Section 508, WCAG 2.0 AA and the 508 VPAT

What Section 508 is and who it applies to

Section 508 is part of the Rehabilitation Act of 1973. In 1998 Congress amended it to require federal agencies to make their electronic and information technology accessible to people with disabilities. The law applies when an agency develops, procures, maintains or uses that technology. Employees and members of the public with disabilities must get access to information comparable to the access others have.

The technical rules come from the US Access Board. On 18 January 2017 the Board issued a final rule that updated the standards, usually called the 508 Refresh. Compliance with the Revised 508 Standards has been required since 18 January 2018. The standards cover information and communication technology, or ICT: software, hardware, electronic content, and support documentation and services.

Section 508 regulates agencies, not vendors. But an agency can only buy ICT that conforms, so a solicitation that includes ICT will list accessibility requirements, and the vendor has to show how the product meets them. That is why a federal buyer asks for an Accessibility Conformance Report, and why the request usually names the 508 edition of the VPAT.

WCAG 2.0 AA, and what else the Revised 508 Standards cover

For web content the Revised 508 Standards do not write their own rules. Section E205.4 says electronic content shall conform to the Level A and Level AA success criteria and conformance requirements of WCAG 2.0, incorporated by reference. Section E207.2 applies the same WCAG 2.0 criteria to software, including the user interface of platforms and applications. Non-web documents and non-web software are excused four criteria that only make sense for web pages: 2.4.1, 2.4.5, 3.2.3 and 3.2.4.

Section 508 still names WCAG 2.0, not 2.1 or 2.2. That is less of a gap than it sounds. W3C states that content conforming to WCAG 2.1 also conforms to WCAG 2.0, and that content conforming to WCAG 2.2 also conforms to 2.0 and 2.1. So a product that meets WCAG 2.1 AA or 2.2 AA meets the web content part of Section 508. The one wrinkle is 4.1.1 Parsing, which WCAG 2.2 removed as obsolete. The 508 edition of the VPAT still lists it, and the current template pre-fills the row as Supports, citing the WCAG 2.0 errata. See our WCAG guide for how the three versions relate.

WCAG is not the whole of the standard. Chapter 3 sets functional performance criteria: at least one way to use the product without vision, with limited vision, without perceiving colour, without hearing, with limited hearing, without speech, with limited manipulation, with limited reach and strength, and with limited language, cognitive and learning abilities. These apply where the technical chapters do not address a function, and they are how an agency judges an alternative design. Chapter 5 covers software, including interoperability with assistive technology and authoring tools. Chapter 6 covers support documentation and services: documentation must explain the product’s accessibility features, electronic documentation must meet WCAG 2.0 A and AA, and help desks must be able to tell a user about those features. Chapter 4 covers hardware.

The 508 edition of the VPAT, and what buyers read in it

The VPAT is a free template from the Information Technology Industry Council. The current version is VPAT 2.5Rev, published in April 2025, in four editions: 508, EU, WCAG and INT. Filled in for a specific product, the template becomes an Accessibility Conformance Report, or ACR. Section508.gov tells vendors selling to the federal government to use the 508 edition or the INT edition, which includes every Revised Section 508 requirement. Our VPAT page compares the four editions, and What a VPAT is covers the basics.

The 508 edition opens with the report date, product name and version, a description, contact details, the evaluation methods used and the standards covered. Then come the tables. Three WCAG 2.0 tables, for Level A, Level AA and the optional Level AAA. Then the Revised 508 chapters: Chapter 3 functional performance criteria, Chapter 4 hardware, Chapter 5 software, and Chapter 6 support documentation and services. Each WCAG row also says which 508 sections it applies to, so one answer serves both.

Every row has three columns: the criterion, a conformance level, and Remarks and Explanations. The conformance levels are Supports, Partially Supports, Does Not Support and Not Applicable. Not Evaluated is allowed only in the Level AAA table. A federal buyer reads the Remarks column first. The template requires remarks for any Partially Supports or Does Not Support, and they must name the functions with issues and say how they fall short. A row that says Partially Supports with nothing beside it tells a contracting officer nothing. A row that says which screens fail, how many, and what the workaround is lets them judge the risk and move on.

