How do buyers evaluate a VPAT?

They read the completed report, called an Accessibility Conformance Report (ACR), for whether it covers the version they’re buying on the edition they asked for, whether every criterion is answered, what the remarks say about each gap, and how and by whom the product was tested. Then they check the claims with follow-up questions, a demo or their own testing. Checked on October 14, 2026.

What is on an ACR review checklist?

The checks that come up across section508.gov and public university guidance are: a recent date and the current product version, the right edition and WCAG version, scope that covers the features the buyer will use, a specific remark on every Partially Supports and Does Not Support row, a reason for every Not Applicable, the evaluation methods, a named contact who can answer questions, and plans for the parts that don’t fully conform.

Why would a buyer send a VPAT back?

The common reasons are an old date or an older product version, the wrong edition or an older WCAG version than the buyer asked for, Supports on every row, vague or copied remarks, Not Applicable with no explanation, a report that covers only part of the product, and no evaluation methods or contact. The University of Arizona’s VPAT review guide lists most of these as red flags.

Will Partially Supports get my product rejected?

Not by itself. Section508.gov’s FAQ says a product is still considered for purchase even if all of the Section 508 standards are not met, and its guidance tells buyers to read each Partially Supports row to see what fails. A specific remark and a plan for the gap are what let a reviewer weigh it.

Do buyers test the product after reading the ACR?

Often. Section508.gov tells federal agencies to reserve the right to test before award, on the final commercially available release, and to verify vendor claims independently where possible. University guidance asks for a demo or hands-on testing alongside the report, such as using the product with only a keyboard.

What happens to my ACR after the contract is signed?

It can become part of the contract. Section508.gov’s model language asks for an ACR for each item developed, updated or configured for the agency, lets the agency test before acceptance, and has the vendor repair or replace non-compliant products at no cost to the agency. Its solicitation guidance also lets the agency require remediation to match your original conformance claims before acceptance.

How Buyers Review Your ACR (and Why They Send It Back)

By Andrew Szigety, DHS Trusted Tester (TT‑2606‑09221). Published October 14, 2026.

A reviewer checks whether your ACR (Accessibility Conformance Report) describes the version they’re buying, on the edition they asked for, with every criterion answered, a remark that explains each gap, and a clear account of how and by whom it was tested. Then they check the claims: follow-up questions, a demo or hands-on testing, and contract terms that hold you to the report. Checked on October 14, 2026.

Key Takeaway

Honest gaps aren’t what sinks a report. Section508.gov says a product is still considered for purchase when it doesn’t meet every Section 508 standard, and the University of Arizona’s review guide lists all “Supports” ratings as a red flag. Specific remarks and a plan for each gap are what a reviewer can work with.

Who Reads Your ACR

On a federal deal, the report goes to the acquisition team and often to the agency’s Section 508 program. Section508.gov’s technology accessibility playbook tells agencies to require an ACR for all solicitation responses, to have experts review vendor conformance claims before award, and to use a risk-based model to decide when independent testing is needed.

At a university, it usually goes to the campus accessibility office, or to a buyer working from that office’s guide. The University of Arizona publishes a VPAT review guide that records a risk rating and any conditions for each product, and the University of Louisiana at Lafayette tells staff to request the report before the purchase decision is made. Colleges often send the HECVAT questionnaire too, and its accessibility questions are covered in how to answer the accessibility questions in a HECVAT.

Enterprise buyers vary more, and many send their own vendor questionnaire. Read its accessibility questions before you send the report, since they decide what that reviewer checks.

