Section 508 contract language: clauses, QASPs and holdbacks

The Section 508 paragraph in the draft solicitation is one sentence, and this is it:

“The contractor shall support the Government in its compliance with Section 508 throughout the development and implementation of the work to be performed.”

That is real published federal text. It appears in at least two General Services Administration Technology Transformation Services solicitations: the Search.gov Development Support request for quotations, posted 8 June 2018, just under five months after the Revised 508 Standards compliance date of 18 January 2018, and the C2 Code Review request for quotations at section 14.1, dated 2 November 2017. In each document that sentence is followed by one paragraph reciting the statute in vocabulary the 2017 refresh superseded, and dropping a word from it: both say “electronic information technology”, where 29 U.S.C. 794d is headed “Electronic and information technology”. Those two paragraphs are the whole of the Section 508 content in either solicitation. Between them they name no standard version, no test method, no evidence deliverable, no remediation clock, no right to test and no consequence.

Two people are reading a paragraph like that right now with a deadline attached. One is a contracting officer, contracting officer’s representative, requiring-activity program manager or agency 508 program manager who has to decide what actually goes into the solicitation, the statement of work and the quality assurance surveillance plan before the posting date. The other is a capture lead, contracts manager or product owner at a software vendor, systems integrator or reseller who has to price the exposure before the question-and-answer deadline closes.

They need the same document: the clause text, the acceptance criterion it creates, the Federal Acquisition Regulation remedy that enforces it, the surveillance row that measures it, and the gate where the money stops. What follows assembles that contract file end to end. Every clause is either published federal sample language, codified agency-supplement text, or a construction built on a named FAR authority and labeled as such.

If you want that file drafted or reviewed against a specific buy, that is what ADACP’s Section 508 procurement support exists for. The rest of this page is the working material.

There is no governmentwide FAR clause for Section 508, and that is the root of the problem

FAR subpart 39.2, Information and Communication Technology, contains exactly five sections: 39.201 Scope of subpart, 39.202 Definition, 39.203 Applicability, 39.204 Exceptions and 39.205 Exemptions (acquisition.gov, FAR part 39). There is no clause-prescription section. Compare FAR 39.106 in the same part, which says the contracting officer “shall insert a clause substantially the same as the clause at 52.239-1, Privacy or Security Safeguards” for information technology requiring security. Privacy and security get a prescribed clause. Section 508 does not.

An eCFR full-text search of title 48 for “794d”, the Section 508 citation, returns 24 results, but that endpoint counts change records rather than provisions. As of 27 July 2026 they resolve to eleven distinct sections. Three sit in the FAR itself and all three are policy: 11.002, 39.201 and 39.203. Three more are policy sections in agency supplements: HHSAR 339.203, VAAR 839.201 and TAR 1239.201. The remaining five are the only clause-numbered provisions in title 48 that cite the statute, and every one of them is an agency supplement: HHSAR 352.239-73 and 352.239-74, AIDAR 752.239-71 and 752.239-72, DOLAR 2952.239-70 (eCFR search API, title 48).

So the accessibility clause in front of you was written locally, by an agency that had to invent it. GSA’s own governmentwide measurement says that process is uneven. The FY 2025 Governmentwide Section 508 Assessment, a statutory report to Congress mandated by Public Law No. 117-328 and codified at 29 U.S.C. 794d-1, built from responses covering 212 agencies, parent agencies and components, states: “Agencies reported inconsistent adoption of Section 508 contract language and uneven leadership support for enforcement. Vendor accessibility claims remain difficult to validate, and limited shared guidance and tools hinder more uniform implementation” (section508.gov, FY 2025 assessment).

In Table 7 of that report, against the column “Compliance or performance clauses are included in contracts to ensure vendor accountability”, the row “Almost always (≥90%)” reads 38%. GSA states the same figure in prose, and the sentence is worth quoting whole because its second half is usually dropped:

“Vendor accountability mechanisms are inconsistently applied. Only 38% of agencies ‘almost always’ include compliance or performance clauses, and 45% ‘almost always’ escalate nonconformance issues to vendors; 38% escalate issues only ‘sometimes’, ‘rarely’, or ‘never’.”

Two supporting numbers from the same report explain why. GSA reports that “60% of agencies and 71% of components assist acquisition officials with Section 508 language in ICT contracts”, and that “20 percent require acquisition professionals to take additional training”. A vendor should not assume the clause it is reading was drafted by anyone who checked it against the standard. An agency drafter should not assume the template in the shared drive is current.

One housekeeping note on the arithmetic before any of these figures get reused. The FY 2025 report’s Table 7 cells and its narrative percentages do not always reconcile, because the underlying counts are rounded and the report does not publish them. Table 7’s deliverables column reads Rarely 20% and Never 7%, summing to 27, while GSA’s narrative sentence says 26%. Quote the narrative sentence whole, or quote table cells with their labels. Do not add rounded cells and present the sum as GSA’s figure.

The conformance target: name it, or the clause has nothing to measure

A clause that says “shall comply with Section 508” has not stated a target. The target lives in the Revised 508 Standards, and for anything with a user interface it is one thing:

• E205.4, electronic content: “Electronic content shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1).”
• E207.2, software: “User interface components, as well as the content of platforms and applications, shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1).”

Both are at access-board.gov/ict. Both also carry exceptions that a drafter should read before treating the target as flat. E205.4 exempts non-Web documents from four success criteria (2.4.1 Bypass Blocks, 2.4.5 Multiple Ways, 3.2.3 Consistent Navigation, 3.2.4 Consistent Identification). E207.2 has three exceptions: assistive-technology software that supports the platform’s accessibility services, the same four success criteria for non-Web software, and WCAG 2.0 Conformance Requirement 3, Complete Processes, for non-Web software.

