Why Title II and 504 arrive as an accessibility flow-down clause

If a renewal comes back with an accessibility paragraph nobody on your side drafted, it may read like the provision the University of Iowa requires in every agreement to provide a digital product. Conform to WCAG 2.1 AA and the Revised Section 508 Standards. Produce an audit on request. Remediate on demand. If you do not, the university may fix the product itself and subtract the cost from your future fees.

Neither federal rule behind that paragraph names a software vendor in its operative text. The word “vendor” does not appear anywhere in 45 CFR part 84, and in 28 CFR part 35 it appears 39 times, every one of them inside the part’s appendices, which carry the Department of Justice’s guidance and section-by-section analyses rather than regulatory text. Both rules bind buyers: a “public entity” under ADA Title II, a “recipient” of federal financial assistance under Section 504.

They still land on you, because both define their reach by arrangement rather than by ownership, and because DOJ said in the preamble what a public entity can do about that. Write it into the contract. The obligation therefore arrives in the only form it can take, as clause language on a renewal. This is the vendor’s side of that, and it is where our SaaS and software accessibility work starts.

The eight words that reach past the buyer

28 CFR 35.200(a) states the Title II obligation this way:

(a) General. A public entity shall ensure that the following are readily accessible to and usable by individuals with disabilities: (1) Web content that a public entity provides or makes available, directly or through contractual, licensing, or other arrangements; and (2) Mobile apps that a public entity provides or makes available, directly or through contractual, licensing, or other arrangements.

45 CFR 84.84(a) says the same with “recipient” in place of “public entity”, inside a subpart that also reaches self-service machines: 45 CFR 84.83 carries a kiosk provision, a bare nondiscrimination duty with no technical standard attached and no compliance date, and it has no Title II counterpart.

“Directly or through contractual, licensing, or other arrangements” is eight words, and it is identical in both rules. It appears in each rule’s general paragraph, in each rule’s compliance date paragraphs, and again, without its first three words, in each rule’s exceptions. 28 CFR 35.201(c) exempts “Content posted by a third party, unless the third party is posting due to contractual, licensing, or other arrangements with the public entity”, and 45 CFR 84.85(c) is word for word the same with “recipient” substituted. DOJ closed that door explicitly at 89 FR 31368: “this exception does not apply where a third party such as a vendor is acting on behalf of a public entity, through contractual, licensing, or other arrangements.” Content your platform puts on a customer’s site under a signed agreement is not third-party content in the sense the exception means.

The phrase is not new. It sits in the Title II general prohibition at 28 CFR 35.130(b)(1), part of a regulation issued in 1991, applied to any aid, benefit, or service, and the Section 504 general prohibition now numbered 45 CFR 84.68(b)(1) carries the same words. The 2024 rules moved it into the web and mobile app requirements, and HHS explained at 89 FR 40129 that ownership is beside the point: recipients “provide or make available web content and mobile apps even where recipients do not design or own the web content or mobile app, if there is a contractual, licensing, or other arrangement through which the recipient uses the web content or mobile app to provide a program or activity.”

DOJ then named the mechanism, at 89 FR 31346: “public entities can choose to work with providers who can ensure accessibility, and public entities can also include contract stipulations that ensure accessibility in third-party services.” At 89 FR 31367 it gives the reason: “a public entity may not delegate away its obligations under the ADA”, and the entity “retains responsibility for ensuring the accessibility of that content.” The buyer owes the outcome, cannot hand the duty to you, and has one instrument for managing the risk. The clause on your renewal is that instrument.

View the data as a list

1. The same eight words: In both rules, word for word
2. The exception does not apply: Not where a vendor acts for you
3. The duty cannot be delegated: The public entity keeps it
4. So it becomes a clause: Contract stipulations, on your renewal

Why the rules do not reach you, and the route by which they could

Title II binds a “public entity”, defined at 28 CFR 35.104 as a State or local government, an instrumentality of one, or the National Railroad Passenger Corporation and commuter authorities. Selling to one does not make you one.

