VPAT ACR

Where to find a vendor's ACR when the vendor will not send it

By David LoPresti August 11, 2026

The vendor’s product page says the company is committed to accessibility. There is no report on it. The sales contact answered your email by linking you back to that same page. Market research is due, the requirements package behind it is due, and you have nothing you can put in a file.

What follows is the acquisition side of an Accessibility Conformance Report, before the scoring and before the writing: which places actually hold one today, how to ask so that a missing report becomes a condition of award rather than an inconvenience, and what a reviewer writes down when the document never arrives. Three of the four places that might hold the report return nothing for a third-party product, so the honest shape of this job is not investigative. When the search fails, the leverage is contractual.

One boundary. This is procurement and testing guidance, not legal advice. Whether an exemption applies to a particular buy, and how a determination would hold up if challenged, belong to your counsel and your contracting officer. A second boundary, on scope: everything after the vendor-website section is federal acquisition practice under the FAR. If you are buying for a state agency, a university or a company, the places to look are the same and your leverage is your own contract terms rather than FAR part 39.

Looking is a duty, not a courtesy

Two FAR paragraphs put the search on someone’s desk. The market research policy at 48 CFR 10.001(a)(3)(ix) requires agencies to “Assess the availability of supplies or services that meet all or part of the applicable information and communication technology accessibility standards at 36 CFR 1194.1 (see subpart 39.2).” That duty rides on the market research trigger at 10.001(a)(2): before new requirements documents are developed, before soliciting above the simplified acquisition threshold, below that threshold only “when adequate information is not available and the circumstances justify its cost,” and before certain indefinite-delivery indefinite-quantity orders. FAR 39.203(a) closes the loop by requiring the acquisition itself to meet those standards unless an exception at 39.204 or an exemption at 39.205 applies.

An assessment of availability that consists of a vendor’s marketing page is not an assessment. The same policy also caps how hard you may push at this stage. FAR 10.001(b): “When conducting market research, agencies should not request potential sources to submit more than the minimum information necessary.” The market research ask and the solicitation ask are two different asks, and that sentence is the reason.

Four places the report might be, and what each returns

The vendor’s own website. GSA tells vendors to put it there: “Make it easy to find your product’s ACR on your company’s website (e.g., link to it on the product description page)” (Section508.gov, Accessibility Conformance Report). Step 5 of the Buy Accessible Products and Services process says the same from the buyer’s side: “Vendors often post this information on their website, typically on their accessibility or product description page.” Those are GSA’s frequency words, and no source found here puts a number behind them. Microsoft, for one, publishes a searchable index of its reports at microsoft.com/en-us/accessibility/conformance-reports. GSA’s own OpenACR documentation states the other case just as plainly: ACRs “are usually private documents, difficult to find, and not visible to the public.”

The GSA ACR Library on Section508.gov. Reviewers find this page and take it for a directory. Its own scope sentence: “Accessibility Conformance Reports (ACRs) are provided only for the tools and training made available by GSA through Section508.gov to support informed decision-making” (ACR Library). Its two tables list three online tools and six training courses; three of those nine rows carry a report date of “Pending” and no file, and the six published reports are dated April 18 or April 24, 2025. Not one third-party vendor report is in it.

The OpenACR project. A machine-readable format, not a directory. The published sample directory holds six reports: Drupal 10, Drupal 9, GovReady, Moodle, NVDA and Plone. The file in GSA/openacr inviting vendors to register their own source repository says “Anyone is free to submit a Pull Request to this repository to include a link to their git repository,” and its table is empty, untouched since November 16, 2021. The roadmap’s link to its completed “web directory listing of available OpenACRs” milestone returns a 404, vendor submission sits under the heading “Optional phases: where are we going,” no release has ever been published, and main last moved on March 12, 2024. The shipped catalog/ directory has kept up better than the README, which still describes a project starting from VPAT 2.4Rev and WCAG 2.0: its nine catalog files span VPAT 2.4 and 2.5 editions and WCAG 2.0 through 2.2, five of them on the 2.5 edition, with one file in each edition adding EN 301 549.

