In early 2025, federal procurement reviews started to change in ways that weren’t widely announced but were quickly felt. Accessibility documentation began getting closer scrutiny, especially around how Section 508 testing was performed and documented before new purchases or renewals moved forward.
If you sell SaaS products, internal enterprise tools, digital documents, mobile apps, hardware, or IT services into federal environments, Section 508 testing is no longer something you can treat as a checkbox. It’s part of procurement due diligence. And while Section 508 is a federal requirement, similar expectations are increasingly showing up in large enterprise and regulated private-sector reviews.
What Is Section 508 Compliance?
Section 508 sets accessibility requirements for U.S. federal agencies and the technology they use or procure. In practical terms, it means digital content and systems must be usable by people with disabilities.
Since the 2018 “508 Refresh,” the technical baseline for web content aligns with WCAG 2.0 Level AA. Many teams choose to test against newer WCAG versions as a forward-looking practice, but WCAG 2.0 AA remains the formal reference point under Section 508.
Section 508 commonly applies to:
- Websites
- Web apps and SaaS platforms
- Desktop, enterprise, and cloud software
- Mobile apps
- PDFs, manuals, reports, and forms
- Procurement and support documentation
- Multimedia and e-learning content
- Hardware and self-service kiosks
Effective Section 508 testing tools provide the foundation for compliance evidence.
Q: How often should federal contractors test?
A: Federal contractors with ongoing deliverables should test every major version or at least once every quarterly sprint.
Importance of Section 508 Website Compliance
1. Procurement teams are scrutinizing VPATs more closely
Federal reviewers now expect more than high-level accessibility claims. It’s increasingly common for them to ask how testing was performed, which pages or workflows were reviewed, what version of the product was tested, and whether there is an active remediation plan. Generic or copy-paste VPATs often trigger follow-up questions and delays.
2. Accessibility risk extends beyond federal contracts
While Section 508 applies to federal procurement, web accessibility enforcement in the private sector continues to grow. WCAG-based claims are now a regular part of litigation and compliance reviews.
Weak accessibility testing doesn’t just affect government work. It can surface later as legal risk, contract friction, or rushed remediation under pressure.
3. Renewals and audits are becoming more detailed
Contract renewals and periodic reviews with agencies such as DoD and HHS increasingly involve updated ACRs and evidence that accessibility issues are being actively addressed.
One-time testing is rarely enough. Reviewers want to see that accessibility is being managed, not just documented.
For organizations selling digital products or services, Section 508 website compliance is no longer a one-off requirement. It’s part of ongoing risk management in both public and regulated private sectors. Read the full guide here.
How to Test for Section 508 Compliance
Below is the exact process accessibility auditors use to conduct Section 508 testing.
Step 1: Run an Initial Automated Scan
Automated tools catch around 25–35% of WCAG/508 issues. So, use them only for the first pass, not the final evaluation.
In this step, you should look for:
- Missing alt text: Screen readers cannot explain if images have no description.
- Color contrast failures: Similar text and background colors can become hard to read.
- Missing form labels: No labels on form fields can confuse the user about what information to put.
- Incorrect heading structure: Out of order headings can confuse the navigation for screen reader users.
- ARIA misuse: Assistive technology can give you the wrong result if ARIA attributes are applied incorrectly.
- Keyboard traps: Users can get stuck and can’t navigate away due to the trap.
- Missing language attributes: No language specification can cause incorrect pronunciation by screen readers.
Automated 508 compliance testing tools are good for identifying all the above obvious errors. However, Section 508 compliance requires manual validation.
Q: How often should you test for Section 508 compliance?
A: Most organizations should run a full accessibility test every 6–12 months or whenever they release major new features.
Step 2: Manual Audits
Keyboard testing is one of the fastest ways to uncover major accessibility issues, and manual audits typically begin with this step.
Audit experts use only the keyboard to move through the product to check if they can:
- navigate all interactive elements,
- access every part of the content,
- operate controls,
- open menus, modals, tabs, and accordions,
- use skip links and landmark regions,
- reach the footer without getting stuck, and see every focus indicator.
During this process, they look for common failures such as missing focus states, focus slipping into hidden elements and controls that don’t work without a mouse. They find components that simply can’t be operated using the keyboard alone.
