Five states that reach a vendor before Section 508 does

The sentence that sounds right and ends the wrong way

A state agency solicitation lands with an accessibility paragraph in it. Your Accessibility Conformance Report is written against the Revised Section 508 Standards. Someone on the bid call points out that Section 508 binds federal agencies and this buyer is a state, so 508 does not apply.

That is correct, and it is the wrong thing to say next. Section 508 does not reach a state agency by force of federal law. What reaches you is whatever that state chose to adopt, at its own version and scope, with its own paperwork.

Be precise about the mechanism, because the mechanism decides whether you can push back. Across the five states below, exactly one statutory sentence speaks to a vendor directly: California Government Code 7405(b). In the other four the duty runs to the buying agency, and the agency is then told, by rule or published standard or a procurement page, to obtain something from you.

Watch the noun as well as the verb. Of the five documents that reach a vendor, one is a statute (California), one is a mandatory rule (Texas), one is a state agency standard (Minnesota), one is recommended clause text on an agency web page (Illinois), and one is a guidance page written under a rule (Colorado). Only two of the five are law. Texas is the one that writes down what happens when you cannot produce the document.

View the data as a list

Five documents that reach a vendor: Only two of the five are law

• California: Statute, and law
• Texas: Mandatory rule, and law
• Minnesota: State agency standard, not law
• Illinois: Recommended clause text, not law
• Colorado: Guidance page, not law

Fifty states exist and five were researched here. Nothing below generalizes to the other forty-five, and nothing carries from one of these five to another. For state number six the method is four questions: which statute, which instrument that statute authorizes, which WCAG version and which published edition the instrument names, and whether the duty runs to the agency or to you. Our Section 508 compliance work starts by pinning the buyer’s instrument, because the instrument sets the test scope.

Section 508 says who it binds, in one sentence

36 CFR 1194.1 provides: “The standards for information and communication technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act are set forth in Appendices A, C and D to this part.” Appendix A repeats it at E101.1: “Compliance with these standards is mandatory for Federal agencies subject to Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d).”

Federal agencies. So a state solicitation citing Section 508 is citing a federal rule that some state instrument imported, and the import is where the variation lives.

What each of the five demands, and of whom

	California	Minnesota	Illinois	Texas	Colorado
Statute	Gov’t Code 7405	Minn. Stat. 16E.03 subd. 9	30 ILCS 587	Gov’t Code 2054.451 to 2054.465	C.R.S. 24-85-103 and 24-34-802
Operative standard	36 CFR part 1194, cited in the statute itself	Minnesota Digital Accessibility Standard v4.00	IITAA 2.1 Standards	1 TAC 206.50 for web pages; 1 TAC 213.10 for applications and operating systems; 1 TAC 213.18 on procurement; 1 TAC 213.22 on conflicting federal standards	8 CCR 1501-11
WCAG version	Statute names none; Gov’t Code 11546.7 names “2.0, or a subsequent version” at minimum Level AA	Statute names 2.0; standard requires 2.1 A and AA, 4.1.1 exempt	2.1 Level AA	2.0 Level AA, excluding Guideline 1.2 Time Based Media, in 206.50 and 213.10; 213.17 as amended 16 June 2026 carves out EIR required to comply with the DOJ Title II Rule	2.1 A and AA, pinned to the 21 September 2023 edition
Who is covered	State governmental entities; entities contracting with a state or local entity subject to Section 11135	Executive branch state agencies; “State agency” excludes MnSCU unless stated elsewhere	Executive, legislative and judicial branches and public universities; not local government, school districts or community colleges	Executive, legislative and judicial state agencies, including university systems and institutions of higher education	Any state or local government, and their departments, agencies, special districts and instrumentalities
What the vendor is asked for	An agreement to respond to and resolve accessibility complaints	Conformance of the deliverable itself	Most recent VPAT or ACR, “where applicable”	VPAT or ACR URLs, or other credible evidence	ACR, test methods, defect list with a plan, third-party report, accessibility commitment
Force of that ask	Statutory	State agency standard	Recommended clause text on an agency page	Mandatory administrative rule	Agency guidance page, not the rule
Private enforcement against the covered entity	Not addressed in 7405	Not addressed in 16E.03	Not addressed in 30 ILCS 587	Expressly none: “This subchapter does not create a cause of action”	Remedies run to plaintiffs against the public entity: $3,500 per plaintiff per violation

