Questions · Procurement, updates and cost
Can we fill out our own VPAT, or do we need a third party?
You can write it yourself. ITI says the product owner is likely the best source for the testing and that a third-party review is not required, unless a solicitation asks for one. But buyers may weigh independence: the HECVAT asks whether a third-party expert audited your latest version, and GSA tells federal buyers to verify vendor claims.
What a credible self-written ACR takes
- Testing every Level A and AA criterion of the WCAG version you report — 50 in WCAG 2.1, 55 in WCAG 2.2 — on the screens and complete flows buyers use, with a keyboard, a screen reader and contrast measurements. The W3C: “Tools cannot check all accessibility aspects automatically. Human judgement is required.”
- A remark for every row, and for each Partially Supports or Does Not Support, the features affected and how they fall short.
- An “Evaluation Methods Used” section, which ITI requires, saying how the product was tested.
Where independence matters
HECVAT 4.1.6, ITAC-11: “Has a third-party expert conducted an audit of the most recent version of your solution?” Its guidance notes that VPATs and ACRs “are voluntary reports often generated by the creator of the product,” while audits by expert third parties “give greater confidence to customers.”
GSA tells federal purchasers to verify vendor claims with independent testing whenever possible — for web products, with a baseline-aligned process such as Trusted Tester. Agencies that adopt the Trusted Tester process accept results only from certified Trusted Testers.
Whoever tests, the ACR remains the vendor’s statement: ITI puts the integrity of the data on the vendor.
How ACR Desk handles this
We test independently of your team and write the ACR; you review, approve and publish it under your name, and the report says who tested and how. The keyboard and screen reader testing is done by an IAAP-certified specialist (CPWA) who is also a DHS-certified Trusted Tester; our standard evaluation follows WCAG-EM, not the Trusted Tester process, so if a solicitation requires Trusted Tester results, tell us before you order.
Last reviewed: September 30, 2026. Not legal advice: rules change, and your buyer’s solicitation or contract governs what they require.
Sources
Primary sources only. Each was read on September 30, 2026.
- VPAT® — current version 2.5Rev (April 2025), four editions, FAQs — Information Technology Industry Council (ITI).
- VPAT® 2.5Rev WCAG edition (April 2025) — template and Essential Requirements for authors (Word file) — Information Technology Industry Council (ITI).
- Higher Education Community Vendor Assessment Toolkit (HECVAT 4, current version 4.1.6) — IT Accessibility questions ITAC-01 to ITAC-18 — EDUCAUSE.
- Understanding Vendor Claims in Accessibility Conformance Reports for Section 508 Conformance — Section508.gov, GSA.
- DHS Trusted Tester Process & Certification Program — Section508.gov, GSA (reviewed/updated July 2026).
- Selecting Web Accessibility Evaluation Tools — W3C Web Accessibility Initiative.
- Web Content Accessibility Guidelines (WCAG) 2.1 — W3C Recommendation (current version dated May 6, 2025) — W3C.
- Web Content Accessibility Guidelines (WCAG) 2.2 — W3C Recommendation (current version dated December 12, 2024) — W3C.