If keyboard navigation doesn’t work, the product is not Section 508 compliant.
This is where most accessibility teams and vendors fail. Manual auditing teams also test your product using real assistive technologies like screen readers, speech recognition tools, voice controls, screen magnifiers and alternative input tools.
During testing, they verify that proper announcements are made for headings, buttons, menus and dialogs. The alt text, forms, ARIA roles, table headers and focus management are accurate.
These results form the backbone of your ACR/VPAT documentation. See a sample ACR to understand how testing results shape your VPAT documentation. Read here in detail.
Step 3: Validate WCAG Criteria Mapped to Section 508
Although Section 508 references WCAG 2.0 AA, most teams now test against WCAG 2.2 because agencies request it.
WCAG is built around four main areas. The first area is Perceivable, which means users are able to see or hear the content. The second is Operable, which means people can use the keyboard, have enough time and avoid any seizures. The third area is Understandable which ensures content behaves in a predictable way. The last one is Robust which makes the content compatible with screen readers. The table below gives a quick hint at the key WCAG areas that testers will check during a 508 audit.
Key WCAG Areas for Section 508 Compliance Testing
| Principle | What It Covers |
|---|---|
| Perceivable | Text alternatives, captions, contrast, resize text, reflow, images of text |
| Operable | Keyboard access, enough time, seizure prevention, navigation, focus order, pointer gestures |
| Understandable | Clear labels, predictability, error prevention |
| Robust | ARIA usage, compatibility with assistive technologies |
Map each result directly to the Success Criterion number for your VPAT.
| Section 508 | Description | WCAG 2.x Criteria | Notes / Examples |
|---|---|---|---|
| §1194.22 Web | Web-based applications | 1.1.1, 2.1.1, 2.4.7 | E.g., alt text for images, keyboard navigation |
| §1194.31 Software | Software applications | 2.1.1, 2.3.1 | Focus indicators, accessible error messages |
| §1194.41 Documentation | Documentation & Help | 1.4.3, 3.3.2 | Text contrast, clear instructions |
There’s also a Section 508/WCAG mapping PDF on the Access Board website. It’s a good reference to see which WCAG criteria satisfy which §1194 requirements.
Step 4: Identify Exceptions and Non-Compliant Areas
Most products will fail some criteria despite strong engineering.
Document the exact component/URL and why it fails 508. Categorize the issue based on severity (Critical, High, Medium, Low).
This transparency will actually strengthen your ACR because it shows a professional, accurate evaluation.
Step 5: Document the Findings in a VPAT®/ACR
The next crucial step is to fill out the VPAT. Organizations typically document accessibility through an ACR created using the VPAT® template. This documentation must reflect findings from legitimate testing. It should include:
- Testing methodology
- AT tools used
- Scope
- Version numbers
- Tester qualifications
- Detailed conformance notes
- Roadmap for fixes
Remember, procurement officers are trained to spot vague or copy-paste responses. So, accuracy always wins and you should aim for a complete and accurate 508 VPAT ACR.
Read more about VPAT and how to create an effective Accessibility Conformance Report in our detailed guide.
Step 6: Build a Remediation Plan
Testing alone doesn’t solve the problem; you also need a strong remediation plan.
Efficient remediation clearly lists the issues and sets the timeline for each task. It also includes retesting after fixes are made and long-term accessibility goals.
If you are preparing for a government contract, add this remediation plan to your accessibility package.
Q: What are the most common mistakes people make in Section 508 testing?
A: Teams creating a 508 VPAT only after automated testing is the biggest mistake. Most commonly, people skip screen reader testing or ignore PDFs. In addition to this, outdated VPAT editions or leaving out remediation details and evidence are common mistakes that lead to rejection by most vendors.
Avoid these mistakes and your 508 testing will instantly be stronger than that of most competitors.
Conclusion
Section 508 compliance is not a bureaucratic checkbox. It is an operational requirement if you want to keep winning government contracts. Proper 508 testing not only shields your organization from lawsuits but also makes your product usable for all users.
Working with expert auditors who specialize in manual testing and assistive technology evaluations can save you months of headaches. Choose ADA Compliance Pros and avoid costly procurement delays.
If you are ready to see where your website stands, then schedule a free consultation today and get a clear roadmap for Section 508 compliance.