View the data as a table

	E205.4 electronic content	E207.2 software
What the provision covers	Electronic content	User interface components, as well as the content of platforms and applications
Conformance target	Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0	Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0
Exceptions the standard carries	Non-Web documents exempt from four success criteria: 2.4.1, 2.4.5, 3.2.3, 3.2.4	Three: assistive-technology software, the same four criteria for non-Web software, WCAG 2.0 Conformance Requirement 3

Write “Level A and Level AA” into the clause, matching the standard’s own words. GSA’s sample solicitation sentence says “WCAG 2.0 Level AA Success Criteria (or a later WCAG version adopted by the agency)”. Conformance at Level AA already requires satisfying Level A, because WCAG 2.0 Conformance Requirement 1 defines Level AA conformance as a page that “satisfies all the Level A and Level AA Success Criteria, or a Level AA conforming alternate version is provided” (W3C, WCAG 2.0 conformance). So GSA’s phrasing is not a narrowing, but the fuller wording removes an argument. A later WCAG version binds only if the agency has adopted it in the contract, and adopting one creates a version-mismatch question that has to be answered deliberately rather than by accident.

Two boundary conditions belong in the same paragraph of the statement of work.

Legacy ICT. The standard’s own words are E202.2: “Any component or portion of existing ICT that complies with an earlier standard issued pursuant to Section 508 of the Rehabilitation Act of 1973, as amended (as republished in Appendix D), and that has not been altered on or after January 18, 2018, shall not be required to be modified to conform to the Revised 508 Standards.” FAR 39.203(e) and (f) implement it on the acquisition side, and both drop the standard’s “on or”, writing the trigger as alteration “after January 18, 2018”. The two phrasings differ by a day at the boundary. Quote E202.2. The safe harbor is component by component on the face of E202.2, and it reaches only existing ICT, which Chapter 1 of the standard defines as “ICT that has been procured, maintained or used on or before January 18, 2018” and FAR 39.203(e) defines the same way. Nothing being newly procured under the contract you are drafting can qualify.

Exceptions and Best Meets. Where conforming ICT is not commercially available, E202.7 requires the agency to procure the ICT that best meets the standards consistent with its business needs, and E202.7.1 requires the responsible agency official to document in writing “(a) the non-availability of conforming ICT, including a description of market research performed and which provisions cannot be met, and (b) the basis for determining that the ICT to be procured best meets the requirements”. The FAR mirror is 39.205(a)(3), Nonavailability of conforming commercial products and commercial services. A vendor answer of “we best meet it” survives only if the agency has signed that determination. GSA’s FY 2025 recommendations push agencies to “Systematically track and document all exceptions, including ‘Best Meets’ determinations, and use this data to inform contract reviews, identify recurring accessibility gaps, and guide procurement decisions”. The detail of who signs what, and when, is covered in the exceptions an agency has to document.

Before the clause: the three places the requirement has to already exist

A clause cannot enforce a requirement that was never written into the requirement documents. Three FAR provisions put it there, and all three are worth citing in a Q&A question if they are missing.

FAR 7.103(q), acquisition planning. The lead-in matters as much as the paragraph: “The agency head or a designee shall prescribe procedures for the following”, and (q) is “Ensuring that acquisition planners specify needs and develop plans, drawings, work statements, specifications, or other product or service requirements (e.g., help desks, call centers, training services, and automated self-service technical support) descriptions that address information and communication technology (ICT) accessibility standards (see 36 CFR 1194.1) in proposed acquisitions and that these standards are included in requirements planning (see subpart 39.2)”. The duty is to prescribe procedures, and it can be delegated. Note the named examples. Help desks, call centers and training services are in scope at the planning stage, not just the software.

FAR 11.002(f), requirement documents. The contracting officer “shall obtain from the requiring activity the requirement documents”, which must identify the needs of current and future users with disabilities, “the applicable ICT accessibility standards (see subpart 39.2)” and “any ICT accessibility standards that cannot be met due to an exception or an exemption for any component or portion of the product”. If those three items are absent, the clause downstream has nothing to bite on.

FAR 39.203, applicability. Paragraph (a): “Unless an exception at 39.204 or an exemption at 39.205 applies, acquisitions for ICT supplies and services shall meet the applicable ICT accessibility standards at 36 CFR 1194.1.” Paragraphs (b) and (c) then split the obligation across a vehicle and its orders, a control that is easy to lose because the vehicle award feels like the decision point. It is handled below.

Assume the draft is being machine-checked. GSA operates a Solicitation Review Tool that “scans the SAM.gov and eBuy.gov every 24 hours”, classifies whether a posting is for ICT, and “then checks whether it includes adequate Section 508 compliance requirements to support accessibility in federal IT” (section508.gov, Solicitation Review Tool). GSA says the tool “is available to agency procurement officials and Section 508 Program Managers by sending a request to srt@gsa.gov”, so a vendor will not see the output. The agency will.

The clause library

Fifteen rows. Each one names what the language does, where the text comes from, the acceptance criterion it creates, and what a contract loses without it. Everything marked GSA sample is published copy-pasteable text from Define Accessibility Criteria in Contracts, reviewed March 2026, unless the row names a different GSA page. Everything marked DOLAR is codified at 48 CFR 2952.239-70, Section 508 Requirements (AUG 2024), the most recently dated Section 508 clause codified in title 48.

