ACR — WCAG edition
$1,490fixed
5 business days
- WCAG 2.1 A and AA (2.2 on request)
- ACR, fix list, draft statement
- One retest within 90 days
For vendors selling to higher education
Selling software to a public university: the ACR procurement will ask for.
Public universities have a federal deadline for accessible web content and apps — including the ones they license from vendors. That is why their procurement, IT security or accessibility office is asking you for an ACR. Here is what they need, and why.
The rule, in plain terms
WCAG 2.1 AA — including what the university licenses from you.
The Department of Justice’s ADA Title II rule (28 CFR 35.200) requires state and local government entities — public universities included — to make their web content and mobile apps meet WCAG 2.1 Level AA.
It covers content the university provides “directly or through contractual, licensing, or other arrangements.” DOJ’s own guidance uses a university’s third-party tuition payment site as an example of content the university must make sure is accessible (ADA.gov, First Steps).
A content-posting exception exists for third parties, but not when the third party posts “due to contractual, licensing, or other arrangements” with the public entity (28 CFR 35.201(c)). As ADA.gov puts it, a public entity “can’t contract away its responsibilities under the ADA.”
| Public entity | Date |
|---|---|
| Total population of 50,000 or more — a state university uses its state’s population | April 26, 2027 |
| Total population under 50,000, and special district governments | April 26, 2028 |
Dates as amended by the interim final rule of April 20, 2026 (91 FR 20902), which moved each date back one year.
Status, September 2026
Delayed once. Not repealed.
In the April 2026 interim final rule, DOJ said it plans future rulemaking on the substance of the 2024 rule and may propose changes during the extension. As of September 26, 2026, no such proposed rule has been published in the Federal Register, and the current text of 28 CFR 35.200 carries the 2027 and 2028 dates.
DOJ also wrote that, regardless of the compliance dates, covered entities have an ongoing obligation to make services offered through web content and mobile apps accessible under Title II.
What DOJ suggests they ask you
Detailed accessibility information, before the contract.
DOJ’s “First Steps” guidance lists practices that public entities told the Department were helpful with vendors. DOJ notes it does not recommend or endorse any particular approach.
- Requiring vendors to provide detailed information about the level of accessibility of their product before signing any contracts.
- Asking vendors to include a warranty that they comply with certain technical standards and applicable accessibility laws.
- Contract language prohibiting vendors from disclaiming accessibility warranties.
- Indemnification for any breach of accessibility warranties.
- Testing vendor products and publishing the results.
The questionnaire
What the HECVAT asks about accessibility.
The HECVAT, published by EDUCAUSE for higher education, is a vendor questionnaire covering security, privacy and IT accessibility. In version 4.1.6, its IT Accessibility sheet runs from ITAC-01 to ITAC-18. The questions that an ACR and its evidence answer:
| Question | Text |
|---|---|
| ITAC-05 | Web Link to Accessibility Statement or VPAT |
| ITAC-06 | Has a VPAT or ACR been created or updated for the solution and version under consideration within the past 12 months? |
| ITAC-07 | Will your company agree to meet your stated accessibility standard or WCAG 2.1 AA as part of your contractual agreement for the solution? |
| ITAC-08 | Does the solution substantially conform to WCAG 2.1 AA? |
| ITAC-11 | Has a third-party expert conducted an audit of the most recent version of your solution? |
| ITAC-14 | Can you provide a current, detailed accessibility roadmap with delivery timelines? |
| ITAC-17 | Can all functions of the application or service be performed using only the keyboard? |
| ITAC-18 | Does the product rely on a special “accessibility mode,” a “lite version,” or an alternate interface such as an overlay? (paraphrased) |
How our package maps to it. The ACR and its date answer ITAC-05, 06 and 08. Our evaluation is independent of your team, and the report says who tested and how (ITAC-11). The fix list is the starting point for the roadmap in ITAC-14. The keyboard-only pass answers ITAC-17, and we never use overlays (ITAC-18). ITAC-07 is a contract commitment only you can make.
