The six Section 508 exceptions are the agency's to claim, not yours

Four options, and the one that does not exist

Your draft Accessibility Conformance Report (ACR) has “Partially Supports” rows you cannot clear before the response date. The solicitation points at 36 CFR 1194.1 and gives you no clause, no instructions and no place to explain yourself. Somebody on the capture call says it: we will claim an exception.

You cannot. Not one of the six general exceptions in the Revised 508 Standards belongs to the vendor. Each is written as an agency determination, about ICT the agency is buying, already running, or has decided sits outside its scope. Two of them, E202.6 and E202.7, require the responsible agency official to document the basis in writing. Under the FAR every one of the six leaves paper in the contract file, either a written confirmation from the requiring activity under 39.204(b) or a written determination under 39.205(c). The question is not which exception you can claim. It is what the official needs in hand before signing one, and how much of it comes from you.

Assert an exception in your proposal narrative. This option does not exist. There is no vendor-side exception request in the Standards or in the FAR, and the provision most teams reach for, E202.4 Federal Contracts, does the opposite of what its heading suggests.

Feed the requiring activity’s Best Meets determination. For a commercial product this is the realistic path. E202.7 and FAR 39.205(a)(3) let an agency buy the closest conforming option when nothing on the market fully conforms. The official then has to write down three things. One of them, the list of requirements that cannot be met, is your ACR read back to them. A second, the description of market research, is only as good as the evidence you and your competitors handed over.

Remediate before submission, or commit to a dated roadmap, and accept that the agency decides whether that is enough. GSA tells agencies to make Section 508 conformance an evaluation factor in ICT selection, which is why what you can show about conformance is scored rather than filed.

No-bid.

An agency is never obliged to use an exception at all. GSA is explicit: “Although exceptions may be available, agencies can choose not to use them and instead require full Section 508 conformance for all information and communication technology (ICT). Claiming an exception is optional.”

View the data as a list

Four options on the capture call: Only three are real. No exception in the Revised 508 Standards is yours.

• Claim an exception yourself: This option does not exist, in the Standards or in the FAR
• Feed Best Meets: E202.7 and FAR 39.205(a)(3), the realistic commercial path
• Remediate before submission: Or commit to a dated roadmap the agency then judges
• No-bid: An agency is never obliged to use an exception at all

Who the six provisions are addressed to

The umbrella provision sets the ceiling. E202.1: “ICT shall be exempt from compliance with the Revised 508 Standards to the extent specified by E202.” Everything under it is scoped, and none of it is scoped to a contractor’s deliverable. The six are Legacy ICT (E202.2), National Security Systems (E202.3), Federal Contracts (E202.4), ICT Functions Located in Maintenance or Monitoring Spaces (E202.5), Undue Burden or Fundamental Alteration (E202.6) and Best Meets (E202.7).

Two turn on a written determination, and the Standards name the signer only as “the responsible agency official.” The Standards leave the role open: “The Standards do not define who the responsible official is or what their title should be. Each agency has the discretion to designate the responsible official and determine how that role is assigned.” GSA recommends authorizing officials for each of the six and publishes seven sample request forms, seven rather than six because Undue Burden and Fundamental Alteration get one each. In GSA’s own workflow the requestor is “the program office, acquisition official, or IT team” and the signature captured is the authorizing official’s. The vendor is neither.

The E202.4 trap, in five lines

The heading	E202.4 Federal Contracts
The actual text	”ICT acquired by a contractor incidental to a contract shall not be required to conform to the Revised 508 Standards.”
The misreading	”We are a contractor, this is a federal contract, so our deliverable is exempt.”
What it covers	The contractor’s own in-house tooling. FAR 39.204(a)(2) states it inline: “ICT acquired by a contractor incidental to a contract, i.e., for in-house use by the contractor to perform the contract.”
The consequence	An exception paragraph built on this reading tells the contracting officer, in writing, that you have not read the provision you cite.

GSA’s three-question test disposes of it. All three answers must be yes: is the contractor procuring the ICT, will only contractor personnel use it, and will ownership stay with the contractor when the contract ends. Anything that transfers to the agency, or that agency staff touch, fails.

GSA’s worked example puts the line where the deliverable begins: “While the ICT deliverable must conform to Section 508 requirements, the authoring tool used off-premises by a contractor to produce the ICT deliverable is covered by this exception and does not have Section 508 requirements.” The Access Board said the same in 2000 with a website: the site built for the agency must comply, “the firm’s own web site would not be covered.”

