A VPAT is the Voluntary Product Accessibility Template, published by the Information Technology Industry Council. It is a blank form. You fill it in, one row per accessibility rule, saying how well your product meets that rule and explaining anything that is not a clean pass.
Once it is filled in, the document has a different name: an ACR, or Accessibility Conformance Report. VPAT is the empty template. ACR is your completed report. People use both words for the finished document, and now you know why.
The short version
VPAT is the form. ACR is the form once you have filled it in. Buyers ask for a VPAT and mean an ACR. Nobody will correct you either way.
If a customer has just emailed asking for one, start a step earlier than this page. What to do first when a customer asks for a VPAT is the triage that settles which product, which edition and which deadline you are actually working to, and it is twenty minutes well spent before anybody opens the template.
Who Actually Needs One
You need one when somebody with a budget asks for it, and that is usually one of four situations:
- You are selling to a US federal agency. Section 508 requires agencies to buy accessible technology, and procurement officers ask for an ACR as the evidence.
- You are selling to a university, school district, hospital, or state agency. Most inherit federal procurement habits even when the federal rule does not bind them directly.
- You are selling to a large enterprise. Big buyers now push accessibility requirements down their supply chain, because their own obligations flow through to what they buy.
- You are selling into Europe. EN 301 549 is the European procurement standard, and the European Accessibility Act has pulled it into private-sector deals too.
If none of those describe you, you do not need a VPAT. An accessibility statement is the document your situation calls for, and it is a much lighter lift.
The Four Editions, and Picking One
The current template is version 2.5Rev, published April 2025, and it ships in four editions. They cover different rule sets, and choosing wrong means redoing the work.
| Edition | Covers | Reach for it when |
|---|---|---|
| WCAG | WCAG A, AA, and AAA, across versions 2.0, 2.1 and 2.2 | Your buyer named WCAG and nothing else. |
| Revised Section 508 | WCAG 2.0 plus the US federal 508 requirements | You are selling to a US federal agency. |
| EN 301 549 | WCAG 2.1 plus the European procurement requirements | You are selling into the EU public sector. |
| INT (International) | All three at once, reaching WCAG 2.2 | You sell in more than one market, or you do not want to do this twice. |
Read that middle column before you pick, because the edition decides your WCAG version as well as your rule set. The 508 edition reports against WCAG 2.0, since that is what the Revised 508 Standards incorporate. The EU edition reports against WCAG 2.1, through EN 301 549. Only the WCAG and INT editions reach 2.2, so a buyer asking for 2.2 in a federal procurement is asking for two different things at once.
Most software companies pick INT. It is longer, but it answers every buyer with one document, and the extra rows are mostly quick once you have done the WCAG work underneath.
The Conformance Terms, and the One You Cannot Use
Every row gets one of four verdicts. The wording is fixed, and using it precisely is what makes a report credible.
- Supports. The template's own definition is at least one method that meets the rule without known defects, or that meets it with equivalent facilitation. So an alternative route can carry the row.
- Partially Supports. Some of the product meets it and some does not. This is the most-used term in any honest report, and the remarks column is where you say which parts.
- Does Not Support. The definition is that the majority of the product's functionality does not meet the rule, which is stricter than the everyday reading. It is not the term for one broken control. Say so plainly and say what you are doing about it.
- Not Applicable. The rule does not apply, because the product has no video, no audio, no forms, whatever the case is.
There is a fifth term you will see and mostly cannot use. Not Evaluated means nobody checked, and it is permitted only in the Level AAA section, so a row you have not tested at A or AA cannot be left open. You have to go and test it. Use it anywhere else and a procurement officer who reads these for a living will send the report back.
The Mistake That Costs Deals
Marking everything Supports.
It reads as thorough. It reads as confident. It is neither. And to anyone who evaluates these for a living, it reads as a report nobody actually tested, because no real product supports all fifty-five A and AA criteria cleanly on the first pass. We have never audited one that did.
Procurement teams have seen hundreds of these. An all-Supports report gets a five-minute check against the live product, and one broken keyboard trap later, your credibility on every other row is gone. A report with eleven Partially Supports rows and clear remarks wins against an all-green report that falls apart under a spot check. Honesty is the competitive move here, which is not a sentence you get to write often.