Three things there are worth stating flat. One of the five attaches a number to a violation, and it is Colorado, where the number is assessed against the public entity rather than against its vendor; no penalty figure appears anywhere in the California, Minnesota, Illinois or Texas sources. One of the five expressly forecloses private enforcement, and it is Texas, which also has the strictest vendor documentation rule in the set. And the “not addressed” cells are not immunity: those three statutes are silent, but a person may still have claims under other law, including ADA Title II and, in California, Government Code 11135.

California: the one provision written at the vendor

California’s conformance duty runs to the buyer. Government Code 7405(a) requires that “state governmental entities, in developing, procuring, maintaining, or using electronic or information technology … shall comply with the accessibility requirements of Section 508 … and regulations implementing that act as set forth in Part 1194 of Title 36 of the Federal Code of Regulations.” That last phrase is the statute’s own wording, quoted unaltered. California imports a rule whose operative sentence says it sets standards for federal agencies.

Subdivision (b) is the sentence written at you: “Any entity that contracts with a state or local entity subject to Section 11135 for the provision of electronic or information technology or for the provision of related services shall agree to respond to, and resolve any complaint regarding accessibility of, its products or services that is brought to the attention of the entity.”

Read what it asks for. It is a complaint-handling covenant, not a conformance obligation, and it is qualified twice. The counterparty must be “subject to Section 11135,” which pulls local entities in only where the program is state conducted, state funded or receives state financial assistance. And what you agree to is to respond and resolve, not to certify a version.

Conformance pressure arrives from elsewhere. SAM 4833, revised 04/2025, states that “state entities, as well as any contractors or vendors working for them, are responsible for ensuring” that public websites and internal systems are accessible. Government Code 11546.7(a) then puts a signed certification on the agency’s own home page “Before July 1, 2019, and before July 1 biennially thereafter,” attesting compliance with sections 7405 and 11135 “and the Web Content Accessibility Guidelines 2.0, or a subsequent version … at a minimum Level AA success criteria.” An agency signing that biennially has a reason to ask you for evidence, though no statute tells it what evidence to ask for.

View the data as a table

	Gov’t Code 7405(a)	Gov’t Code 7405(b)	SAM 4833	Gov’t Code 11546.7(a)
Who it names	State entities	Vendors of an entity under Section 11135	State entities and their vendors	The agency, on its own home page
What it asks for	Comply with Section 508 and Part 1194	Agree to respond to and resolve a complaint	Public sites and internal systems, usable by all	A signed page notice, every two years
What a vendor takes from it	The duty runs to the buyer	Respond and resolve, not certify	Names vendors, not just the state	The agency will need evidence

Minnesota: the statute says 2.0 and the standard says 2.1

Minn. Stat. 16E.03, subd. 9(b) directs that the state standards “must incorporate section 508 of the Rehabilitation Act … and the Web Content Accessibility Guidelines, 2.0,” then adds that the chief information officer “may incorporate the revisions in the accessibility standards.”

The CIO did. The State of Minnesota Digital Accessibility Standard, version 4.00, effective 1 July 2024, requires “Web Content Accessibility Guidelines (WCAG) 2.1 levels A and AA,” with one carve-out: “Success Criterion 4.1.1 (Parsing) is exempt in anticipation of WCAG 2.2.” Quoting the statute at a Minnesota buyer and offering a WCAG 2.0 report is quoting the floor, not the deliverable.

Minnesota is the clearest of the five on where your own equipment stops being in scope. The standard says “External websites provided under contract must comply to the Standard,” then draws the line: it “applies to the products and services being procured by State agencies and not a contractor’s own internal workplace ICT.” The website you build must conform; the office system you build it on does not. The next sentence closes the gap: “If the deliverable requires State employees or citizens to use a particular application, website, or other tool, then that application/website/tool must be accessible.”

Two scope limits matter to a bid decision. The standard “applies to executive branch state agencies,” with other branches “encouraged to follow” it, and it does not reach backward: it “does not apply to any procurement or development process initiated before September 1, 2010.”