#	Clause purpose	Source of the language	Acceptance criterion it creates	What breaks without it
1	Conformance target	Revised 508 Standards E205.4 and E207.2; DOLAR B names 36 CFR part 1194 appendices A and C	Deliverable conforms to WCAG 2.0 Level A and Level AA success criteria and conformance requirements	Nothing to test against; every dispute becomes an argument about what “508 compliant” means
2	Custom ICT development	GSA sample, Custom ICT Development Services; DOLAR (a)(1)	ICT “fully conforms to the applicable Revised 508 Standards prior to delivery and before final acceptance”	Conformance is treated as a post-delivery fix at government cost
3	Installation, configuration, integration	GSA sample; DOLAR (a)(2)	Integration must not be done “in a way that reduces the level of conformance”	An accessible product is broken by the way it is deployed and nobody owns it
4	Maintenance upgrades, replacements, option years	GSA sample; DOLAR (a)(3)	No reduction below the level of conformance at the time of award, plus an updated ACR completed to ITI instructions for each option year exercised	Conformance decays release by release across a five-year vehicle
5	Service personnel competence	GSA sample, Service Personnel	Personnel “possess the knowledge, skills, and ability necessary to address the applicable Revised 508 Standards defined in this contract” and provide supporting documentation on request	Labor-hour buys deliver inaccessible output with no competence standard to point at
6	Contractor process maturity	DOLAR (a)(4)	Contractor processes at “a maturity level at least equivalent to the DHS Trusted Tester methodology”	Test results arrive with no stated method behind them
7	Hosting	GSA sample, Hosting Services; DOLAR (a)(5)	Hosting must not reduce existing conformance, and the agency reserves the right to test the hosted solution throughout the life of the contract	A conformant application is served by a wrapper nobody can test
8	Test method by document type	GSA sample, Validation for ICT Items; DOLAR (b)(1)-(3)	Web and software results based on the Harmonized Testing Process for Section 508 Compliance; Office and PDF results based on the Harmonized Testing Guidance from the Accessible Electronic Documents Community of Practice; other ICT validated by a described, documented process	Any scanner output counts as a test result
9	Conformance reporting	GSA sample, Conformance Reporting; DOLAR (c)(1)-(2)	ACR per ICT item before acceptance, based on the latest VPAT from ITI and completed per ITI instructions, plus a supplemental report with five named contents	The vendor delivers a template with the remarks column empty
10	Working demonstration	GSA sample; DOLAR (c)(2)(vi)	Before final acceptance, a fully working demonstration that “shall expose where such conformance is and is not achieved”	Conformance is asserted on paper and never shown running
11	Right to test	GSA sample, Conformance Reporting; DOLAR (c)(3); FAR 46.102(d)	Agency may perform independent testing before acceptance, and DOL reserves independent third-party testing “at any time”	Self-attestation becomes the only evidence in the file
12	Non-compliance, repair or replace	GSA sample, Non-Compliance; DOLAR (d); HHSAR 352.239-74(b)	Written notice from the contracting officer, then repair or replace “at no cost” within the period the contracting officer specifies; DOLAR sets notification at 15 business days from the determination	Remediation is a change order
13	Misrepresented conformance claims	GSA sample, Accessibility in Procurement II; HHSAR 352.239-73(d)	Where tested conformance is lower than the vendor’s own claims, the government may require remediation to align with the original claims before acceptance	An optimistic ACR carries no downside
14	Vehicle and order controls	FAR 39.203(b) and (c)	The vehicle identifies which supplies and services the contractor says are compliant and where the detail lives; each order confirms conformance or documents an exception or exemption	One award is treated as having settled 508 for five years of orders
15	Acceptance-linked payment and holdback	ADACP construction on FAR 52.232-1 and FAR 46.407(f)	Payment on acceptance only; on conditional acceptance, an amount withheld sufficient to cover the estimated cost and related profit to correct the deficiency, with the basis documented in the contract file	Nonconformance is discovered after the invoice is paid

The language itself

Rows 2 through 5, 7 and 8 can be pasted from GSA’s published page as written. Three examples, verbatim:

“When the offeror provides custom ICT development services pursuant to this contract, the offeror shall ensure the ICT fully conforms to the applicable Revised 508 Standards prior to delivery and before final acceptance.”

“The offeror shall ensure maintenance upgrades, substitutions, and replacements to equipment and software pursuant to this contract do not reduce the original level of conformance with the applicable Revised 508 Standards at the time of contract award.”

“When providing hosting services for electronic content provided by the agency, the offeror shall not implement the hosting services in a manner that reduces the existing level of conformance of the electronic content with applicable Revised 508 Standards. Throughout the life of the contract, the agency reserves the right to perform testing on a vendor or contractor’s hosted solution to verify conformance with this requirement.”

Row 8 is where the two published sources diverge in a way that matters to a drafter. GSA’s Validation for ICT Items language reads: “For web and software, WCAG Level A and AA Conformance Test Results must be based on the Harmonized Testing Process for Section 508 Compliance: Baseline Tests for Software and Web Accessibility.” It names no WCAG version and no DHS. DOLAR 2952.239-70(b)(1) pins both: “For web and software, WCAG 2.0 Level A and AA Conformance test results shall be based on the Accessibility Tests for Software and Web, Harmonized Testing Process for Section 508 Compliance from the DHS Trusted Tester program.” If you paste GSA’s sentence, add the version number and the program, or you have named a process without saying which edition of it or who publishes it. The same asymmetry runs through the documents line: GSA writes “the Harmonized Testing Guidance from the AED ACOP” and leaves the acronym unexpanded; DOLAR spells it out as “the Accessible Electronic Documents Community of Practice”.

Row 9’s supplemental report is the only place in the library where the substance of the testing has to be handed over. GSA calls it a Supplemental Accessibility Conformance Report and lists five contents: accessibility test results based on the required test methods; documentation of features provided to help achieve accessibility and usability; documentation of core functions that cannot be accessed by persons with disabilities; documentation on how to configure and install the item to support accessibility; and, for authoring tools, information on how the tool enables creation of accessible content “including the range of accessible user interface elements the tool can create”. DOLAR (c)(2) prescribes the same five, in the same order.

