Three proposals that do not compare
You have a date and a budget line, and three documents that use the same vocabulary for three different purchases. One is an annual platform subscription with a dashboard and a score. One is a fixed-price audit with a page cap. One is a monthly retainer with no page count in it at all. Every one of them says “accessibility.” None of them says what lands on your desk at the end, who signs it, or what it will prove to the specific person who is going to challenge you.
That person is usually identifiable. A software vendor with a submission window is writing for the Section 508 program manager or the contracting officer’s representative who will read the Accessibility Conformance Report. A city, county, transit agency or state university is writing for whoever has to show work against 28 CFR 35.200. A reviewer holding a supplier’s report is deciding whether to accept it, push back, or test the product independently. A commercial site owner holding a demand letter is writing for opposing counsel.
The category decision comes before the supplier decision. This page is the category decision: five engagement types, the artifact each one produces, who is accountable for it, what moves the number, and, for each one, the circumstances in which you should buy something cheaper or nothing at all. That last column is the one to read first.
Check you are shopping in the right profession
Two unrelated professions answer to the phrase “accessibility consultant,” and a buyer can get a long way into a conversation with the wrong one.
A Certified Access Specialist, or CASp, is a California state credential. Government Code 4459.5 directs the State Architect to run a program for “voluntary certification by the state of any person who meets specified criteria as a certified access specialist,” with testing on “standards governing access to buildings for persons with disabilities.” What a CASp measures against is defined in Civil Code 55.52 as a “construction-related accessibility standard,” which the statute ties to the California Building Standards Code (Title 24) and the federal ADA Accessibility Guidelines. The deliverable, set out in Civil Code 55.53, is “a signed and dated written inspection report” identifying “the inspected structures and areas of the site,” the structures or areas needing correction, and “a schedule of completion for each of the corrections.”
That is a real, regulated, useful product. It has nothing to say about a web application, a PDF, a kiosk interface or an ACR row, and a WCAG auditor has nothing to say about a parking stall slope. If your problem is a ramp, a counter height or a restroom, stop here and hire a CASp or a built-environment accessibility firm. If your problem is a website, an app, a document set or a procurement response, keep reading.
The version question sets the scope before anything else
A quote that does not name a WCAG version is not a quote for a defined piece of work, because the versions are not interchangeable and the rule that binds you picks one.
Section 508 binds federal agencies and reaches vendors through procurement. Appendix A to 36 CFR Part 1194 says so in its own scoping text: “Compliance with these standards is mandatory for Federal agencies subject to Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d).” The technical bar for electronic content is set at E205.4: content “shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0.” E207.2 sets the same bar for software user interface components. Not WCAG 2.1. Not 2.2.
ADA Title II’s web rule picks a different version. As 28 CFR 35.200(b) currently reads, covered public entities must comply with “Level A and Level AA success criteria and conformance requirements specified in WCAG 2.1.” The dates moved: DOJ published an interim final rule on April 20, 2026, effective the same day, extending both deadlines by one year, so the compliance date for entities with a population of 50,000 or more went “from April 24, 2026, to April 26, 2027,” and the date for entities under 50,000 or any special district government went “from April 26, 2027, to April 26, 2028.” Any proposal or internal memo still urgent about April 2026 is working from superseded text, and a government reviewer will notice.
The difference is not cosmetic. Counting the level markers in the published Recommendations, WCAG 2.0 Level A and AA is 38 success criteria (25 at A, 13 at AA). WCAG 2.1 Level A and AA is 50 (30 and 20). WCAG 2.2 Level A and AA is 55 (31 and 24), with a further 31 at AAA. So a Title II audit is scoped against roughly a third more criteria than a Section 508 audit of the same estate, and a 2.2 audit more again.
