How often should we update our VPAT?

What the sources say

• GSA’s vendor FAQ: “Every time your product is changed or updated (e.g. version change, bug fix, etc.), an updated ACR may be required to address any changes in the product’s accessibility.” A report written against the original 2001 Section 508 standards must be redone against the Revised Standards.
• GSA’s recommended solicitation clause: “ICT must remain accessible throughout the contract period of performance, even as products and software are updated or modified.”
• HECVAT 4.1.6, ITAC-06: an ACR for an older version “does not accurately reflect the accessibility of the product under consideration,” and the answer should then be no. ITAC-16 describes revised ACRs as “a snapshot in time of a given release.”
• ITI’s best practice: when you revise a report, change the report date and explain the revision in the Notes, or issue a new report that says it supersedes the earlier one.

A practical schedule

Update the ACR when a release changes navigation, forms, sign-in, dialogs or other components that appear on many screens; when you add a flow buyers rely on; when a buyer’s standard moves, for example from WCAG 2.1 to 2.2; and, if universities are among your buyers, before the report is 12 months old. Between updates, the Notes section can say which release the report covers.