Nobody certifies a website: what each US accessibility proof means
By David LoPresti August 9, 2026 A solicitation asks the supplier for a “VPAT certification.” A prospect asks whether your site is “certified ADA compliant.” A marketing lead wants the certification badge for the footer. The organization that publishes the VPAT template answers the first request in its own FAQ with a flat denial: “there is no VPAT certification.”
That is not pedantry. The word certification is doing four different jobs in this market, and the four objects behind it have almost nothing in common:
- A conformance claim is a statement an author makes about named web pages, at a named WCAG level, on a named date.
- An Accessibility Conformance Report is a document a product owner writes about its own product, on a template a trade association publishes and does not review.
- A certification attaches to a person who passed an exam, or, in one federal program, to a state law. It does not attach to a website.
- A badge is an image. Placing one is making a claim, and the FTC has already brought an enforcement action over what an automated product was promised to deliver.
Everything below is United States law and United States procurement practice. ITI also publishes an EU edition of the VPAT, and what the European regime asks of a supplier is outside what this page can tell you.
The template publisher says the certification does not exist
The Voluntary Product Accessibility Template is published by the Information Technology Industry Council, currently as VPAT Version 2.5Rev (April 2025) in four editions: 508, EU, WCAG and INT.
ITI answers “Is there a VPAT certification?” in its own FAQ. The answer opens with “No,” continues with the words “there is no VPAT certification,” and then explains that the product owner completes the template to demonstrate the accessibility of its own products. Asked “How can I get VPAT ‘certified’?” the same FAQ answers: “There is no certification for VPAT.” Asked whether it reviews what suppliers publish: “No, ITI does not review or approve VPATs. ITI provides the VPAT templates as a free resource for anyone to use.” On badges: “there’s no certification or conformance logo required or even available to those who have filled out the VPAT.” And on scoring: “There is no ‘pass/fail’ scale for determining whether a product is accessible or inaccessible.” A supplier reports each applicable provision as supports, partially supports, does not support, or not applicable. There is no aggregate.
The completed document has its own name. ITI: “Once completed, the VPAT with documented testing results is referred to as an Accessibility Conformance Report (ACR) that details the accessible features of the tested product or service.” GSA’s ACR page defines it for federal buyers as “a document that explains how information and communication technology (ICT) products such as software, hardware, electronic content, and support documentation meet (conform to) the Revised 508 Standards for IT accessibility.”
Two properties of that document matter more than the word on its cover. The author is the seller: GSA’s ACR/VPAT FAQ describes vendors testing their own products and reporting which standards they support, partially support or do not support, then concludes that “If the product supports all of the applicable Section 508 Technical Standards, the product is considered compliant with Section 508.” That is a procurement posture, not an adjudication, and no authority cited on this page turns an ACR into a warranty.
The second property is shelf life. GSA publishes no expiry date for an ACR, which is a trap rather than a convenience, because the trigger is the product’s state and not the calendar: “Every time your product is changed or updated (e.g. version change, bug fix, etc.), an updated ACR may be required to address any changes in the product’s accessibility.” A two-year-old ACR for software on a two-week release train describes a product that no longer exists.
The federal rules do not use the word
The Department of Justice was asked to require certification and declined. In the Title II web and mobile app rulemaking as published at 89 FR 31320, at page 31392, the Department lists what commenters wanted, “including mechanisms for providing accessibility feedback; accessibility statements; third-party audits; certifications of conformance; documentation of contracting and procurement practices,” and then refuses: “The Department declines to adopt a policy-based approach because, based on the wide range of policies and practices proposed by commenters, there is not a sufficient rationale that would justify adopting any specific set of accessibility policies” in subpart H. Its reason follows on the next page: “State and local government entities are best suited to determine how they will comply with the technical standard, depending on their needs and resources.”
The regulatory text matches the refusal, and here it is better to count than to assert. The full text of 36 CFR part 1194, the part containing the Revised Section 508 Standards, runs to about 102,000 characters through the eCFR versioner API, and the string “certif” appears in it zero times. In 28 CFR part 35 subpart H, the ADA Title II web and mobile app rule, it appears zero times as well. Across the whole Title II rule as published, 89 FR 31320 to 31396, the stem “certif-” appears exactly twice, and both instances are the rejected-alternatives passage quoted above.
So there is no federal answer to “what proof is enough.” A buyer who wants one has to write it into the contract, which is what the last section here is for.