View the data as a table
| WCAG 2.0 | WCAG 2.1 | WCAG 2.2 | |
|---|---|---|---|
| Success criteria at Level A | 25 | 30 | 31 |
| Success criteria at Level AA | 13 | 20 | 24 |
| Level A and AA combined | 38 | 50 | 55 |
| The rule that names this version | Section 508: E205.4 sets Level A and AA of WCAG 2.0 for electronic content | ADA Title II: 28 CFR 35.200(b) specifies Level A and AA of WCAG 2.1 | Neither of the above. The ICT Testing Baseline references 2.2 Understanding SC articles |
One more trap sits underneath this. The ICT Testing Baseline, which the Federal CIO Council’s Accessibility Community of Practice recognizes as a best practice and which “Federal agencies are encouraged to adopt,” states plainly that “while Section 508 requires WCAG 2.0 Level A and AA, Baseline tests with applicable WCAG success criteria (SC) reference the latest version (2.2) of WCAG Understanding SC articles,” and then that “the Baselines are mapped only to Section 508 (and WCAG 2.0) requirements.” A Baseline-aligned test is not automatically a WCAG 2.1 test. If you are a public entity buying against Title II, say so in writing. For the rule-by-rule version mapping across Section 508, Title II, Title III and state procurement, see which WCAG version each rule actually names.
The five engagement types
| Engagement | What lands on your desk | Who signs it | What it proves in procurement | What moves the price | When you do not need it |
|---|---|---|---|---|---|
| Tool subscription | Dashboard, scan results, issue counts, optional recurring monitoring | Nobody. It is a software license, not an attestation | Detection capacity. It proves you can find a class of defects, not that you conform | Seats, page or scan volume, term length, monitoring frequency, integrations | You have nobody to act on the findings, or the estate is small enough to test directly, or the buyer is asking for evidence rather than a score |
| Expert manual audit | Findings report against a defined sample: scope, conformance target, accessibility support baseline, technologies relied upon, structured and random samples, defect register | The named evaluator, with the commissioning organization named alongside | A defensible baseline and an actionable defect list. It does not produce a WCAG conformance claim for the whole site | Sample size and selection method, template variance across the page set, number of complete processes, assistive technology and platform coverage, retest cycles, turnaround | The estate is too large for comprehensive coverage and a sampled baseline is the documented right call, or you already have current findings and need remediation capacity instead |
| Trusted-Tester-style evidence package | Test results against the ICT Testing Baseline using a repeatable, named process, plus tester identity and credential, environment, tools, assistive technology and severities | The tester or testers, named, with their organization and credential | That the method is repeatable and the result is reviewable by someone else. Required where the buying agency has adopted the process | Baseline scope (web versus electronic documents), page and process count, credentialed tester hours, documentation depth | The buyer has not adopted the Trusted Tester process and will accept a documented manual audit, or the artifact in question is a single video or document |
| ACR authoring | A completed VPAT in the correct edition, scored supports, partially supports, does not support or not applicable, with remarks; optionally a Supplemental Accessibility Report | Author block: the consultant. Vendor block: you. The conformance claim stays yours | That you responded to the solicitation’s request with a complete report. It certifies nothing | Template edition (508, EU, WCAG, INT), chapters in scope, whether usable test evidence already exists, whether a Supplemental Accessibility Report is required | Nobody has asked for one and no buyer in your pipeline requires one, or your existing test evidence is current and documented and only needs transcription |
| Remediation retainer | A prioritized defect queue, an agreed fix cadence, a retest result per closed defect, and a written escalation path | The firm doing the work, against acceptance criteria written into the statement of work | Progress against dated commitments, which is what governance failures actually look like | Defect volume and instance counts, code access, release cadence, number of retest cycles, response times | Your development team can absorb the queue and you only need an independent retest at the end |
Tool subscription
A scanning platform is a software purchase, and federal buying records treat it that way. FEMA’s 2024 purchase order for an automated web accessibility testing tool was coded to product service code 7A21, “IT AND TELECOM - BUSINESS APPLICATION SOFTWARE (PERPETUAL LICENSE SOFTWARE),” at $154,920 for one year. Testing and remediation services carry labor codes instead: DA01, “IT AND TELECOM - BUSINESS APPLICATION/APPLICATION DEVELOPMENT SUPPORT SERVICES (LABOR),” on SBA’s 508 compliance testing award, and DF01, “IT AND TELECOM - IT MANAGEMENT SUPPORT SERVICES (LABOR),” on CMS’s Section 508 support services. Product service code, not dollar value, is where the federal buying system draws the line between a license and a judgment. The two are not two prices for the same thing.
