Creating a VPAT and Accessibility Conformance Report

1. What a VPAT is and where the format comes from

VPAT stands for Voluntary Product Accessibility Template and originally refers to a standardized template developed by the Information Technology Industry Council, ITI for short, in cooperation with the US General Services Administration. The template traces back to Section 508 of the US Rehabilitation Act legislation, which since the late 1990s has required federal agencies to demonstrate accessibility when procuring electronic and information technology products.

At its core, a VPAT is a tabular document that records, for each individual success criterion of an underlying standard such as WCAG or EN 301 549, the degree to which a specific product or service meets that criterion. Strictly speaking, the term VPAT refers to the blank template, while the filled out document is correctly called an Accessibility Conformance Report, even though both terms are used practically interchangeably in everyday conversation.

2. From VPAT to ACR: terminology and practical use

This terminological distinction between VPAT as the template and Accessibility Conformance Report, or ACR, as the specifically completed document is more than pedantry, because it points to what a customer actually cares about: not the blank form, but a credible, product specific assessment grounded in a real audit. A company that requests an ACR and instead receives a generic, barely filled in VPAT template is right to reject it as insufficient.

In practice, the two terms have become commonly blended, so requests like please send your VPAT and please send your ACR effectively refer to the same document. What matters most for companies producing such a report themselves is that the document is clearly product specific, versioned, and dated with a concrete review date, rather than reading like a generic marketing claim without substance.

3. When a VPAT is required: B2B and public procurement

Historically, demand for VPATs originates from the US public sector, where Section 508 makes submitting the template practically mandatory for any larger IT procurement. This practice has since spread far beyond the United States: European public buyers increasingly require conformance evidence in their tenders too, often referencing EN 301 549, and many large companies with their own compliance requirements now also ask their software and digital agency suppliers for a VPAT as part of the procurement process.

For agencies and store owners in the Magento ecosystem, this becomes relevant particularly when a customer itself operates in a regulated industry such as finance, insurance, or healthcare, where accessibility is scrutinized internally, or when a store project is being built for a public sector buyer or a company with government ownership. Anyone active in these market segments should keep a current VPAT as a standing part of their sales collateral, rather than producing one under time pressure during an active tender.

4. The structure of a VPAT or Accessibility Conformance Report

A VPAT is typically organized into a cover section with product name, version number, evaluation date, evaluation methods used, and contact information, followed by one or more tabular criteria sections. Each row of this table corresponds to a single success criterion of the underlying standard and usually contains the criterion number, the conformance level, and a free text field for remarks and explanations, where concrete evidence or known limitations are named.

The following example shows a single table row for the WCAG keyboard operability criterion, as it would typically be phrased in an Accessibility Conformance Report, here as a simplified JSON representation, the kind also used for a machine readable OpenACR document under the open format co-developed by the ITI.

{
  "criterion": "2.1.1 Keyboard",
  "level": "A",
  "conformanceLevel": "Supports",
  "remarks": "All interactive elements in checkout are fully keyboard operable, no mouse-only interactions found."
}

5. VPAT editions: WCAG, EN 301 549, and the combined INT edition

The ITI provides several VPAT editions, each tailored to a specific standard: the VPAT WCAG Edition evaluates purely against the WCAG success criteria, the VPAT 508 Edition against the US Section 508 requirements, the VPAT EU Edition against EN 301 549, and the VPAT INT Edition, for International, combines WCAG, Section 508, and EN 301 549 in a single document with parallel evaluation.

For European companies serving both the European market and internationally operating enterprise customers, the INT Edition is usually the better choice, because it provides a single source of truth and avoids repeated requests for whichever regional format happens to apply. Companies serving exclusively European public buyers can get by with the leaner EU Edition, but should keep in mind that it covers WCAG criteria only indirectly, through the reference in EN 301 549 clause 9.

6. The conformance levels in detail

For each criterion, the VPAT format provides four possible conformance levels: Supports means the functionality fully meets the criterion, Partially Supports means part of the functionality meets the criterion while another part does not, Does Not Support means the majority or all of the functionality fails to meet the criterion, and Not Applicable means the criterion simply is not relevant to the product in question, for example a video criterion for a store with no video content.

The care taken in choosing the right level largely determines the credibility of the entire document. A VPAT that reports Supports across the board without any actual audit having taken place is quickly caught during a customer's spot check and durably damages trust in the entire company. Realistic VPATs almost always contain a mix of Supports, Partially Supports, and occasionally Does Not Support, combined with clear remarks that put each rating in context.

7. A practical workflow for producing a VPAT

The production process begins with a complete audit against the chosen standard, combining automated scans, manual keyboard testing, and testing with real screen readers, because a VPAT without a solid testing foundation has little value. In a second step, the individual test results are mapped to the criteria of the chosen VPAT edition, with a spreadsheet or a structured documentation format proving useful as an intermediate step before the final, formatted VPAT document is produced.

In a third step, the document should be reviewed internally by someone who was not involved in the audit itself, to catch blind spots and overly optimistic ratings. Finally, the VPAT is stamped with a version number, an evaluation date, and a contact person for follow up questions, and kept in a central place, such as sales collateral or a dedicated compliance page, for future requests, rather than being produced once for a single tender and then forgotten.

8. Common mistakes when producing one

The most common mistake is an overly optimistic self assessment, often the result of the VPAT being filled out by marketing rather than by the developers who actually ran the tests. A second frequent mistake is missing concrete evidence in the remarks field: a row that reports Supports without any explanation at all reads far less credible to an experienced reviewer than a row with a brief, concrete note on the test method used.

A third, often underestimated mistake is an outdated version that was never refreshed after a major frontend relaunch. A VPAT that is a year old and still refers to a checkout version that has since been completely overhauled can, in the worst case, be riskier than having no VPAT at all, because it actively asserts an outdated, possibly no longer accurate conformance claim. A regular review cycle, for example after every major release, is therefore a mandatory part of the process.

9. Using the VPAT strategically in the sales process

Beyond its pure compliance function, a carefully produced VPAT can actively build trust in the sales process, precisely because many competitors either have no such document at all or keep only a superficially filled one on hand. A vendor who proactively presents a current, honest ACR before the customer even asks signals a deeper understanding of the target audience's actual requirements than a vendor who scrambles to address the topic only once asked.

For Magento agencies, this concretely means treating a VPAT not as an annoying chore for individual tenders but as a reusable sales asset that can be kept current with manageable effort once its basic structure exists. The difference between a competitor with no VPAT and a vendor with a current, differentiated report can directly decide the outcome of a public tender or a B2B procurement process.

10. Summary

11. FAQ: VPAT and Conformance Report: Key Facts at a Glance