The contract file. On one contract type the pointer is an obligation rather than a hope. 48 CFR 39.203(b): “Confirmation of an exception or a determination of an exemption is not required prior to award of an indefinite-quantity contract, except for requirements that are to be satisfied by initial award. The contract must identify which supplies and services the contractor indicates as compliant and show where full details of compliance can be found (e.g., vendor’s or other exact website location).” Read the scope before relying on it: the sentence attaches to indefinite-quantity contracts, not to every acquisition. Where it does attach, read the vintage too. The pre-2021 rule at 39.203(b)(2) put the duty on the contracting office, which had to “indicate to requiring and ordering activities which supplies and services the contractor indicates as compliant,” so on an older vehicle the pointer may not sit inside the four corners of the contract. If you are ordering against an existing vehicle, read the contract before you email the vendor.

GSA’s market research step names other places: colleagues at your agency, the CIO Council Accessibility Community of Practice, the Acquisition Gateway Solutions Finder, and GSA’s e-Tools for Purchasing Officers. Two cautions on those. GSA’s own bullet marks the Gateway “(requires OMB MAX ID),” and on that reading it is closed to a contractor or a member of the public doing the same research. And on August 21, 2026 the Solutions Finder address did not resolve, while the Gateway itself and the e-Tools page were both live.

Comparison of four places a vendor ACR might be. The vendor's own website is where GSA tells vendors to post the report; what it holds varies by vendor, since Microsoft indexes its own reports, and it gives no guarantee because ACRs are usually private documents that are difficult to find. The GSA ACR Library holds reports for GSA's own tools and training only, listing three online tools and six training courses with three rows marked Pending, and it contains no third-party vendor report. The OpenACR project is a format rather than a directory, holding six sample reports only, and it is not a vendor registry because its submission table has been empty since November 16, 2021. The contract file is an indefinite-quantity vehicle's own compliance pointer, holds whatever that vehicle's terms say, and gives no coverage outside those contracts. — Only the contract file carries an obligation behind it, and only on one contract type.

	The vendor’s own website	The GSA ACR Library	The OpenACR project	The contract file
What it is	Where GSA tells vendors to post it	GSA’s own tools and training only	A format, not a directory	The vehicle’s own compliance pointer
What it holds	Varies; Microsoft indexes its reports	Three tools, six courses, three Pending	Six sample reports only	Whatever the vehicle’s terms say
What it will not give you	A guarantee; ACRs are usually private	Any third-party vendor report	A vendor registry; its table is empty	Coverage outside those contracts

The ACR Repository is not a place to look yet

GSA is building one, and it is closed. The FY 2025 Governmentwide Section 508 Assessment reports that “GSA completed development of a beta version of the Accessibility Conformance Report (ACR) Repository and moved it to a staging environment,” and the Paperwork Reduction Act notice GSA published on June 24, 2026, FR Doc 2026-12667, 91 FR 37982, fixes the terms in advance: “There is no obligation for product owners to submit ACRs for any product.” As of the date on this page GSA publishes no production URL, no launch date and no exit from beta, and none of the 622 URLs in Section508.gov’s sitemap is a repository page, so there is no federal lookup. The three GSA efforts that get conflated here, the library, the format and the future repository, are separated out in how a procurement reviewer scores a vendor ACR.

Re-check that for yourself on any later date rather than trusting this paragraph. Fetch Section508.gov’s sitemap and search it for “repositor”, and search federalregister.gov for GSA notices under Docket No. 2026-0232.

Ask twice, and ask differently each time

The market research ask is bounded by FAR 10.001(b), quoted above. Ask for the report and the test method, not for a proposal.

The solicitation ask is where a missing report stops being an inconvenience. GSA’s guidance on requesting accessibility information makes the report a condition: “To be considered for award, the ACR must be complete, and submitted according to the instructions.” The same page tells you to “Clarify whether any, or all, requirements must be provided in order to be considered for award,” to state “that the agency reserves the right, prior to making an award decision, to perform testing on some or all of the offeror’s proposed ICT items to ensure the accuracy of their response,” and to keep the accessibility material out of any page limit, “to allow offerors to report complete supporting data.”

