Does a VPAT have to be completed by a third party?

No. ITI, which publishes the VPAT, says a third-party review is not required and that ITI does not review or approve completed VPATs. The product owner usually has the most accurate information and can fill it in. The exception is a solicitation or contract whose own terms ask for independent testing. Checked on September 17, 2026.

Can I fill out my own VPAT?

Yes. The template is free from ITI and membership in ITI isn’t required. Section508.gov says the product owner or developer has to test the product against the standards first, and the report’s evaluation methods field should say how it was tested: manual, automated or both, and which tools were used.

Is there a VPAT certification?

No. ITI says there is no VPAT certification and no submission process. A completed VPAT is called an Accessibility Conformance Report (ACR), and you can send it to buyers or post it on your website. A credential such as DHS Trusted Tester belongs to the person who did the testing, not to the document.

Will a federal agency accept a self-assessed VPAT?

It can. Section508.gov tells agencies to require an ACR for each off-the-shelf product along with a description of the evaluation methods behind it, to reserve the right to test the product before award, and to say in the solicitation who does the testing. Agencies that adopt the DHS Trusted Tester process accept test results only from certified Trusted Testers, and adoption is each agency’s own decision.

Why do buyers ask who did the accessibility testing?

Anyone can type Supports into a row, and section508.gov only requires remarks on rows marked Partially Supports or Does Not Support, so the form alone doesn’t show how anyone knows. The HECVAT questionnaire colleges send vendors says a VPAT can be a self-assessment, gives higher confidence to one completed by expert third parties, and asks when an audit was done and by whom.

When is an independent VPAT evaluation worth it?

When the request asks for one, when nobody on your team can test every screen with a keyboard and a screen reader against each criterion, or when the buyer is an agency that accepts results only from certified Trusted Testers and nobody on your team is certified. If you have a skilled tester in house and the buyer hasn’t asked, a careful self-assessment can do the job.

Does a VPAT Have to Come From a Third Party?

By Andrew Szigety, DHS Trusted Tester (TT‑2606‑09221). Published September 17, 2026.

No law or rule requires a third party to fill in a VPAT. ITI, which publishes the free template, says a third-party review isn’t required and that it doesn’t review or approve completed reports. The exception is a solicitation whose own terms ask for independent testing, so read the request first. Checked on September 17, 2026.

Key Takeaway

You’re allowed to write your own ACR. What a buyer weighs is the evidence behind it: who tested, how, with which assistive technology, on what date and which version, and whether the remarks name real problems. An outside evaluator is one way to supply that evidence, and it isn’t the only way.

What ITI Says About Who Fills It In

ITI publishes the VPAT (Voluntary Product Accessibility Template) free, and membership in ITI isn’t required to use it. A VPAT completed for a specific product is called an ACR (Accessibility Conformance Report). The FAQ on ITI’s VPAT page takes the third-party question head on. ITI doesn’t review or approve VPATs, a third-party review “is not required,” and the product owner “will likely have the most accurate information” about what the report covers. There’s also no VPAT certification and nowhere to submit one.

ITI adds one caveat. If you’re filling in a VPAT to answer a government or other solicitation, follow its directions, because the solicitation may require a third-party audit or review as part of its terms. If the terms aren’t clear, ITI says to ask whoever issued it.

What the Federal Guidance Says

Section508.gov, the GSA site for federal accessibility work, writes guidance for both sides of a federal purchase. Its pages expect the vendor to write the report, expect the buyer to check it, and leave independent testing to each solicitation.

What ITI and section508.gov say about who completes a VPAT and how buyers check one, read from each page on September 17, 2026.
Source	What It Says	What It Means for You
ITI, VPAT pageitic.org/policy/accessibility/vpat	The template is free and ITI membership isn’t required. ITI doesn’t review or approve VPATs, a third-party review is not required, and there is no VPAT certification. A solicitation may require a third-party audit or review in its own terms.	You can fill it in yourself. Check the solicitation before you do.
Section508.gov, How to Create an ACRsection508.gov/sell/how-to-create-acr-with-vpat	The product owner or developer must first test the product before completing an ACR. The title page records the evaluation methods: manual, automated or both, and the testing tools used. Remarks are required on rows marked Partially Supports or Does Not Support.	The vendor is expected to write the report and to say how it tested.
Section508.gov, Request Accessibility Informationsection508.gov/buy/request-accessibility-information	For each off-the-shelf product, agencies are told to require an ACR plus a written description of the evaluation methods used to produce it, “to demonstrate due diligence in supporting conformance claims.” It also recommends agencies reserve the right to test the product before award.	A federal buyer will ask how you tested, and may test the product too.
Section508.gov, Buy Accessible ICTsection508.gov/buy	Agencies should say in the solicitation who will do the accessibility testing, and the page frames the choice as the government testing, or the contractor having the testing done by an independent third party.	Whether a federal bid needs independent testing is written into that bid.
Section508.gov, Understanding Vendor Claimssection508.gov/buy/understand-claims	Whenever possible, buyers should run their own independent testing to verify a vendor’s conformance claims, and for web products can use a process aligned with the ICT Testing Baseline, such as Trusted Tester.	A Supports is a claim the buyer is told to check.

Each row was read from the page it links to on September 17, 2026. Section508.gov dates its own reviews at the foot of each page, and the four above were last reviewed between September 2023 and August 2026. Follow the link in any row to check it yourself.

Why Buyers Still Ask Who Tested It

The form can’t tell them. Anyone can type Supports into a row, and section508.gov’s guide only requires remarks on rows marked Partially Supports or Does Not Support. A report reading Supports down every row with blank remarks can be complete as a form and still say nothing about how anyone knows.