Row 12’s clock is worth copying exactly, because it is the only notification window in the Section 508 clauses codified in title 48:

“If the furnished ICT is determined to be non-compliant, the contracting officer shall notify the contractor of this determination, within 15 business days of determination of non-compliance. The contractor shall, at no cost to DOL, repair or replace the non-compliant products or services within the period specified by the contracting officer. The contracting officer makes the final decision to accept or not accept a contractor’s ICT that does not meet the Revised 508 Standards.”

Read the paragraph that clock sits in before assuming who signs the determination. DOLAR (d) opens “Before final Acceptance of ICT, including updates and replacements, DOL shall determine that the furnished ICT is in compliance”. The determination is DOL’s, and the clause does not say which official makes it. What the clause does assign to the contracting officer is the notification duty and the final accept-or-not decision. GSA’s separate Non-Compliance sample language goes further and puts the determination itself on the contracting officer: “the contracting officer determines that any furnished ICT item is not in compliance with such requirements, the contracting officer will promptly inform the offeror in writing of the noncompliance.” If you want the determination on the contracting officer rather than on an unnamed agency function, draft GSA’s version.

One word that changes what the clause obliges

A VPAT is a blank template published by the Information Technology Industry Council. An ACR is the completed report. A clause that demands “a VPAT” has, read literally, demanded a blank form.

DOLAR 2952.239-70 as codified prints “Voluntary Product Assessment Template (VPAT)” and asks at (b) for “test results to verify conformance of the Voluntary Product Assessment Template (VPAT)”. The template’s real name is Voluntary Product Accessibility Template, and GSA’s own sample language gets the deliverable right: “an Accessibility Conformance Report (ACR) for each ICT item […] based on the latest version of the Voluntary Product Accessibility Template (VPAT®)”. Draft the ACR wording, not the VPAT wording.

The organization’s name is garbled in the other direction on the GSA page. It prints “the Industry Technology Industry Council (ITIC)” and then requires the ACR to be “completed according to the instructions provided by ITIC”. DOLAR gets it right: “the Information Technology Industry Council (ITI)”. Cite the instructions, not the acronym, or a vendor gets to argue about which body’s instructions were meant. Reviewers who have to judge what a completed report actually says will find the criteria in how to score a vendor’s ACR.

A parallel precision note applies to the two words this whole subject mixes up. Federal sources genuinely use them interchangeably: GSA’s Table 7 row is “Section 508 compliance is considered in market research”, while DOLAR’s clause is headed “Section 508 Requirements” and its text says the ICT “shall conform”. Use conformance for the technical property of the ICT measured against the standard, and compliance for the legal state of the agency or the contract. Quoted federal text stays as written.

The counter-example that shows clause age is not clause strength

HHSAR 352.239-73 and 352.239-74 are both dated DEC 2015 and both still codified in July 2026. They use “electronic and information technology (EIT)”, cite 36 CFR part 1194 generically rather than the Revised Standards, and ask for an “HHS Section 508 Product Assessment Template” rather than an ACR. They also carry the sharpest sentence in the library, in two slightly different forms. HHSAR 352.239-74(b), the clause, says that where delivered EIT does not conform, “remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense”. HHSAR 352.239-73(d), the solicitation provision, says the same thing in the words “at its expense”, and extends it to claims later found untrue, “i.e., after award of a contract or order”. Quote whichever one is actually in your document. They are not the same paragraph and they do not read identically.

And then 352.239-74(c) reads, in the codified text: “The Section 508 accessibility standards applicable to this contract are: (Contract staff must list applicable standards)”. An unfilled paragraph (c) does not leave the clause with nothing at all, because (b) of the same clause says the applicable standards “are identified in the Statement of Work or Specification or Performance Work Statement”. What a blank (c) does is leave the clause pointing at whatever the statement of work happens to say, which on the evidence of the 18F boilerplate at the top of this page may be nothing. If you are the vendor and paragraph (c) is blank in your copy, that is a Q&A question, not a gift.

HHS also sets its own scope floor. HHSAR 339.205(a): Section 508 “specifies the applicable accessibility standards for all new solicitations and new or existing contracts or orders, regardless of EIT dollar amount”. There is no micro-purchase carve-out at HHS.

View the data as a table

	GSA sample language	DOLAR 2952.239-70	HHSAR 352.239-73 / -74
Currency	Page reviewed March 2026	Codified AUG 2024, the most recently dated 508 clause in title 48	Dated DEC 2015, still codified in July 2026
Standard it points at	The applicable Revised 508 Standards	36 CFR part 1194 appendices A and C	36 CFR part 1194 generically, not the Revised Standards
Evidence deliverable named	An Accessibility Conformance Report (ACR) for each ICT item	”Voluntary Product Assessment Template (VPAT)”: the blank form, read literally	An “HHS Section 508 Product Assessment Template” rather than an ACR
Who pays for remediation	Repair or replace “at no cost"	"at no cost to DOL, repair or replace the non-compliant products or services"	"the responsibility of the Contractor at its own expense”
Notification clock	Contracting officer will “promptly inform the offeror in writing"	"within 15 business days of determination of non-compliance”	None stated; DOLAR’s is the only window in title 48’s 508 clauses

The QASP: what turns a clause into something a COR can measure

FAR 37.604 sends quality assurance surveillance plans to subpart 46.4 and says “The Government may either prepare the quality assurance surveillance plan or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.” FAR 46.401(a) says the plans “should be prepared in conjunction with the preparation of the statement of work” and “should specify (1) All work requiring surveillance; and (2) The method of surveillance”. Read the verb. Those two contents are prescribed, not mandated, and the mandatory language in 46.401(a) attaches to quality assurance being performed rather than to what the plan says. They are still the first two columns of any accessibility surveillance table, because nothing else in the FAR tells you what a QASP has to contain.

