Reference
What is a VPAT?
A VPAT is a document stating how your product measures up against each accessibility requirement, criterion by criterion. Filled in, it is called an Accessibility Conformance Report. Universities, hospitals and government agencies are required to consider accessibility when they buy software, so their procurement teams ask every vendor for one — usually late in the deal, and usually with a deadline.
Last reviewed September 2026
What is actually in one
A conformance table with one row per WCAG success criterion — 55 rows at Level A and AA. Each row carries a conformance level and a remarks column explaining the judgement.
- Supports
- Every relevant function meets the criterion, with no known defects.
- Partially Supports
- Some functionality meets it and some does not. Most honest reports use this often.
- Does Not Support
- The majority of relevant functionality does not meet it.
- Not Applicable
- The criterion does not apply — there is no video, no live audio, no legal transaction.
- Not Evaluated
- Nothing was checked. A report that uses this where it is true is more credible than one that never does.
Around it sits the product information, the standard being claimed, a scope statement saying what was and was not evaluated, and the methodology.
What it costs, and why
A VPAT needs an audit behind it, which is where the money goes. Typical published pricing for a small product:
| Accessibility audit | $1,250 – $2,750 | $100–$250 per primary page |
|---|---|---|
| VPAT report, WCAG edition | $350 | on top of the audit |
| Section 508 edition | $550 | |
| EN 301 549 edition | $650 | |
| International edition | $950 | all three standards |
Four to eight weeks is normal. Mid-sized SaaS products run into five figures once the report has to cover several editions or configurations.
How much of it can be automated
Less than people expect, and more than vendors admit. Of the 55 Level A and AA criteria:
- 6 can be settled outright by an automated tool — contrast, a missing language attribute, an unlabelled control.
- 34 turn on judgement about meaning. A machine can see that alt text exists; deciding whether it conveys the image’s purpose is a different question.
- 15 need someone to operate the product — whether captions are accurate, whether a session timeout can be extended, whether focus can escape a dialog.
This is why a scanner alone cannot produce a credible VPAT, and why a report claiming conformance across criteria nobody examined is the thing that gets a vendor into trouble later.
Which standard your VPAT should claim
It depends entirely on who asked.
- WCAG 2.2 Level AA
- The current version of the guidelines, and the safest answer when a buyer does not name one.
- WCAG 2.1 Level AA
- What HECVAT asks about by name, and what the ADA Title II rule requires of state and local government.
- EN 301 549 (WCAG 2.1 Level AA)
- European public procurement, and the reference point for the European Accessibility Act.
- Section 508 (WCAG 2.0 Level AA)
- US federal procurement. The 2017 refresh of Section 508 incorporates WCAG 2.0 AA.
A product failing only WCAG 2.2’s target-size rule is fully conformant with 2.1 and partially conformant with 2.2. Answering the wrong version of the question usually makes a vendor look worse than they are.
Affido drafts a VPAT from your live product in an afternoon, names its own gaps, and keeps it current as you ship. $999 once, or $249 a month.
Start freeRelated questions
What is a VPAT and why is a customer asking me for one?
A VPAT is a document stating how your product measures up against each accessibility requirement in WCAG, criterion by criterion. Filled in, it is called an Accessibility Conformance Report. Universities, hospitals and government agencies are required to consider accessibility when they buy software, so their procurement team asks every vendor for one — usually late in the deal, and usually with a deadline.
How much does a VPAT cost and how long does it take?
A defensible VPAT for a small product costs roughly $1,600 to $4,450 — an audit at $1,250 to $2,750 plus $350 to $950 for the report itself — and takes four to eight weeks. Mid-sized SaaS products run into five figures. Affido produces a draft from your live product in an afternoon for $999 as a one-off, or $249 a month to keep it current.
Can a VPAT be generated automatically, or do I need a consultant?
Partly. Automated testing settles only six of the 55 WCAG Level A and AA criteria outright; most of the rest turn on judgement — whether alt text is meaningful, whether link text makes sense out of context — and a handful need someone to operate the product. Affido automates the testing, uses AI for the judgement, and walks you through the few checks that need a person. It is a self-assessment, not an independent audit, and it says so on the report.
Should my VPAT cover WCAG 2.1 or WCAG 2.2?
It depends who is asking. HECVAT names WCAG 2.1 AA, as does the ADA Title II rule for state and local government. Section 508 references WCAG 2.0 AA, and EN 301 549 points at 2.1 AA for web content. Affido always evaluates against 2.2, which contains all of them, and reports against whichever standard you pick — so one scan answers every version of the question.
What is the accessibility section of the HECVAT and how do I answer it?
HECVAT is the questionnaire US universities send to software vendors, and its IT Accessibility tab has 18 questions (ITAC-01 to ITAC-18) covering your conformance status, your contact for accessibility issues, whether a VPAT exists and how recent it is, and whether a third party has audited you. Affido answers them from your evidence and resolves five of them from your own records, including the link to your accessibility statement and whether your report is less than twelve months old.