Software and the ACR
An ACR your buyer's reviewer can reproduce.
Suretto tests your product against WCAG 2.2 AA with automated rules, recorded screen-reader runs and keyboard-only runs, then builds the Accessibility Conformance Report from that evidence. Every claim in it points to the recording or data that shows it.
Who asks for an ACR.
Procurement asks for "the VPAT". They mean the completed document, the ACR, for a specific product and version.
- US federal agencies. Section 508 requires them to buy accessible technology and ask vendors for an ACR. Without one, the purchase generally cannot proceed.
- State and local government. The ADA Title II rule requires WCAG 2.1 AA by 26 Apr 2027 for entities serving 50,000 people or more, and by 26 Apr 2028 for smaller ones. Those bodies are responsible for the tools they use, so they ask their vendors.
- Universities and school districts. Many have copied the federal rule into their own procurement.
- Large enterprises. Many apply the same requirement in their own procurement, and the ACR is the document they ask for.
- European buyers. Public-sector and regulated buyers refer to EN 301 549, the standard behind the European Accessibility Act.
Four editions of one template.
The current template is VPAT 2.5, maintained by the Information Technology Industry Council. Each edition maps to the standard a market uses. Choose by who you sell to.
| Edition | Reports against | Who it is for |
|---|---|---|
| WCAG | WCAG 2.x, Levels A and AA, with AAA optional | Private-sector buyers, and any buyer who names WCAG and nothing else |
| 508 | The revised US Section 508 standards | US federal agencies, and state bodies that apply the federal rule |
| EU | EN 301 549 | European buyers, including the public sector and businesses covered by the European Accessibility Act |
| INT | WCAG, Section 508 and EN 301 549 in one document | Vendors selling in more than one market. Most vendors selling internationally use this one. |
What reviewers check.
An ACR lists each criterion with a conformance level: Supports, Partially Supports, Does Not Support or Not Applicable. Experienced reviewers read the remarks, not the levels.
The product version and the test date. An ACR describes one version. Without a date, a reviewer cannot tell what it covers.
The test method. Which assistive technologies, browsers and operating systems were used.
Every "Partially Supports" explained. What fails, and where.
Consistency with the product. The reviewer opens it with a screen reader. A report that says "Supports" everywhere, on a product that fails the first keyboard test, loses trust at once.
Honest partial support with a dated remediation plan usually reads better than a perfect report that cannot be reproduced. Read the full article: VPAT and ACR, explained for software vendors.
How we build the ACR from evidence.
The audit and the ACR come from the same evidence store. Nothing in the report is written from memory or self-assessment.
Scope
We record the product, its version, the screens and states in scope, and the browsers, operating systems and assistive technologies we will test with. These go at the top of the report.
Test
The agreed criteria are assessed using automated rules, selected browser and screen-reader combinations, keyboard checks and human review. Contrast is calculated from browser-derived colours; coverage and limitations are documented.
Decide
Each result sets a conformance level. Anything that fails or needs judgement goes to a reviewer, whose decision and reasoning become the remark. A "Partially Supports" names what fails and where.
Issue
The ACR is issued in the edition you need, dated, with each "Supports" linked to the recording or data behind it.
The 508 and INT editions also have sections on product documentation and support services. Those are not something a screen-reader run can test. We complete them with you from your own material, and the report says so.
Track changes after the assessment.
Ship a new dashboard or a redesigned settings page and last quarter's ACR may no longer be true. Many buyers now ask for a refreshed ACR at contract renewal.
- An agreed monitoring scope. Monitoring repeats automated checks against a defined inventory and schedule. Human reassessment and ACR updates are scoped separately.
- Regressions reported with their place. An alert names the failing criterion and the screen, with the evidence attached.
- Reissued, not edited. A new, dated ACR is generated from current evidence. Earlier issues stay as they were, so a buyer can see what was true on which date.
- Mobile apps included. iOS and Android screens are tested with VoiceOver and TalkBack, so one ACR can cover the web app and the mobile app your buyer also uses. Available to pilot partners now.
- Priced per month. Monitoring starts from $300 per month. The first audit and ACR start from $2,000 per product. Details are on the pricing page.
Pilot programme
Bring the product your next buyer will review.
We are working with a small group of software vendors through early 2027. Start with one agreed user journey at no cost, in exchange for feedback on the fixes and evidence. A full-product assessment and ACR are quoted separately.
To ask a question first, write to hello@suretto.com.