# How should an enterprise software startup prepare a VPAT before a buyer asks for one?

> How an enterprise software startup can prepare a VPAT and ACR before a buyer asks: pick the edition, scope and test the product, word each term honestly and plan reissues.

- Canonical page: https://humbleteam.com/blog/enterprise-software-startup-vpat-accessibility-report
- Last updated: 2026-11-09

Skip to main content

[All articles](https://humbleteam.com/blog)

- Other

Updated November 9, 2026 10 min read

A VPAT is only as good as the tests behind it. Pick the edition, scope complete journeys, test with a keyboard and a screen reader, word each conformance term honestly and plan reissues.

Adam Brooks
Startups and B2B SaaS

Share [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fhumbleteam.com%2Fblog%2Fenterprise-software-startup-vpat-accessibility-report) [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fhumbleteam.com%2Fblog%2Fenterprise-software-startup-vpat-accessibility-report&text=How%20should%20an%20enterprise%20software%20startup%20prepare%20a%20VPAT%20before%20a%20buyer%20asks%20for%20one%3F) [Email](mailto:?subject=How%20should%20an%20enterprise%20software%20startup%20prepare%20a%20VPAT%20before%20a%20buyer%20asks%20for%20one%3F&body=https%3A%2F%2Fhumbleteam.com%2Fblog%2Fenterprise-software-startup-vpat-accessibility-report) Copy link

Illustrative situation: a startup sells permit-review software. A county purchasing office emails on Monday and asks for a VPAT by Friday. The founder downloads a template, a contractor runs an automated scan, and nearly every row comes back “Supports.” The county’s accessibility reviewer opens the first dialog with a keyboard and cannot leave it. The scene is invented. It shows the mistake this guide helps avoid: a report written from optimism instead of from tests.

Humbleteam, a digital product design agency, publishes this guide. It covers editions, conformance terms, how buyers read them, scope, testing, the design choices that decide the result, known gaps and reissue, with a worksheet and an invented worked example. Sources and product behavior are described as of November 8, 2026 and can change. This is not legal advice: your counsel decides which laws and contract terms apply to your product.

## What are a VPAT and an ACR, and which edition fits which buyer?

The Information Technology Industry Council (ITI) publishes the [VPAT](https://www.itic.org/policy/accessibility/vpat), a free template. Filled in with test results for one product, it becomes an Accessibility Conformance Report (ACR). ITI says it does not review or approve them, there is no VPAT certification, and nothing gets submitted anywhere. You may send the ACR to anyone or post it publicly. ITI also treats the VPAT name and report form as registered service marks, so do not alter the template.

Version 2.5Rev (April 2025) has four editions:

- 508: the revised Section 508 Standards, which incorporate WCAG 2.0.
- EU: EN 301 549, which incorporates WCAG 2.1.
- WCAG: WCAG 2.0, 2.1 and 2.2.
- INT: all three, with WCAG 2.2.

[Section508.gov](https://www.section508.gov/sell/how-to-create-acr-with-vpat/) says vendors selling to the federal government must use the 508 or INT edition. Our reading: a European public buyer gets EU, and a buyer who names a WCAG version gets the WCAG edition. The 508 tables follow WCAG 2.0, so they do not ask about criteria added in 2.2. To report on those, use the WCAG or INT edition.

## What do the four conformance terms mean, and why do remarks matter?

Section508.gov defines them. Supports means at least one method meets the criterion “without known defects.” Partially Supports means some functionality does not meet it. Does Not Support means most functionality does not. Not Applicable means the criterion is not relevant to the product. Remarks are required for the two failing terms. Not Evaluated is allowed only in the optional AAA table.

So one open bug you know about moves a row off Supports. A remark should name the screen, say what fails, say who is affected and give the workaround.

## How do buyers read the report?

Federal guidance on [reading vendor claims](https://www.section508.gov/buy/understand-claims/) tells buyers that Partially Supports means the product does not conform, that Not Applicable is not a failure, and that Not Evaluated gives no assurance. It also tells them to test independently. Its [procurement steps](https://www.section508.gov/buy/) add that an expert review only indicates accessibility, and hands-on testing validates it. Assume the reviewer will test with a keyboard.

A gap does not by itself end the sale. The [Section508.gov FAQ](https://www.section508.gov/sell/acr-vpat-faq/) says a product that misses some standards is still considered and compared with similar products. It also says the ACR is not optional if you want federal buyers to consider you.

## What scope should the first report cover?

The title page asks for product name and version, report date, contact and evaluation methods. Choose one released version, the platforms customers use and the complete journeys a buyer’s staff perform. Complete journeys matter: W3C says [conformance covers full pages and every page in a multi-step process](https://www.w3.org/WAI/WCAG22/Understanding/conformance), so a half-covered flow cannot be claimed.

