A Washington state agency sends a contract renewal, and the accessibility section has grown. Since December 2024 the state’s standard has asked for human user testing by the agency or a third party, one of three kinds of written evidence and a remediation plan from the vendor, and since July 1, 2026 it has set WCAG 2.2 Level AA as the minimum.
New York’s Executive Law holds the websites state contractors provide to the “most current version” of WCAG, and the state’s IT policy names it: WCAG 2.2 AA. The product in question was built, tested and reported against WCAG 2.1.
This article settles four things from the documents themselves: what a WCAG 2.2 AA claim adds to 2.1, which rules require it as of October 2026 and which still name older versions, how 2.2 fails real pages on details a 2.1 audit does not measure, and what has to change in the Accessibility Conformance Report a vendor sends.
WCAG 2.2 Level AA adds six success criteria to 2.1 and removes one
WCAG 2.2 became a W3C Recommendation on October 5, 2023, and the current text is the edition of December 12, 2024, according to W3C’s publication history. W3C’s summary of the changes counts “9 additional success criteria since WCAG 2.1.” Three of the nine sit at Level AAA. The other six new WCAG 2.2 success criteria change a Level AA claim: two at Level A and four at Level AA.
One criterion went the other way. The Recommendation marks 4.1.1 Parsing obsolete and gives the reason: “Assistive technology no longer has any need to directly parse HTML. Consequently, these problems either no longer exist or are addressed by other criteria. This criterion no longer has utility and is removed.” Counted in the December 2024 text, a WCAG 2.2 Level AA claim covers 55 success criteria, 31 at Level A and 24 at Level AA. The same claim under WCAG 2.1 covered 50.
Everything else carries over. The abstract of WCAG 2.2 states that “Content that conforms to WCAG 2.2 also conforms to WCAG 2.0 and WCAG 2.1,” and its introduction adds that the Working Group “recommends that sites adopt WCAG 2.2 as their new conformance target, even if formal obligations mention previous versions.” How the principles, guidelines and levels fit together is explained in the guide to the web accessibility guidelines.
View the data as a list
- WCAG 2.1 Level AA: 50 success criteria, 30 at Level A and 20 at Level AA. 4.1.1 Parsing is one of the 30.
- Removed in WCAG 2.2: 4.1.1 Parsing.
- Added at Level A: 3.2.6 Consistent Help and 3.3.7 Redundant Entry.
- Added at Level AA: 2.4.11 Focus Not Obscured (Minimum), 2.5.7 Dragging Movements, 2.5.8 Target Size (Minimum) and 3.3.8 Accessible Authentication (Minimum).
- WCAG 2.2 Level AA: 55 success criteria, 31 at Level A and 24 at Level AA.
A team that already tests from a WCAG 2.1 Level AA checklist does not start over. It adds six rows and retires one. The WCAG 2.2 AA checklist below holds only what changed, with a first test for each row; the other 49 rows of the 2.1 list stand as they are.
| Criterion and level | What it requires | First test |
|---|---|---|
| 2.4.11 Focus Not Obscured (Minimum), AA | A focused component is not entirely hidden by author-created content | Tab and Shift+Tab with every banner and sticky bar showing |
| 2.5.7 Dragging Movements, AA | Every drag action also works with a single pointer and no dragging, unless dragging is essential or the user agent provides it and the author has not modified it | Use each slider, sortable list and board with clicks only |
| 2.5.8 Target Size (Minimum), AA | Pointer targets of at least 24 by 24 CSS pixels, or one of five exceptions | Measure small controls, then apply the 24-pixel circle test |
| 3.2.6 Consistent Help, A | Help that repeats across pages keeps the same relative order | Compare where contact and help sit on each page |
| 3.3.7 Redundant Entry, A | Answers already given in a process are filled in or offered for selection | Walk each multi-step form and list repeated questions |
| 3.3.8 Accessible Authentication (Minimum), AA | No cognitive function test at sign-in unless an alternative, a mechanism, object recognition or personal content is offered | Paste a password and a code; read what the CAPTCHA asks |
| 4.1.1 Parsing, removed | Obsolete in 2.2, still present in the 2.0 and 2.1 texts | Keep it only in reports against 2.0 or 2.1 |
Washington made WCAG 2.2 AA the floor for state technology on July 1, 2026
Washington’s standard is USER-01-01-S, the Digital Accessibility Standard, adopted by the State CIO on December 10, 2024. Its first item set WCAG 2.1 Level AA as the minimum. Its third item set the change:
Effective July 1, 2026, the minimum level of compliance for accessibility is Level AA compliance with WCAG 2.2.