Section 504 binds a “recipient”, which 45 CFR 84.10 defines as an entity “to which Federal financial assistance is extended directly or through another recipient … but excluding the ultimate beneficiary of the assistance.” Being paid a fee for software is not how assistance is extended, and the same section excludes “a direct Federal procurement contract or a contract of insurance or guaranty” from that assistance. One route does reach a software company: take an HHS grant directly, or a subaward passed through another recipient, and you are a recipient owing 45 CFR 84.84 on your own account. Whether your own website carries ADA Title III obligations is a separate question neither rule answers.

View the data as a table

	ADA Title II	Section 504
The party the rule binds	A public entity	A recipient
Where the term is defined	28 CFR 35.104	45 CFR 84.10
What the definition covers	A State or local government, an instrumentality of one, Amtrak and commuter authorities	An entity to which Federal financial assistance is extended, directly or through another recipient
Why a software vendor is not one	Selling to one does not make you one	Being paid a fee for software is not how assistance is extended

Which of your customers owes which date

Four dates matter, and the two rules do not share a day. Each was moved a year later in 2026 by an interim final rule.

Compliance date	Provision	Who it binds	Date before the 2026 extension
26 April 2027	28 CFR 35.200(b)(1)	Public entity, other than a special district government, with a total population of 50,000 or more	24 April 2026
11 May 2027	45 CFR 84.84(b)(1)	Recipient of HHS financial assistance with fifteen or more employees	11 May 2026
26 April 2028	28 CFR 35.200(b)(2)	Public entity with a total population under 50,000, or any special district government	26 April 2027
10 May 2028	45 CFR 84.84(b)(2)	Recipient with fewer than fifteen employees	10 May 2027

Note the trap in the last row: the HHS small-recipient date is 10 May 2028, not 11 May. The two 2027 dates sit just over two weeks apart.

You can work out the Title II date without asking. “Total population” is defined at 28 CFR 35.104, and its third branch resolves the case that looks unresolvable: a public entity with no Census population of its own, but which is an instrumentality of a State or local government that has one, takes “the combined decennial Census population estimates for any State or local governments of which the public entity is an instrumentality or commuter authority.” DOJ works that branch in both directions in the same preamble, at 89 FR 31352: “a public State university located in a town of 20,000 within a State with a population of 5 million would be considered a large public entity for the purposes of this part because it is an instrumentality of the State. However, a county community college in the same State where the county has a population of 35,000 would be considered a small public entity for the purposes of this part, because the community college is an instrumentality of the county.” The university takes its State’s count and the community college takes its county’s, and they land on different dates. Independent school districts get their own branch, measured by the Census Bureau’s Small Area Income and Poverty Estimates. The Section 504 side does not resolve that way: 45 CFR 84.84(b) sets the line at “fifteen or more employees” and names no published series to read the number off, so it has to come from the customer.

The extensions suspended nothing else. 91 FR 20908 says so inside the interim final rule: “Regardless of the compliance dates, covered entities have an ongoing obligation to ensure that their services, programs, and activities offered using web content and mobile apps are accessible to individuals with disabilities in accordance with their existing obligations under title II of the ADA.” The amendments “do not alter any other provisions of the 2024 final rule”, and the HHS extension at 91 FR 25501 moved its own two dates the same way.

Whether the new dates hold is open. Both were issued as interim final rules with a request for comments, and both are challenged in National Federation of the Blind v. Department of Justice, No. 1:26-cv-02007-RDB (D. Md.), filed 21 May 2026 against DOJ and HHS under 5 U.S.C. 706. On the CourtListener docket, which mirrors PACER and can lag it, read on 24 August 2026 the case is open, the most recent entry is a procedural order of 13 July 2026, and nothing has been decided on the merits.