GSA names six QASP sections that must carry Section 508: Performance Objectives and Standards, Performance Indicators and Acceptable Quality Levels, Surveillance Methods, Frequency of Surveillance, Remediation and Corrective Action, and Roles and Responsibilities (Including Section 508 in Quality Assurance Surveillance Plans, reviewed March 2026). GSA also states the purpose plainly: for ICT deliverables the QASP “should include verification of conformance with the Section 508 standards” and “should also specify how compliance with Section 508 standards will be verified. This ensures ICT accessibility is treated as a measurable, enforceable contract requirement.”

Put vendors on notice in the solicitation itself. GSA’s sample sentence:

“The agency will evaluate the Contractor’s compliance with Section 508 requirements using the Quality Assurance Surveillance Plan (QASP). Deliverables must conform to the Section 508 Standards (36 C.F.R. Part 1194), including the incorporated WCAG 2.0 Level AA Success Criteria (or a later WCAG version adopted by the agency), as verified through Section 508 conformance testing and ICT accessibility reviews described in the QASP.”

The surveillance table

GSA publishes five worked sample QASPs by project type with differentiated remediation clocks. The table below maps them into the five columns a surveillance plan needs, with hosting added from the clause library. Bracketed day counts are GSA’s own bracketed values, left bracketed because they are meant to be set per buy.

Requirement	Surveillance method	Frequency	Acceptable quality level	Artifact that evidences it
Websites and web content	Representative sample of webpages, “for example, 10% or a risk-based sample”, using automated scanning plus manual methods “such as the Trusted Tester process or equivalent testing procedures”	Each sprint review and before final release	No defects that prevent users with disabilities from completing required tasks; defects remediated within [5] business days; government determines severity	Sampled-page test report naming the method, plus retest record
Software applications	Automated tools on representative screens and workflows, manual inspection tools, functional testing with screen readers, voice recognition and magnification	Design, major development milestones, user acceptance testing, before release to production	Critical defects fixed within [10] business days, moderate within [20]	ACR plus supplemental report, plus definition-of-done evidence per release
Electronic documents	Accessibility checkers, manual inspection, screen reader testing	Draft submission and final deliverable	Non-conformant documents corrected within [10] business days and resubmitted	Per-document test result against the Accessible Electronic Documents Community of Practice harmonized guidance
ICT hardware	Review of vendor conformance documentation, tests of tactile keys, display contrast, audio output, input device compatibility, functional tests	Product design where applicable, demonstrations, on delivery, before final acceptance	Remediate, replace or provide equivalent conformant product at no additional cost	ACR per device model plus functional test record
Consulting and professional services	Accessibility checkers and manual inspection of documents, manual and automated evaluation of presentation materials, observation of live training including captioning	Design or outline stage, draft, final submission, and during live delivery	Issues corrected within [5] business days and resubmitted; materials re-delivered in conformant format at no additional cost	Conformant deliverable file plus observation record
Hosted service	Agency testing of the hosted solution to verify no reduction in conformance	Throughout the life of the contract	Existing level of conformance maintained	Dated test result against the hosted instance

Four of the five columns are GSA’s, restated. The artifact column is ADACP’s, not GSA’s: the sample QASPs describe testing and corrective action but do not say what document lands in the contract file at the end of each surveillance event, and a plan that does not name the artifact tends to produce an email instead of a record.

GSA’s own default remediation sentence sits behind all of these:

“The Contractor must remediate Section 508 defects identified by the agency within [10ß] business days of notification, unless otherwise approved by the Contracting Officer or COR. The agency will re-test to confirm that corrective action meets Section 508 requirements. The agency may reject the deliverable until the Contractor completes remediation and meets all Section 508 standards. Remediation will occur at no additional cost to the agency.”

The stray character in “[10ß]” is in GSA’s published text. Set the number deliberately rather than pasting it.

On scope, GSA gives the honest answer to “do we have to test everything”: “Accessibility testing described in a QASP should be risk-based and appropriate to the type of ICT deliverable. While agencies may not test every individual element of a product, they should test representative workflows, templates, and components that reflect typical and critical user interactions.”

And on evidence, GSA’s Roles and Responsibilities sample sets a minimum noticeably higher than a scanner export: the documentation “must include results for all applicable Section 508 standards, cover all major features, functions, and product workflows, and clearly describe the testing methodologies and tools used.”

Why “0 errors from an automated scanner” is the wrong acceptable quality level

There is a real, published federal QASP with an accessibility row, from GSA’s own digital services shop. The Search.gov Development Support Services QASP (18F/tts-buy-searchgov-development) has an “Accessible” row reading: performance standard “Web Content Accessibility Guidelines 2.0 AA (WCAG 2.0 AA) standards”; acceptable quality level “0 errors reported for WCAG 2.0 AA standards using an automated scanner and 0 errors reported in manual testing”; method of surveillance “http://wave.webaim.org/extension/ and manual review by Government personnel (TTS)”.

The instructive part is further down the same Performance Requirements Summary. Past Deployed and Documentation, the “Secure” row’s acceptable quality level reads “Remediation of critical or high issues within 30 days and moderate issues within 90 days”. Security got severity tiers and clocks. Accessibility got a scanner name.