If a deliverable cannot conform, Minnesota has a named route and it is the buyer’s to walk. Subdivision 10 provides that “Exceptions to the standards may be granted by the chief information officer based upon a request by an agency,” and subdivision 9(c) lets that officer modify a standard that “poses an undue burden to the state,” “provided written findings and rationale are made explaining the deviation.” Neither is a vendor filing; what you supply is the written basis for one.

Illinois: recommended clause text, not a statutory command

Illinois asks for the artifact a vendor recognizes, in the softest instrument of the five. The statute at 30 ILCS 587/15 directs that the standards “shall address, at a minimum” three things, of which item (2) is “recommendations for procurement language that can be incorporated into existing State procurement processes to ensure compliance with accessibility standards.” Recommendations, not a command.

The Illinois DoIT procurement page carries the clause and frames it the same way: “the State should include a requirement similar to the following whenever procuring information technology.” Inside the clause the ask is hedged again: “Where applicable, vendor shall provide the State of Illinois their most recent Voluntary Product Accessibility Template/Accessibility Conformance Report (VPAT/ACR).” The same page names what it will take: “The State of Illinois accepts ACRs based on the 508, WCAG, and INT versions of the VPAT.”

The standard itself is firm on version and date. The IITAA 2.1 Standards require “WCAG 2.1 Level AA” and “apply to information technology developed, procured, or substantially modified by State of Illinois entities after June 24, 2024. Technologies developed or procured prior to this date are subject to the IITAA 2.0 Standards which required compliance WCAG 2.0 Level AA.” That date tracks the federal one: the DoIT updates page records that Illinois published its updated standards on 24 April 2024 effective 24 June 2024, the publication and effective dates of the DOJ Title II web rule. Its scope stops short of where a vendor might assume: 30 ILCS 587/10 says “State entity” “does not include units of local government, school districts, or community colleges.”

Texas: the only rule that says what happens if you cannot produce the document

Texas incorporates the federal standard weakly, then compensates with a procurement rule stricter than anything else here. Gov’t Code 2054.453(b) says only that “In adopting rules under this section, the department shall consider the provisions contained in 36 C.F.R. Part 1194.” Consider, not adopt.

Read the chapter number before the section number. Texas splits its technical standards across two chapters of the Administrative Code, and its own rules name them together as “Chapter 206 and/or Chapter 213 of this title.” Web pages sit in Chapter 206. 1 TAC 206.50(a) requires that “all new or changed web pages must comply with … the standards referenced in US Section 508 Appendix C Chapter 7 §702.10 (WCAG 2.0 Level AA excluding Guideline1.2 Time Based Media),” the missing space in “Guideline1.2” being the rule’s own. Its subsection (d) puts a testing duty on the buyer: “all new or changed web page/site designs must be tested by the state agency using one or more EIR accessibility validation tools.” 1 TAC 213.10 fixes the same version for “all software applications and operating systems EIR.” A web ACR scoped to 213.10 alone is scoped to the wrong rule.

Texas is the only one of the five whose own adopted technical standard still sits on WCAG 2.0, and its exception rule now points past it: 1 TAC 213.17 as amended carves out EIR “required to comply with the DOJ Title II Rule,” and that rule sits on WCAG 2.1.

Then comes the rule to read line by line. 1 TAC 213.18(a) requires that “the agency shall require a vendor to provide accessibility information for the purchased products or services, where applicable,” through URLs to manufacturer’s VPATs or ACRs for commercial off the shelf products, or “other documents/forms requested by the agency that provide credible evidence of the vendor’s capability or ability to produce accessible EIR products and services.” Then the consequence no other state here writes down: “(3) If credible accessibility documentation cannot be provided, then the EIR shall be considered noncompliant.”

