria for a product with no video content)

A fifth value, Not Evaluated, appears in the template but the VPAT instructions permit it only in the WCAG Level AAA table — the one success-criteria table an ACR is not required to complete. It is not a valid conformance level for a Level A or AA row, so an incomplete A/AA row should be left for the evaluator rather than filled with it.

Note also what "Supports" is not. It is an assertion that the functionality meets the criterion — not shorthand for "our scanner found nothing." An automated scan that produces no finding has ruled out the failure patterns its rules cover; it has not established that the criterion is met, and recording "Supports" on that basis is the kind of claim a procurement team is entitled to rely on and a vendor cannot substantiate.

Why an automatically-generated VPAT should always say "DRAFT"

This is a genuinely important point: a report generated from automated scanning alone can only speak to the criteria automated rules cover — under half of the active Level A/AA success criteria, and even for those the rules detect failures rather than confirming success (see the breakdown in Automated vs Manual Testing). The remainder genuinely requires human expert review to assess accurately. In April 2025 the FTC approved a final order requiring accessiBe to pay $1 million over allegations that it made false, misleading, or unsubstantiated claims about its automated accessibility product. The lesson of that case is about substantiation — a claim you cannot back with evidence — not that automated testing is itself improper. It is widely cited as the reason any ACR generated primarily from automated scanning should be explicitly labeled DRAFT, with a clear methodology disclosure, and never presented as a final, audited compliance certification.

What a VPAT is not

A VPAT is not itself a legal certification of compliance, and it's not legally binding proof that a product satisfies any particular law — it's a standardized disclosure document, meant to give a purchaser or auditor a structured, comparable way to understand a vendor's accessibility posture, gaps included. A VPAT that reports several "Does Not Support" entries honestly is more useful (and more defensible) to everyone involved than one that inflates its own conformance claims.

Common questions

What is a VPAT?

A Voluntary Product Accessibility Template — a standardized document in which a vendor reports how their product conforms to accessibility standards like WCAG, Section 508, and EN 301 549, one success criterion at a time.

What are the VPAT conformance levels?

Four: Supports, Partially Supports, Does Not Support, and Not Applicable. A fifth value, Not Evaluated, exists but the VPAT instructions restrict it to the WCAG Level AAA table — it is not a valid level for a Level A or AA row.

Why should an automatically generated VPAT say DRAFT?

Automated scanning detects failure patterns for under half of WCAG's success criteria and confirms none of them; the rest needs human expert review. Following the FTC's April 2025 accessiBe order, a pre-filled report should be labeled DRAFT and never presented as a final audited certification.