View the data as a table
| FEMA, scanning tool | SBA, 508 testing | CMS, 508 support | |
|---|---|---|---|
| What was procured | An automated web accessibility testing tool, 2024 purchase order | 508 compliance testing | Section 508 support services |
| Product service code | 7A21 | DA01 | DF01 |
| What the code says it is | IT AND TELECOM - BUSINESS APPLICATION SOFTWARE (PERPETUAL LICENSE SOFTWARE) | IT AND TELECOM - BUSINESS APPLICATION/APPLICATION DEVELOPMENT SUPPORT SERVICES (LABOR) | IT AND TELECOM - IT MANAGEMENT SUPPORT SERVICES (LABOR) |
| License or labor | License | Labor | Labor |
What a tool buys is detection capacity, and the federal government publishes the limit. Section508.gov’s testing overview states that “automated scanning tools cannot apply human subjectivity” and therefore either “produce excessive false positives” or, when configured to eliminate those false positives, “test for only a small portion of the requirements.” The Technology Accessibility Playbook puts the same point in acceptance terms: automated tools “only provide partial coverage of the Section 508 Standards,” some standards “require human judgment to determine conformance,” and “to fully validate conformance, manual testing using a repeatable, systematic methodology is necessary.”
Treat the circulating coverage percentages with care. The 57%, 30% and 25% figures move around this market without a consistent citation attached, and none of them arrives with a source a buyer can check. One coverage number can be attributed to a named public body: the State of Illinois DoIT position that “automated testing tools are able to test fewer than 60% of accessibility criteria, so additional manual testing is necessary,” published on the same page that requires findings to be confirmed through manual testing. Use it as Illinois’s stated operating position, and do not accept the same shape of number from a supplier with no attribution on it at all.
The score on the dashboard deserves separate skepticism. W3C’s evaluation methodology says that “there is currently no single metric that is known to address the required reliability, accuracy, and practicality,” that “aggregated scores can be misleading,” and that “for this and other reasons WCAG 2 does not provide a rating scheme.” Track a score internally if it helps your team see movement. Do not put it in a bid.
Expert manual audit
The recognized methodology is WCAG-EM, published as WCAG-EM 2.0. Note its status before you write it into a contract: it “was published by the Accessibility Guidelines Working Group as a Group Note using the Note track,” and that note “is endorsed by the Accessibility Guidelines Working Group, but is not endorsed by W3C itself nor its Members.” It is a methodology you can require a supplier to follow, not a standard you can be held to.
The methodology also sets a hard limit on what an audit can be sold as. “WCAG 2 conformance claims cannot be made for entire websites based upon the evaluation of a selected sub-set of web pages and functionality alone,” and “in the majority of situations, using this methodology alone does not result in being able to make WCAG 2 conformance claims.” If a supplier’s proposal implies that buying the audit and fixing the findings lets you say the site conforms to WCAG 2.1 AA, the supplier is selling an outcome the methodology forbids. What the audit produces is a findings report against a defined sample.
WCAG-EM specifies the minimum contents of that report, and the list doubles as your acceptance checklist: evaluator name, name of the evaluation commissioner, date, scope of the digital product, conformance target, accessibility support baseline, technologies relied upon, the structured sample, the randomly selected samples with the selection method used, and the complete processes selected. Step 5.1 notes that “clear issue descriptions, steps to reproduce, severity of the findings, screenshots and/or videos can help teams resolve issues more quickly.”
Step 5.2 adds the record a competent evaluator keeps for dispute resolution: archived samples plus the “names and versions of the evaluation tools, web browsers and add-ons, assistive technology, and other software used.” Read the label on that step before you rely on it. WCAG-EM marks Step 5.2 “(optional)” and says only that “while optional, it is good practice for evaluators to keep record of the evaluation specifics.” It also notes that the record “is typically kept internal and not shared by the evaluator unless otherwise agreed on.” A supplier can therefore skip it, or keep it and never show you, and still be running the methodology honestly. That is exactly why it belongs in the statement of work rather than in an assumption.
Ask for those items by name. A supplier who cannot produce a sample report containing them is not running the methodology they are quoting.