The standard reaches well past websites. Its definition of covered technology begins with “All public-facing digital content and tools, including: Websites, applications, documents and media, blog posts, and social media content,” and adds internal material such as notices of benefits and program eligibility. It is written for state agencies, and it reaches vendors through procurement: item 4 says agency procurement and contracting activities “must include” accessibility requirements, validation and remediation.
Validation comes in two parts. The agency must “Ensure agency or third-party human user testing to validate accessibility,” and it must also hold one of three documents: “A third-party accessibility validation report,” a “Vendor Product Accessibility Template (VPAT),” or “Compliance review documentation showing an evaluation of the solution’s compliance with the applicable WCAG level.” Read with its punctuation, the item requires the testing in every procurement and treats the three documents as alternatives.
Remediation follows. The agency must “Require a remediation plan from the vendor for addressing accessibility issues,” evaluate the “remediation plan and timeline,” and choose contract clauses to enforce it. When a vendor has no plan and no other accessible product will do, the standard tells the agency to reserve the right to cut or end contracts where a vendor shows “a lack of accountability to timely response and remediation,” adds that “This also applies if a vendor misrepresents the current accessibility of their products,” and points renewals and new procurements at “the track record of vendors.”
For a Washington bid, those requirements turn into four things to have ready:
- An answer for the testing by people, which the standard gives to the agency or a third party: support for the agency’s testers, or an independent tester’s report, which an agency may accept as third-party testing and which can also serve as the “third-party accessibility validation report”
- An ACR that names WCAG 2.2
- A remediation plan with a date for every row that is not fully supported
- Documents that claim no more than the testing showed
Keep every claim of WCAG 2.2 AA compliance within what testing showed, because the contract remedies above reach a vendor that misrepresents its products’ accessibility as well as one that falls behind on remediation. Other states word their vendor requirements differently, as the state-by-state reading for government vendors shows, so read each solicitation’s own clause.
New York ties agencies and contractors to WCAG 2.2 AA by statute and IT policy
New York has two statutes, one for its agencies and one for the people its agencies hire. State Technology Law § 103-d sets the agency rule:
Each state agency shall, to the extent practicable, conform any of their websites, created or modified with changes to form or function after the effective date of this section, by January first, two thousand twenty-seven, to the most current version of the Web Content Accessibility Guidelines, specifically level AA, adopted by the World Wide Web Consortium for accessibility, or any successor standards.
The section defines changes to form or function as “modifications to the visual presentation, informational organization, website infrastructure, or user utility of the website,” including redesigns and the “integration of dynamic interfaces.” An agency that cannot comply must post a written progress report by the same date, and “The written report shall be updated annually from the date of the original posting.” The section “shall not require an agency to take any action that would result in a fundamental alteration in the nature of a service, program, or activity.”
Executive Law § 170-f is the vendor rule, and it is one sentence:
Each contractor, subcontractor, vendor, consultant, or other person providing services pursuant to a state contract shall be required to conform any website provided by such contractor, subcontractor, vendor, consultant, or person in relation to and for the purpose of the provision of such services to the most current version of the Web Content Accessibility Guidelines adopted by the World Wide Web Consortium for accessibility, or any successor standards.
It names no conformance level and no date. The most current version W3C has adopted is WCAG 2.2, because the only later version, WCAG 3.0, is still a Working Draft in W3C’s publication history. The state’s Accessibility Toolkit treats the version as settled: new or changed state websites “are required to meet WCAG 2.2 AA standards by January 1, 2027.”
New York’s IT policy fills in what the statute leaves open. NYS-P08-005, issued by the Office of Information Technology Services as the guidance the State Technology Law requires for § 170-f and § 103-d and updated on October 7, 2026, “mandates adherence to the Level AA success criteria and conformance requirements as outlined in the WCAG Version 2.2.”
It adds that “Websites developed or managed through a third-party contract on behalf of an SE,” a state entity, “must also meet WCAG Version 2.2 AA conformance criteria.” Every solicitation and contract to develop, procure or maintain ICT must carry the policy’s accessibility clause, which reaches “Any network-based information and applications development, or programming.” Its section 4.5 adds that for pre-built software with a user interface “the vendor should supply or complete for review a Voluntary Product Accessibility Template (VPAT).”
Section 170-f applies to a website you provide under any state contract, whether or not the solicitation cites it. Check the solicitation for the NYS-P08-005 clause before the bid goes in, and where either applies, test what the contract has you build or provide against WCAG 2.2 Level AA and send the ACR on the WCAG or INT edition.