What one published clause asks a vendor for

Iowa’s page is short, published, and mandatory on its face: “Any contract or agreement to provide a digital product, including tools, applications, and software, must include the following provision.” The provision:

Technology provided to the university shall comply with World Wide Web Consortium (W3C) Web Content Accessibility Guidelines (WCAG) 2.1 AA and Revised Section 508 Standards for accessibility for persons with disabilities. Technology includes, but is not limited to, software, hardware, web applications, webpages, websites, and nonweb technologies. The university reserves the right to request that the Contractor provide an acceptable audit and/or test results that document the technology’s compliance and the testing methodology utilized. If the technology provided by Contractor does not meet WCAG 2.1 AA and Revised Section 508 standards, the university may demand that the Contractor promptly make modifications that will bring them into compliance. In addition, the University may take whatever steps necessary to ensure compliance with the above listed standards and may subtract any costs arising from such mitigation effort from future fees payable to Contractor under this Contract.

Five distinct obligations sit inside that paragraph and the purchasing practice stated on the same page, and different work answers each on a different schedule.

Obligation	Where it comes from, in the source’s words	What answers it
Conformance standard	Contract provision: “shall comply with … (WCAG) 2.1 AA and Revised Section 508 Standards”	Two standards at once. WCAG 2.1 is what both federal rules require; the Revised 508 Standards sit on WCAG 2.0
Pre-award documentation	Purchasing page, not the contract provision: “The university will request that you provide an up-to-date VPAT … as part of the purchasing process”	A current conformance report. The clause does not say which of the four VPAT editions
Evidence on demand	Contract provision: “an acceptable audit and/or test results that document the technology’s compliance and the testing methodology utilized”	Results plus method. The VPAT’s “Evaluation Methods Used” field is where method lives
Remediation on failure	Contract provision: “may demand that the Contractor promptly make modifications”; purchasing page: “a plan to address any gaps in WCAG 2.1AA conformance in a timely manner (before April 2027)“	A gap-closure plan with dates on it
Remedy and set-off	Contract provision: “may take whatever steps necessary to ensure compliance … and may subtract any costs arising from such mitigation effort from future fees payable to Contractor”	Nothing answers this in advance. It is a price, not a deliverable

The first row is where reports go wrong. Both federal rules require WCAG 2.1 Level A and AA in a dated edition: 28 CFR 35.104 defines WCAG 2.1 as the “W3C Recommendation 05 June 2018”. The Revised Section 508 Standards require something else, at 36 CFR part 1194, Appendix A, E207.2: “User interface components, as well as the content of platforms and applications, shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0”. One clause, two citations, two versions. An Accessibility Conformance Report built on the Revised 508 edition of the VPAT answers the second and leaves the first unanswered, which is the split we mapped rule by rule in which WCAG version each US rule requires.

ITI publishes four VPAT editions, currently version 2.5Rev dated 24 April 2025: WCAG, Revised 508, EN 301 549, and International, which ITI’s page describes as the edition that “Incorporates all three of the above standards”. Its About This Document section lists what that edition covers: WCAG 2.0, 2.1 and 2.2, the Revised Section 508 standards, and EN 301 549. For a clause naming both WCAG 2.1 and the Revised 508 Standards, that is the one edition carrying both citations in a single document. Our VPAT and ACR work settles the edition before testing starts, because the edition fixes the scope and the scope fixes the bill.

Not every institutional standard reads like Iowa’s. Purdue’s Standard S-5, issued 1 June 2017 and last revised 16 October 2020, sets the university’s bar at “Web Content Accessibility Guidelines (WCAG) 2.0 Level AA” and “recommends” that RFPs and contracts include language outlining it. Iowa requires a provision; Purdue recommends one, one version below its own federal deadline.

Buying through a cooperative: your baseline is the vehicle’s baseline

If the order arrives through a purchasing cooperative, the version question was settled before anyone at the buying institution read it, in a document neither of you may have negotiated. Two Midwestern Higher Education Commission (MHEC) master agreements in force today answer it differently. Clause 22 of MHEC-RFP-04282024-C004 with ERP Analysts, Inc., effective 1 July 2025 through 30 June 2028, reads:

For web-based environments, services and content must conform to the Web Content Accessibility Guidelines (“WCAG”) 2.1 AA or higher.