View the data as a table
| 36 CFR part 1194 | 28 CFR part 35 subpart H | 89 FR 31320 to 31396 | |
|---|---|---|---|
| What it is | The part containing the Revised Section 508 Standards | The ADA Title II web and mobile app rule | The whole Title II rule as published |
| Times the string certif appears | Zero | Zero | Exactly twice |
| Where those appearances are | None in the regulatory text | None in the regulatory text | Both in the rejected-alternatives passage at page 31392 |
The ADA does run a certification program, and it certifies a building code
One ADA certification exists, at 28 CFR part 36 subpart F, and its object is not a website, a product or a company. Section 36.601: “Certification of equivalency means a final certification that a code meets or exceeds the minimum requirements of title III of the Act for accessibility and usability of facilities covered by that title,” where “Code means a State law or local building code or similar ordinance, or part thereof, that establishes accessibility requirements.”
Section 36.602 names the applicant and the effect: “On the application of a State or local government, the Assistant Attorney General may certify that a code meets or exceeds the minimum requirements of the Act … At any enforcement proceeding under title III of the Act, such certification shall be rebuttable evidence that such State law or local ordinance does meet or exceed the minimum requirements of title III.” Even then it is narrow. Section 36.606 ties it to a single edition: “Any amendments or other changes to the code after the date of the certified edition are not considered part of the certification.” Set that beside a vendor calling itself ADA certified. The only certification the ADA regulations create is issued to a government, about a written code, for a single edition of it, and it produces rebuttable evidence rather than a finding of compliance.
California’s web accessibility certification is a self-certification
California requires one of these. Government Code section 11546.7 provides that before July 1 biennially, each state agency director and chief information officer “shall post on the home page of the state agency’s or state entity’s Internet Web site a signed certification … that they have determined that the Internet Web site is in compliance with Sections 7405 and 11135, and the Web Content Accessibility Guidelines 2.0, or a subsequent version … at a minimum Level AA success criteria.”
Look at what that sentence does. Two officials sign a statement about their own website and post it themselves. No outside body issues, reviews or revokes it. DOJ examined this model and passed: at 89 FR 31393 it wrote that “Laws like California’s, which require entities covered by California’s law to certify or post evidence of compliance, would impose administrative burdens on public entities similar to those imposed by the international approaches discussed in the preceding paragraph.” DOJ’s plural is worth noting. California is described as one of a class, and this page has not surveyed the class. Nothing found in the research for this article shows what happens to a California agency that skips the posting.
Suppliers to those agencies get a different duty, and it is worth quoting exactly. Section 11546.7 points at Government Code section 7405 as a whole. Subdivision (a) is the state entity’s own obligation to comply with Section 508 and 36 CFR part 1194. Subdivision (b) is the contractor’s, and it says a contracting entity “shall agree to respond to, and resolve any complaint regarding accessibility of, its products or services that is brought to the attention of the entity.” A duty to respond and resolve. Not a duty to certify.
A certification attaches to a person, and each one attests something different
Three credentials are worth separating here: one run by a federal department, one by a trade association, one by a California state program. They attest three different things, and the differences are sharper than the shared word suggests.
DHS Trusted Tester: certified in one named test method
GSA’s Trusted Tester page states the frame: “DHS offers training and formal accessibility testing certification for using the DHS Trusted Tester Process. Agencies that adopt the Trusted Tester Process only accept test results from individuals who have been certified as Trusted Testers.”
The scope is that method, and DHS states what it covers: “Our test process follows the ICT Testing Baseline, which meets the minimum requirements for Revised 508 standards (including WCAG 2.0 Levels A and AA).” So it is evidence the holder can run one process against WCAG 2.0, not a statement about WCAG 2.1 and not a statement about any product.
The exam is what separates this credential from the others. The DHS training catalog describes the certification course as: “Test web pages for Section 508 compliance using the Trusted Tester Section 508 Conformance Test Process for Web, and achieve a score of 85% or higher on the Certification Exam to become a certified Trusted Tester.” The practice exam entry is more explicit about the format still: candidates prepare “by testing sample web pages for Section 508 compliance using the Trusted Tester Section 508 Conformance Test Process for Web,” and must score 85% or higher there to advance to the certification exam. The candidate is scored while testing pages. The threshold is published, “You must score 85% or more,” and GSA’s April 2024 note records that the bar moved “from 90% to 85% to make the certification more attainable for learners.”
