VPAT template: how to complete it, and why there is no certification

The VPAT is a form. You test your own product, you fill the form in, and the completed document is called an Accessibility Conformance Report. Nothing happens after that: no authority inspects the report, no body issues a credential, and there is no badge to place on your site. The Information Technology Industry Council, which publishes the template, states it plainly in its own FAQ: “there is no VPAT certification.” Asked a second way, “How can I get VPAT ‘certified’?”, the same FAQ answers: “There is no certification for VPAT.”

So a phrase like “VPAT certified” describes something that does not exist. What does exist is worth having, and this page is about producing it well. If you also need to know what the neighboring words mean, our guide to what accessibility certification actually covers separates the four things buyers tend to call by that one name.

Is an accessibility VPAT mandatory?

VPATs are voluntary, as the name implies. They were created to assist ICT product vendors in adhering to US Section 508 of the Rehabilitation Act, which mandates that federal government entities make ICT accessible to people with disabilities.

However, if you are a vendor who wants to sell or lease your ICT products to the federal government or any of its agencies, you will be asked for one. Federal buyers ask suppliers for an Accessibility Conformance Report so they can compare how products handle each applicable Section 508 provision. An ICT product with no report can be passed over in a procurement for that reason alone, whatever its actual accessibility.

That can cost you money, because you lose access to the federal market even when your products are on par with or better than those of competitors who did produce a report.

Since having a report for each of your ICT products keeps the product in front of every possible buyer, it makes business sense to treat the VPAT as a practical requirement even though the law calls it voluntary.

For how long is a VPAT Valid?

A VPAT has no expiration date, because there is nothing to expire. The report describes a specific version of a product, tested on a specific date, against a specific standard. It stops being accurate the moment any of those three change, and a stale report is a business risk of its own: a buyer who finds the product behaving differently from what your report claims has a documented mismatch in hand.

Retest and reissue when you ship a release that touches the interface, when the standard you reported against is revised, and on a schedule of your own so the document never drifts far from the product. Annual review is a reasonable floor for a product under active development.

Who can create a VPAT?

There are no legal limitations on who can create a VPAT. Anyone can. Businesses have two alternatives when it comes to creating VPATs for their ICT products: either they hire an impartial third party to conduct the testing and write the report, or they use an internal team or an individual inside the company.

ITI’s own position is that a third party is not required. Its FAQ says VPATs “shouldn’t require a third party review” and that “the product/service owner who completes the VPAT will likely have the most accurate information about the unique features represented on the VPATs,” adding that an outside review “is always something you can choose to do as part of an extra compliance check, but is not required.” ITI adds one caveat: if you are completing a VPAT in response to a government solicitation, follow the directions in that solicitation, since a solicitation can require an outside audit even though the template does not.

It is still worth being honest about the skill involved. The questions in a VPAT are technical, and answering them calls for specific knowledge of accessibility and of each provision the document covers. Reporting “supports” for a provision your product does not meet is a claim a buyer can check, so the accuracy of the answers matters more than the speed of producing them.

If nobody on staff can test to that level, a qualified evaluator is the way to get answers you can defend. Negotiating federal procurement is hard enough without pushback caused by a report that does not survive scrutiny.

What people mean when they say “VPAT certification”

The phrase “VPAT certification” is used across the accessibility market, and it leads people to believe that completing a VPAT for an ICT product produces a certificate from some recognized authority. It does not. There is no certification and no body that issues one. ITI, which publishes the template, does not play that role: “No, ITI does not review or approve VPATs. ITI provides the VPAT templates as a free resource for anyone to use.”

There is no badge either. ITI’s FAQ says that beyond posting the report itself, “there’s no certification or conformance logo required or even available to those who have filled out the VPAT.” Any accessibility logo you see in a website footer was placed there by the site owner or supplied by a vendor, not awarded by the organization behind the template.

There is also no score. ITI states there is no “pass/fail” scale for determining whether a product is accessible or inaccessible. Instead you declare a conformance level for each applicable provision, using one of four terms: supports, partially supports, does not support, or not applicable. Version 2.5 adds a column for explaining each of those answers. The value of the document is in those per-provision explanations, and a buyer who knows the format reads them rather than counting the “supports” rows.

What people are pointing at when they say “VPAT certificate” is the completed report. ITI: “Once completed, the VPAT with documented testing results is referred to as an Accessibility Conformance Report (ACR) that details the accessible features of the tested product or service.” You can hand that report to anyone who asks or publish it on your website, which is what ITI suggests: post it “as evidence that you have tested your product/service against the VPAT criteria.” That is the whole mechanism. It is a disclosure you author and stand behind, not a credential somebody granted you.

The work still pays off beyond the document itself. Testing against each provision turns up defects, and fixing them before you publish changes what you are able to write in the conformance column.

Which edition of the template to use

ITI publishes the template as VPAT 2.5Rev, dated April 2025, in four editions. Choosing the wrong edition produces a report the buyer cannot use:

• VPAT 2.5 508 reports against the Revised Section 508 standards, the US federal accessibility standard. This is the edition for US federal procurement.
• VPAT 2.5 EU reports against EN 301 549, the European requirements for public procurement of ICT.
• VPAT 2.5 WCAG reports against the Web Content Accessibility Guidelines alone.
• VPAT 2.5 INT incorporates all three, for a product sold into more than one of those markets.

The editions embed different WCAG versions, because the standards they reference do: WCAG 2.0 in the 508 edition, WCAG 2.1 in the EU edition, and WCAG 2.2 in the WCAG edition. If a solicitation names a standard, report against the edition that carries it.

Need more information or help with the VPAT?

You can reach us at (626) 486-2201 if you have any additional questions concerning the VPAT. You can also use this link to get in touch with our sales team, who will be happy to help you with any questions you have about the VPAT and to go through your requirements for VPAT testing and reporting.