Which WCAG Version Actually Applies to You

"We need WCAG 2.1 AA" carries two separate decisions. 2.1 is the version, which is how many rules exist. AA is the level, which is how strict those rules are. Confusing them is why teams end up aiming at something nobody asked for.

The Four Versions, and What Each One Added

The versions are backwards compatible. Meeting 2.2 means you meet 2.1 and 2.0. That is the single most useful fact here. Aim at 2.2 and every older requirement is satisfied on the way. If you need to know exactly which rules arrived when, the version history lists every criterion under the version that introduced it.

There is exactly one hole in that, and it matters only if a regulation names your version. WCAG 2.2 removed 4.1.1 Parsing, so an audit run against 2.2 does not test it. The Justice Department's Title II rule adopts WCAG 2.1 and says in terms that it is not adopting 2.2, so conformance to 4.1.1 is still required of a public entity. The health department said the same thing about its own rule. So the stacking argument holds for a contract, a complaint or a target you set yourself, and stops short of a duty pinned to a dated version.

The practical answer is small. Test against 2.2 as usual, and check 4.1.1 as well if a dated regulation binds you, which is one extra check about duplicate ids and well-formed markup. The Title II rule also carries a provision letting a public entity rely on a nonconformance that would not affect a disabled person's ability to use the content, so this is a box to tick rather than a reason to audit twice.

One more name to recognise, because a procurement form may use it. WCAG 2.2 was approved as ISO/IEC 40500:2025 in October 2025, which is the same standard under an ISO number, matching the October 2023 text. WCAG 2.0 was ISO/IEC 40500:2012. National laws often cite ISO numbers rather than W3C ones, so a questionnaire asking for 40500 is asking for WCAG.

That word "matching" is doing quiet work, and it leads to the fact almost nobody publishes. WCAG 2.2 has been republished once since 2023, on 12 December 2024, and the republication changed four defined terms. Single pointer, motion animation and programmatically determined among them, all of which other criteria are built on. So the version in force is not the October 2023 text most people quote. The ISO edition is that October 2023 text and does not carry the changes. Two people citing WCAG 2.2 can be citing slightly different documents.

Which answers the question owners actually ask, which is whether to hold off ordering an audit until the new one lands. Nothing about your current obligation changes while a draft develops. Every law we cover that names WCAG names a version already published, and a checkout nobody can finish with a keyboard is a problem you have today whatever the next standard ends up calling it. There is a second reason waiting does not work either. W3C says the working group might also develop further interim versions on the same short timeline as 2.2, so the thing you would be waiting for is not one event with a date on it.

What 2.2 Added

Nine new success criteria, of which six are A or AA and matter for most obligations:

• 2.4.11 Focus Not Obscured (AA). A sticky header must not hide the focused element entirely. Partial covering passes at AA and fails only at AAA.
• 2.5.7 Dragging Movements (AA). Drag-and-drop needs a single-pointer alternative that is not a drag.
• 2.5.8 Target Size (AA). 24 by 24 CSS pixels, with five exceptions rather than one. Spacing, equivalent control, inline targets, browser-determined size, and essential presentation.
• 3.2.6 Consistent Help (A). Help mechanisms appear in the same relative order across a set of pages, which is not quite the same as a help button pinned to a fixed spot.
• 3.3.7 Redundant Entry (A). Do not ask for the same information twice in one process, and note that browser autofill does not discharge this. The site has to supply what it already knows.
• 3.3.8 Accessible Authentication (AA). No cognitive test at sign-in unless one of four escapes applies. Allowing paste and password managers is the commonest. And because recognising objects is one of the four, an image CAPTCHA asking you to pick the buses passes at AA and fails only at AAA.

2.2 also removed one. 4.1.1 Parsing is gone, because modern browsers recover from the markup errors it was written for, and W3C went further by declaring it always satisfied under 2.0 and 2.1 too. So a checklist that still lists it is not necessarily out of date, and nobody should be failed on it either way. If a scanner keeps flagging duplicate IDs, W3C's own note says to report the consequence under whichever criterion it actually breaks.

One wrinkle matters if a regulator names a dated version. That always-satisfied note first appeared in the September 2023 republication of WCAG 2.1, and the DOJ's Title II rule incorporates the June 2018 text, which does not carry it. Under a dated citation, 4.1.1 is still a live Level A criterion, and the answer is still favourable because current parsers recover from the conditions it describes.

The Three Levels, and Which to Target

The levels are cumulative, so AA includes all of A and AAA includes all of AA. AA is the answer in nearly every real situation, and W3C explicitly advises against requiring AAA across a whole site, because some AAA rules cannot be satisfied for all content types.

How to Tell What a W3C Sentence Is Worth

One rule for reading the standard saves a lot of argument, and it is stated inside the standard itself. The main content of WCAG is normative and defines requirements. Introductory material, appendices, diagrams, examples, and notes are informative, and informative material helps you interpret the guidelines without creating any requirement.

Which means the advice against site-wide AAA is a note, so it is W3C's own recommendation and not a rule you can fail. And a whole family of documents outside the standard, including everything under the Understanding pages and the Techniques list, is informative too. That does not make them worthless. It means "W3C says" is not automatically the same as "the standard requires", and knowing which one you are holding is what stops a conversation going in circles.

Which Version Your Obligation Names

• Section 508 incorporates WCAG 2.0 AA.
• The DOJ Title II rule names WCAG 2.1 AA, with deadlines in April 2027 and April 2028.
• EN 301 549, the European procurement standard, incorporates WCAG 2.1 AA in the edition currently in force, with a newer edition moving to 2.2 expected.
• The European Accessibility Act works through EN 301 549, so 2.1 AA in practice.
• ADA Title III litigation has no codified standard. Complaints and settlements generally plead WCAG 2.1 AA.

Notice that most of them name 2.1 rather than 2.2. That is normal, because regulation lags publication. And because the versions stack, testing against 2.2 answers all of them at once, which is why our audits test the 2.2 superset. With the one exception above, so if a dated regulation binds you, add 4.1.1 to the list.

One more document to know exists if your product is not a website. W3C publishes WCAG2ICT, which explains how to apply WCAG to non-web software, documents and kiosks, and it is the route a procurement question about a desktop app or a ticket machine is really asking about.

So What Should You Aim At?

WCAG 2.2 Level AA. That is the answer for almost everyone reading this. Stop there.

It answers every law currently naming 2.0 or 2.1 bar the 4.1.1 point above, it covers the mobile and cognitive rules that older versions miss, and it will not need redoing when regulations catch up. Aiming lower saves nothing, because the gap is 5 rules. Aiming at AAA across a whole site is a target the standard itself advises against.