View the data as a table

Do	Don’t
Check all three GSA questions first: you procure the ICT, only your personnel use it, and ownership stays with you when the contract ends	Claim the deliverable is exempt because you are a contractor on a federal contract, when the deliverable must conform
Limit the list to your own in-house tooling, such as an authoring tool used off-premises to produce the deliverable	Include anything that transfers to the agency, or that agency staff touch, because it fails the test
Read the provision, not the heading: it reaches ICT acquired incidental to a contract, for in-house use by the contractor	Put an exception paragraph built on that reading in front of a contracting officer, in writing

The provision exists only because 40 U.S.C. 11101(6)(C) puts that equipment outside the statutory definition of information technology, beyond the Access Board’s reach, while 11101(6)(A) affirmatively pulls in equipment a contract requires the contractor to use. It is the residue, not the rule.

The six branches: what the official needs from you, and who signs

The officials named below are GSA’s recommendations, not the text of the Standards. Each agency designates its own.

Branch	Test that has to pass	What the official needs from you	Who signs, per GSA	Alternative means required
E202.2 Legacy ICT	Complied with an earlier standard issued pursuant to Section 508 and not altered on or after 18 Jan 2018 (E202.2). FAR 39.203(e) and GSA’s decision questions add that the agency deployed, maintained or used it on or before that date	Version and build history, a dated statement of what changed and what it touched, evidence the pre-2018 build conformed	CIO, Section 508 PM, ERB	Not by the Standards. GSA recommends it
E202.3 National Security Systems	Operated by the agency as part of a national security system per 40 U.S.C. 11103(a)	Nothing. This is the agency’s characterization of its own system	Agency head, CIO, Section 508 PM, ERB	Not by the Standards. GSA recommends it
E202.4 Federal Contracts	All three GSA questions yes: you procure it, only your personnel use it, you keep it	A list of your own in-house tooling and confirmation that none of it transfers	CIO, CAO, Section 508 PM, ERB, acquisition official	Not by the Standards. GSA recommends it
E202.5 Maintenance or monitoring spaces	Status indicators and hardware-based operable parts sit in spaces frequented only by service personnel	Inventory of which controls and indicators sit where, plus confirmation that remote management software is reported in scope	CIO, CAO, Section 508 PM, ERB	Not by the Standards. GSA recommends it
E202.6 Undue Burden or Fundamental Alteration	Significant difficulty or expense against resources available to the program or component (E202.6.1), or a design conflict changing the nature of the ICT	Provision-level cost and effort estimates tied to named provisions; for fundamental alteration, a statement of the design conflict	Agency head, CIO, Section 508 PM, ERB, with counsel consulted	Yes, E202.6.3
E202.7 Best Meets	Conforming ICT is not commercially available and the agency buys the closest option	Current ACR, named test method and scope, the provisions that cannot be met, market-research substance, dated roadmap	CIO, CAO, Section 508 PM, ERB. The responsible agency official documents under E202.7.1 and the contracting officer files the requiring activity’s determination	Yes, E202.7.2

Legacy ICT is not an age test

E202.2 covers a component “that complies with an earlier standard issued pursuant to Section 508 … and that has not been altered on or after January 18, 2018.” Old ICT that never conformed to the 2000 standards is not covered, and GSA’s decision questions demand a yes to whether the ICT “is known to have conformed” to those original standards. The Access Board is generous on one side: “a typical software security patch does not affect interoperability, user interface, or access to information and data; therefore, deployment of such software security patches would not be considered ‘alterations’.” The FAR is unforgiving on the other, at 39.203(f): “When altering any component or portion of existing ICT, after January 18, 2018, the component or portion must be modified to conform to the current ICT accessibility standards in 36 CFR 1194.1.” If your modernization touches the interface, the safe harbor closes on that component. Section508.gov’s line that this exception is not in the FAR is true only of 39.204 and 39.205: legacy ICT sits at 39.203(e), and 39.203(f) catches refresh work.

National security is a system characterization, not a customer type

40 U.S.C. 11103(a) lists five functional triggers, then carves routine administrative and business applications, “including payroll, finance, logistics, and personnel management applications,” back out of the fifth. The exception is statutory, mirrored at 29 U.S.C. 794d(a)(5). Classified subject matter does not transfer to the host: GSA’s example is a course about classified ICT that may qualify while the learning management system hosting it does not.

E202.5 is a wiring closet, not a back office

The provision reaches only status indicators and operable parts in spaces “frequented only by service personnel for maintenance, repair, or occasional monitoring of equipment.” The FAR defines operable parts as “hardware-based user controls,” which keeps software out. GSA’s router example: the power switch, reset button and status lights are covered, “but remote monitoring software is required to be accessible.” Industry asked for a back office exemption during the rulemaking and was refused in the 2017 final rule, the Board noting that “people with disabilities frequently perform ‘back office’ IT work.”