GSA publishes clause text too, in Define Accessibility Criteria in Contracts, with two warnings on the same page that are the honest half. On making the vendor validate its own claims: “Consider your ability to independently validate conformance claims when determining whether to require the offeror to perform the validation.” A clause you cannot check is a clause you have not enforced. And on the party that may have no conformance activity of its own to report on: “Use caution when considering use of this language for resellers or aggregators that are not likely to have direct control over the ICT item’s conformance activities.” The full clause set, and the surveillance plan that enforces it after award, are worked through in Section 508 contract clauses and QASP language.

GSA’s ACR and VPAT FAQ puts the consequence in one sentence: “Without the ACR, the government may not proceed with the purchase unless there is a special use case exception that the government … may claim in which the ACR will not be required.” The exception, that sentence adds, belongs to the government and never to the vendor. Read that as GSA’s framing on a guidance page rather than as a FAR requirement: nothing in FAR part 39, FAR part 10 or 36 CFR part 1194 makes an ACR a precondition to purchase. What makes it bite in a real acquisition is the award condition you wrote into the solicitation, which is enforceable on its own terms.

Deciding whether the thing you received is a report

Something arrived: a logo, a heading with the word accessibility in it, three paragraphs of commitment. ITI, which publishes the template, draws the line at testing results. “Once completed, the VPAT® with documented testing results is referred to as an Accessibility Conformance Report (ACR) that details the accessible features of the tested product or service” (ITI, VPAT). GSA’s authoring instructions turn that into a two-minute checklist. How to Create an ACR Using a VPAT lists seven title-page fields and fixes the count: “Make sure you complete all seven fields (shown in Step 2 above), including the product information, contact information, and evaluation methods.” They are company name, product name and version, report date by month and year, product description, contact information, additional notes, and evaluation methods, defined as “Information about how your product was tested (manual, automated, both), testing tools used, etc.”

Four structural tests go beyond the header. Conformance is claimed criterion by criterion, in a column using the defined levels rather than prose. The remarks column has to be filled in where the claim is weak: “The third column is reserved for remarks, which are required if the product either partially supports or does not support the guideline.” The phrase “not evaluated” is confined to one table on the same page, where GSA instructs authors that it “may only be used for the Level AAA table since this is the only success criteria table that is not required to be completed.” And the template’s instruction pages should be gone, since GSA tells authors to delete them up to the heading that names the company and reads Accessibility Conformance Report Revised Section 508 Edition.

Rows marked “not evaluated” need their own reading. Per GSA’s Understanding Vendor Claims page, that note “indicates that the vendor has not conducted an assessment or evaluation of the product’s accessibility in relation to the particular Section 508 standards in question,” and it “does not provide any assurance of accessibility and should prompt further inquiries and considerations.” Put that next to the authoring rule above and the test sharpens: inside the Level AAA table the phrase is permitted, and anywhere else it is a defect in the report rather than a gap in your knowledge of the product. A document built out of those rows is a submission, not evidence.

One limit on this test. No federal or ITI source defines the marketing page on the other side of the comparison, so the check is one-sided by design: hold the document you have against the list of what a report must contain, and note what is absent.

Breakdown of what makes a document an ACR. At the centre, a VPAT with testing results, which ITI says is the point at which it becomes an Accessibility Conformance Report. Four checks branch from it. First, seven title-page fields, covering product and contact information and evaluation methods. Second, conformance claimed criterion by criterion, in a column of defined levels rather than prose. Third, remarks where support is weak, required where the product partially supports or does not support. Fourth, the phrase not evaluated, permitted in the Level AAA table and nowhere else. — Run these before reading a single conformance row, because a header that fails them tells you what the rest is worth.