What no source states is how long the certification lasts. Neither section508.gov nor dhs.gov publishes a validity period or an expiry date. The only lapse mechanism in the published record is version driven: GSA notes that “DHS no longer provides training and certification on Trusted Tester v4.0,” and the 2018 program update told earlier holders that “Existing V3 certified Trusted Testers must recertify for Trusted Tester V5.” That instruction carried a condition and a date: “If you are a Trusted Tester V3 that provides test results to any DHS agency, then you must obtain the Trusted Tester V5 Certification by April 1, 2019.” A contract asking for a “current” Trusted Tester certification cannot cite a published rule for what current means. It can cite only that version history.
IAAP: credentials that attest what a person knows
The International Association of Accessibility Professionals sets out its frame on its certification overview: its certifications are “Based on job tasks that the minimally qualified candidate should be able to deliver. Not tied to classes, courses, educational or training programs. They validate your on-the-job experience. Valid for three years and MUST be renewed by earning education credits.”
The CPACC is “IAAP’s foundational professional certification,” demonstrating “a broad, cross-disciplinary conceptual knowledge about: disabilities, accessibility and universal design, and accessibility-related standards, laws, and management strategies.” IAAP is candid about the fit: holders “may not personally design, implement, or evaluate the technical aspects of accessibility.” Its exam is 100 multiple-choice questions, closed book, two hours.
The WAS is “an IAAP technical Professional Certification that quantifies and represents a Candidate’s expression of their ‘current’ hands-on technical digital accessibility proficiency,” gated on three years of first-person technical work, and IAAP warns that “WAS is not for beginners or individuals looking to get into web accessibility.” Its exam is 75 multiple-choice questions, closed book, two hours. Holding both produces the CPWA, “IAAP’s highest credential.” A fourth live credential sits beside those three: the ADS, which IAAP describes as “a technical certification that recognizes the skills and experience of professionals who create accessible electronic documents (PDFs, ePub and other document formats) which impact millions of users.” That is the credential aimed at the same material a federal contract names at 602.3, electronic support documentation. A fifth credential is gone: “The IAAP CPABE Certification was sunsetted mid-year 2024,” IAAP states on the CPABE page, with existing holders permitted to display it through their expiration date.
That yields a distinction worth taking into a supplier conversation. IAAP labels WAS technical and gates it on three years of hands-on work, and its own wording is careful: the credential “quantifies and represents a Candidate’s expression of their ‘current’ hands-on technical digital accessibility proficiency.” Expression is IAAP’s word, and the instrument behind it is 75 multiple-choice questions, closed book. The Trusted Tester exam is scored on testing actual web pages. Both are real credentials with real bars, and the difference is between one that infers testing ability from experience plus questions about it and one that observes a scored test performance. Neither says anything about the product you are buying. Which of them your own staff should hold is a training question, and it is where our accessibility training work starts. Fees and renewal terms change, so this page links the exam pages rather than restating them.
View the data as a table
| DHS Trusted Tester | IAAP CPACC | IAAP WAS | |
|---|---|---|---|
| Who issues it | US Department of Homeland Security | International Association of Accessibility Professionals | International Association of Accessibility Professionals |
| What it attests | Ability to run one named test process against WCAG 2.0 Levels A and AA | Broad, cross-disciplinary conceptual knowledge | In IAAP’s wording, an expression of current hands-on technical proficiency |
| How it is examined | Scored while testing sample web pages, 85% or higher to pass | 100 multiple-choice questions, closed book, two hours | 75 multiple-choice questions, closed book, two hours |
| How long it lasts | No validity period published by section508.gov or dhs.gov | Valid for three years, renewed by earning education credits | Valid for three years, renewed by earning education credits |
| What it says about a product | Nothing | Nothing | Nothing |
CASp certifies a person, and the subject is buildings
California’s Certified Access Specialist program is a real state certification of a person. Government Code section 4459.5(a): “The State Architect shall establish and publicize a program for voluntary certification by the state of any person who meets specified criteria as a certified access specialist.” The Division of the State Architect describes what it tests: “The CASp Program certifies through examination an individual’s knowledge of various accessibility codes, standards, and regulations,” so that CASps “possess the expertise to assess facilities for compliance with construction-related accessibility standards.” Certification is valid three years.