What Reviewers Check

A current date and version. The report should cover the version they’re buying. Arizona’s guide asks whether the report is within 18 months and whether the product has had major updates since. Section508.gov says an updated ACR may be required whenever the product changes.
The right edition and standard. Section508.gov says federal sales must use the Revised Section 508 or INT edition. Arizona and UL Lafayette both look for WCAG 2.1 Level AA and treat a report that only covers WCAG 2.0 as out of date.
Every criterion answered, across the whole product. Section508.gov’s solicitation guidance asks vendors to clarify whether conformance holds throughout the entire product or only in limited areas, and Arizona checks that the report covers the features the university will use.
Remarks that explain partial support. Section508.gov tells buyers that Partially Supports means the product doesn’t conform and to read the ACR in detail to see what fails. Its sample language says each ACR shall state exactly how the product meets the standards in the remarks column.
The evaluation methods. Federal agencies are told to ask for a description of the evaluation methods behind the conformance claims, and Arizona asks when testing was last done, which methodology was used, and whether it was internal or third-party.
Who tested, and who to call. Section508.gov suggests asking for a person at your company qualified to speak to the product’s accessibility, and Arizona lists a report with no identified author or contact as a red flag.
Not Applicable used correctly. Section508.gov’s sample language says every Not Applicable must be explained, and buyers are told to check why a row is marked that way. Not Evaluated gives no assurance at all, and it’s only allowed on Level AAA rows.
A plan for the gaps. Federal guidance recommends asking for remediation plans for features that don’t fully conform, and Arizona asks about the roadmap for reported issues. UL Lafayette describes a transparent vendor as one that acknowledges limitations and provides a plan.

Each field, with example rows, is walked through in how to fill out a VPAT, and how a report’s date and version age is covered in how often to update a VPAT.

Red Flags That Send It Back

Red flags reviewers name in section508.gov and public university guidance, and what to send instead, read on October 14, 2026.
What the Reviewer Sees	Why It Comes Back	What to Send Instead
Supports on every row	Arizona lists all Supports ratings as a red flag, and UL Lafayette says a vendor claiming full compliance without caveats should be scrutinized.	Honest answers, with Partially Supports wherever some functionality fails.
Vague or copied remarks	Arizona checks whether remarks are specific or generic. UL Lafayette calls remarks like “accessibility is important to us” a red flag.	A remark that names the screen, the element and what fails.
An old date or an older version	Arizona flags reports more than 18 months old. A report on a version you no longer sell describes something the buyer can’t buy.	A report on the current version, with any revision explained in the notes.
The wrong edition or WCAG version	A federal reviewer needs the Section 508 tables. University guides ask for WCAG 2.1 AA.	The edition and WCAG version the request names. The INT edition covers all three standards.
Not Applicable with no reason	Section508.gov’s sample language requires every Not Applicable to be explained, and Arizona flags whole sections marked N/A without explanation.	A short reason on each Not Applicable row.
Only part of the product	Arizona flags a report that covers only part of the product, and federal reviewers ask whether conformance holds throughout.	A scope note listing what was tested and what wasn’t.
No methods, no contact	Nothing in the report says how anyone knows, or who to ask.	The evaluation methods filled in, and a named contact.

Form mistakes, such as leftover instruction pages or made-up conformance terms, are listed in how to fill out a VPAT. A missing report is a red flag of its own: UL Lafayette calls it a significant risk indicator. If a buyer has asked and you don’t have one yet, how to answer accessibility questions in an RFP covers what to say in the meantime.

What Happens After the Review

A report that passes a first read usually leads to more questions, not a decision.

Follow-up questions. Section508.gov tells buyers to ask vendors to clarify claims, describe their evaluation methods, and describe plans for features that don’t fully conform. Arizona adds whether people with disabilities helped test the product and what support you offer.
A demo. Section508.gov recommends asking for a demonstration of the relevant features. Arizona’s vendor guidance has reviewers use the product with only a keyboard and read a form with a screen reader during the demo, and asks vendors to show focus indicators on every interactive element.
Hands-on testing. Agencies are told to reserve the right to test before award, on the final commercially available release, with a test plan built around typical user scenarios. For web products, section508.gov points buyers to a process such as Trusted Tester.
More detail on the gaps. Federal buyers may ask for GSA’s Issue Detail Supplement, where you rate each issue as critical, major or minor and say who it affects and what the workaround is. Section508.gov says it can be used to build a remediation plan before acceptance.
A conditional yes. A report with gaps doesn’t end the deal. Arizona’s guide allows conditional approval with a remediation plan. Under the Access Board’s standards, when no fully conforming product is available, an agency buys the one that best meets the standards.

The Report Becomes Part of the Contract

Once a buyer accepts it, your ACR is the yardstick the product is measured against. Section508.gov’s model contract language asks for an ACR for each item developed, updated or configured for the agency, based on the latest version of the VPAT. It lets the agency test before acceptance, and it has the vendor repair or replace non-compliant products at no cost to the agency within a period the contracting officer sets. Its solicitation guidance adds that if the product conforms at a lower level than claimed, the agency can require remediation to match your original claims before it accepts the product.