Clause 31 of MHEC-12312023 with Resultant, Inc. is the same sentence one version lower:

For web-based environments, services and content must conform to the Web Content Accessibility Guidelines (“WCAG”) 2.0 AA.

Check that vehicle’s term against MHEC rather than against the PDF. The cover heading prints “EFFECTIVE DECEMBER 1, 2023, through DECEMBER 31, 2026”, clause 1 of the same document says 31 December 2023 to 30 June 2026 with four renewal years available, and MHEC’s contract page for Resultant resolves both, giving the term as effective 31 December 2023 through 30 June 2030.

Same cooperative, same clause heading, two baselines. That is two named documents rather than a pattern: no survey of what cooperative agreements require turned up in the research for this article. What the second one gives an institution is a WCAG 2.0 AA contractual baseline on a vehicle that runs past all four of the compliance dates above. The version gap does not close by waiting, which puts the question back on the paperwork.

View the data as a list

1. The duty points at the buyer: The institution alone is responsible
2. The cooperative takes none: MHEC is not responsible for the vendor
3. The vehicle fixes the version: WCAG 2.1 AA or higher, or WCAG 2.0 AA
4. Changing it needs an addendum: Signed by both, so you sign too

The cooperative does not take on the duty. Clause 4 of the ERPA agreement says the buying institution “is solely responsible for conducting its own due diligence” and that MHEC “is not responsible for any actions or omissions by the Provider”, and its clause 5 adds that the master agreement “does not constitute a purchase order.” The duty points at the institution and only at the institution, while the paperwork fixing the WCAG version runs between the cooperative and the vendor.

When the institution needs terms the vehicle does not carry, clause 6 of the same agreement tells it what to do: an addendum or supplemental agreement, which must be in writing, “Be signed by the authorized representatives of both the Eligible Organization and the Provider”, and “Apply exclusively between the parties.” Your signature is a condition of the fix, and nothing in either federal rule gives a buyer a unilateral right to change a live contract. The buyer’s duty arrives on a fixed date; its leverage arrives at renewal, which is why these clauses show up when they do.

What the rules never say, and what the clause takes away

Neither rule names an artifact. Read 28 CFR 35.200 through 35.205 and 45 CFR 84.82 through 84.89 end to end and the words “VPAT”, “audit”, “test”, “report”, “certification” and “assessment” do not appear once. The only written statement either rule requires belongs to the buyer: under 28 CFR 35.204, a decision that compliance would cause a fundamental alteration or undue burden “must be made by the head of a public entity or their designee” and “must be accompanied by a written statement of the reasons for reaching that conclusion”. 45 CFR 84.88 is the same duty with “recipient” substituted. That hatch is signed by the buyer’s leadership and gives a vendor nothing.

Everything else on your renewal is contract, not regulation, and that cuts both ways. A clause reading “shall comply with WCAG 2.1 AA” asks for more than the rule it derives from, because the rules concede four things it does not:

• Exceptions. 28 CFR 35.201 and 45 CFR 84.85 remove archived web content, preexisting conventional electronic documents, individualized password-protected documents and preexisting social media posts from the requirement entirely.
• Conforming alternate versions. 28 CFR 35.202 and 45 CFR 84.86 permit a conforming alternate version of web content, as WCAG 2.1 defines that term, “only where it is not possible to make web content directly accessible due to technical or legal limitations.”
• Equivalent facilitation. 28 CFR 35.203 and 45 CFR 84.87: nothing “prevents the use of designs, methods, or techniques as alternatives to those prescribed, provided that the alternative designs, methods, or techniques result in substantially equivalent or greater accessibility and usability of the web content or mobile app.”
• Minimal impact. 28 CFR 35.205 and 45 CFR 84.89 deem an entity “not in full compliance” to have met the requirement where the noncompliance “has such a minimal impact on access” that it would not affect a disabled user’s ability to access the same information, engage in the same interactions, conduct the same transactions, or otherwise participate in or benefit from the same services, “in a manner that provides substantially equivalent timeliness, privacy, independence, and ease of use”.

