How does a large company check a design agency’s accessibility capability before a major redesign?
Before a major redesign, ask every design agency for the same accessibility evidence: the standard in writing, annotated designs, past reviews and testing with disabled people. This guide gives a scoring sheet and statement-of-work terms.
A retailer shortlists two agencies to redesign its checkout and account area, on web and in a mobile app. Both proposals say the team “designs to WCAG AA.” Legal asks three questions the proposals leave open: which version, on which platforms, and who confirms the finished product meets it. The design director sees that the two sentences are identical and the agencies may not be. The retailer, the agencies and the proposals are invented.
Humbleteam, a digital product design agency, publishes this guide, and the questions below apply to us too. The guide makes no claim about Humbleteam’s own accessibility work. It is general information, not legal advice: your counsel decides which laws apply to your product and how.
It is for the product or design leader who sponsors an agency. It covers what to name in the brief, what evidence to ask for, how to score it, and what to write into the statement of work. For the rest of the buying process, see our guide to writing an RFP for a product design agency.
What does “we design to WCAG AA” actually promise?
WCAG 2.2 became a W3C Recommendation on October 5, 2023. It adds nine success criteria to 2.1 and drops one, 4.1.1 Parsing; the 2.0 and 2.1 criteria are essentially the same in 2.2. A brief that names “WCAG 2.2 Level AA” has therefore fixed both the version and the level.
Three limits matter in an agency contract.
First, conformance belongs to built pages. W3C’s rules say conformance is for full web pages, and that a multi-step process such as checkout conforms only if every page in it does. A design file cannot conform. The shipped pages can.
Second, code decides many criteria. Success criterion 4.1.2, Name, Role, Value, exists so that assistive technology can read each component’s name, role and state. W3C says it is primarily for authors who build or script their own components. Design can specify those names and states. Engineers make them real.
Third, the level matters. Support for turning off interaction-triggered motion is criterion 2.3.3, which is Level AAA, so AA does not require it. W3C also says AAA conformance is not recommended as a general policy for whole sites, because some content cannot meet every AAA criterion. If reduced motion matters to your product, write it as its own requirement.
So the realistic promise from a design agency is narrower than the sentence in the proposal. It designs to the named target, documents what engineers need, and tests what it can before handover. W3C’s planning guidance lists acceptance testing as a separate responsibility: making sure any agency-delivered website or component meets the level you want. Decide who holds that job before you sign.
Which standards and laws should the brief name?
Keep two things apart. The brief names a technical standard. Your counsel decides which laws apply.
| Source | What it says | What it leaves open |
|---|---|---|
| European Accessibility Act (Directive 2019/882) | Applies to listed services provided to consumers after June 28, 2025, including consumer banking and ecommerce. Websites and mobile apps must be accessible “in a consistent and adequate way” by making them perceivable, operable, understandable and robust. Microenterprises providing services are exempt. | The articles set outcomes, not a checklist. Whether your product is a consumer service, and how your country applied the directive, are questions for counsel. |
| EN 301 549 | The European standard for accessible digital products. Version 3.2.1 (2021) is based on WCAG 2.1 AA. Version 4.1.1, published in September 2026, adopts WCAG 2.2. | The AccessibleEU Centre says v4.1.1 is not yet the legal reference until the Commission cites it in the Official Journal. |
| ADA.gov web guidance (US, 2022) | Businesses open to the public must give equal access to goods and services, including those offered online. The Department of Justice has no regulation setting out detailed standards. WCAG and the Section 508 Standards are “helpful guidance.” | It names no required WCAG version. Some buyers still cite Section 508 in contracts, and Section508.gov sample language refers to WCAG Level A and AA. |
| Equality Act 2010 (UK) | A duty to make reasonable adjustments. For services, the Equality and Human Rights Commission’s code of practice says the duty is anticipatory and owed to disabled people generally, not only to a person who has already asked. | The Act names no technical standard, and the code says it creates no new legal obligations. |
A recital of the EU directive says that when part of a service is subcontracted, its accessibility should not be compromised and the service provider still has to comply. Counsel can say how that applies to your agency contract.