Trusted-Tester-style evidence package
The DHS Trusted Tester Process is described by Section508.gov as “a manual test approach that aligns with the ICT Testing Baseline” that “provides repeatable and reliable conformance test results,” with DHS running the training and certification. Read the acceptance sentence carefully: “agencies that adopt the Trusted Tester Process only accept test results from individuals who have been certified as Trusted Testers.” That is a restriction imposed by adopting agencies. It is not a governmentwide guarantee that a Trusted Tester report will be accepted everywhere, and it is not a reason to weight the credential in a comparison if your buyer has not adopted the process.
Two checks on any supplier claiming this credential. First, the version: Section508.gov states that “DHS no longer provides training and certification on Trusted Tester v4.0,” so a v4 line on a resume is stale. Second, the coverage: the Baseline is “a comprehensive set of test components that a Section 508 conformance test process should include to ensure full coverage of all requirements,” and the same page states just as plainly what it is not, namely “a step-by-step testing procedure or methodology.” Baseline for Web version 3.1 was published April 1, 2024; Baseline for Electronic Documents version 1.0 on September 30, 2024. If your deliverable is a document set, the web Baseline does not cover it.
There is a reason buyers are asking for this level of evidence and not just a report. The government’s own FY2025 Section 508 assessment records that “vendor-provided accessibility conformance reports remain inconsistent or unreliable, increasing the burden on agencies to independently validate conformance.” On the buy side, GSA advises purchasers that “whenever possible, purchasers should conduct independent conformance validation testing and evaluation to verify vendor accessibility conformance claims,” pointing at the Baseline and at Baseline-aligned processes. Independent evaluation of that kind is what Section 508 conformance testing is for, whichever side of the table commissions it.
ACR authoring
Terminology first, because it is a live buyer test rather than pedantry. ITI, which publishes the template, states that once completed, “the VPAT with documented testing results is referred to as an Accessibility Conformance Report (ACR).” The VPAT is the blank. The ACR is the filled-in document. A supplier who offers to “send you a VPAT” is describing a blank form.
Ask which edition. VPAT 2.5Rev, published April 2025, comes in four: 508 for the Revised Section 508 standards, EU for EN 301 549, WCAG for the W3C guidelines, and INT for all three. The edition determines the standard the rows are scored against. ITI’s instruction for scoring is that manufacturers or vendors “declare the degree of conformance using one of four conformance levels: supports; partially supports; does not support; or not applicable,” with a remarks column for detail.
Federal buyers are told what “partially supports” means in acceptance terms. GSA’s guidance on that entry says that while the vendor has made efforts, “the product does not conform to Section 508 standards.” GSA separately flags a row marked “not evaluated,” which is not one of the four conformance levels at all but an absence of one, warning that it “does not provide any assurance of accessibility and should prompt further inquiries and considerations.” A report full of “not evaluated” rows has not been scored low. It has not been tested.
Nothing about an ACR is a certificate. ITI states that “ITI does not review or approve VPATs,” that “there is no certification for VPAT,” and that “there is no ‘pass/fail’ scale for determining whether a product is accessible or inaccessible.” It adds the caveat that matters commercially: if you are completing one in response to a solicitation, “follow the specific directions receive[d] in the solicitation, which may require a third party audit or review as part of its terms.”
A solicitation can ask for more than the report. GSA tells agencies to require a Supplemental Accessibility Report containing a “description of evaluation methods used to produce the ACR, to demonstrate due diligence in supporting conformance claims,” documentation of accessibility features, information on core functions that cannot be used by people with disabilities, and configuration guidance. Agencies are also advised to “state that the agency reserves the right, prior to making an award decision, to perform testing on some or all of the offeror’s proposed ICT items.” A thin ACR is therefore a bid risk, not a paperwork risk.
And an expert review of somebody’s ACR is not testing. The Playbook says expert reviews “can offer some insight” but “comprehensive testing is essential to validate these claims.” That is the boundary between the ACR authoring row and the evidence package row, and it is the boundary a quote has to state explicitly. ACR authoring and the testing behind it should be quoted as two things, with the testing named separately, or you are buying transcription.