Higher education puts this in writing. The HECVAT questionnaire that colleges and universities send vendors, in version 4.1.6 (the version EDUCAUSE published when we last checked, on September 14, 2026), says a VPAT can be a self-assessment from the vendor, though higher confidence is given if expert third parties complete it. Its ITAC‑11 question asks whether a third-party expert audited the most recent version, and wants to know when and by whom. The same row also says well-qualified first parties may still deliver meaningful results, and if no audit is planned, it asks for a rationale, so a No with a reason is still an answer. Every row of that tab is covered in how to answer the accessibility questions in a HECVAT.

Federal guidance lands in the same place: ask for the evaluation methods, reserve the right to test, and verify claims whenever possible. None of that requires an outside evaluator, but a report with no methods and no remarks leaves a reviewer nothing to check except the product itself.

What a Credible Self-Assessment Needs

If you write your own, these are the parts a reviewer reads to decide whether to believe it. Most already have a place in the template.

Who tested it. Name the person or team, and say whether they also built the product. A reviewer is going to ask, so answer it on the page.
How it was tested. Fill in the evaluation methods properly: manual, automated or both, the tools, and the standard and version you tested against. “We reviewed the product” doesn’t describe a method.
Which assistive technology. Name the screen reader, browser and operating system, with versions, and say whether every flow was tried with a keyboard alone.
When, and which version. Give the report date and the product version tested. Section508.gov notes that an updated ACR may be required whenever the product changes.
Honest conformance levels. Mark Partially Supports wherever some functionality doesn’t meet a criterion, which is how section508.gov defines it, and name the failing component in the remarks. Its FAQ says a product that doesn’t meet every Section 508 standard is still considered for purchase.
What was in scope. List the screens, user roles and flows you tested. ITI gives every edition a Notes field for detail about the product tested and how it was evaluated.

The pattern to avoid is a blank evaluation methods section over a column of Supports with empty remarks. Nothing in it tells a reviewer how anyone knows, so the questions come back to you. If it helps to see the fields filled in, Harbor’s sample ACR is published in full.

When an Independent Evaluator Is Worth It

The request asks for one. A solicitation, questionnaire or contract that calls for independent testing settles it. ITI says to follow the solicitation, and section508.gov leaves the choice to each one.
Nobody on the team can do the testing. Deciding each WCAG 2.2 Level A and AA criterion with a keyboard and a screen reader is a skill, and a report is only as accurate as the person who tested.
The buyer is an agency that uses Trusted Tester. Agencies that adopt the DHS Trusted Tester process accept test results only from individuals certified as Trusted Testers, and adoption is each agency’s own decision. That condition is about the tester’s certification rather than independence, so ask the contracting officer, and check whether anyone on your staff holds it.
One report will go to many buyers. A report you post publicly or attach to every deal gets read by reviewers you’ll never talk to, and a named outside evaluator answers the who-tested-it question before they ask.

If none of those apply, you have a skilled tester in house, and the buyer hasn’t asked, a careful self-assessment can do the job.

How Harbor Does It

Harbor is the independent option. Every unique template is tested by hand against all 55 WCAG 2.2 Level A and AA criteria, and the report is signed by the evaluator, Andrew Szigety, DHS Trusted Tester TT‑2606‑09221, who is named in it along with the methods used. The ACR comes in the INT edition, so one document answers a WCAG, a Section 508 or an EN 301 549 request. If you’re not sure which one a buyer wants, see which VPAT edition you need.

Harbor doesn’t publish a fee. It follows your unique template count and is fixed in writing after a free 15-minute call. If a prospect’s request is what brought you here, a prospect asked for a VPAT covers what they’re asking for, and the VPAT/ACR service page covers what an engagement includes.

Harbor provides technical audits and conformance documentation, not legal advice. What a particular buyer accepts is set by that buyer and its solicitation.

Common Questions

Does a VPAT have to be completed by a third party?: No. ITI, which publishes the VPAT, says a third-party review is not required and that ITI does not review or approve completed VPATs. The product owner usually has the most accurate information and can fill it in. The exception is a solicitation or contract whose own terms ask for independent testing. Checked on September 17, 2026.
Can I fill out my own VPAT?: Yes. The template is free from ITI and membership in ITI isn’t required. Section508.gov says the product owner or developer has to test the product against the standards first, and the report’s evaluation methods field should say how it was tested: manual, automated or both, and which tools were used.
Is there a VPAT certification?: No. ITI says there is no VPAT certification and no submission process. A completed VPAT is called an Accessibility Conformance Report (ACR), and you can send it to buyers or post it on your website. A credential such as DHS Trusted Tester belongs to the person who did the testing, not to the document.
Will a federal agency accept a self-assessed VPAT?: It can. Section508.gov tells agencies to require an ACR for each off-the-shelf product along with a description of the evaluation methods behind it, to reserve the right to test the product before award, and to say in the solicitation who does the testing. Agencies that adopt the DHS Trusted Tester process accept test results only from certified Trusted Testers, and adoption is each agency’s own decision.
Why do buyers ask who did the accessibility testing?: Anyone can type Supports into a row, and section508.gov only requires remarks on rows marked Partially Supports or Does Not Support, so the form alone doesn’t show how anyone knows. The HECVAT questionnaire colleges send vendors says a VPAT can be a self-assessment, gives higher confidence to one completed by expert third parties, and asks when an audit was done and by whom.
When is an independent VPAT evaluation worth it?: When the request asks for one, when nobody on your team can test every screen with a keyboard and a screen reader against each criterion, or when the buyer is an agency that accepts results only from certified Trusted Testers and nobody on your team is certified. If you have a skilled tester in house and the buyer hasn’t asked, a careful self-assessment can do the job.