What buyers actually read
In our experience they read three things: the date, the remarks on any row that is not Supports, and whether the evaluation methods section names a real testing process. An ACR that says "evaluated with automated tooling" and nothing else tells them the judgment calls were skipped.
How the Report Gets Written
A VPAT is the last step. Not the first. The order that works:
- Test the product against every applicable rule. All fifty-five at A and AA, not a sample. Machine checks for what machines can verify, human review for the rest.
- Write down what fails, precisely enough that a developer can find it and a buyer can understand it.
- Fix what you can before publishing. Every row you turn from Partially Supports to Supports is a row you do not have to explain.
- Fill in the template, using the terms honestly and writing real remarks on everything that is not a clean pass.
- Date it and name the version tested. An undated ACR is worthless, and an ACR against a release from two years ago is worse than none.
- Re-issue it when a release changes the interface. That is the thing that actually invalidates a row. No published interval requires a refresh, so a date is judged against your release history rather than against the calendar.
Steps one and two are an audit. If you would rather not run one internally, that is what our VPAT and ACR preparation service is for. We test every rule, write the findings, and hand you the completed report with the evidence behind each row.
Word, PDF, or the Machine-Readable Version
Send the format your buyer asked for. If they did not name one, send the Word or PDF template, because that is what most procurement teams still open. Then there is a third option worth understanding before somebody in a solicitation asks you for it by name.
OpenACR is a US General Services Administration project that turns the same report into a machine-readable file. The source is YAML, the reading copy is generated HTML, and the whole thing sits on the ITI template rather than replacing it. It is a delivery format, not a different standard and not a different set of rules. Its published catalogs cover the 2.4 and 2.5 template editions and reach WCAG 2.2 with Revised Section 508, though none of them carries the April 2025 revision label, so check the edition against the one your buyer named.
The reason GSA built it is the reason a large buyer might want it. A Word file is a static picture of one afternoon, and comparing four of them is an afternoon's work of its own. A structured file can be diffed against last quarter's, kept in version control alongside the product, and read by something other than a person.
| What to weigh | Word or PDF | OpenACR |
|---|---|---|
| What a buyer receives | The ITI template, filled in | A YAML file, and an HTML page generated from it |
| Who reads it easily | Anybody, with no tooling at all | A person reading the HTML, or a system reading the YAML |
| Tracking change over time | By hand, one file against another | By commit, the way you track anything else in a repository |
| How to produce one | Download the template and fill it in | Write the YAML, or use GSA's browser editor, which the project describes as still in progress |
| Safe assumption about acceptance | Expected almost everywhere | Ask first. Send it alongside the template rather than instead of it |
Why Validation Is Not the Same Thing as Truth
A document can be schema-valid and completely untrue. That is the sentence to carry out of this section, and it is the one people take exactly backwards. Validation checks shape. It has never checked substance, and it was never built to.
The checker asks four questions, and they are worth reading one at a time.
- Does this criterion number exist in the catalog for this edition?
- Is this component name defined?
- Is that component allowed against that criterion?
- Is the conformance term one the catalog knows about?
Not one of those is about your product. Nothing opens your software, nothing reads your remarks, and nothing compares what you wrote against anything a person could go and check.
Two consequences follow, and both are worth knowing before you treat a validation pass as evidence. The remark field is optional, so a file carrying nothing but bare verdicts validates cleanly. And the rule that Not Evaluated may only appear in the Level AAA section is written as a sentence of English inside the format's own description of that term, which puts it where a person will read it rather than where the checker will run it.
If somebody sends you a validated report
Valid means well-formed. It means the file will load, the criterion numbers are real and the verdicts are spelled the way the template spells them. It says nothing whatsoever about whether the product does what the file says it does. The questions that settle that are the ones on our conformance report review checklist, and they are the same questions whatever the file extension is.
Which is where the rest of this page already stands. The format decides how easily a buyer can read and compare your report. The testing decides whether it is worth reading.
One honest limit
A VPAT is a self-disclosure, not a certification. Nobody accredits it, and no third party signs it off. What makes one credible is the quality of the testing behind it and the candour of the remarks. Any vendor promising you a "certified VPAT" is selling something that does not exist.