How to make a VPAT for a website (and when you do not need one)
What a VPAT is, which edition to pick, how to fill each row honestly and what it costs. With the list of the 56 WCAG 2.2 A/AA criteria.
· Rampa
VPAT (Voluntary Product Accessibility Template) is a template from the ITI association. When you fill it in, the resulting document is called an ACR (Accessibility Conformance Report). People use both words for the same thing: a table with every accessibility criterion and one of four answers: Supports, Partially Supports, Does Not Support or Not Applicable.
When you need one and when you do not
You need one if you sell to universities, government or large companies in the U.S. and Europe: they ask for it in the RFP. You do not need one if you run a store or a services site for the general public: there, what protects you is fixing the code and publishing an accessibility statement. A VPAT does not prevent lawsuits; it is a procurement document.
Which edition
There are four templates: WCAG (the guidelines only), 508 (the U.S. federal law, which uses WCAG 2.0 AA), EU (the European standard EN 301 549, which uses WCAG 2.1 AA) and INT (all three). If you will be asked from both sides of the Atlantic, INT saves work: it is the same 56 WCAG rows plus short 508 and EN tables that, for a website, almost fill themselves.
How to fill a row without lying
- Supports: you tested the criterion on every view and found no failures. Say how you tested it.
- Partially Supports: there are failures on some views or elements. Say which and how many: "27 low-contrast texts on 5 pages".
- Does Not Support: most of the product fails. Rare on a well-kept site; do not use it for one isolated failure.
- Not Applicable: the criterion is about something you do not have (live video, single-key shortcuts). Say so: "No video on the evaluated pages".
- Not Evaluated only exists for Level AAA. If it appears on A or AA, the reviewer sends it back.
The method that goes on the cover
The VPAT asks you to state how you evaluated. What holds up is: automated testing (axe-core or similar) on every view, manual review with keyboard and zoom, and a screen reader (NVDA on Windows, VoiceOver on iPhone) on navigation, forms and main flows. If you only write "automated tool", the reviewer knows half the rows were never tested.
What it costs
A consultancy charges between $3,000 and $15,000 for a VPAT, depending on size. An independent professional, between $450 and $900 for a site of 10 to 40 views, with a retest after fixes. What is not worth it is the $200 VPAT done in an afternoon with a scanner: it gets rejected and has to be redone.