Element	18F Search.gov QASP, accessibility row (2018)	GSA sample QASP language (reviewed March 2026)
Standard named	WCAG 2.0 AA	Section 508 Standards, 36 CFR part 1194, WCAG 2.0 Level AA (the Revised 508 Standards themselves say Level A and Level AA, at E205.4 and E207.2)
Test process named	One automated scanner, plus unspecified “manual review”	Automated tools, manual code inspection, assistive technology testing; Trusted Tester process or equivalent for web
Sampling stated	None	Representative sample, “for example, 10% or a risk-based sample”
Severity model	None	Minor versus major defects, government determines severity
Remediation clock	None in the accessibility row (30 and 90 days in the security row)	[5], [10] or [10]/[20] business days by project type
Evidence required of contractor	None named	ACR or test report, all applicable standards, all major workflows, methods and tools described

Write the acceptable quality level in task-completion terms, which is what GSA’s current sample does:

“All information and communication technology (ICT) deliverables shall meet Section 508 requirements with no accessibility defects that prevent users with disabilities from completing required tasks. Examples of minor defects may include cosmetic or low-impact issues that do not prevent users with disabilities from being able to perceive, operate, or understand the content. Major Section 508 conformance defects or repeated minor defects will result in the agency rejecting the deliverable until remediation is complete. The Government will determine the severity of accessibility defects and whether remediation is required before acceptance.”

Two cautions on that language. GSA notes agencies may instead require fully conformant deliverables with no leeway for minor defects. And GSA’s solicitation-phase guidance carries a much weaker sample on a page reviewed in the same month, March 2026: “An AQL is completed when testing is successfully completed using the contractor’s ACR”, alongside an admission on the same page that “Sample evaluation criteria for accessibility are still being developed” (Accessibility in Procurement II). The government has two live acceptable quality levels of very different strength. Choose the stronger one and say so in the QASP.

View the data as a table

Do	Don’t
Write the acceptable quality level in task-completion terms: no defects “that prevent users with disabilities from completing required tasks”	Do not write the acceptable quality level as “0 errors reported for WCAG 2.0 AA standards using an automated scanner”
Name the test method: automated scanning plus manual methods “such as the Trusted Tester process or equivalent testing procedures”	Do not leave the accessibility row clockless while the security row gets tiers: “Security got severity tiers and clocks. Accessibility got a scanner name.”
State the sampling rate, GSA’s own example being a representative sample, “for example, 10% or a risk-based sample”	Do not settle for the weaker federal sample, “An AQL is completed when testing is successfully completed using the contractor’s ACR”
Set the remediation clock in business days and split it by severity: GSA’s samples run to “[5], [10] or [10]/[20] business days by project type”	Do not paste GSA’s “[10ß]” as published; the stray character is in the source text, so set the number deliberately
Require documentation covering all applicable Section 508 standards, all major features, functions and workflows, and the methods and tools used	Do not promise element-by-element testing; GSA’s answer is that it “should be risk-based and appropriate to the type of ICT deliverable”

Whether a given evidence package will satisfy that surveillance method depends on what the method covers and who ran it, which is a separate question worth settling before you promise anything: see what the Trusted Tester process covers and what it does not.

Payment, holdback and the FAR remedies behind each clause

A clause with no remedy is a statement of intent. Six FAR provisions supply the remedies, and every one of them is quotable in a Q&A question or a cure notice.

Payment attaches to acceptance. FAR 52.232-1: “The Government shall pay the Contractor, upon the submission of proper invoices or vouchers, the prices stipulated in this contract for supplies delivered and accepted or services rendered and accepted, less any deductions provided in this contract.” This, and not a bespoke retainage paragraph, is the ordinary mechanism by which failing an accessibility acceptance criterion stops money moving.

The right to inspect cannot be contracted away. FAR 46.102(d): agencies shall ensure that “No contract precludes the Government from performing inspection”. FAR 52.246-4(c) for fixed-price services: “The Government has the right to inspect and test all services called for by the contract, to the extent practicable at all times and places during the term of the contract.”

Reperformance is at the contractor’s cost. FAR 52.246-4(e): where services do not conform, the government “may require the Contractor to perform the services again in conformity with contract requirements, at no increase in contract amount”. Where reperformance cannot cure the defect, the same paragraph lets the government “(1) Require the Contractor to take necessary action to ensure that future performance conforms to contract requirements; and (2) Reduce the contract price to reflect the reduced value of the services performed.”

FAR 46.407(b) states the general rule, and the two conditions built into it are the part vendors will read first: the contracting officer “ordinarily must give the contractor an opportunity to correct or replace nonconforming supplies or services when this can be accomplished within the required delivery schedule”, and “Unless the contract specifies otherwise (as may be the case in some cost-reimbursement contracts), correction or replacement must be without additional cost to the Government.” The no-cost rule is a default, not an absolute. On a cost-reimbursement contract, check what the contract says before promising a program office that remediation is free.

Holdback has a general authority, not an accessibility-specific one. FAR 46.407(f): “In the case of conditional acceptance, amounts withheld from payments generally should be at least sufficient to cover the estimated cost and related profit to correct deficiencies and complete unfinished work. The contracting officer must document in the contract file the basis for the amounts withheld. For services, the contracting officer can consider identifying the value of the individual work requirements or tasks (subdivisions) that may be subject to price or fee reduction.”

Be precise about what that means. No holdback or retainage clause for accessibility appears in the FAR, in GSA’s published sample language, in GSA’s sample QASP language, in HHSAR 352.239-73 or -74, or in DOLAR 2952.239-70. There is no published federal percentage, rate or formula for an accessibility holdback, so no percentage belongs in your clause on federal authority. The workable construction, which ADACP recommends rather than cites, is to size the withheld amount to the estimated cost and related profit of the specific remediation, using the FAR 46.407(f) subdivision method to value the individual work requirement that failed, and to record the basis in the contract file as 46.407(f) requires. That is a drafting decision the contracting officer owns and documents.

