ADA Title II: why U.S. universities and governments will ask you for a VPAT in 2026
The Department of Justice rule requires states, cities and public universities to meet WCAG 2.1 AA by April 2027. They pass it on to their vendors. What they will ask for and how to have it ready.
· Rampa
In April 2024 the U.S. Department of Justice published the rule that applies Title II of the ADA (Americans with Disabilities Act) to the websites and apps of state and local governments. That includes public universities, schools, public hospitals and city halls.
The rule sets the standard: WCAG 2.1 Level AA (the technical web accessibility guidelines). And it sets dates: April 26, 2027 for entities serving 50,000 people or more, April 26, 2028 for smaller ones.
What it has to do with you if you sell software
The rule binds the public entity, not you. But the entity complies by using your product: if your payment platform, portal or app is not accessible, the university is the one out of compliance. So the requirement travels into the contract. Since 2025, more and more RFPs and renewals ask for three things:
- A VPAT or ACR (Accessibility Conformance Report): a table, criterion by criterion of WCAG, where you state whether your product supports, partially supports or does not support each one.
- A HECVAT (the higher-education security questionnaire), which is not about accessibility but usually comes in the same package.
- A roadmap: for the criteria you do not meet, when you will fix them.
What a reviewer looks for in your VPAT
The person reading it at the university is usually from accessibility, not procurement. They check whether each row has a concrete remark ("3 checkout fields without a label") or just "Supports" with no explanation; whether it states what was tested, with which tools and on what date; and whether any Level A or AA criterion says "Not Evaluated", which is grounds for rejection. An honest VPAT with several "Partially Supports" and a plan beats a perfect one with no remarks.
How to have it ready without a consultancy
For a public website or web app, the work is: an automated pass on every view (covers about half of the criteria), a manual pass with keyboard and screen reader for the rest, and filling the table with one remark per criterion. That is two or three days of work for a 20-view site, not two months. What cannot be skipped is the manual part: a VPAT made with a scanner alone shows on the first row.