The scope boundary is in the statute rather than in anyone’s opinion. Civil Code section 55.52(a)(6) defines “construction-related accessibility standard” as a requirement for “making new construction and existing facilities accessible to persons with disabilities,” and lists its sources: four sections of the Civil Code, section 19955.5 of the Health and Safety Code, the California Building Standards Code at Title 24, the ADA, and the ADA Accessibility Guidelines at 28 CFR part 36 appendix A. Every item is building law. No web content standard appears in the list.
What the specialist signs matches that scope. Under Civil Code section 55.53 the inspector provides “a statement that, in the opinion of the CASp, the inspected structures and areas of the site meet construction-related accessibility standards,” and issues “a numbered disability access inspection certificate indicating that the site has undergone inspection by a certified access specialist.” Read the certificate text twice: it certifies that an inspection happened. Section 55.52(a)(8) states the limit of that for one procedural question, whether a defendant qualifies for a stay and an early evaluation conference: “To determine whether a defendant is a qualified defendant, the court need not make a finding that the place of public accommodation complies with all applicable construction-related accessibility standards as a matter of law. The court need only determine that the place of public accommodation has a status of ‘meets applicable standards’ or ‘inspected by a CASp.’” The certificate buys a procedural posture in California litigation. It is not a finding of compliance, and the statute says so in terms.
CASp and the disability access inspection certificate belong to California construction-related access practice, a licensed built-environment specialty rather than a digital accessibility service. There was once a credential bridging the two worlds inside one body, and IAAP retired it in 2024.
The badge is a claim you are making, not a review someone did
W3C publishes WCAG conformance logo images, and the page offering them removes any suggestion of outside verification. WAI states: “Note that these logos do not represent review or validation of conformance by W3C and/or WAI,” and “Content providers are solely responsible for the use of these logos.” On automation: “No tool alone can determine if a page conforms to WCAG requirements … Knowledgeable human evaluation is required to determine if a page is accessible.”
Placing the image is not decoration. WCAG 2.2 section 5.3.1 makes claims optional, “Authors can conform to WCAG 2.2 without making a claim,” and its Note 3 closes the loop: “If a conformance logo is used, it would constitute a claim and must be accompanied by the required components of a conformance claim listed above.” Those components are the date, the guidelines title with version and URI, the level satisfied, a description of the pages covered including whether subdomains are included, and the technologies relied upon. Scope is not assumed either way: WAI states that “By default, a conformance icon refers to a single page,” so a logo sitting in a site-wide footer without scope information is a claim about every page it appears on.
View the data as a list
WCAG conformance claim: A logo counts as one
- The date
- Guidelines title, version and URI
- The level satisfied
- The pages covered: Including whether subdomains are included
- Technologies relied upon
Overstating that claim has been tested once, administratively. The FTC’s analysis of its proposed consent order against accessiBe, published at 90 FR 647, records that “accessiBe represented that accessWidget could make any website compliant with the Web Content Accessibility Guidelines (‘WCAG’),” and that “The proposed complaint alleges that accessWidget did not make all websites WCAG compliant, and that the company’s claims were false, misleading, or unsubstantiated.” Provision I of the order “prohibits accessiBe from representing that its automated products … can make any website WCAG compliant, or can ensure continued compliance with WCAG over time as web content changes, unless the company has competent and reliable evidence to support the representations.” The Commission approved the final order on April 22, 2025 by a 3-0 vote, with $1,000,000 in monetary relief. Three points of precision if you cite it: that document is a Notice, a consent order settles allegations without a court finding, and the order binds accessiBe and nobody else.
What a contract can require, and what it cannot
Everything above converges on one question: what do you write, so that at delivery you can measure something. Clauses hold when a named authority defines the object. “Deliverable web content shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0, per 36 CFR part 1194 appendix A, E205.4” works because those are the rule’s own words, with siblings at E207.2 (appendix A) for software and 602.3 (appendix C) for electronic support documentation. The appendix letters are not interchangeable, and a clause that cites the wrong one points at nothing.
For a state or local government buyer the nearest equivalent is 28 CFR 35.200(b), which requires covered web content and mobile apps to “comply with Level A and Level AA success criteria and conformance requirements specified in WCAG 2.1,” and reaches content provided “directly or through contractual, licensing, or other arrangements.” Two qualifiers travel with it. The obligation runs from April 26, 2027 for public entities with a total population of 50,000 or more and from April 26, 2028 for the rest, and it does not bite where the entity “can demonstrate that compliance with this section would result in a fundamental alteration in the nature of a service, program, or activity or in undue financial and administrative burdens.” A clause written against 35.200(b) today is written against an obligation with a start date and a statutory defense attached.