A flat conformance clause with a set-off attached drops all four and adds a remedy carrying no stated cap on its face. That is a larger obligation than the one the buyer owes the public.

View the data as a table

	The rule the buyer owes	A flat conformance clause
Exceptions	Archived content, preexisting documents and old social media posts are out of scope entirely	Dropped
Conforming alternate versions	Permitted only where direct accessibility is not possible for technical or legal reasons	Dropped
Equivalent facilitation	Alternative designs, methods or techniques are allowed if accessibility is equivalent or greater	Dropped
Minimal impact	Noncompliance with such a minimal impact on access that it changes nothing a user can do is deemed to comply	Dropped
What it names as a deliverable	No artifact at all. VPAT, audit, test, report, certification and assessment appear nowhere	Shall comply with WCAG 2.1 AA, plus a remedy with no stated cap on its face

Where the redline has room

None of this is a legal position or a prediction about what a buyer will accept. It is a list of places where the clause and the rule behind it fail to line up.

1. Name the version and the edition. “WCAG 2.1 Level A and AA, W3C Recommendation of 5 June 2018, as incorporated at 28 CFR 35.200(b)(3)” is testable. “WCAG 2.1 AA or higher” is not a scope.
2. Name the report edition, before the audit is scoped, if the clause cites both WCAG 2.1 and the Revised 508 Standards.
3. Scope the subject. Iowa’s “technology” covers hardware and nonweb technologies. If you ship neither, the clause still commits you to standards for both.
4. Ask what the rule’s own concessions do here. Acceptance criteria can track 35.201, 35.202, 35.203 and 35.205, or the clause can stay silent and hand the buyer more than its regulator asks of it.
5. Ask for a cure period and a cap. The set-off in Iowa’s published clause has neither, and the delivery schedule can follow the customer’s own date, which 28 CFR 35.104 lets you work out.

The buyer-side versions of these questions are covered in our notes on accessibility vendor questionnaires and on what happens when a buyer will not accept your test evidence.

No court has settled any of it. A CourtListener opinion search on 24 August 2026 for “28 C.F.R. § 35.200” and for “45 C.F.R. § 84.84” returned zero results for each. The first compliance date has not arrived, so an empty docket is expected rather than meaningful. It is not evidence that the duty is soft.

Where this stops

Whether a clause is worth signing, how to cap remediation exposure, and what a stale conformance claim exposes you to are questions for your counsel, and this firm does not answer them. We answer the layer underneath: which version and edition your product has been tested against, what the report says in the rows where it does not conform, and whether the conformance report a buyer is holding matches the rule that binds them. Put the clause and the report on the same table before the renewal date, because after signature the schedule belongs to the buyer.

Questions this raises for a vendor

Does a Revised Section 508 edition ACR satisfy a Title II buyer’s WCAG 2.1 requirement?

No. The Revised 508 Standards require WCAG 2.0 Level A and AA at 36 CFR part 1194, Appendix A, E207.2, while Title II and the HHS Section 504 rule require WCAG 2.1. A report scoped to the 508 edition has not tested the version those two rules name, and the criteria added in WCAG 2.1 are the gap.

Do the 2026 compliance date extensions remove a Title II buyer’s obligation in the meantime?

No. The interim final rule says at 91 FR 20908 that “Regardless of the compliance dates, covered entities have an ongoing obligation to ensure that their services, programs, and activities offered using web content and mobile apps are accessible” under their existing Title II obligations. What moved is the date on which the WCAG 2.1 requirement in 28 CFR 35.200(b) attaches.

Which VPAT edition covers both WCAG 2.1 and the Revised Section 508 Standards?

The International edition. ITI publishes four editions of VPAT 2.5Rev, dated 24 April 2025, and its International edition lists WCAG 2.0, 2.1 and 2.2, the Revised Section 508 standards and EN 301 549 as the standards it includes. The WCAG edition lists WCAG 2.0, 2.1 and 2.2 and no 508 chapters; the Revised 508 edition lists the 508 standards and WCAG 2.0, but not 2.1 or 2.2. A clause citing both is answered by one International report or by two separate ones.