What a good 508 ACR needs

• A clear scope. Name the product and version, and say which parts were tested: web content, electronic documents, software or an authoring tool. The 508 edition asks for exactly this, and a report that covers an unnamed version is out of date the day it is written.
• A date. Give the month and year at least. If you revise the report, change the date and explain the revision in the Notes.
• Evaluation methods. The template asks how the product was tested: with automated tools, by hand, with assistive technologies, or a mix, and whether a published test method was used. Buyers compare this line with the answers that follow.
• Remarks backed by evidence. For every row that is not Supports, name the features with issues and how they fall short. Add workarounds where they exist. A remark you can trace to a specific page and a specific element is a remark the buyer can check.
• Honest Not Applicable rows. Say why a criterion does not apply. Sections of the 508 tables that do not apply, such as hardware for a web-only product, can be removed with a note explaining why, but individual criteria cannot.
• A person who signs. An ACR is the vendor’s own representation. The name on it should belong to someone who read the evidence and stands behind each row.

Where automated testing helps, and where a person is needed

Section508.gov describes three ways to test: automated, manual and a hybrid of the two. Automated tools cover many pages quickly and are good at the parts of WCAG that have a definite answer, such as missing text alternatives, colour contrast ratios, form fields without labels and markup that assistive technology cannot read. They can also show a buyer that the same checks ran on every page, not a sample chosen by hand.

Automated tools cannot apply human judgement. Whether an alt text describes the image, whether a heading says what follows, whether focus order makes sense, whether an error message tells the user what to fix: these need a person. So does everything in Chapters 3, 5 and 6, which ask about the product as a whole and about your support, not about a page. A good 508 ACR uses automation to cover ground and gather evidence, and a person to decide what the evidence means and to answer the rows a scanner cannot see.

How Dreven helps with a Section 508 ACR

• Dreven checks your web pages against WCAG and shows you each result with the evidence behind it: the page, the element and what was found. Because WCAG 2.1 and 2.2 include every WCAG 2.0 criterion, the results map onto the 508 edition’s WCAG tables.
• Each result is one of four states: passed, failed, not applicable, or needs a person. Nothing that needs judgement is quietly marked as a pass.
• Your reviewer decides each result that needs a person, records why, and signs. The decision and the evidence stay with the report, so a buyer can ask how a row was determined and get an answer.
• The report is drafted in the VPAT 2.5Rev structure for the edition you choose, including the 508 edition, with remarks that name the pages and counts behind each row. The Chapter 3, 5 and 6 rows are about your product and your support, so your team completes those.
• Dreven does not certify anything, and nobody does. There is no Section 508 certification and no VPAT certification. The report is your statement, and the person who signs it makes the claim.

Questions people ask about Section 508

What is a Section 508 VPAT?

A Section 508 VPAT is the 508 edition of the Voluntary Product Accessibility Template, filled in for a specific product. Filled in, it is called an Accessibility Conformance Report, or ACR. It reports against the Revised 508 Standards: WCAG 2.0 Level A and AA for web content, documents and software, plus the functional performance, hardware, software and support documentation chapters. Federal buyers ask for it when they evaluate ICT.

Which version of WCAG does Section 508 require?

WCAG 2.0, at Level A and Level AA. The Revised 508 Standards incorporate it by reference, in section E205.4 for electronic content and E207.2 for software. Non-web documents and non-web software are excused four criteria that only apply to web pages. Section 508 has not moved to WCAG 2.1 or 2.2, so the 508 edition of the VPAT still lists the WCAG 2.0 criteria.

If my product meets WCAG 2.1 AA or 2.2 AA, does it meet Section 508?

It meets the WCAG part. W3C states that content conforming to WCAG 2.1 also conforms to WCAG 2.0, and the same holds for 2.2. The exception is 4.1.1 Parsing, removed in WCAG 2.2, which the 508 edition still lists and pre-fills as Supports. Section 508 also has requirements outside WCAG, for functional performance, software, hardware and support documentation, which you answer separately.

Does Section 508 apply to private companies?

Not directly. Section 508 regulates federal agencies and the ICT they procure, develop, maintain or use. A vendor is affected because an agency can only buy what conforms, so the solicitation lists accessibility requirements and asks for an ACR. Section508.gov recommends that vendors prepare an ACR for any ICT they intend to market to the federal government, and make it easy to find on the product page.

Is there a Section 508 certification?

No. There is no Section 508 certification, no VPAT certification and no conformance logo. ITI, which publishes the VPAT, does not review or approve completed reports. An ACR is the vendor’s own statement about its product, which is why the Remarks and Explanations column matters so much: it is where the buyer can see what was tested, what was found and how each answer was reached.

What should the Remarks column say for a Partially Supports row?

The template requires remarks for Partially Supports and Does Not Support. Name the functions or features with issues and say how they fall short. Where there is an accessible alternative or a workaround, describe it. Numbers help: how many pages or components are affected, and out of how many. A remark a buyer can trace to a specific screen is worth more than a general apology.