VPAT and ACR for SaaS: the VPAT 2.5 template, its four editions and how to write a credible report

The short answer

A VPAT (Voluntary Product Accessibility Template) is a free Word template published by the Information Technology Industry Council (ITI). Once you fill it in for one version of your product, it becomes an Accessibility Conformance Report (ACR), which is what a procurement team means when it asks for "your VPAT". The current template is VPAT 2.5Rev, dated April 2025, in four editions: WCAG (it covers WCAG 2.2), 508 (US federal), EU (EN 301 549) and INT (all three).

No VPAT certification exists, and ITI doesn't review or approve reports. Buyers trust an ACR for what's in it: a tested sample, a conformance term and a specific remark on every criterion, a product version and a date. Among vendors that publish prices, writing the report costs USD 350–950 on top of an audit, or USD 1,490–1,990 as a fixed price that includes the testing.

This guide was checked against ITI's page, Section508.gov, the W3C and the US federal regulations on 17 October 2026. It is planning information for a SaaS team, not legal advice.

VPAT vs ACR: the template and the report

The VPAT is the blank form; the ACR is your completed copy for a named product and version. ITI's VPAT page says the template is free, needs no ITI membership, and that the VPAT name and report form are registered service marks that shouldn't be altered without its permission. Its FAQ adds three facts that save arguments with sales teams: there is no certification, no submission process and no ITI review. The product owner fills it in and gives it to buyers or publishes it.

The template is optional; the report usually isn't. Section508.gov's ACR/VPAT FAQ says the VPAT itself isn't required, but that "it is not voluntary to complete an ACR if you wish the government to consider purchasing your product." The same page says a product that doesn't meet every standard can still be bought: agencies compare it with similar products.

If your buyers prefer structured data, GSA's free ACR Editor produces the same report in the machine-readable OpenACR format.

Which VPAT edition to use

ITI publishes one template per market. The WCAG version inside each depends on the standard that edition reports against:

Three details decide which edition you send.

• Federal buyers. Section508.gov's guide to creating an ACR with a VPAT says to use the Revised 508 or the INT edition when selling to the US federal government, and that any VPAT 2.x is acceptable.
• Test once, report many times. The W3C states in WCAG 2.2 that content conforming to 2.2 also conforms to 2.1 and 2.0, so one test at WCAG 2.2 AA covers every edition. The exception is 4.1.1 Parsing, which 2.2 removed. GSA's OpenACR catalog of the 2.5 WCAG edition still lists a 4.1.1 row, and the W3C's WCAG 2 FAQ says that under 2.0 and 2.1 the criterion should be considered always satisfied for content using HTML or XML.
• EN 301 549 just changed. ETSI published EN 301 549 V4.1.1 in September 2026, with its web, document and software clauses aligned to WCAG 2.2. ITI's EU edition, from April 2025, still links to V3.2.1, which follows WCAG 2.1. Until ITI updates it, report against the version the tender names.

When a buyer just asks for "your VPAT", ask which edition. If they can't say and you sell to government in both the US and the EU, INT covers every row they could check, at the cost of the longest document.

Who asks for an ACR, and what changed in 2026

Both US rules cover web content and apps the institution provides "directly or through contractual, licensing, or other arrangements." That clause is why a university's procurement team now sends a SaaS vendor an accessibility questionnaire: if its students use your product, your product counts as its web content.

The dates moved in 2026. The Department of Justice published an interim final rule on 20 April 2026 pushing its deadlines back by about a year, and HHS followed with its own extension on 11 May 2026. The standard, WCAG 2.1 AA, didn't change. For private companies, no federal rule requires an ACR; our ADA website compliance guide covers what the law does say.

The five conformance terms, and how buyers read them

Every row of an ACR gets one term. The definitions below are the template's, as reproduced on Section508.gov; the third column is how GSA's buyer guidance tells federal purchasers to read them.

Remarks are required for Partially Supports and Does Not Support, and encouraged for Supports. They are where buyers decide, so make each one specific: what fails, where, for whom, and whether a workaround or fix exists. Here are three illustrative rows for a fictional scheduling app:

How to produce an ACR that holds up

1. Define the product and version. Name what's in scope: the web app, the admin console, mobile apps, emails, PDF exports, the help centre. Section508.gov's FAQ allows one ACR for a product with documentation and a mobile app, or separate reports.
2. Choose the edition and the target. Test to WCAG 2.2 AA unless a contract says otherwise, then report in the edition each buyer needs.
3. Sample like an auditor. The W3C's WCAG-EM 2.0, a Group Note of 23 July 2026, sets five steps: define the scope, explore the product, select a sample, evaluate it and report. The sample covers common views and essential functionality, adds a random set of 10% of that structured sample (8 extra views on 80, in the W3C's example) and includes every step of complete processes. For a SaaS product, that means sign-up, sign-in with multi-factor authentication, onboarding, the core workflows, billing, settings, exports and error states.
4. Test by hand and with assistive technology. Run an automated scan first, then test with the keyboard alone, with screen readers (NVDA or JAWS on Windows, VoiceOver on macOS and iOS, TalkBack on Android), at 200% zoom, at a 320-pixel-wide viewport and with a contrast checker. Federal buyers are encouraged to validate claims independently with a process such as the DHS Trusted Tester process, so expect your "Supports" rows to be checked.
5. Fill the title page. Section508.gov lists seven fields: company, product name and version, report date (month and year), product description, contact information, notes and evaluation methods used. Say what you tested, with which tools and assistive technologies, and when.
6. Write a remark for every row, split by component where the template asks for it: web, electronic documents, software, authoring tool.
7. Add the Issue Detail Supplement for federal bids. GSA's ACR Issue Detail Supplement, updated in October 2026, is a workbook that rates each known issue as critical, major or minor and records the affected area, the user groups affected and any workaround. GSA recommends that agencies include it in any solicitation that asks for an ACR.
8. Make the ACR accessible and easy to find. Section508.gov asks vendors to check the report's own accessibility and to link it from the product page.
9. Reissue it when the product changes. Section508.gov's FAQ says a version change or bug fix may require an updated ACR, and an ACR written against the original 2001 Section 508 standards must be redone. Put "does this change an ACR row?" in your release checklist for UI changes.

Mistakes that make buyers distrust an ACR

• "Supports" on every row with no evaluation method. It reads as untested, and federal buyers are told to verify.
• Counting an overlay as a fix. In April 2025 the FTC approved a final order requiring accessiBe to pay USD 1 million and barring it from claiming that its automated products can make any website WCAG-compliant. An ACR row describes your product's code and content, which a script on top doesn't change.
• Missing remarks on Partially Supports and Does Not Support rows, where they're required.
• A stale report. An ACR for version 2.1 says nothing about 4.0, and a report with an old date on a product that ships weekly invites questions.
• Calling it a certification or adding a "VPAT certified" badge. ITI says there's no such thing.
• Not Evaluated on Level A or AA rows. The template allows it only for AAA.
• Gaps in scope. A report that covers the marketing site but not the logged-in product, or the web app but not the mobile app buyers' staff will use.

What a VPAT costs, and how long it takes

These are the vendors whose own pages state a VPAT or ACR price or price range, read on 17 October 2026. Others, including some of the largest accessibility firms, quote each project on request.

A worked example, arithmetic only and not a quote: a SaaS product whose sample has 10 primary screens and 4 light ones (settings, empty states, a confirmation page), needing the INT edition.

Neither total includes fixing what the testing finds. That is usually the larger cost and the one that changes your conformance terms. Accessible.org says it can pause issuing the report so your team can fix issues first, which gives you a cleaner ACR to send.

Time follows scope. A fixed-price report on 15 screens can be done in about a week; a product with several apps, a remediation round and a retest takes weeks to months. If a tender closes next Friday, send an honest report with Partially Supports and a dated fix plan, not a padded one.

If you want Dardo to do the testing and the fixes, our web accessibility audit starts at USD 690 on our pricing page. That is the price of an audit, not of a VPAT; writing the ACR from it is scoped separately. Our guide to accessibility audit costs compares audit prices in more detail.

An outline of an ACR

This is what a completed VPAT 2.5 report contains, from ITI's template description, Section508.gov's instructions and GSA's OpenACR catalog of the 2.5 editions:

For a typical web-based SaaS product, most hardware, voice and relay rows are Not Applicable. The work is in the WCAG tables, EN 301 549 clauses 9 (web) and 12 (documentation and support services), and clause 11 (software) if you also ship desktop or mobile apps.

What to do next

Start with a self-check: our free WCAG 2.2 checklist turns all 55 Level A and AA criteria into questions answered yes, partly, no or not applicable, which line up closely with the ACR's terms. It shows which rows you can't yet claim as Supports. Then test properly, fix the blockers in sign-in and your core workflows, and write the report from the evidence.

If you sell into Europe, read our guide to the European Accessibility Act; for the criteria that WCAG 2.2 added, see what changed in WCAG 2.2. If your product's marketing site also needs work, our SaaS website design service builds it to WCAG 2.2 AA from the start.