Insights · 23 October 2026

VPAT and ACR, explained for software vendors

If you sell software to a US federal agency, a state body, a university or a large enterprise, sooner or later procurement will ask for your VPAT. Here is what that document is, which version they mean, and what separates one that helps you win the deal from one that gets you questioned.

Two names for one thing

A VPAT, the Voluntary Product Accessibility Template, is a blank form maintained by the Information Technology Industry Council. Once a vendor fills it in for a specific product and version, the completed document is an Accessibility Conformance Report, or ACR. Buyers usually say "VPAT" when they mean the finished ACR.

The current template is VPAT 2.5. It comes in four editions, each mapped to the standard a market uses:

• WCAG edition: reports against WCAG 2.x only. Common for private-sector buyers.
• 508 edition: reports against the US Section 508 standards. Required for US federal sales.
• EU edition: reports against EN 301 549, the standard behind the European Accessibility Act.
• INT edition: covers all three at once. Most vendors selling internationally use this one.

Who asks for it, and why

US federal agencies must buy accessible technology and ask vendors for an ACR; without one, the purchase generally cannot go ahead unless the agency claims an exception. State agencies, public universities, school districts and many large companies have copied that rule into their own procurement. The ADA Title II rule for state and local governments, now due in April 2027 for large entities, adds to the pressure because those bodies are responsible for the accessibility of the tools they use.

What a reviewer looks for

An ACR lists each success criterion with a conformance level (Supports, Partially Supports, Does Not Support, Not Applicable) and remarks. Experienced reviewers read the remarks, not the levels. A credible report:

• names the product version and the date it was tested;
• states the testing method: which assistive technologies, browsers and operating systems;
• explains every "Partially Supports" with what fails and where;
• is consistent with what the reviewer finds when they open the product with a screen reader.

The fastest way to lose trust is a report that says "Supports" everywhere and a product that fails the first keyboard test. A report with honest partial support and a dated remediation plan usually reads better than a perfect one that cannot be reproduced.

A VPAT is not a certificate

An ACR documents how far a product meets a standard. It does not certify legal compliance, and no third party can. What it can do is show that the claims were tested, by whom and how. That is why we build ours from the same evidence store as the audit: every "Supports" in a Suretto ACR links back to the recording or data that shows it.

Keeping it current

An ACR describes one version. Ship a new checkout flow or a redesigned dashboard and the report may no longer be true. Many buyers now ask for a refreshed ACR at contract renewal. Continuous verification on each release is the practical answer: the report is regenerated from current evidence rather than rewritten from memory.

Sources: Accessible.org, VPAT to ACR guide; Level Access, VPATs and ACRs; Section508.gov, selling to the government; DOJ Title II deadline extension.