W3C’s [WCAG-EM](https://www.w3.org/WAI/test-evaluate/conformance/wcag-em/) gives the method: define the scope, explore the product, select a representative sample, evaluate it, report. Our suggested sample: sign-in, the main data table, create and edit, approve and export, admin settings. Note what you left out, such as embedded third-party widgets.

## Who should test, and how?

ITI says the [product owner is likely the best source of test results](https://www.itic.org/policy/accessibility/vpat), and no third-party review is required unless a solicitation asks for one. Section508.gov tells agencies to say who tests, and that can be an [independent third party the vendor hires](https://www.section508.gov/buy/). Our rule of thumb: let someone who did not build the screens run the final pass, and use an outside evaluator before the first report goes to a large buyer.

Automated scans alone do not settle it. W3C says [no tool alone can determine](https://www.w3.org/WAI/test-evaluate/) whether a site meets accessibility standards; knowledgeable human evaluation is required. Plan a keyboard pass, a screen reader pass and sessions with disabled users, which W3C says [find issues conformance checks miss](https://www.w3.org/WAI/test-evaluate/involving-users/).

## What does WCAG 2.2 AA add, and which design choices decide the result?

WCAG 2.2 became a W3C Recommendation on October 5, 2023. It adds nine success criteria and drops 4.1.1 Parsing, per [W3C](https://www.w3.org/WAI/standards-guidelines/wcag/new-in-22/). The new AA criteria are Focus Not Obscured (Minimum), Dragging Movements, Target Size (Minimum), at 24 by 24 CSS pixels with exceptions, and Accessible Authentication (Minimum).

In enterprise screens, these design choices move rows:

- Tables: focus must follow an order that preserves meaning. Moving by row or by column can both pass, so [choose the keyboard model](https://www.w3.org/WAI/WCAG22/Understanding/focus-order.html) before build.
- Modals: focus may be held inside a dialog if people know how to leave, and Esc is common. See [No Keyboard Trap](https://www.w3.org/WAI/WCAG22/Understanding/no-keyboard-trap.html).
- Sticky headers and action bars must not entirely hide the focused item ( [2.4.11](https://www.w3.org/WAI/WCAG22/Understanding/focus-not-obscured-minimum.html) ).
- Contrast tokens: text needs [4.5:1](https://www.w3.org/WAI/WCAG22/Understanding/contrast-minimum.html), and component boundaries and states need [3:1](https://www.w3.org/WAI/WCAG22/Understanding/non-text-contrast.html). Fix the token once.
- Errors must be [identified and described in text](https://www.w3.org/WAI/WCAG22/Understanding/error-identification.html), so a red border alone fails.
- Dragging, such as reordering columns, needs a [single-pointer alternative](https://www.w3.org/WAI/WCAG22/Understanding/dragging-movements.html).
- Sign-in should allow password managers and pasted codes ( [3.3.8](https://www.w3.org/WAI/WCAG22/Understanding/accessible-authentication-minimum.html) ).

## What do the laws say, in plain words?

United States, federal: Section 508 sets the rules for agency purchases, and the revised standards use WCAG 2.0 Level A and AA, per [Section508.gov](https://www.section508.gov/buy/).

United States, state and local: the Justice Department’s ADA Title II rule covers web content and apps a public entity provides or makes available [directly or through contractual or licensing arrangements](https://www.ecfr.gov/current/title-28/chapter-I/part-35/subpart-H/section-35.200), at WCAG 2.1 AA. An April 2026 [interim final rule](https://www.federalregister.gov/documents/2026/04/20/2026-07663/extension-of-compliance-dates-for-nondiscrimination-on-the-basis-of-disability-accessibility-of-web) moved the dates to April 26, 2027 for populations of 50,000 or more and April 26, 2028 for smaller entities. That is one reason a county may ask you for a report.

European Union: the European Accessibility Act has applied since June 28, 2025 to listed products and services, such as computers, consumer banking and ecommerce. Microenterprises providing services are exempt ( [EUR-Lex summary](https://eur-lex.europa.eu/EN/legal-content/summary/accessibility-of-products-and-services.html) ). The summary’s list does not name general business software. Whether your product or a customer’s service is covered is for counsel. For the standard, the [AccessibleEU Centre](https://accessible-eu-centre.ec.europa.eu/content-corner/news/european-accessibility-standard-en-301-549-has-been-updated-2026-09-07_en) says EN 301 549 v4.1.1 (September 2026) adopts WCAG 2.2, but v3.2.1, based on WCAG 2.1, stays the legal reference until the new version is cited in the Official Journal.