View the data as a list

1. Agency asks for evidence: 1 TAC 213.18(a)
2. Vendor sends VPAT or ACR: Or other credible evidence
3. Nothing credible arrives: The rule names this case
4. The EIR is noncompliant: Stated in the rule itself

Two further subsections change what you should budget. Subsection (c) extends the subchapter to EIR “developed, procured, or materially changed by a contractor under a contract with an agency, which requires the use of such product to a significant extent in the performance of a service or the furnishing of a product.” Subsection (f) puts a dollar figure on independent testing: it “must be performed by a third-party testing resource or knowledgeable state agency staff member to validate compliance with 1 Texas Administrative Code § 206.50 and this chapter for any EIR development project whose costs exceed $500,000” and that takes a year or longer to reach operations status, involves more than one state agency or institution of higher education, or substantially alters work methods or service delivery. Read who owes that testing and what satisfies it: the duty is the agency’s, and a knowledgeable state employee satisfies it as fully as an outside lab does.

Those subsection letters date from June 2026. The Department of Information Resources adopted amendments to 1 TAC 213.11, 213.13 and 213.17 through 213.22 “without changes to the proposal as published in the March 13, 2026, edition of the Texas Register (51 TexReg 1469),” effective 16 June 2026. Three changes decide whether the citation in front of you is current. The old 213.18(a), which set duties for the department’s own commodity contracts, moved to a new 213.4, so the old (b) is now (a), the old (d) is now (c), and the $500,000 testing paragraph is now (f). The old 213.22, titled “Holdover,” was repealed and replaced by a new 213.22 titled “Applicable Standards,” quoted later in this article. And 213.17 was rewritten to name the DOJ Title II Rule and to change “significant difficulty” to “significant barrier.” Copies of Chapter 213 still circulating on third-party mirrors carry the pre-2026 lettering. The department took no action on 213.10, 213.12 and 213.15, so those stand as they were.

Exceptions have two differently named owners depending on the instrument. The statute at 2054.460(e) says “The executive director of the state agency shall make the final decision on whether this section applies. The decision may not be appealed.” The rule at 1 TAC 213.17(3) says “The agency head must approve in writing exceptions for a material difficulty or expense pertaining to significant barriers to users under Texas Government Code § 2054.460 …” either “(A) prior to the procurement, completion, use, or deployment; or (B) at the point the barrier is identified if the vendor is unable to immediately remedy the failure to comply with Chapter 206 and/or Chapter 213 of this title.” None of it is privately enforceable: Gov’t Code 2054.465 reads, in full, “This subchapter does not create a cause of action.”

Colorado: the only one with a number attached

Colorado is where the paperwork question becomes a money question, and the first thing to fix is whose money. C.R.S. 24-34-802(1)(c)(I), as amended by HB 24-1454, makes it a discriminatory practice for “a public entity or state agency … to fully comply, on or before July 1, 2024, with the accessibility standards for individuals with a disability established by the office of information technology pursuant to section 24-85-103,” and adds that “Liability for noncompliance as to content lies with the public entity or state agency that manages the content.” The fine attaches to that practice, so it runs against the buyer, not against you. What reaches your desk is the buyer’s need to purchase its way clear of it, which is why Colorado agencies ask for the longest document list of the five.

The number sits at C.R.S. 24-34-802(2)(a)(III): “A statutory fine of three thousand five hundred dollars, payable to each plaintiff for each violation.” SB 23-244 added the sentence that stops it multiplying: a violation “must be considered a single incident and not as separate violations if the violation occurred on a single digital product, including a website or an application.” The same section carries one reduction, at 24-34-802(2)(d): “a small business defendant” gets a fifty percent cut “if it corrects the accessibility violation within thirty days after the filing of the complaint,” small business being “an employer with twenty-five or fewer employees and no more than three million five hundred thousand dollars in annual gross income.”

The timing matters more than the number. HB 24-1454 also created a conditional good-faith immunity for public entities running to 1 July 2025 and repealed it on that date by its own terms: “This subsection (1)(c)(II) is repealed, effective July 1, 2025.” A Colorado agency asking you for evidence in 2026 is doing so without a grace period.

The rule reaches contracted work directly. 8 CCR 1501-11, current version effective 30 June 2025, applies “to all information and communication technology (ICT) in active use, whether public-facing or internal-facing, that the public entity provides or makes available directly or through contractual, licensing, or other arrangements.” Its third-party content exception closes on you: such content is excepted “unless the third party is posting due to contractual, licensing, or other arrangements with the public entity.” Section 11.4 pins the standard at WCAG 2.1 A and AA “as published on Sep. 21, 2023, not including any later amendments or versions.” Colorado is also the only one of the five whose rules reach local government on their own terms.