For the brief, WCAG 2.2 AA is a workable design and test target. WCAG 2.1 AA is the basis of the current EN 301 549, and the new version moves to 2.2. Add EN 301 549 if you sell in the EU and counsel wants it. List the platforms. For native apps, W3C’s WCAG2ICT note describes how WCAG criteria apply to mobile apps and other non-web software, but it is informative guidance and not a standard.
What evidence should an agency show, and how do you score it?
Ask for the same eight things from every agency, then score them against written anchors. The anchors matter more than the weights.
| Evidence to request | Strong answer | Weak answer | Weight |
|---|---|---|---|
| 1. Standard, level and scope in writing | “WCAG 2.2 AA” plus platforms, extras beyond AA, and which criteria design affects and which depend on build | “AA compliant,” no version or platform | 10 |
| 2. Annotated design sample from a past project, redacted | Screens marked with focus order, heading levels, names and states, error messages, contrast values for text and components, target sizes, motion behavior | Screens labeled “accessible,” or a color check alone | 20 |
| 3. A past accessibility review | Redacted findings: the standard used, who reviewed, what failed, what changed in the design | A logo, an award, or a report on a product the agency did not design | 15 |
| 4. Testing method | Automated checks plus manual keyboard and screen reader checks, a named tester, and the project stages where each runs | “We run an automated scan” | 15 |
| 5. Testing with disabled participants | How they recruit, which range of disabilities and assistive technology, which tasks, and what changed afterward | None, or one volunteer treated as representative | 15 |
| 6. Design-system accessibility documentation | Per component: keyboard behavior, labels, states, required design annotations, test status | “Our system is accessible” | 10 |
| 7. Named owner and training | A named accessibility lead, agreed roles, a training record | Accessibility belongs to “everyone,” so to nobody | 5 |
| 8. Handoff and acceptance plan | Annotation format, issue log, who retests, how open defects appear at handover | “Engineering will handle it” | 10 |
Row 2 maps to criteria a designer controls. Focus order is 2.4.3, and text needs a contrast ratio of at least 4.5:1, or 3:1 for large text. Interface components need 3:1 under 1.4.11. Pointer targets must be at least 24 by 24 CSS pixels, with listed exceptions. Ask for contrast values on the color tokens, since one failing token fails everywhere it is used.
Row 6 has a public model. IBM’s Carbon design system documents, per component, what the system already handles and where designers must annotate. For its accordion, keyboard operation and the expanded or collapsed state are built in, but heading levels and chevron alignment need annotations. Each component page also carries a testing table that separates automated tests from manual screen reader testing. The limit is stated by another system: the GOV.UK Design System says that using it does not immediately make a service accessible.
Rows 4 and 5 follow public-sector practice that private teams can borrow. The GOV.UK Service Manual says to run both automated and manual tests, because automated testing alone misses issues, and to check common assistive technologies and test with disabled and older users. W3C adds that evaluating with users finds usability issues that conformance evaluation alone misses, and warns against generalizing from one person. Combine user sessions with a WCAG check. Neither replaces the other.
What can design guarantee, and what can’t it?
Design can set contrast, target sizes and spacing, avoid interactions that only work by dragging (WCAG 2.2 adds a rule that dragging needs a single-pointer alternative), specify focus order, and write the error messages. It cannot guarantee how code is marked up, what content editors publish later, how a third-party widget behaves, or how every screen reader announces a component.
W3C’s draft roles and responsibilities mapping shows the split for headings: writers write the text and levels, designers define how headings look, and developers mark them up. A single-agency promise of “WCAG compliance” blurs that split.
The same applies to reports. The Information Technology Industry Council (ITI) describes an Accessibility Conformance Report (ACR) as a VPAT completed for a specific product or service. It is a report on a product, not a certificate for an agency. Ask an agency for one only if it shipped the product the report describes, and read who tested, which version, and what each “partially supports” covers. ITI itself notes that a conforming product can still be hard for some users, and a non-conforming one can work for others.
For the built product, plan an evaluation at acceptance. W3C’s WCAG-EM sets out a process: define the scope, explore the site, select a sample of pages, evaluate it and report. Decide now who runs it.