Rejection has to be prompt and in writing. FAR 46.407(g): “Notices of rejection must include the reasons for rejection and be furnished promptly to the contractor. Promptness in giving this notice is essential because, if timely nature of rejection is not furnished, acceptance may in certain cases be implied as a matter of law.” An accessibility defect sitting in a bug tracker for two quarters while invoices are paid is not a live rejection.

Commercial buys run on a clock. FAR 52.212-4(a) reserves the government’s right to inspect or test, and to require repair, replacement or reperformance at no increase in contract price, but adds: “The Government must exercise its postacceptance rights (1) within a reasonable time after the defect was discovered or should have been discovered”. A defect found at a QASP checkpoint is a far stronger position than the same defect found in year three.

GSA’s FY 2025 report puts the whole set into one recommendation to agencies: “Require all ICT contracts to include defined testing methodologies and right-to-repair provisions to ensure vendors fix, replace, or correct non-conforming products at their own expense.” Read in context, “right-to-repair” there means the government’s contractual right to make the vendor fix it, not the consumer movement of the same name. GSA pairs it with a payment-control recommendation: “Reject contract deliverables that fail to meet Section 508 requirements to ensure agencies only pay for ICT products and services that meet federal standards and contractual obligations.”

View the data as a list

1. Inspect before acceptance: FAR 46.102(d)
2. Reject promptly, in writing: FAR 46.407(g)
3. Correct at no added cost: FAR 46.407(b)
4. Withhold, pay on acceptance: FAR 46.407(f), 52.232-1

The commercial-items limit

None of the bespoke language above pastes freely into a FAR Part 12 buy. FAR 12.302(c): the contracting officer “shall not tailor any clause or otherwise include any additional terms or conditions in a solicitation or contract for commercial products or commercial services in a manner that is inconsistent with customary commercial practice for the item being acquired unless a waiver is approved in accordance with agency procedures”, and the waiver request must describe the customary commercial practice, support the need for the departure and include a determination that customary practice is inconsistent with the government’s needs.

Inspection and acceptance at 52.212-4(a) is not on the do-not-tailor list at 12.302(b), so a targeted accessibility acceptance criterion is defensible. A full bespoke testing, holdback and escalation regime bolted onto a commercial software-as-a-service subscription is the kind of departure that needs the waiver. For that case, route the control to ACR review at evaluation plus the FAR 39.203(b) and (c) vehicle-and-order mechanics, rather than to invented contract terms.

The escalation swimlane, with the federal failure point marked

Table 7 of the FY 2025 assessment gives, for each acquisition activity, the share of agencies performing it “Almost always (≥90%)”: market research 38%, solicitations 48%, technical evaluation 42%, compliance or performance clauses 38%, escalation of nonconformance 45%, verification of deliverables 30%. Laid along the lifecycle, the curve falls at the post-award gates, and GSA says so in words: “While parent agencies and components show broadly similar outcomes, post-award practices, such as verification of deliverables and escalation of accessibility defects, remain the weakest and most inconsistent steps.”

GSA’s diagnosis of the pattern is the sentence to put on the first slide of any internal briefing about this: “Response data show a consistent pattern: agencies more often include Section 508 requirements than verify and enforce them. This gap between requirements-setting and follow-through limits vendor accountability and increases the likelihood that nonconformant ICT is accepted.”

Gate	Who acts	Artifact produced	Authority	GSA “almost always” figure
Requirements planning	Requiring activity, program manager	Work statement identifying applicable standards, user needs and any exception or exemption	FAR 7.103(q), 11.002(f)	Market research 38%
Solicitation	Contracting officer	Clause set plus QASP notice sentence plus ACR submission instruction	FAR 39.203(a); GSA sample language	Solicitations 48%
Technical evaluation	Evaluation panel, 508 program manager	Scored ACR review against the named standard	No FAR authority; agency source selection plan	Technical evaluation 42%
Award	Contracting officer	Executed clauses, including test method, evidence deliverables and right to test; on an indefinite-quantity vehicle, the list of supplies and services the contractor calls compliant and where the details live	Agency supplement clause; FAR 39.203(b)	Compliance or performance clauses 38%
Order issuance	Requiring and ordering activities	Order-level conformance confirmation or documented exception or exemption	FAR 39.203(c)	Not separately measured
QASP surveillance	COR, agency testers or third-party testers	Dated test results against sampled workflows, retest records	FAR 46.401(a), 37.604	Verification of deliverables 30%
Nonconformance determination	Contracting officer	Written determination and notice of rejection stating reasons	FAR 46.407(g); DOLAR (d) 15 business days	Not separately measured
Escalation	Contracting officer, program office	Cure notice, remediation plan with dated clock, withheld amount with documented basis	FAR 46.407(b) and (f), 52.232-1	Escalation of nonconformance 45%
Past performance	Contracting officer, COR	Accessibility as a rated performance factor	GSA guidance	Not separately measured

The empty authority cell on the technical-evaluation row is not an oversight, and it is the same hole this article opened with. FAR 39.203(b) is often cited there, but it is a content requirement for indefinite-quantity contracts and a waiver of pre-award exception confirmation. It confers no evaluation authority, and nothing else in FAR Part 39 does either. What scores an ACR at evaluation is the agency’s own source selection plan, which is exactly why 42% is the ceiling on that row.

The last row is the lever a vendor actually feels. GSA’s post-solicitation guidance is explicit: “Since Accessibility is a requirement for the product, it is important to include this as a performance factor in CPARS and other means of past performance tracking.” GSA’s FY 2025 recommendations go further: “Incorporate accessibility performance into contract renewals, past performance evaluations, and future award considerations.”