Federal rules still name WCAG 2.0 and 2.1, and one WCAG 2.2 AA build can answer them
Section 508 requires “Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0” (36 CFR part 1194, appendix A, E205.4). The ADA Title II rule for state and local governments requires WCAG 2.1 Level A and AA from April 26, 2027 for entities of 50,000 people or more, and from April 26, 2028 for smaller entities and special district governments (28 CFR 35.200(b)), dates set by an interim final rule of April 20, 2026.
The HHS Section 504 rule applies WCAG 2.1 Level A and AA to recipients of HHS funding from May 11, 2027, or from May 10, 2028 for recipients with fewer than 15 employees (45 CFR 84.84(b)), dates HHS set by an interim final rule of May 11, 2026. Businesses under ADA Title III have no technical standard in any regulation: DOJ’s web guidance says the Department “does not have a regulation setting out detailed standards.” The matrix of federal versions by rule gives every citation.
Title II reaches vendors’ products through the public entities that use them. It covers web content and mobile apps that a public entity provides “directly or through contractual, licensing, or other arrangements” (35.200(a)). A Washington state agency that runs a vendor’s licensing portal therefore owes WCAG 2.2 AA under its state standard now, and WCAG 2.1 Level A and AA under Title II from April 26, 2027.
One build can answer both. DOJ’s guidance, published as Appendix D to the Title II rule, says public entities “could also choose to comply with subpart H by conforming their web content to WCAG 2.2 Level AA because WCAG 2.2 Level AA provides substantially equivalent or greater accessibility and usability to WCAG 2.1 Level AA.”
The route is the rule’s equivalent facilitation section, 35.203. The same appendix answers the state question directly: “if a State law requires public entities in that State to conform to WCAG 2.2, nothing in subpart H would prevent a public entity from conforming with that standard.” HHS’s rule carries the same equivalent facilitation wording at 45 CFR 84.87, and its 2024 preamble says recipients “could also choose to comply with this rule by conforming their web content to WCAG 2.2 Level AA” (89 FR 40155). The catch is 4.1.1. W3C warns in its comparison with 2.1 that authors bound by policy to 2.0 or 2.1 “may need to continue to test and report 4.1.1.”
Title II incorporates the June 5, 2018 text of WCAG 2.1, which predates W3C’s September 2023 note that 4.1.1 “should be considered as always satisfied for any content using HTML or XML.” DOJ declined that note. Appendix D states that “conformance to Success Criterion 4.1.1 is still required by subpart H of this part,” and lets an entity rely on § 35.205 where a 4.1.1 failure “would not affect the ability of individuals with disabilities to use the public entity’s web content or mobile app.”
The European standard has moved to WCAG 2.2. EN 301 549 V4.1.1, adopted on August 24, 2026 and dated September 2026, states in clause 9.0 that conforming with WCAG 2.2 Level AA is equivalent to conforming with its clauses 9.1 to 9.4 and the conformance requirements of clause 9.6, and it voids the Parsing clause, 9.4.1.1. Its own dates run to May 31, 2027 for publication as national standards and May 31, 2028 for withdrawing conflicting ones. How the standard differs from Section 508 clause by clause is covered in EN 301 549 against Section 508.
View the data as a table
| Rule or standard | WCAG version and level | Dates |
|---|---|---|
| Washington, USER-01-01-S | WCAG 2.2 Level AA | From July 1, 2026 |
| New York, State Technology Law § 103-d | The most current version, Level AA | By January 1, 2027, to the extent practicable, or a public progress report |
| New York, Executive Law § 170-f | The most current version, no level named | No date in the statute |
| New York, ITS policy NYS-P08-005 | WCAG 2.2 Level AA | State websites, including those built under contract, by January 1, 2027; an accessibility clause in every ICT solicitation |
| ADA Title II, 28 CFR 35.200 | WCAG 2.1 Level A and AA | April 26, 2027 (50,000 people or more); April 26, 2028 (fewer, or a special district) |
| HHS Section 504, 45 CFR 84.84 | WCAG 2.1 Level A and AA | May 11, 2027 (15 or more employees); May 10, 2028 (fewer) |
| Section 508, 36 CFR 1194 | WCAG 2.0 Level A and AA | In force |
| EN 301 549 V4.1.1 | WCAG 2.2 Level AA (clause 9) | Adopted August 24, 2026; national standards by May 31, 2027; conflicting ones withdrawn by May 31, 2028 |
The rule for a vendor is short: build and test to WCAG 2.2 Level AA, and keep 4.1.1 in the test plan for Title II and HHS Section 504 buyers, whose rules incorporate the 2018 text of WCAG 2.1. For Section 508, the Access Board’s ICT Testing Baseline says “No testing necessary” for 4.1.1 and records the test as passed. That one target covers the WCAG part of every rule in this section. Section 508 and EN 301 549 add requirements of their own beyond WCAG, for software, hardware and documentation, and those still need their own rows.