View the data as a table
| Do | Don’t |
|---|---|
| Ask which edition: 508, EU, WCAG or INT. The edition determines the standard the rows are scored against. | Do not accept an offer to “send you a VPAT” as the deliverable. The VPAT is the blank. The ACR is the filled-in document. |
| Quote the ACR and the testing behind it as two things, with the testing named separately, or you are buying transcription. | Do not read an ACR as a certificate. ITI does not review or approve VPATs, and there is no pass/fail scale. |
| Read the solicitation for a Supplemental Accessibility Report, which asks for a description of the evaluation methods used to produce the ACR. | Do not read “not evaluated” as a low score. It is not one of the four conformance levels at all. It means untested. |
| Expect the agency to reserve the right to test some or all of the offeror’s proposed ICT before an award decision. | Do not treat an expert review of somebody’s ACR as testing. The Playbook says comprehensive testing is essential to validate the claims. |
Remediation retainer
A retainer is worth buying when the constraint is throughput and governance rather than knowledge. Inside the federal government, that is the documented pattern. The FY2025 assessment found that roughly “70 percent of agencies reported no required timelines across ICT types,” that where timelines exist “80 percent to 90 percent of agencies reported remediating within those timelines,” and concluded that “governance, not technical feasibility, is the primary constraint.” Agencies that set a date largely hit it. Most never set one.
Play 11 of the Technology Accessibility Playbook sets out the lifecycle a retainer should be buying: categorize defects, prioritize by user impact, and define escalation. Its three-band definition is usable as written. “Critical issues may prevent an end user from accessing or using the technology. Major issues may make it extremely difficult, but not impossible, for an end user to access or use the technology. Minor issues do not materially affect the use of the product, but may represent a technical defect.” It also names the contractual teeth: “develop an escalation process to set timelines and address the need for corrective action or remediation based on risk and impact on end users,” following “cure notice, show cause, or delinquency notices, where applicable.”
Retainers without those two elements, a severity policy and an escalation clause, are staffing arrangements with a monthly invoice.
Who signs what
The trust question buyers are rarely asked to consider is which name goes on the artifact, and there is a machine-readable federal answer.
In GSA’s own ACR library, the OpenACR file for the training course “Section 508 - What Is It and Why Is It Important” v4.1 carries a third-party consultant in the author block and GSA’s Government-wide IT Accessibility Program in the vendor block. The schema separates the roles because the roles are different. A consultant is accountable for the quality of the testing and the drafting. The conformance claim in the document belongs to the product owner. If you commission an ACR expecting the consultant to stand behind the claim, you have misread the instrument, and so has any supplier who let you believe it.
The same library shows what disclosure choice looks like in practice. That first report’s evaluation methods field reads, in full: “The course was testing using manual and automated tools including assistive technology used by people with disabilities. Tools included Axe, ANDI, JAWS, NVDA, VoiceOver, ZoomText and Dragon Naturally Speaking.” Tools and assistive technology named, but no test process, no scope statement, no page count, no environment, no tester credential. GSA’s own ACR Editor report makes the opposite choice, naming a process rather than a tool list: “ACR Editor is tested using Trusted Tester and User testing with assistive technology against Section 508 standards.” Same publisher, same catalogue, opposite disclosure. Neither one alone answers an acceptance reviewer’s questions, which is exactly why the review rubric exists. For the reviewer’s side of that exchange, see how a procurement reviewer scores a vendor ACR.
What moves the price
Of the page-one results for “website accessibility consultant” that could be read on July 27, 2026, one publishes a number: an hourly rate card at $495 for guidance and $195 for technical help, with a three-hour minimum booking. That is one firm’s public rate, not a market rate, and it tells you nothing about a fixed-price audit.
The clearest public unit-economics worked example in this niche comes from GSA. Take “a new website with 100 pages using a similar template, where a Section 508 conformance test typically involves 50 distinct checklist items.” Then: “if a skilled tester spends roughly one hour on each page, the total estimated effort could be 100 hours.” The same page adds the detail that changes remediation quotes: “a single coding defect found across all 100 pages will most likely be considered one defect with 100 instances, not 100 separate defects.”