Undue burden is measured against the program, not your contract

E202.6.1 is the substantive test, worth quoting to anyone who thinks price is the metric: the agency considers “the extent to which conformance would impose significant difficulty or expense considering the agency resources available to the program or component for which the ICT is to be procured, developed, maintained, or used.” Not contract value, not the accessibility line item. GSA restates it: undue burden “is based on the resources available to the program or component, not just the resources budgeted for the ICT.”

E202.6.2, not E202.6.1, is the documentation duty, and it is the agency’s alone: “The responsible agency official shall document in writing the basis for determining that conformance to requirements in the Revised 508 Standards constitute an undue burden on the agency,” including “an explanation of why and to what extent” compliance would create one. The statute says the same at 29 U.S.C. 794d(a)(4), and GSA advises consulting management and counsel first. Fundamental alteration is a lighter paper trail and a different test, design conflict rather than cost: GSA’s examples are a business need for small, portable equipment when the only conforming equivalent is bulky, and an industry-standard file format that cannot support accessibility.

E202.6.3 then attaches. That duty is the agency’s, not yours, and FAR 39.205(b) puts it there too. What you can offer toward the agency’s alternate means of access is still worth putting in writing, because it is a field the agency has to fill in its own exception record.

Best Meets is the branch you can actually feed

E202.7 is a selection rule, not a waiver: where conforming ICT “is not commercially available, the agency shall procure the ICT that best meets the Revised 508 Standards consistent with the agency’s business needs.” The Access Board rejected the whole-product framing in 2000: agencies “cannot claim that a product as a whole is not commercially available because no product in the marketplace meets all the standards.”

E202.7.1 tells you what to write to. The official documents “(a) The non-availability of conforming ICT, including a description of market research performed and which provisions cannot be met, and (b) the basis for determining that the ICT to be procured best meets the requirements in the Revised 508 Standards consistent with the agency’s business needs.” FAR 39.205(c)(3) itemizes the same three elements. The list of provisions that cannot be met is your ACR read honestly, and the market research is only as good as the evidence the agency collected from you and your competitors. GSA’s decision questions name the artifact, asking whether the official evaluated “Accessibility Conformance Reports or test results.”

Read the closing clause of E202.7.1(b) carefully. “Consistent with the agency’s business needs” qualifies the selection: the official is picking the closest conforming option among those that meet the business need, not the closest conforming option outright. That clause is what your competitor will argue.

One limit. GSA states the exception is available only for commercial off-the-shelf products and “would not be applicable to custom ICT developed under contract,” and CMS goes further in its own policy, granting no exception of any type for custom ICT developed under contract. FAR 39.205(a)(3) speaks of “commercial products and commercial services,” which supports that reading, but E202.7 itself says only “not commercially available.” Treat COTS-only as GSA and CMS policy, not as the text of the Standards.

Where the paperwork actually lands

The FAR does not mirror E202. It sorts the same six by whether documentation and alternative-means duties attach.

Provision	FAR home	Documentation route
Legacy ICT	39.203(e), alteration duty at 39.203(f)	Applicability, not an exception filing
National Security Systems, Federal Contracts, Maintenance or monitoring spaces	Exceptions, 39.204	Written confirmation from the requiring activity, filed in the contract file, 39.204(b)
Undue Burden, Fundamental Alteration, Nonavailability	Exemptions, 39.205	Written determination from the requiring activity explaining the basis, filed in the contract file, 39.205(c); alternative means required by 39.205(b)

Citing 39.204 for an undue burden determination is a wrong-section citation in front of a contracting officer. The micro-purchase exception people still repeat is gone, sunset on 1 January 2003.

Your evidence enters upstream. FAR 11.002(f) makes the contracting officer obtain requirement documents identifying “any ICT accessibility standards that cannot be met due to an exception or an exemption for any component or portion of the product,” and FAR 7.105(b)(5)(iv) forces the exception into the written acquisition plan item by item, listing “the exception and/or exemption, and the item(s) to which it applies.” On an IDIQ, FAR 39.203(b) defers the determination to the order but still requires that the contract “identify which supplies and services the contractor indicates as compliant and show where full details of compliance can be found (e.g., vendor’s or other exact website location).” The FAR does not name the ACR there. It requires a pointer to where the detail lives, and for a commercial product that pointer is a published ACR.

There is no standard FAR Section 508 solicitation provision or contract clause to point at. The 2021 rule that put the Revised Standards into the FAR, FAR Case 2017-011 at 86 FR 44229, states that it “does not create new solicitation provisions or contract clauses.” Check the agency’s FAR supplement before asserting that flatly.