## How do you handle known gaps?

Write the term for the product as it ships today, never the planned one. Keep fix dates out of the Conformance Level cell and put them in a remediation note. GSA’s [Issue Detail Supplement](https://www.section508.gov/sell/acr-supplement/) is a good shape for it: severity (critical, major or minor), affected area, affected users and workaround. Commit only to dates engineering has scheduled. Our rule: fix every critical gap, such as no keyboard access to a core function, before the first send.

## How often should you reissue?

The Section508.gov FAQ says an updated ACR may be required whenever the product changes, including a version change or bug fix. Our rule of thumb: retest the areas each UI release touches, run a full pass at least once a year and change the report date each time. [Section508.gov](https://www.section508.gov/sell/acr/) suggests making the report easy to find on your site. Our guide to the [startup trust center](https://humbleteam.com/blog/enterprise-software-startup-trust-center) covers where it sits among security documents.

## Which fields does the worksheet need?

VPAT preparation worksheet (our starting points, not an ITI form)

Criterion area

How to test

Finding

Conformance term

Remark to the buyer

Fix date

Keyboard paths and focus order

Tab through each journey with no mouse. Enter and leave every table, menu and dialog. Compare focus order with reading order.

Focus visibility

Tab with sticky bars and side panels open. Confirm the focused item is never fully hidden.

Contrast tokens

Check each text and component token against its backgrounds, in every theme.

Forms and error messages

Submit empty and invalid input. Confirm each error names the field and the problem in text.

Dragging and small targets

List every drag action and its non-drag alternative. Measure dense controls.

Sign-in and codes

Use a password manager. Paste a one-time code. Look for puzzles.

Add an evidence link and a test date to every row.

## Illustrative worked example: Pellmoor and Brennmoor County

Everything here is invented. Pellmoor is a fictional startup that sells permit-review software. Brennmoor County is a fictional buyer that asks for an ACR naming WCAG 2.2 AA.

Pellmoor scopes release 4.2 of its web app: sign-in, the review queue, permit review, approval and export. It uses the WCAG edition. An outside evaluator runs keyboard and screen reader passes. Findings on the report date:

- Dialogs: focus enters, Esc leaves and focus returns to the trigger. Supports.
- Sign-in: the one-time code field blocked pasting. Engineers fixed it before the report date, so the row reads Supports.
- Review queue: column order changes only by dragging. Partially Supports on Dragging Movements. The remark names the screen and the missing menu alternative. The remediation note lists the March 2027 release.
- Status chips: text contrast is 3.8:1. Partially Supports on Contrast (Minimum). The note lists a token change.
- Sticky action bar: it hides lower rows when they take focus. Partially Supports on Focus Not Obscured (Minimum).

Brennmoor’s reviewer tests the three Partially Supports rows and finds the remarks match.

## Where do these defaults stop working?

None of our sources says how long a first ACR takes or what it costs, so we give no figure. We did not download the VPAT template, so the term definitions come from Section508.gov’s how-to, which shows version 2.4 screens. Its pages are written for federal buyers, and a private buyer may send its own questionnaire or ask for a third-party audit. The rules about fixing critical gaps, the outside evaluator, the yearly pass and the sample are ours. We did not read national transpositions of the European Accessibility Act or any guidance on native apps. Dates move: the Justice Department changed its dates in 2026, and EN 301 549 v4.1.1 is not yet cited. Whether Section 508, Title II or the Act reaches you is for counsel.

## What can you produce now?

Five outputs, before the buyer’s email arrives:

- A scope sheet: product, version, platforms, journeys, report date and the chosen edition with the reason.
- The filled worksheet, with evidence links and test dates.
- A draft ACR on the ITI template with honest terms and remarks.
- An issue list in the Issue Detail Supplement shape, with scheduled fix dates only.
- A reissue calendar with one named owner.

If you want a design partner for the focus, contrast and error fixes the worksheet turns up, our comparison of [agencies that publish B2B SaaS platform cases](https://humbleteam.com/blog/b2b-saas-platform-ux-ui-design-agencies) shows what each one publishes.

## Read next

- [Other November 2, 2026 What should an enterprise software startup put on its trust center page?](https://humbleteam.com/blog/enterprise-software-startup-trust-center)
- [Other September 28, 2026 How Dubai teams can test bilingual product journeys](https://humbleteam.com/blog/dubai-arabic-english-product-ux-testing)
- [Other September 28, 2026 What to prepare for a London product design workshop](https://humbleteam.com/blog/london-product-design-workshop-brief)
- [Fintech Other November 6, 2026 Selecting a product design agency for Dubai fintech and enterprise](https://humbleteam.com/blog/dubai-product-design-agency-guide)