Four ways this ends, and what goes in the file

A complete report arrives. Record what GSA’s market research step asks for: “vendor name, version, and model number,” and how the solution will or will not meet the business need. Then evaluate the claims rather than filing them. GSA’s Understanding Vendor Claims page tells purchasers to “conduct independent conformance validation testing and evaluation to verify vendor accessibility conformance claims” whenever possible.

A document arrives and it is not usable. Fields are blank, criteria outside the Level AAA table read “not evaluated,” or the remarks column is empty next to a “partially supports” claim. The finding is that the submission has not met a stated condition of award, quoting the condition you put in the solicitation. That is a finding about the response, not a judgment about the product.

No report, and the vendor will not produce one. If the requirement was in the solicitation, the offeror failed a stated award condition and the record says so. If you reserved the right to test before award, that right is now the cheapest way to get a defensible answer about the product itself.

Nothing in the market conforms. A different finding, and it must not be reached by way of an unanswered email. FAR 39.205(a)(3) requires the agency to “procure the supplies or service available in the commercial marketplace that best meets the ICT accessibility standards consistent with the agency’s needs,” and the Revised 508 Standards say the same at E202.7 of 36 CFR part 1194, Appendix A. E202.7.1 fixes the paperwork: the responsible agency official documents in writing “(a) The non-availability of conforming ICT, including a description of market research performed and which provisions cannot be met, and (b) the basis for determining that the ICT to be procured best meets the requirements in the Revised 508 Standards consistent with the agency’s business needs.” FAR 39.205(c)(3) asks for the same elements, and FAR 39.205(b) then requires alternative means of access.

Blurring the third state into the fourth is how a vendor’s silence becomes a nonavailability determination the agency cannot support. A vendor who will not answer has not established that the market has nothing. GSA’s Buy Accessible Products and Services step puts a floor under the search: “Try to find at least two possible solutions.”

Comparison of the four ways an ACR request ends. When a complete report arrives, the finding is whether the solution will or will not meet the business need, the file records vendor name, version and model number, and the next move is to validate the claims by testing. When a document arrives but is unusable, the finding is that it has not met a stated condition of award, the file records the unmet condition quoted from the solicitation, and the next move is to judge the response rather than the product. When no report arrives at all, the finding is that the offeror failed the award condition, the file records that failed condition and any pre-award test result, and the next move is to use the reserved right to test. When nothing in the market conforms, the finding is that no conforming ICT is available, the file records non-availability, the market research performed, and the basis for best meets, and the next move is to procure what best meets the standards plus alternative means of access. — The third and fourth columns rest on different authority, and a silent vendor never gets you to the fourth.

	Complete report arrives	Document arrives, unusable	No report at all	Nothing in the market conforms
The finding	Will or will not meet the business need	Not met a stated condition of award	Offeror failed the award condition	No conforming ICT is available
What goes in the file	Vendor name, version, model number	The unmet condition, quoted	The failed condition and any test result	Non-availability, market research, best meets
Next move	Validate the claims by testing	Judge the response, not the product	Use the reserved right to test	Best meets, plus alternative means of access

Two places the published guidance will send you wrong

A FAR citation on Section508.gov’s buy page does not support the sentences attached to it. The page states: “If there are technically acceptable solutions available in the marketplace, you must select one of those solutions (39.203(c)). You cannot choose a different solution and claim an exception (e.g., ‘best meets’ or ‘undue burden’).” Current 48 CFR 39.203(c) is headed “Task order or delivery order” and addresses compliance when an order is issued. The pre-2021 text at 39.203(c)(1) did cover commercial-item availability, and the August 2021 FAR rewrite moved it. What the current FAR says is narrower than the page. FAR 39.203(d) requires an agency acquiring commercial products and services to “comply with those ICT accessibility standards that can be met with supplies or services that are available in the commercial marketplace and that best address the agency’s needs,” and FAR 39.205(a)(3) applies only “Where there are no commercial products and commercial services that fully conform.” Neither provision makes market availability foreclose the other two exemptions: undue burden at 39.205(a)(1) turns on “the agency resources available to the program or component for which the ICT supply or service is being procured,” and fundamental alteration at 39.205(a)(2) turns on the nature of the ICT. The same page also states that “As per the FAR (39.203(c)), testing must be performed regardless of the source.” Neither the current 39.203(c) nor the pre-2021 version contains a testing mandate. Cite 39.203(d) and 39.205(a)(3) for what they do say, treat pre-award testing as the reserved right your solicitation created, and keep the 39.203(c) cite out of a determination.