From that, the five drivers that actually move a quote:
- Sample size and selection method. GSA’s decision rule is explicit. Use comprehensive testing when “the system or ICT inventory is small enough to test every item practically,” when “Section 508 conformance failures are considered high-risk,” or when “precise results are required for Section 508 compliance reporting.” Use representative sampling when the inventory is too large, when “the goal is to establish a baseline of Section 508 conformance across a broad range of assets,” or when “ongoing improvements are being monitored over time.”
- Template variance. Pages that share a template collapse into far fewer distinct tests, and the defect-instance rule above means they collapse in remediation too. A page set built from a handful of templates is a different piece of work from the same page count built bespoke, and the quote should say which one it assumes.
- Assistive technology and platform coverage. Every added screen reader, browser, operating system and magnifier pairing is another pass.
- Retest cycles. One retest of closed defects is a different contract from continuous verification across a release cadence.
- Turnaround. A submission deadline decides how much sample, coverage and retest fits before the date. That scope, not urgency in the abstract, is what the quote is pricing.
Three caveats belong in any sampled fixed-price quote, and GSA states all three under the heading of sample testing drawbacks: “findings are estimates, not guarantees,” there is a “risk of missing critical Section 508 defects,” and “confidence depends on representative sample size and selection method.” A supplier who will not write those into the report is overselling the sample.
For orders of magnitude, federal award records show the bands the market runs in, though every figure below is a total obligation across the stated period and covers many systems, retests and staffing, never a single audit. A Smithsonian purchase of WCAG Level AA video accessibility remediation came to $9,426 over roughly three months. SBA’s 508 compliance testing services, described as “validating information and communication technology (ICT) conformance to accessibility standards specified by Section 508,” ran $969,800.51 from September 2022 to September 2025. A CMS Section 508 support services obligation reached $23,301,742.20 over four years. Do not divide any of those by anything. Use them to see that the market is banded and that scope, not brand, sets the band.
View the data as a table
| Smithsonian | SBA | CMS | |
|---|---|---|---|
| Total obligation recorded | $9,426 | $969,800.51 | $23,301,742.20 |
| Period it covers | Roughly three months | Sept 2022 to Sept 2025 | Four years |
| What the award was for | WCAG AA video remediation | 508 compliance testing | Section 508 support services |
Real testing versus a resold scan: five checks
Every item below is drawn from federal, state or W3C guidance rather than from a supplier’s adjectives. Send them to every firm on your list and require written answers before you compare prices.
| Check | What an acceptable answer contains | Where the requirement comes from |
|---|---|---|
| 1. Test method stated | The named process (manual, automated or hybrid), the methodology it follows, and the scope: what was tested, how many pages, and what was omitted | GSA’s essential elements of an accessibility test report; WCAG-EM Step 5.1 |
| 2. Assistive technology and versions named | Names and versions of tools, browsers, add-ons, assistive technology and other software, plus the operating system and browser version used | WCAG-EM Step 5.2; GSA’s essential elements |
| 3. Tester competence attestable | Tester names, organization, contact details, and “tester credentials, if any, to denote subject matter expertise in the area of testing, such as Trusted Tester ID” | GSA’s essential elements; GSA’s sample tester position description |
| 4. Defect register with severity and reproduction steps | What the defect is, when or where it occurs, its severity on a named scale, a screenshot, a code snippet where applicable, and enough detail for a developer to fix it | GSA’s essential elements; Playbook Play 11; Illinois DoIT severity scale |
| 5. Retest attestation | A stated acceptable quality level, the method of surveillance, and an obligation to correct failing deliverables at no extra cost | GSA TTS Search.gov QASP; Playbook Play 11 escalation process |
Test method stated. GSA’s essential elements of an accessibility test report require you to “specify what tools and test methodologies were used to complete testing,” naming manual, automated or hybrid, and to “specify the test scope, including what was tested, how many pages, what may have been omitted in test scope.” A report that names a tool but no process has answered half the question, as GSA’s own training-course ACR shows.
