ADA Title II for Vendors: What Cities, Counties and Colleges Will Ask You For

By Andrew Szigety, DHS Trusted Tester (TT‑2606‑09221). Published October 14, 2026.

The Title II web rule puts the duty on the public entity, but it covers content and apps the entity provides “through contractual, licensing, or other arrangements.” So a product a city, county or public college offers the public must meet WCAG 2.1 Level AA by that customer’s date: April 26, 2027, or April 26, 2028 for smaller governments. Expect to be asked for an ACR, a contract clause and a fix plan. Checked on October 14, 2026.

Why a Rule for Governments Reaches Your Product

Title II of the ADA covers state and local government: states, cities, counties, public schools and colleges, transit agencies, courts and special districts. The Department of Justice’s 2024 web rule, now in 28 CFR 35.200, requires a public entity to make sure the web content and mobile apps it “provides or makes available, directly or through contractual, licensing, or other arrangements” meet WCAG 2.1 Level AA. That last phrase is the one that reaches you.

The ada.gov page on the rule gives an example: if a city lets people pay for parking with a mobile app, that app must meet WCAG 2.1 Level AA even if a private company runs it. The rule’s exception for third-party content doesn’t change that. It only covers content from third parties who aren’t posting under a contract, license or other arrangement with the government, like a resident’s comment on a city forum.

In the rule’s explanation, the Department says public entities “can choose to work with providers who can ensure accessibility” and “can also include contract stipulations that ensure accessibility in third-party services.” That’s how the rule arrives at a vendor: as a buying criterion and a contract term. The rule itself, its five exceptions and how population is counted are covered in the ADA Title II web accessibility rule.

The Dates Your Customers Are Working To

• April 26, 2027 for a state or local government with a total population of 50,000 or more.
• April 26, 2028 for a government with a population under 50,000, and for any special district government.

These dates come from an interim final rule published April 20, 2026, which moved each one back a year. Anything written before then shows the superseded 2024 dates, so check before you plan around one. The current text of the regulation was last amended on that day. If you sell to several public customers, the earliest date among them sets your schedule, and procurement can ask for evidence well before any of them.

What Procurement Teams Ask Vendors For

The rule doesn’t name a document, but public buyers publish what they ask for. Universities are the easiest to read, and their procurement pages ask for some mix of four things.

• A current ACR. It’s usually requested as a VPAT, which is the blank template; the filled-in report is the ACR, as VPAT vs ACR explains. Ohio University asks for a VPAT no older than two years, built on WCAG 2.1 Level AA, or an independent evaluation by a qualified accessibility professional. Michigan Tech asks for a VPAT in its solicitations and tells staff to get an ACR from the vendor.
• A contract clause. Michigan Tech’s published contract language has the vendor warrant that the product conforms to WCAG 2.1 Level A and AA, advise the university in writing of any nonconformance, give detailed plans to reach conformance with an intended timeline, and indemnify the university. The University of Washington attaches a Digital Accessibility Rider to contracts for the goods and services it applies to.
• A plan for the gaps. The University of Washington expects vendors to show the product is either compliant or working toward compliance within a reasonable timeline. Ohio University’s contract template leaves a blank for the date by which services that aren’t accessible yet will be.
• For colleges, a HECVAT. Its IT Accessibility tab asks whether your VPAT or ACR has been created or updated for this version in the past 12 months, whether you’ll agree to WCAG 2.1 AA in the contract, and whether the product substantially conforms to it. How to answer the HECVAT accessibility questions goes row by row.

When the ACR arrives, reviewers read it for specifics: which version was tested, how, by whom, and what the remarks say about each gap. How buyers review an ACR covers what they check. If an RFP asks before you have one, how to answer accessibility questions in an RFP covers what to say in the meantime.

Will a WCAG 2.2 Report Do?

Yes. In the 2024 rule’s explanation, the Department says public entities could comply by conforming to WCAG 2.2 Level AA, because 2.2 AA includes every 2.1 AA success criterion except one that is obsolete, plus criteria 2.1 doesn’t have. So testing to 2.2 AA answers a Title II customer and the enterprise buyers who already ask for 2.2. WCAG 2.1 vs 2.2 sets out what changed.

The VPAT edition matters more than the WCAG version. The Section 508 edition is built on WCAG 2.0, which has 38 of the 50 Level A and AA criteria in WCAG 2.1, so a 508-only report leaves 12 of the rule’s criteria unanswered. The INT edition reports WCAG 2.2, Section 508 and EN 301 549 in one document. Which VPAT edition do you need has the detail.

The rule treats mobile apps the same way as web content, and defines them as software downloaded and designed to run on phones and tablets. If you ship an app alongside the web product, ask your customer whether they need it in the report too.

What a Vendor Can Do Now

• List your public customers and their dates. The earliest one sets your schedule, and the next renewal may come sooner.
• Get the product tested against WCAG 2.1 or 2.2 Level AA. Every unique screen, by a person working with a keyboard and a screen reader. A scan alone can’t decide most of the criteria.
• Write it up as an ACR with honest remarks. Partially Supports with a clear remark is more useful to a reviewer than Supports that falls apart when they test. How to fill out a VPAT walks through the form.
• Fix what stops people first. Sign-in, forms, payments and anything else a resident or student needs to finish a task. Put the rest on a dated roadmap you can share.
• Read the accessibility clause before you sign. If you can’t warrant full conformance yet, say what doesn’t conform and when it will. That’s the disclosure clauses like Michigan Tech’s ask for.
• Publish an accessibility statement so your customers’ users know how to report a problem. How to write an accessibility statement has an example.
• Keep the report current. HECVAT asks about the past 12 months, and Ohio University about the past two years. How often to update a VPAT covers when a new one is due.

Each row was read from the page it links to on October 14, 2026. The regulation’s text was read in the eCFR version current to October 1, 2026. University pages are examples of what public buyers ask, not a rule every buyer follows.

How Harbor Does It

Harbor Accessibility writes the conformance report a public buyer asks for. Every unique screen or page template in your product is tested by hand against all 55 WCAG 2.2 Level A and AA criteria, with a keyboard and a screen reader, which answers the WCAG 2.1 AA standard the rule names. Every engagement is tested and signed by a DHS Trusted Tester, Andrew Szigety (certificate TT‑2606‑09221) or an additional tester he selects as needed, and whoever signs is named on the ACR.

The ACR comes in the INT edition, so one document answers a city, a federal agency and a European buyer. Visual fix guides and follow-up reviews are part of every engagement, with the ACR re-issued after each review, along with a ready-to-publish accessibility statement written from the same findings and up to 90 days of email support. Harbor doesn’t publish a fee. It’s set on a free 15-minute call and fixed in writing before you commit. If a customer’s renewal or RFP date is driving this, say so on the call. You can read a full sample VPAT/ACR first.

Harbor provides technical audits and conformance documentation, not legal advice. Which rule applies to your product, and how, is a question for counsel. VPAT® is a registered service mark of the Information Technology Industry Council (ITI).

• The Title II Rule
• HECVAT Accessibility Questions
• Get a VPAT/ACR
• Read the Sample VPAT/ACR
• Book the 15-Minute Call