One honest limit. GSA’s report measures whether agencies escalate. No published federal source measures what happens after they escalate, or how often accessibility appears as a rated element in CPARS. Do not let a briefing deck turn “45% almost always escalate” into a claim about outcomes.

Reading the same contract file from the vendor’s side

Take the fifteen-row library and read it as a bill of obligations rather than a drafting kit. On a buy that uses GSA’s published language or a clause like DOLAR 2952.239-70, “we have a VPAT” discharges none of the following:

1. An ACR per ICT item, completed to the template publisher’s instructions, before acceptance. Not one corporate ACR covering a product family. Item by item, and for product substitutions. DOLAR names the Information Technology Industry Council; the GSA page prints ITIC. Either way it is the ITI instructions that govern.
2. A refreshed ACR at each option year where maintenance, upgrades and replacements are in scope.
3. A supplemental accessibility conformance report with five named contents, including explicit “documentation of core functions that cannot be accessed by persons with disabilities”. That row is not optional and cannot honestly be left empty.
4. Test results produced by a named method. For web and software under DOLAR, the harmonized process from the DHS Trusted Tester program. For Microsoft Office and PDF documents, the Harmonized Testing Guidance from the Accessible Electronic Documents Community of Practice. For everything else, a described testing process with results attached.
5. Process maturity and personnel competence you can evidence, at “a maturity level at least equivalent to the DHS Trusted Tester methodology” under DOLAR (a)(4). That is a process-and-competence requirement satisfiable by a documented equivalent method, which is different from a requirement that named individuals hold a certification.
6. A fully working demonstration before final acceptance that exposes where conformance is and is not achieved. A demonstration designed to hide the gaps does not satisfy the clause as written.
7. Independent government or third-party testing, before acceptance under GSA’s language, “at any time” under DOLAR (c)(3), and throughout the life of the contract on hosted solutions.

The consequence of an overstated report is also published. GSA’s sample language: “If the Government determines that Section 508 conformance claims provided by the contract holder represent a higher level of conformance than what is actually provided to the agency, the Government shall, at its option, require the contract holder to remediate the item […] to align with the contract holder’s original Section 508 conformance claims prior to acceptance.” The bracketed gap is a “(DOCX)” link artifact in GSA’s published text, not part of the clause. HHSAR 352.239-73(d) reaches the same result after award, at the contractor’s expense.

Price it before the question deadline. GSA tells agencies plainly that this language costs money: “Use of these provisions and clauses may increase the cost of an award. Ask offerors to separate out these costs in their proposals, particularly if your agency anticipates that conformance to particular provisions of the Revised 508 Standards may warrant an exception for undue burden.” Separating accessibility test and evidence effort as a priced line is a position the government’s own guidance invites.

Seven questions worth filing before the Q&A window closes, each traceable to a specific gap above:

1. Which standard applies, stated as WCAG 2.0 Level A and Level AA under 36 CFR part 1194, and has the agency adopted any later WCAG version in this contract?
2. If the clause is HHSAR 352.239-74, what goes in paragraph (c), and if it stays blank, which document does paragraph (b) point to?
3. Which test method is required for each deliverable type, and is the harmonized process named with its version and publisher?
4. Is the deliverable an ACR, a supplemental report, both, and at what milestone?
5. What is the remediation clock in business days, and does it differ by defect severity?
6. Does the QASP define the acceptable quality level in task-completion terms or in scanner-error counts, and what sampling rate applies?
7. Will accessibility be a rated CPARS element?

One forward-looking note, and one closing warning

A proposed rule, FR Doc 2026-12559 at 91 FR 37550, published 23 June 2026 with comments closing 23 July 2026, would retitle FAR Part 39 to “Acquisition of Information and Communication Technology” and move the Section 508 material out of subpart 39.2 into 39.104-1 through 39.104-5, with the indefinite-quantity rule at a new 39.201 and the task-order rule at a new 39.301. None of that is in force. As of today the live FAR still reads Part 39 “Acquisition of Information Technology” with subpart 39.2 “Information and Communication Technology” at 39.201 through 39.205, and every pin cite in this article is written to the current text.

The warning is about pin cites generally. Section508.gov’s buy pages carry at least two stale citations, both to FAR 39.203(c). One says “If there are technically acceptable solutions available in the marketplace, you must select one of those solutions (39.203(c))”. The other says “As per the FAR (39.203(c)), testing must be performed regardless of the source”. Current 39.203(c) is about task and delivery orders under indefinite-quantity contracts. The nonavailability rule is 39.205(a)(3), mirrored at E202.7. And no provision of current FAR Part 39 imposes a testing requirement of any kind: the only mention of testing anywhere in the part is 39.103(b)(3), on delivery, implementation and testing of modular increments, which has nothing to do with Section 508. Verify every FAR pin cite against acquisition.gov before it goes into a solicitation, because a wrong citation in a clause is the first thing a protest or a dispute will find.

Agencies building this capability from a standing start, rather than one contract at a time, will need the budget argument as well as the clause text. The federal government’s own scores are the most useful place to start that conversation: see how to score your accessibility program against the federal benchmark and phase the spend.

Your next step

Open the draft solicitation, task order or renewal you are working on and check it against four things, in this order: does it name WCAG 2.0 Level A and Level AA under 36 CFR part 1194; does it name a test method by deliverable type; does it require an ACR plus a supplemental report before acceptance; and does the QASP carry an acceptable quality level written in task-completion terms with a remediation clock in business days. If any of the four is missing, it is a Q&A question if you are the vendor and a redline if you are the agency, and both have a deadline.

If the answer is that the clause already obliges more evidence than you can currently produce, the gap is an evidence package, not a contract argument. ADACP’s ACR authoring and vendor guidance covers what a conformance report and test record have to contain to survive the government exercising the right to test that its own clause reserves.