Name the artifact by edition and version: an ACR on ITI VPAT 2.5Rev, 508 edition, reporting supports, partially supports, does not support or not applicable per provision, refreshed on any release that affects what it reports. Name the method and the tester: the DHS Trusted Tester Section 508 Conformance Test Process for Web, run by an individual holding a DHS Trusted Tester certification, delivered in that process’s reporting format. For any logo the supplier publishes, require the WCAG 2.2 section 5.3.1 components alongside it. Our VPAT and ACR work and our Section 508 practice start from sentences like those rather than from the word compliant.
The clauses that empty out are the ones this page has already dismantled. “Supplier shall provide a VPAT certification” asks for a thing ITI says does not exist. “Supplier’s VPAT shall be certified or approved by ITI” asks for a review ITI says it does not perform. “Supplier’s product shall be certified ADA compliant” asks for a certificate the ADA regulations issue only to governments, about codes. “The site shall pass an accessibility audit” asks for a result nothing here defines, against ITI’s own statement that there is no pass or fail scale.
View the data as a table
| Do | Don’t |
|---|---|
| Conform to Level A and Level AA of WCAG 2.0 per 36 CFR part 1194 appendix A, E205.4, with E207.2 for software and 602.3 for support documentation | Supplier shall provide a VPAT certification. ITI says there is no VPAT certification |
| For a state or local government buyer, cite 28 CFR 35.200(b) and its Level A and AA WCAG 2.1 requirement, starting April 26, 2027 or April 26, 2028 | Supplier’s VPAT shall be certified or approved by ITI. ITI says it does not review or approve VPATs |
| Name the artifact by edition and version: an ACR on ITI VPAT 2.5Rev, 508 edition, refreshed on any release that affects what it reports | Supplier’s product shall be certified ADA compliant. That certificate goes only to governments, about codes |
| Name the method and the tester: the DHS Trusted Tester Section 508 Conformance Test Process for Web, run by a certified Trusted Tester | The site shall pass an accessibility audit. ITI says there is no pass or fail scale |
| For any logo the supplier publishes, require the WCAG 2.2 section 5.3.1 components alongside it |
Whether any of these clauses would survive a contract dispute is a different question, and this page does not answer it. It establishes only what each clause can be measured against. What is enforceable in your jurisdiction, and what your organization owes, belong to your counsel.
What this page cannot tell you
No court has construed these terms. No published decision testing an accessibility certification clause, a conformance logo representation or a VPAT warranty turned up in the research for this article. The nearest adjudicated outcome is the FTC consent order above, which settles allegations administratively against one company.
DOJ has not said what evidence discharges a Title II obligation. It considered third-party audits and certifications of conformance and declined both.
No authority here makes an ACR a warranty, and no remedy is named. section508.gov treats a fully supporting product as compliant for procurement purposes, while the report is written by the party selling the product. Nothing in the sources for this article resolves that tension or states what the buyer’s remedy is when the report is wrong.
Trusted Tester expiry is undocumented. Not “valid for N years,” not “never expires.” Only the version-change mechanism is published. The version numbering itself is documented, if awkward: the Federal CIO Council publishes Trusted Tester version 5.0, dated June 2019, and notes on that page that certified testers and baseline work “should use Trusted Tester 5.1 or above,” while “This 5.0 version of Trusted Tester should only be used for the current certification training and exam until it has been updated to align with 5.1 or above.” Section508.gov announced courses aligned to version 5.1.3 in April 2024. So 5.0 is the exam’s version, 5.1 and above is the working version, and the courses moved to 5.1.3.
This page is United States only. ITI publishes an EU edition of the VPAT, aimed at the European regime. What that regime requires of a supplier, and what artifact discharges it, is outside the research for this article.
No prevalence figures exist. Nothing published here states how many ACRs exist, how many certified testers or certificants there are, or what any exam’s pass rate is. Where this page could not count something, it does not estimate it.
Your next step
Open the accessibility requirement in your current solicitation, or the accessibility promise on your own marketing page, and find the noun. If it is “certification,” “certified” or “badge,” it names something no authority in this article issues for a website. Replace it with four things you can check at delivery: the standard and version, the level, the pages or product components covered, and the test method with the tester’s qualification. Send us the requirement text and the deliverable it applies to, and we will mark the parts that cannot be measured as written.