How might two agencies score on the same sheet?
An illustrative case: two invented agencies, Pine and Quay, answer the eight requests from the retailer’s brief. Weighted score is weight times score divided by 5.
| Evidence | Weight | Pine score | Pine weighted | Quay score | Quay weighted |
|---|---|---|---|---|---|
| 1. Standard, level, scope | 10 | 5 | 10 | 4 | 8 |
| 2. Annotated design sample | 20 | 2 | 8 | 5 | 20 |
| 3. Past accessibility review | 15 | 3 | 9 | 4 | 12 |
| 4. Testing method | 15 | 2 | 6 | 4 | 12 |
| 5. Disabled participants | 15 | 1 | 3 | 3 | 9 |
| 6. Design-system documentation | 10 | 2 | 4 | 3 | 6 |
| 7. Named owner and training | 5 | 4 | 4 | 3 | 3 |
| 8. Handoff and acceptance plan | 10 | 2 | 4 | 4 | 8 |
| Total | 100 | 48 | 78 |
Pine’s pitch was the smoother one. It named “WCAG 2.2 AA” with platforms, listed a trained accessibility lead, and attached an ACR for a past product. One evaluator gave its testing a 4 because it runs an automated scan on every release. At calibration the panel pointed out that automated scans alone miss issues, and that the ACR described a product built with another firm’s code. Testing dropped to 2, and the past-review row stayed at 3.
Quay’s deck was plainer. Its annotated sample showed focus order, heading levels and contrast values on the tokens. Its redacted review listed what failed and which screens changed. It admitted that the sessions with disabled participants in its last project were small, so it scored a 3 there and not a 5. By then the panel was comparing artifacts, not presentations.
What belongs in the statement of work?
These are our suggestions, to be reviewed by your legal and procurement teams.
- Name the standard and level: WCAG 2.2 Level AA on the listed platforms, plus any EN 301 549 or contract reference counsel adds. Give extras beyond AA, such as reduced motion, their own lines.
- List the screens and journeys in scope. W3C’s process rule means a partly covered checkout cannot be claimed as conforming.
- List the deliverables: annotations on every in-scope screen (focus order, headings, names and states, error text, contrast values, target sizes), component specifications, and accessibility notes with each handoff.
- Say who tests what. The agency tests designs and prototypes at named milestones. A named party tests the built product and accepts it.
- Set the participant sessions: how many, which range of disabilities and assistive technology, and a findings report.
- Define a defect as a failure of a named criterion in the agreed scope, or a task a participant could not finish because of a barrier. Give each one a severity, an owner, a fix window and a retest.
- Specify the handover: annotated files, component documentation, an open-issues list with owners, and a short statement of what the agency tested and did not test.
- Add change control, so screens added later inherit the same requirements.
- Avoid “compliant with all applicable laws.” Legal responsibility stays with your company, and counsel confirms how.
Where does this break?
- Do not hold a concept prototype to build standards. The GOV.UK Service Manual says that for rough prototypes you do not need to worry about accessible code, though checking contrast is useful.
- Write the EN 301 549 version into the SOW and revisit it. v4.1.1 exists and is not yet cited as the legal reference.
- Treat sessions with one or two people as leads, not proof. W3C says to state the scope of a study and not to generalize from a few people.
- A well-documented design system does not make the product built on it accessible. Row 6 supports rows 2 and 8; it does not replace them.
- For native apps, WCAG2ICT warns that some WCAG criteria assume a browser. Agree with your engineers how each criterion is tested in the app.
- If evaluators score before checking the artifacts, the smoother agency wins. Calibrate against the evidence column, as in the example.
What can you produce from this?
Three documents before the RFP goes out: the one-page evidence request with the eight rows, a scoring sheet with your own weights and anchors, and a list of statement-of-work clauses with a named owner for build acceptance. Send the clause list to counsel and ask them to correct anything that conflicts with what the law requires of you. If you plan a separate accessibility specialist beside a lead agency, our guide to lead agency or specialists covers who holds which contract role.