WCAG 2.2 fails pages on details a 2.1 AA audit never measures
The six new criteria were not in WCAG 2.1, so a 2.1 AA audit report says nothing about them. A default axe-core run does not fill the gap either. The rule list for axe-core 4.14.0, an open-source testing engine, has a rule for only one of the six, target-size, and says its WCAG 2.2 rules “are disabled by default, until WCAG 2.2 is more widely adopted and required.” Two of the six, 2.4.11 and 2.5.8, can be shown failing on public pages.
Target Size fails two help links one line apart
Success criterion 2.5.8 asks for pointer targets of “at least 24 by 24 CSS pixels,” with five exceptions. The first is spacing: a smaller target passes if a 24-pixel circle centered on it intersects no other target and no other small target’s circle. On the public sign-in page of a software product, two help links sit under the Login button. They measure 144.2 by 16 and 114.5 by 16 CSS pixels, stacked one line apart, with their centers 20 pixels apart.
Two 24-pixel circles whose centers are 20 pixels apart overlap by 4 pixels, so both links fail. No other control on the page resets the password or opens that help article, each link sits alone on its line rather than in a sentence, and the size comes from the site’s own styling, so none of the other exceptions applies. They are the links for a person who cannot sign in.
W3C’s Understanding document fails a tighter version of the same layout, two rows of 16-pixel buttons 1 pixel apart, in its Figure 7. The fix is small: a line height of 24 pixels puts the centers 24 apart, the spacing W3C passes in its example of 20-pixel buttons with a 4-pixel gap, and making each link a block 24 pixels tall passes on size alone.
View the data as a list
- As measured: links of 144.2 by 16 and 114.5 by 16 CSS pixels, centers 20 pixels apart. Circles of 24 pixels centered on each overlap by 4 pixels. Both links fail.
- With a line height of 24 pixels: the same links, centers 24 pixels apart. The circles meet at one point and do not overlap. Both links pass.
Focus Not Obscured fails a focused link behind a cookie banner
Criterion 2.4.11 requires that a focused component “is not entirely hidden due to author-created content.” Its Understanding document names the case: “A notification implemented as sticky content, such as a cookie banner, will fail this success criterion if it entirely obscures a component receiving focus.” On a software vendor’s home page, with the cookie banner left as it loads, 30 presses of Tab put focus on a link of 259 by 31 pixels that sits wholly behind the banner.
The banner is not modal: its buttons are early Tab stops, and Tab then keeps moving through the page behind it. W3C’s ways to pass include “making the banner modal so the user has to dismiss the banner before navigating through the page, or using scroll padding so the banner does not overlap other content.” To test, leave every banner, chat window and sticky header as the page loads it, then Tab down the page and Shift+Tab back up. Partial covering passes Level AA, and complete covering fails.
The other four new criteria need a person with a script
Sign-in comes first. For 3.3.8 Accessible Authentication (Minimum), try every step the way a password manager user would: paste the password, paste a one-time code, and read what any CAPTCHA asks for. W3C’s Understanding document is explicit: “Blocking people from pasting into authentication fields … would force the user to transcribe information and therefore fail this criterion, unless another method is available.” Failure F109 shows the code version, six separate boxes where pasting the whole code “only fills in one digit in the first input.”
CAPTCHAs split by type. One that asks the user to recognize objects is excepted at Level AA. One that asks the user to type distorted text is a test of “remembering or transcribing a word,” in W3C’s words, and fails unless a sign-in method without such a test is available. The patterns that pass are collected in the guide to accessible authentication.
For 2.5.7 Dragging Movements, operate every slider, sortable list and drag-and-drop board with single clicks or taps only. Keyboard support does not count: the Understanding document says the requirement “is separate from keyboard accessibility because people using a touchscreen device may not use a physical keyboard.” A slider passes when a click on its track moves the thumb there. The alternatives that work are in the guide to dragging movements.
