VPAT and ACR: what they are and how to fill one in

ITI describes the VPAT® as a free template that translates accessibility requirements and standards into testing criteria, and says users should test their products and services against each section and use the template to document the results. The result is the report a buyer asks for. This guide covers the editions, the five conformance terms as ITI defines them, who asks for a report, how to fill one in and the mistakes that make a report worthless.

VPAT is a registered service mark of ITI, which asks that the name and report form not be altered without its written permission. GotAlt is not affiliated with ITI, and we link to ITI for the template rather than reproduce it.

VPAT and ACR: the difference

The VPAT is the blank template. An Accessibility Conformance Report is the VPAT with documented testing results: ITI's FAQ puts it as "a version of the VPAT which has been completed for a specific product". A VPAT is a template, not a certificate. What a company has is a report its product's owner produced, and the report is only as good as the testing behind it.

ITI is clear about what the format is not. It does not review or approve VPATs, there is no submission process, and there is no VPAT certification. It adds that there is no pass/fail scale for deciding whether a product is accessible: the criteria give a picture of the accessible features the product provides. The current template is VPAT 2.5Rev, dated April 2025.

The four editions

ITI publishes four editions so a report can follow the standard a buyer names. Pick the edition that matches the buyer's request, not the one that looks easiest.

For U.S. federal sales, Section508.gov's guide to creating an ACR says vendors must use the Revised Section 508 or INT edition. That guide still describes version 2.4 of the VPAT as current and says any VPAT 2.x is acceptable (its FAQ says 2.x or later), while ITI's current release is 2.5Rev (April 2025). Use the current ITI release unless a buyer names a version. It also points vendors to its ACR Editor for building reports in a machine-readable format.

ITI's EU edition links EN 301 549 version 3.2.1. ETSI published version 4.1.1 on 2 September 2026; the European Commission's AccessibleEU Centre reported on 7 September 2026 that it had not been cited in the Official Journal, so version 3.2.1 still applied. Our EN 301 549 page tracks the dates. For help choosing a WCAG version in the WCAG edition, see which WCAG version the law requires.

The five conformance terms

Each criterion in the report gets one entry in the Conformance Level column. ITI's template requires the report to list the definitions of the terms it uses and recommends five. A vendor that changes the definitions must say so in the Notes. These are ITI's terms, summarized from the Terms section of the VPAT 2.5Rev WCAG edition; Section508.gov's guide restates the first four. ITI's web page lists four levels; the WCAG edition of the template adds Not Evaluated, for Level AAA criteria only. The remarks rules in the last column come from two sources, named in each row.

Buyers read the terms with caution. Section508.gov's guidance for understanding vendor claims tells buyers to review partially supported and not applicable entries in detail, says Not Evaluated gives no assurance of accessibility, and recommends independent conformance testing where possible. Write the report assuming someone will check it.

Who asks for a VPAT

• U.S. federal buyers. Section508.gov's ACR and VPAT FAQ says the government asks vendors to submit an Accessibility Conformance Report so the accessibility of a product can be evaluated, and that without one the government may not proceed with the purchase unless it claims a special exception. A product that does not meet every standard is still considered and compared with similar products. The ITI template itself is voluntary; the report is what the buyer needs.
• Buyers that name EN 301 549. ITI publishes an EU edition so a report can follow EN 301 549, which ITI describes as the EU's accessibility requirements for public procurement of ICT. Whether a European buyer asks for a report, and which edition, is the buyer's decision, so read the tender. Our EU law overview explains where the standard sits in EU law.
• Other buyers. ITI says that if you are completing a VPAT in response to a government or other solicitation, you should follow the directions in the solicitation, which may require a third-party audit or review. Whether a buyer asks for a report, which edition and which WCAG level is the buyer's decision, so read the request before you start.

Who completes the report is the product's owner in the first instance. ITI says the original equipment manufacturer is likely the best source for the testing, and that either a reseller or the vendor can complete it. Section508.gov says that if your product is an add-on to another company's, you complete the report for the part you developed.