Assistive technology and versions named. A version-free claim is unverifiable. Illinois publishes its own list of what its trained testers use, naming the NVDA and JAWS screen readers, the ZoomText magnifier and Dragon speech recognition. Pair the names with versions and the environment. Note the limit too: GSA warns that “AT often compensates for non-conformant technologies,” so assistive technology “should not be the sole method for determining Section 508 conformance,” however good it is for usability. Screen reader testing belongs in the package as a named, versioned test target alongside a code-level process, not instead of one.
Tester competence attestable. GSA publishes a competence bar you can copy into an evaluation sheet: “minimum 3 years of ICT accessibility testing experience,” “deep understanding of Revised Section 508 Standards and WCAG 2.0 Level AA,” “proficiency with manual testing procedures including keyboard-only navigation and code review,” with DHS Trusted Tester certification “(TT v5 or newer)” listed as preferred. The buy-side due diligence list on GSA’s testing expertise page is four items: check qualifications by “requesting resumes describing work experience and credentials,” request “examples of ICT testing reports or Accessibility Conformance Reports, including defect descriptions and prioritizations,” check past performance including CPARS, and include “performance standards and acceptance criteria tied to Section 508 conformance in any Statement of Work.”
Defect register with severity and reproduction steps. GSA requires a defect entry to “provide sufficient information to explain: what the defect is, when or where the defect occurs, and the criticality or severity of each defect,” naming the common bands as Critical, High, Moderate or Medium, and Low, with a screenshot, a code snippet where applicable, and “sufficient detail to explain how developers can remediate the defect.” Illinois publishes plain-language definitions worth adopting outright: Critical “will prevent some users from completing essential task(s)”; High “will require some users to take extra steps”; Med “may be confusing to some users, but task(s) can be completed without extra steps”; Low “violates accessibility standards, but not likely to affect users.”
This is also where the resold scan gives itself away. Illinois states the rule directly: “do not just copy and paste failure details from Accessibility Insights into an accessibility report. Findings must be confirmed and clearly documented in terms that developers will understand.” Ask any supplier for two sample defect entries. If they read like tool output with the rule ID left in, you are buying a scan with an invoice on it.
Retest attestation. The cleanest public model is a real federal contract. The Quality Assurance Surveillance Plan for GSA TTS’s Search.gov development support services contains a performance row where the characteristic is “Accessible,” the performance standard is “Web Content Accessibility Guidelines 2.0 AA (WCAG 2.0 AA) standards,” the acceptable quality level is “0 errors reported for WCAG 2.0 AA standards using an automated scanner and 0 errors reported in manual testing,” and the method of surveillance names both an automated tool and “manual review by Government personnel (TTS).” The document then commits the contractor: if deliverables “fail the quality levels provided above, the contractor will correct those deliverables to meet the specified quality level at no extra cost to the Government.” That is a retest obligation you can lift into your own statement of work. For the surrounding clause set, see Section 508 contract clauses and QASP language that survive review.
One structural note for federal buyers. FAR 39.203(a) is the hook that pulls all of this into a contract: “unless an exception at 39.204 or an exemption at 39.205 applies, acquisitions for ICT supplies and services shall meet the applicable ICT accessibility standards at 36 CFR 1194.1.” If a supplier or a program office believes an exception applies, that determination has its own evidentiary requirements, covered in Section 508 exceptions and how agencies document them.
What nobody can sell you
Four artifacts are advertised in this market and do not exist.
A certified VPAT. ITI publishes the template and says it does not review or approve completed reports, that “there is no certification for VPAT,” and that there is no pass or fail scale.
A compliance certificate or badge. One page ranking in the top ten for this search as of July 2026 offers an audit against “all 54 points of the WCAG Levels A and AAA” and promises that once the site complies, “we will issue you a letter of compliance,” plus a published digital test summary, and that “a badge will be issued for your use on your website.” There is no set of 54 points spanning Levels A and AAA. WCAG 2.2 has 31 success criteria at Level A, 24 at AA and 31 at AAA, and neither WCAG 2.1 (30 / 20 / 28) nor WCAG 2.0 (25 / 13 / 23) produces 54 either. The badge fails on the publisher’s own words: beyond publishing the completed ACR, ITI says “there’s no certification or conformance logo required or even available to those who have filled out the VPAT.”
