VPAT compliance and VPAT certification: what actually exists

There is no VPAT certification. The Information Technology Industry Council (ITI), which publishes the Voluntary Product Accessibility Template, answers the question in its own FAQ: “there is no VPAT certification.” The same FAQ states that ITI “does not review or approve VPATs,” that there is “no submission process for the VPAT,” and that no conformance logo is “required or even available to those who have filled out the VPAT.”

The phrase people search for does point at something real, just not at a credential. A vendor downloads a free template, tests its own product against each provision, records the results, and publishes the finished document. That document has a name: an Accessibility Conformance Report (ACR). It is a self-disclosure you write and stand behind, closer to a nutrition label than to a certificate. The rest of this page is how to produce one a buyer can act on, and what each accessibility proof actually attests covers the neighboring claims people also call certification.

What people mean by “VPAT certification”

Three different requests hide behind the phrase, and each has an honest answer:

• “Send us your VPAT certification.” The buyer wants your completed template. Send the ACR.
• ”Is your VPAT certified by ITI?” ITI states that it does not review or approve VPATs. Nobody countersigns the document.
• ”Are you VPAT certified?” Nobody is. What you can state instead is which standard you reported against, on which edition and version of the template, and on what date you tested.

ITI notes one exception worth knowing before you answer a solicitation. If the solicitation itself requires outside review, follow its terms: the FAQ tells suppliers that a government or other solicitation “may require a third party audit or review as part of its terms,” and to ask the issuing entity for clarification when the wording is unclear.

What VPAT compliance actually means

”VPAT compliance” is shorthand for having tested your Information and Communication Technology (ICT) product against a recognized accessibility standard and reported the results on the template. Buyers outside the federal government now ask for the same document, so the shorthand has spread well beyond procurement offices.

Completing the template can surface accessibility failures across a wide range of digital products:

• E-learning platforms
• Mobile apps
• Websites
• Software or hardware
• Remote access tools

The finished ACR is the primary tool for communicating what your product supports. ITI describes it as “the leading global reporting format for assisting buyers and sellers in identifying information and communications technology (ICT) products and services with accessibility features.” Note the operative word: reporting, not certifying.

Who needs a VPAT

It was once assumed that only government entities procured ICT products from vendors who had completed the template. That is no longer the case. A VPAT is not limited to business with organizations that receive federal funding, because the template is a useful source for any buyer comparing products.

Adopting the VPAT approach strengthens the credibility of your offering with federal government, state government, non-profit and private sector clients. ICT is a broad category, and the revised Section 508 reaches past digital products to certain physical products as well.

To put it simply, a VPAT is a useful resource for organizations dealing in the following products and services:

• Applications and software programs used by public-facing agencies
• Software or applications developed to be used by employees or the public
• Public or employee-used websites that are externally hosted
• Interactive voice response programs
• Digital documents
• Any services accessed through ICT
• Physical products such as copier machines, smartphones, tablets and telephone systems

What an ACR is good for

When we buy prepared food, we read the Nutrition Facts panel before deciding. The manufacturer prints that panel, and no regulator signs each box. An ACR works the same way, and it draws its value from the same source: the accuracy of what the producer discloses.

An accurate ACR does real work for the organization that publishes it:

• It replaces the open-ended language of the ADA with provision-by-provision answers
• It records how the product measured against the WCAG success criteria on a stated date
• It gives buyers something concrete to weigh instead of a marketing claim
• It makes products comparable, because two suppliers reporting on the same edition answer the same provisions
• It increases transparency, since “partially supports” and “does not support” are reportable answers rather than failures to hide
• It works as an internal eye-opener, because testing surfaces defects the team had not logged

There is no score at the end. A supplier marks each applicable provision as supports, partially supports, does not support, or not applicable, and ITI is explicit that there is “no ‘pass/fail’ scale for determining whether a product is accessible or inaccessible.” Any vendor offering you a VPAT grade or a VPAT badge is selling something the template does not produce.

How to produce a VPAT and an ACR

The template costs nothing. ITI offers it “free of charge” and states that “Membership in ITI is not required to use the VPAT.” Download the edition you need and have your team complete it. The VPAT name and report form are ITI registered service marks, so use them as published rather than restyling them.

To describe your accessibility features, you fill the template in and publish the result as your ACR. Anyone can do that in-house, and ITI argues the product owner is the right author, since “the product/service owner who completes the VPAT will likely have the most accurate information about the unique features represented on the VPATs.” Doing it accurately still takes real knowledge of digital accessibility and of how each provision is tested.

An inaccurate description of your accessibility standing is a liability, which is why organizations bring in a third-party evaluator. ITI treats outside review as optional rather than required, writing that “VPATs shouldn’t require a third party review” and that such a review “is always something you can choose to do as part of an extra compliance check, but is not required.”

Working with experienced evaluators buys consistency and a second reading of the provisions. Our VPAT and ACR work follows three steps:

1. An unbiased audit of your ICT products and services against the provisions of the standard you are reporting on.
2. Remediation of the failures the audit identifies across the technical requirements, functional performance criteria and support requirements.
3. Completion of the template with the resulting data, published as your ACR.

The audit produces the evidence behind the report. It does not produce a certificate, because there is none to issue.

Choosing the edition and version

Report on the current template rather than an older one. As of April 2025, the current release is VPAT Version 2.5Rev, published in four editions:

• VPAT 2.5 508 for the Revised Section 508 standards, which incorporate WCAG 2.0
• VPAT 2.5 EU for EN 301 549, which incorporates WCAG 2.1
• VPAT 2.5 WCAG for WCAG 2.0, 2.1 and 2.2 on their own
• VPAT 2.5 INT for all three standards in one report

Pick the edition your buyer’s market requires, then name the edition and version on the report itself. A buyer who reads that your document is an ACR on ITI VPAT 2.5Rev, 508 edition, carrying the date you tested, knows exactly what they are holding.

Interested in improving your product offering with a VPAT? The document is not a credential, and that is its strength. It is a specific, dated, provision-level statement you can defend, and it shortens procurement because it answers in one place the questions a buyer would otherwise ask one at a time.

Getting the underlying testing right is where the report is won or lost. If you would like to discuss the best approach, contact our accessibility team.