What goes in an ACR

ITI's template sets a minimum for every report. In summary it must contain:

• A title in the form "[Company Name] Accessibility Conformance Report", and the template version it is based on.
• The name and version of the product, a short description of it, the report date (at least month and year) and contact details.
• Notes, for anything a reader needs to know about the product or the report.
• The evaluation methods used. ITI suggests saying whether the testers knew the product's functionality, which assistive technologies were used, which manual and automated tools were used, and the name, publisher and link of any published test method.
• The applicable standards or guidelines, listing only the WCAG versions actually used.
• The definitions of the conformance terms.
• The tables: one entry per criterion for the conformance level, and remarks that justify it.

When a report covers a WCAG level, every criterion at that level must be answered for the WCAG version reported. Section508.gov adds that only Levels A and AA are required in an ACR meant for federal procurement, and Level AAA is optional. The final report must itself be accessible, which matters when it is published as a PDF: see our guide to accessible PDFs.

How to fill one in

1. Pick the edition and the target

   Ask the buyer which standard, which WCAG version and which level it wants. A report against the wrong edition or version may not answer what the buyer asked.

2. Define exactly what is being reported

   Name the product and version. For a website, say how the pages were chosen. W3C's evaluation methodology states that a sample alone cannot support a WCAG 2 conformance claim for a whole website, so the Notes should say what was and was not tested. Our website accessibility audit guide explains sampling.

3. Test every criterion before you record anything

   Section508.gov says the product owner must first test the product against the standards to complete a report. Combine automated checks, manual testing and assistive technology. Our testing guide, the keyboard test and the WCAG 2.2 checklist cover the routine.

4. Choose a conformance level for each criterion

   Use the definitions above and keep your evidence: which page, which tool or assistive technology, what you observed.

5. Write remarks a buyer can use

   For Partially Supports and Does Not Support, name the functions or features with issues and how they fall short. If a criterion does not apply, say why. If an accessible alternative exists, describe it. Known workarounds and a way to get more information help the buyer.

6. Finish the document

   Complete the title information, remove ITI's instruction pages, check that the result is accessible, and send it on request or publish it. There is no submission process. Use the registered mark ("VPAT®") wherever the name appears in the report.

7. Date it and keep it current

   The Section508.gov FAQ says an updated report may be required every time the product changes, such as a version change or bug fix. If you revise a report, change its date and say what changed.

Example rows

These three rows are invented, for a fictional web application, to show the level and the remarks that go with it. They are not from a real report.

Common mistakes

• Marking Supports without testing. The template makes the vendor responsible for the integrity of the data in the report. A row marked Supports that nobody tested is a serious mistake, because a buyer relies on it.
• Treating a scan as the test. An automated scan covers part of WCAG (see what automated testing can and cannot check). The 16 checks in GotAlt's free scan map to 11 of the 55 success criteria at Levels A and AA in WCAG 2.2, by our count from the methodology page, and each covers only part of its criterion.
• Supports on every row, with no remarks. A report that never finds a gap gives a buyer nothing to verify and invites a test.
• Confusing Not Applicable and Supports. Follow ITI's note for the WCAG tables, and explain the choice in the remarks.
• Using Not Evaluated outside Level AAA. ITI allows it only there.
• Reporting a whole site from a few pages without saying so. State the sample and its limits in the Notes.
• Using the wrong edition, version or level. The report should match what the buyer asked for.
• Reusing an old report. The Section508.gov FAQ says an updated report may be required whenever the product changes, and that reports built on the 2001 Section 508 standards must be redone against the 2017 revision.
• Dropping the ®. The template, which you reach through ITI's VPAT page, requires the registered service mark with the VPAT name.
• Changing ITI's terms or structure without saying so. The template says deviating from its essential requirements precludes referring to it by name.
• Publishing an inaccessible report. The template requires an accessible final document.
• Presenting the report as a certificate. ITI states that there is no certification, and a buyer can test your claims.

How the WCAG 2.2 checklist and testing guides help

A report needs an answer for every criterion at the level you report, so start from the full list: our WCAG 2.2 reference covers all 86 success criteria, and WCAG levels A, AA and AAA explains which ones belong to which level. The WCAG 2.2 checklist condenses the most common failures into 42 checks and says for each whether a scanner, a browser tool or a person has to check it, which makes it a good way to organize testing. It is not a substitute for answering each criterion.

For evaluation methods, W3C's WCAG-EM is a published method you can name in the report, and the website accessibility audit guide walks through it. The bookmarklet, the contrast checker and the deep audit can supply evidence for individual rows, such as contrast, language and alt text, and the sample report shows what that evidence looks like.