A conformance guarantee from an automated product. The FTC’s final consent order in the accessiBe matter, Docket C-4817, approved by a 3-0 Commission vote, “bars accessiBe from representing that its automated products can make any website WCAG-compliant or can ensure continued compliance with WCAG over time, unless it has the evidence to support such claims,” and required a $1,000,000 payment. Read what that is and is not. The company neither admitted nor denied the allegations, the order binds one company rather than a product category, and the Commission did not decide whether any overlay satisfies Title II or Section 508. What the order does supply is a workable definition of the evidence behind an accessibility claim: “tests, analyses, research, studies, or other evidence based on the expertise of professionals in the relevant area, that (1) have been conducted and evaluated in an objective manner by qualified persons and (2) are generally accepted in the profession to yield accurate and reliable results.” That sentence is a better acceptance test than most statements of work contain.
A score you can put in a bid. Covered above. W3C says no reliable single metric is known and that WCAG deliberately provides no rating scheme.
View the data as a list
What nobody can sell you: Four artifacts are advertised in this market and do not exist
- A certified VPAT: ITI does not review or approve completed reports, and no pass or fail scale
- A certificate or badge: ITI says no conformance logo is required or even available
- A guarantee from an automated tool: FTC consent order C-4817 bars the claim absent evidence to support it
- A score you can put in a bid: W3C says no reliable single metric is known, and WCAG provides no rating scheme
When you do not need the expensive option
GSA lists the legitimate reasons to hire an outside testing firm at all: “a lack of internal resources or expertise for a specific ICT type,” “the need for specialized or complex testing, especially niche technologies,” “surge capacity needs,” and physical distance from the thing being tested, its example being “a kiosk installed at a National Park.” Invert that list and you have the honest downgrade paths.
Buy nothing yet if you cannot name the rule that binds you. The version question decides scope and price. Spend an hour establishing whether you are under Section 508, Title II, Title III exposure, a state procurement standard or a customer contract, and the quotes you receive afterwards will be comparable.
Buy a sampled baseline, not a comprehensive audit, if your estate runs to thousands of pages and you are establishing a starting position rather than reporting a precise conformance figure. GSA’s rule says so, and a sampled baseline plus a defect register plus a retest cadence beats a bigger one-off report for most large estates.
Buy remediation capacity, not another audit, if you already hold current, documented findings. The federal data says the binding constraint is governance rather than difficulty. A second opinion on a defect list you have not worked through buys nothing.
Buy ACR authoring without a full audit only when current, documented test evidence already exists and the work is transcription and review. If nobody has tested the product against the Revised 508 chapters, the testing is the prerequisite, not the polish.
Buy the single-artifact fix when the problem is one artifact. A caption and audio description job on a video library is a defined piece of work at a defined price, and the Smithsonian award above shows the band.
Do not buy usability testing with disabled users as a line inside an audit. It is a separate engagement with separate recruitment and separate value, and it is rare even inside government: “only between 12 percent and 17 percent of agencies reported conducting usability testing with users with disabilities prior to deployment, depending on ICT type.” Scope and price it on its own, or you will get a token session inside a conformance test.
One piece of context to hold while you read any supplier’s confidence. The FY2025 governmentwide average for Section 508 conformance of ICT was 1.96 on a five-point scale, and GSA explains why the number moves the way it does: “agencies that test a broader and more representative portion of their ICT portfolios tend to report lower average conformance, while agencies that test a narrower subset of ICT often report higher conformance rates within that limited scope. As a result, higher reported conformance does not necessarily indicate stronger enterprise-wide accessibility, particularly when testing coverage is incomplete or uneven across ICT types.” Higher reported conformance does not necessarily mean better accessibility, and it can mean narrower testing. The same logic applies to a supplier’s sample report that shows very few findings.
Next step
Before you request a single quote, write five lines at the top of the request and require every bidder to answer them in the same order: the rule that binds us and therefore the WCAG version and level; the sample size, selection method and complete processes to be covered; the assistive technology, browser and operating system pairings with versions; the severity scale the defect register will use; and the number of retest cycles included with an acceptable quality level and a correct-at-no-extra-cost clause. Proposals that answer those five become comparable on price. Proposals that do not answer them have told you what you needed to know about the testing behind them.