What an agency will ask for is set out on the OIT Vendor Accessibility Guide: an ACR, “A description of the tools and methods you used to test your product for accessibility,” a list of issues found “and a plan for fixing them,” any third-party test report, and information on the company’s commitment. The page leaves the door open on partial conformance: “If your product isn’t fully compliant, you can still work with the state,” and “The agency may also require you to have your product evaluated by an acceptable third-party vendor.” The guide is guidance; the statute and the rule are the law.

Date	Colorado event
30 June 2021	HB 21-1110 approved
1 July 2022	Written agency accessibility plan due to OIT, C.R.S. 24-85-103(3)(a)(I)
20 April 2023	SB 23-244 approved
14 April 2024	First version of 8 CCR 1501-11 effective
24 May 2024	HB 24-1454 approved
1 July 2024	Full-implementation deadline; rules apply to ICT in active use from this date
30 June 2025	Current version of 8 CCR 1501-11 effective
1 July 2025	Good-faith immunity ends and repeals itself

No two of these governments cite the same document

The version row above understates the problem, because two governments can name WCAG 2.1 and still mean different files.

Instrument	Version and edition it points at	Exact wording
36 CFR part 1194, Appendix A, E205.4	WCAG 2.0	”conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0”
Texas 1 TAC 206.50, web pages	WCAG 2.0 Level AA, minus one guideline	”WCAG 2.0 Level AA excluding Guideline1.2 Time Based Media”
Texas 1 TAC 213.10, applications and operating systems	WCAG 2.0 Level AA, minus one guideline	”WCAG 2.0 Level AA excluding Guideline 1.2 Time Based Media”
Minn. Stat. 16E.03 subd. 9(b)	WCAG 2.0, as a floor the CIO may move	”the Web Content Accessibility Guidelines, 2.0”
Minnesota Standard v4.00	WCAG 2.1 A and AA, minus 4.1.1	”WCAG 2.1 levels A and AA … Success Criterion 4.1.1 (Parsing) is exempt”
Illinois IITAA 2.1	WCAG 2.1 Level AA	”WCAG) 2.1 Level AA”
Colorado 8 CCR 1501-11 s.11.4	WCAG 2.1 A and AA, 21 September 2023 edition, frozen	”as published on Sep. 21, 2023, not including any later amendments or versions”
California Gov’t Code 11546.7(a)	WCAG 2.0 or later, rolling	”the Web Content Accessibility Guidelines 2.0, or a subsequent version”
28 CFR 35.104	WCAG 2.1, 5 June 2018 edition	”WCAG 2.1, W3C Recommendation 05 June 2018”
W3C, current edition of WCAG 2.1	WCAG 2.1	”W3C Recommendation 06 May 2025”
W3C, WCAG 2.2	WCAG 2.2, cited by none of the five	”W3C Recommendation 12 December 2024”

Read the 28 CFR 35.104, Colorado and W3C rows together. DOJ incorporated the 5 June 2018 edition of WCAG 2.1. Colorado froze the 21 September 2023 edition. The current W3C Recommendation for WCAG 2.1 is dated 6 May 2025, and none of these governments cites it. WCAG 2.2 has been a W3C Recommendation since 12 December 2024, and none of the five points at it either; its only appearance in any of their instruments is Minnesota exempting Success Criterion 4.1.1 “in anticipation of WCAG 2.2.” “We conform to WCAG 2.1 AA” is not a complete answer to any of them, and a report naming the edition it tested against is worth more than one that does not. The full version-by-rule matrix for the federal rules sits behind this one.

Why these five are asking now

All five states are themselves public entities under ADA Title II, which now carries a technical standard and a date. 28 CFR 35.200(b)(1) provides that “Beginning April 26, 2027, a public entity, other than a special district government, with a total population of 50,000 or more shall ensure that the web content and mobile apps that the public entity provides or makes available, directly or through contractual, licensing, or other arrangements, comply with Level A and Level AA success criteria and conformance requirements specified in WCAG 2.1,” with 26 April 2028 for smaller entities. Those are the extended dates: DOJ’s interim final rule of 20 April 2026 moved the first from 24 April 2026 and the second from 26 April 2027.