A GSA page reviewed in June 2026 still calls VPAT 2.4 the current version. How to Create an ACR tells authors that “The current version of the VPAT® is 2.4. Any VPAT® 2.x is acceptable.” ITI has published VPAT 2.5Rev, in four editions, since April 24, 2025. The ACR and VPAT FAQ on the same site gives the instruction that does not go stale, a template that includes the Revised Section 508 Standards, “Rev508 or RevINT Version 2.x or later.” Name the edition and version in your own solicitation rather than inheriting a stale “current” from a guidance page.

Guidance on citing FAR and VPAT versions. Do cite 39.203(d) and 39.205(a)(3) for what they do say. Do treat pre-award testing as the reserved right your solicitation created. Do name the edition and version in your own solicitation. Do require a template that includes the Revised Section 508 Standards, Rev508 or RevINT Version 2.x or later. Do not rely on the 39.203(c) cite in a determination, because that paragraph is headed Task order or delivery order. Do not read 39.203(c) as a testing mandate, because neither the current nor the pre-2021 version contains one. Do not treat market availability as foreclosing undue burden or fundamental alteration. Do not inherit a stale current version from a guidance page, because ITI published VPAT 2.5Rev on April 24, 2025. — Both errors sit on GSA pages a reviewer is likely to trust, so the correction has to be carried into the determination by hand.

Do	Don’t
Cite 39.203(d) and 39.205(a)(3) for what they do say	Rely on the 39.203(c) cite in a determination; that paragraph is headed Task order or delivery order
Treat pre-award testing as the reserved right your solicitation created	Read 39.203(c) as a testing mandate; neither the current nor the pre-2021 version contains one
Name the edition and version in your own solicitation	Treat market availability as foreclosing undue burden or fundamental alteration
Require a template that includes the Revised Section 508 Standards, Rev508 or RevINT Version 2.x or later	Inherit a stale current version from a guidance page; ITI published VPAT 2.5Rev on April 24, 2025

What nobody has published

No published decision applying FAR 39.203(b), E202.7.1, or the “complete, and submitted according to the instructions” award condition turned up in the research for this article. The levers here are contract levers rather than litigation levers, and they work at award or acceptance rather than afterwards.

Nothing published quantifies how many ICT vendors publish a report, how many refuse when asked, or how long a request takes. The FY 2025 assessment measures the agency side instead: 38 percent of agencies report they “almost always” consider Section 508 in market research, and 30 percent “almost always” verify ICT deliverables for conformance. On report quality it offers one sentence and no number: “Agencies report that vendor-provided accessibility conformance reports remain inconsistent or unreliable, increasing the burden on agencies to independently validate conformance.”

The reseller case has no published federal answer. GSA warns against pointing its documentation clauses at resellers who lack control over conformance activities, and separately tells vendors they are responsible for the product they developed. Neither page says what a reviewer records when the offeror is a reseller and the manufacturer will not produce a report.

Your next step

Take the acquisition on your desk and do three things in order. If you are ordering against an indefinite-quantity vehicle, read the contract and look for the pointer FAR 39.203(b) requires. Search the vendor’s site for a dated report rather than an accessibility statement, and check the seven header fields before you read a conformance row. Then decide which of the four terminal states you are in, and write the file note for that one rather than for the one you wish you were in.

Where the gap is on the buying side, ADACP’s Section 508 procurement support covers the solicitation language that produces reviewable reports and the independent validation that verifies them. Where you are the vendor being asked and have nothing to send, VPAT and ACR testing produces the document with testing behind it, which is the only version that survives a reviewer.