Check the FAR numbers before you paste them

Those numbers are current, and moving. Under the Revolutionary FAR Overhaul, model deviation text for Part 39 issued on 12 June 2025, and as of 27 July 2026 the deviation guide lists thirty agencies as having adopted a Part 39 deviation, among them DoD, VA, HHS, DHS, DOJ, Treasury, State, NASA, GSA and USDA. Your buying agency’s own regulation may already read differently.

The proposed rule at 91 FR 37550, FAR Case 2026-001, published 23 June 2026 with comments closed on 23 July 2026, renumbers the exceptions to 39.104-4 and the exemptions to 39.104-5 and moves legacy ICT to 39.104-3(c). It also moves the two rules this article leans on: the indefinite-quantity contract provision goes from 39.203(b) to 39.201, and the task and delivery order provision from 39.203(c) to 39.301. Substance carries over unchanged, including the in-house gloss on incidental contract items. As of this writing it is a proposed rule, not final.

View the data as a table

Time	Milestone	Detail
12 June 2025	Part 39 deviation text	Model text issued under the Revolutionary FAR Overhaul
23 June 2026	Proposed rule	91 FR 37550 renumbers exceptions to 39.104-4, exemptions to 39.104-5
23 July 2026	Comment period closed	As of this writing it is a proposed rule, not final
27 July 2026	Thirty on a deviation	Including DoD, VA, HHS, DHS, DOJ, Treasury, State, NASA, GSA and USDA

So cite 36 CFR part 1194 Appendix A, E202 for substance, because that text is codified and stable, and check the agency’s deviation status before putting a FAR number in a proposal.

This is not the same as “that provision does not apply to our product”

E202 is about an agency exempting ICT from conformance. A provision with no bearing on your product is E204.1: “Where the requirements in Chapters 4 and 5 do not address one or more functions of ICT, the functions not addressed shall conform to the Functional Performance Criteria specified in Chapter 3.” E204 routes it to Chapter 3 rather than excusing it.

The worksheet: what you assemble

GSA’s recommended exception record schema is the closest published spec for what you will be asked to supply, because the agency must populate it: ICT name, vendor, description, version, scope with “boundaries, conditions, or limitations such as specific features, modules, or users to which the exception applies,” justification, and the alternate means of access plan. Build to that shape before anyone asks. For a Best Meets branch, where most commercial bids land, that is five items:

1. A current ACR against the correct edition, matching the release you are offering.
2. A stated test method and scope, with assistive technologies and versions named.
3. A written list of the Revised 508 provisions that cannot be met, at provision level, not “some WCAG issues.”
4. Scope boundaries: which modules, features and user roles the shortfall touches, and which are unaffected.
5. A dated remediation roadmap you can be held to, plus what you can offer toward the agency’s alternative-means plan.

Items 1 and 2 are the two the official cannot write around. E202.7.1 requires a description of market research and the provisions that cannot be met, and neither can be produced from an untested product. That is what an ACR authoring engagement produces. If the product has never been tested against Revised 508 Chapters 4, 5 and 6 rather than WCAG alone, Section 508 conformance testing is the prerequisite, not the polish. For what happens to the package on the far side of the desk, see how a procurement reviewer scores a vendor’s ACR.

An exception is a clock, not a settlement

GSA recommends time-boxing every exception. Its authorization guidance says to set “an expiration or revalidation date between 12 to 36 months of issuance” and to review annually; the recordkeeping table on the same page gives a shorter default, typically 12 to 24 months. CMS limits its exceptions to one year or the next major release, whichever comes first. VA publishes a register of approved Section 508 exceptions with an expiration date on every row. Those decisions feed the annual Governmentwide Section 508 Assessment required by 29 U.S.C. 794d-1, and each determination is made by one agency’s responsible official and filed in that agency’s contract file, so a second agency starts from your evidence rather than from the first agency’s paperwork.

View the data as a table

	GSA	CMS	VA
Time limit	An expiration or revalidation date between 12 to 36 months of issuance	One year or the next major release, whichever comes first	An expiration date on every row of its published register
Where the number comes from	Authorization guidance; its recordkeeping table gives a shorter 12 to 24 months	The limit CMS sets on its own exceptions	A register of approved Section 508 exceptions that VA publishes

Next step

Before your next federal response, mark every ACR row you cannot defend with a named test method, a named assistive technology and version, and a provision-level description of the shortfall. That marked-up list, not an exception paragraph, is what the requiring activity needs to write a determination under E202.7.1 and FAR 39.205(c)(3). If it runs longer than the response window allows you to fix, ADACP’s federal procurement support produces those artifacts on a bid clock.