That “directly or through contractual, licensing, or other arrangements” is why an agency’s deadline becomes your paperwork. What Title II requires of a public entity is a separate question from what its state statute requires, and an agency can be short of one while satisfying the other.

What nobody has settled

None of these five provisions has a reported construction. A search of the CourtListener opinion database on 24 August 2026 for Cal. Gov’t Code 7405, Minn. Stat. 16E.03, 30 ILCS 587, Tex. Gov’t Code 2054.465 and C.R.S. 24-34-802 returned no decision construing any of them. The two hits on the Colorado citation are Court of Appeals decisions from 1976 and 1979, decided decades before the 2021 amendment that put digital accessibility into that section. Treat every mechanic above as text on the page rather than as construed law.

Texas points at two WCAG versions at once. 1 TAC 206.50 and 213.10 sit on WCAG 2.0, while the 213.22 adopted on 16 June 2026 instructs that “To the extent that there is a discrepancy between discrete federal standards, state agencies shall adopt the higher of the two standards,” and 213.17 names the DOJ Title II Rule, which sits on WCAG 2.1. The department proposed adding the DOJ Title II Rule to 213.10 itself in March 2026 and then took no action on that section in June, so the gap is on the face of the current rules. How 213.22 resolves it is not answered in any Texas source read here. Put it to the contracting officer in writing before bid: name the chapter, the section and the WCAG version you propose to test against, and ask the agency to confirm or correct that on the solicitation record.

Colorado’s rule and its enabling statute point in different directions. The statute directs rules “based on and including, but not limited to, the most recent web content accessibility guidelines”; the rule freezes the September 2023 edition. Separately, the statute makes failure “to fully comply” with the OIT standards a discriminatory practice while section 11.5 of the rule offers alternative compliance routes, one of which is publishing and annually updating an accessibility plan. Whether the second answers the first is unresolved on the face of both.

What to put in the response file

The accessibility half of this is concrete, and it is close to identical across all five states even though the legal instruments are not.

View the data as a list

The response file: Close to identical across all five states

• ACR, version and edition: Plus the VPAT edition used
• Test method: The tools, and how you tested
• Defect list: With a plan for fixing them
• Third-party report: Where the buyer asks for one
• Version note per state: Texas 2.0, the others 2.1

1. An ACR that names its version and its edition. Not “WCAG 2.1 AA” alone: the version, the level, the published edition tested against, and the VPAT edition the report was written on. Illinois is the only one of the five that says which VPAT editions it will take, and it names “the 508, WCAG, and INT versions.”
2. A description of what was tested and how. Colorado asks for the tools and methods in as many words; Texas accepts testing documents as credible evidence.
3. A defect list with a remediation plan. Colorado requires the issues found and the plan for fixing them, and says a product short of full conformance can still be bought on that showing.
4. A third-party report where the buyer asks for one. Colorado’s guide says an agency “may also require you to have your product evaluated by an acceptable third-party vendor.” Texas requires validation testing above a $500,000 development-project threshold, performed either by “a third-party testing resource or knowledgeable state agency staff member” (1 TAC 213.18(f)), and the duty is the agency’s. Ask which of the two the agency intends before you price it.
5. A version note per state. One report can carry a Texas WCAG 2.0 reading and a Minnesota, Illinois or Colorado WCAG 2.1 reading if it was scoped that way from the start. Retrofitting one into the other costs a re-test.

If you are buying rather than selling, the same list is the acceptance test, and the questions to ask before accepting a supplier’s ACR are its practical form.

One boundary, stated once. Whether a particular clause binds your company, whether an exception was validly granted, and what a contract shifts onto you are questions for your counsel, not accessibility questions. What sits on this side of the line is the evidence: a report scoped to the right standard at the right version, a written record of method, a defect register, and a retest that closes it.

That is what a VPAT and ACR engagement produces, and it is what these five states, in five instruments, all end up asking for. If your buyer is a state or local agency, our public sector accessibility work starts with the solicitation text and the state’s own operative standard rather than with a generic 508 report.