The two Level A criteria take a walk through the site. For 3.2.6 Consistent Help, check that contact details, a way to reach a person, self-help and any automated contact tool appear in the same order relative to the rest of the page wherever they repeat. For 3.3.7 Redundant Entry, list every question a process asks twice: the second time, the answer must be filled in or offered for selection, unless re-entry is essential, needed for security, or the first answer is no longer valid. Each has its own guide, on consistent help and on redundant entry.
Run all six tests on the flows the buyer will use, starting with sign-in, before any row of the ACR says Supports.
The ACR has to name WCAG 2.2, and only two VPAT editions carry it
An Accessibility Conformance Report is a completed VPAT, and the current template, VPAT 2.5Rev of April 24, 2025, comes in four editions that do not carry the same WCAG. ITI’s VPAT page states it plainly: “WCAG 2.0 is incorporated into the 508 edition,” “WCAG 2.1 is incorporated into the EU edition,” and “WCAG 2.2 is incorporated into the WCAG and INT editions.” The 508 edition has no rows for the criteria added in 2.1 and 2.2, so it cannot carry a 2.2 claim.
| VPAT 2.5Rev edition | Standards it reports | WCAG version inside |
|---|---|---|
| 508 | Revised Section 508 | WCAG 2.0 |
| EU | EN 301 549 | WCAG 2.1 |
| WCAG | WCAG | WCAG 2.0, 2.1 or 2.2 |
| INT | Section 508, EN 301 549 and WCAG | WCAG 2.2 |
Three details match what the Washington standard asks for. The report has to say that it covers WCAG 2.2. The “Evaluation Methods Used” field, which ITI puts in every edition, should say who tested and how, by people and not only with tools, and name the independent tester when there is one. And each row marked Partially Supports or Does Not Support needs a line in the remediation plan, with a date, because the agency must evaluate the “remediation plan and timeline.”
Handle 4.1.1 by buyer. ITI’s templates keep the 4.1.1 row in every edition: for WCAG 2.2 it reads “Does not apply,” for 2.0 and 2.1 it says “Always answer ‘Supports’” under W3C’s September 2023 errata, and the instructions say “Individual criteria cannot be removed.”
For a Section 508 buyer that default matches the Access Board’s testing baseline. For a Title II or HHS Section 504 buyer it does not, because DOJ and HHS both say 4.1.1 is still required, so test it before leaving Supports in that report. The steps for filling in the template are in the guide to creating an ACR, and how a buyer scores an ACR shows what the reader on the other side checks.
Questions buyers ask about WCAG 2.2 AA
Is the ADA the same as WCAG 2.2 AA?
No. ADA.gov describes the ADA as “a federal civil rights law that prohibits discrimination against people with disabilities in everyday activities.” WCAG is a technical standard published by W3C. The ADA’s Title II rule adopts WCAG 2.1 Level A and AA for state and local governments, and DOJ’s guidance accepts WCAG 2.2 Level AA as an equivalent route to it for web content. No ADA regulation names 2.2 as the requirement.
Is WCAG 3.0 official?
No. Every WCAG 3.0 entry in W3C’s publication history is a Working Draft, and the latest is dated September 10, 2026. A Working Draft is not a standard, and none of the rules in this article cites it.
Where is the official text of the WCAG 2.2 AA guidelines?
On W3C’s site, at w3.org/TR/WCAG22, the Recommendation of December 12, 2024. The success criteria are the requirements. The Understanding documents quoted in this article explain them and are, in W3C’s words, “informative, not part of the ‘normative’ WCAG standard.”
Your next step
Pull the last ACR you sent a public-sector buyer and read the version it reports. If it says WCAG 2.0 or 2.1, run the six tests above on the flows that buyer uses, sign-in first, and fix what fails. Then re-issue the report on the WCAG or INT edition, with WCAG 2.2 named, the testing by people and who did it described under Evaluation Methods Used, and a dated remediation plan for every row that is not fully supported.
Some questions the documents leave to counsel and the buyer: whether § 170-f reaches a product’s own web interface under a contract without the NYS-P08-005 clause, how a Washington agency weighs a VPAT against a third-party report, and whether and when the EU’s Official Journal will cite EN 301 549 V4.1.1. Title III names no WCAG version at all.
When the solicitation is already on the table, the testing is the part to hand over. ADA Compliance Pros runs a manual audit against WCAG 2.2 Level AA on the flows your buyer will use, with every finding tied to its success criterion, a prioritized remediation plan and a retest after your fixes, so the same evidence can stand behind your ACR and give a Washington agency an independent tester’s results to weigh. Tell us which solicitation or renewal you are answering, and we will scope the WCAG audit with you on a call.