What to send the university
Four documents, one email.
The ACR
WCAG edition, WCAG 2.1 A and AA, dated within the last 12 months and matching the version they are buying.
Your accessibility statement
With known limitations and a contact for reporting problems. We draft it for you.
A roadmap
Dates for the Partially Supports and Does Not Support items. Our fix list gives you the order; you set the dates.
The HECVAT answers
The IT Accessibility section, consistent with the ACR. ACR Care includes help with it.
Related rules
Private colleges, and HHS funding.
Private colleges are not public entities under Title II, so the DOJ rule does not apply to them directly. The HECVAT is written for higher education as a whole, though, so expect the same accessibility questions.
Institutions that receive financial assistance from the Department of Health and Human Services also fall under HHS’s Section 504 rule (45 CFR 84.84), which uses the same WCAG 2.1 AA standard and the same “contractual, licensing, or other arrangements” language. Its dates: May 11, 2027 for recipients with 15 or more employees, and May 10, 2028 for smaller ones, as extended by an interim final rule of May 11, 2026 (91 FR 25496).
Our offer
$1,490 for the ACR. $199 a month to keep it current.
ACR Care
$199per month
Keeps ITAC-06 answered
- Monthly automated checks with a note
- ACR updated at major releases, up to 2 a year
- Help with the HECVAT accessibility section
What we don’t do: give legal advice on the contract terms a university proposes (warranties, indemnification, ITAC-07), or promise that the university will approve your product.
Questions
Short answers.
The university asked for WCAG 2.2. Can you do that?
Yes, at the same price. WCAG 2.2 adds six Level A and AA criteria (and removes 4.1.1 Parsing), and ITI’s WCAG edition already includes them.
Our ACR is 18 months old. Is it still good?
It still describes the version it tested. But ITAC-06 asks whether your VPAT or ACR was created or updated for the version under consideration within the past 12 months — if you have shipped changes since, update it.
Do we need a third-party audit?
No rule requires one. ITAC-11 asks whether one was done, and a university can weigh the answer. ITI notes that the product owner can complete its own VPAT®.
Sources
Primary sources only. Each was read on September 26, 2026.
- 28 CFR 35.200 — Requirements for web and mobile accessibility (ADA Title II) — eCFR, current text (up to date as of September 24, 2026).
- 28 CFR 35.104 — Definitions (“public entity,” “total population,” “special district government”) — eCFR, current text.
- Extension of Compliance Dates … Accessibility of Web Information and Services of State and Local Government Entities — interim final rule, 91 FR 20902 (FR Doc. 2026-07663) — Department of Justice, Federal Register, April 20, 2026.
- Accessibility of Web Information and Services of State and Local Government Entities — final rule, 89 FR 31320 — Department of Justice, Federal Register, April 24, 2024.
- First Steps Toward Complying with the ADA Title II Web and Mobile Application Accessibility Rule — ADA.gov, Department of Justice (updated after the April 2026 extension).
- Higher Education Community Vendor Assessment Toolkit (HECVAT 4, current version 4.1.6) — IT Accessibility questions ITAC-01 to ITAC-18 — EDUCAUSE.
- 45 CFR 84.84 — Requirements for web and mobile accessibility (HHS, Section 504) — eCFR, current text.
- Extension of Compliance Dates … Web Content and Mobile Applications of Recipients of Departmental Financial Assistance — interim final rule, 91 FR 25496 — Department of Health and Human Services, Federal Register, May 11, 2026.
- WCAG 2.1 — W3C Recommendation, June 5, 2018 (the version incorporated by the ADA Title II rule) — W3C.
- VPAT® — current version 2.5Rev (April 2025), four editions, FAQs — Information Technology Industry Council (ITI).
Get a quote
Forward us the university’s request.
The email, the HECVAT, or the procurement form — whatever you received. We reply with a fixed price and a delivery date within one U.S. business day.