Guide

What a VPAT and an ACR actually are

A buyer has asked for your VPAT. Here is what they are asking for, who can produce it, roughly what it costs in hours, and why no tool can generate one for you.

The two words

VPAT stands for Voluntary Product Accessibility Template. It is a blank form, published and maintained by the Information Technology Industry Council. Anyone can download it.

ACR stands for Accessibility Conformance Report. It is what you get when you fill the template in for your own product, honestly, with evidence behind each row.

Buyers almost always say “send us your VPAT”. They mean the ACR. The template on its own is worth nothing to them.

Which edition do you need?

The current template comes in four editions, and picking the wrong one is the most common way to waste the work:

• WCAG edition. WCAG only. Enough for most commercial buyers.
• Section 508 edition. WCAG plus the US federal requirements. Needed to sell to federal agencies.
• EU edition. WCAG plus EN 301 549. Needed for European public procurement.
• INT edition. All of the above in one document. Longest, and the right choice if you sell in several of those markets.

Ask the buyer which edition they need before starting. They usually know.

What is in it

A short section identifying the product, the version, the evaluation methods used, and the date. Then tables, one row per success criterion, each row carrying a conformance level and a written remark.

The remarks column is where the document earns its trust. A row that says “Partially Supports” with no explanation tells a buyer nothing. A row that says which screens fail, and what the workaround is, tells them everything.

Who can produce one

There is no licence and no accreditation body. You can write your own. Many buyers accept a self-assessment, and some require one prepared by a third party. What a buyer’s procurement team actually checks is whether the document is specific: a document full of “Supports” with no remarks reads as untested, and experienced reviewers treat it that way.

What it costs in hours

For a single-product web application, expect a first ACR to take on the order of one to three weeks of one person’s time. Most of it is not writing. It is testing: working through every criterion against real screens, with a keyboard and a screen reader, and recording what happened.

Re-issuing for a later version is far cheaper, if you kept the evidence. That is the argument for doing it properly the first time.

Why a tool cannot generate one

Automated testing reaches a definite verdict on a minority of the 55 Level A and AA criteria. Every other row needs a person to look and decide. A tool that emits a finished VPAT is filling in rows it did not test, which is exactly the document a procurement reviewer is trained to distrust.

What a scan legitimately does is supply the evidence for the rows it can decide, and tell you precisely which rows are still yours to work through. That is a real head start on the longest part of the job.

A sensible order of work

1. Ask the buyer which edition and which product scope they need.
2. Run a scan and fix what it proves. Fewer failures means fewer awkward rows.
3. Define the scope precisely: which URLs, which flows, which version. A vague scope makes every row unverifiable.
4. Work the criteria in order, testing each against the real product, and write the remark as you go rather than afterwards.
5. Keep the evidence: screenshots, notes, the date, and who tested.
6. Have someone who did not do the testing read it before it goes out.