Universities write it in too. Arizona suggests contract terms that require a WCAG 2.1 AA conformance commitment, a current VPAT, and an updated VPAT with major releases. An accurate report is the easiest one to live with after signing, because every Partially Supports you disclosed is a gap the buyer knew about when it signed.

Sending One That Gets Through

Most of the work is in the report before it’s sent. Use the edition and WCAG version the request names, which VPAT vs ACR explains. Fill in the evaluation methods and a contact, give every gap a specific remark, and attach a short plan for the gaps if you have one. Whether the testing has to come from an outside evaluator is set by the buyer, and does a VPAT have to come from a third party covers what ITI and section508.gov say. If you want to see a finished report with gaps disclosed, Harbor publishes a full sample VPAT/ACR.

Where each point in this article was read, on October 14, 2026.
Source	What It Says	What It Means for You
Section508.gov, Understanding Vendor Claimssection508.gov/buy/understand-claims	Partially Supports and Does Not Support mean the product doesn’t conform. Check why a row is Not Applicable. Not Evaluated gives no assurance. Seek clarification, and validate independently where possible.	Every answer is read as a claim to be checked.
Section508.gov, Solicitation and Post-Solicitationsection508.gov/buy/accessibility-in-procurement-solicitation-post-2	Every Not Applicable must be explained. Clarify whether conformance covers the whole product. Ask for a qualified contact, the evaluation methods and plans for non-conforming features. Test before award and before acceptance, and require remediation to match original claims.	The questions you’ll get, and what the report commits you to.
Section508.gov, Request Accessibility Informationsection508.gov/buy/request-accessibility-information	Require a complete ACR for each item and the evaluation methods behind it. Recommend a demonstration, remediation plans and accessibility improvement plans. Reserve the right to test the final commercially available release.	Expect a demo request and a question about your plans.
Section508.gov, Define Accessibility Criteriasection508.gov/buy/define-accessibility-criteria	Model contract language: an ACR for each item developed, updated or configured, based on the latest VPAT. The agency may test before acceptance, and the vendor repairs or replaces non-compliant products at no cost to the agency.	The report you send is the one you’re held to.
Section508.gov, Technology Accessibility Playbook, Play 8section508.gov/manage/playbooks/technology-accessibility-playbook/8	Require ACRs for all solicitation responses, have experts review vendor claims before award, and use a risk-based model to decide when independent testing is needed.	A federal buyer may bring in its own expert to read your report.
Access Board, Revised 508 Standardsaccess-board.gov/ict	Where conforming ICT isn’t commercially available, the agency procures the ICT that best meets the standards, consistent with its business needs.	A product with documented gaps can still win.
University of Arizona, VPAT Review Guideaccessibility.arizona.edu/procurement/vpat-review	Checks date, WCAG version, scope, detail and honesty. Red flags include reports over 18 months old, WCAG 2.0 only, partial scope, unexplained N/A sections, vague remarks, all Supports and no author or contact. Allows conditional approval with a remediation plan.	A public university’s checklist, written down.
University of Arizona, Vendor Accessibility FAQaccessibility.arizona.edu/procurement/vendor-faq	Keyboard-only and screen reader checks during demos. Contract terms for WCAG 2.1 AA, a current VPAT and an updated VPAT with major releases.	Be ready to drive the demo with a keyboard.
UL Lafayette, VPATslouisiana.edu/accessibility/training-resources/voluntary-product-accessibility-templates-vpats	Request the report before the decision. Vague remarks and claims of full compliance without caveats are red flags. A transparent vendor acknowledges limitations and provides a plan.	Disclosing gaps with a plan reads as transparency.

Each row was read from the page it links to on October 14, 2026, along with section508.gov’s ACR/VPAT FAQ, how-to-create-an-ACR and Issue Detail Supplement pages. Section508.gov dates its own reviews at the foot of each page, and the ones above were last reviewed between September 2023 and August 2026. The university pages carry no review date. Each university sets its own rules, so check the guidance of the institution you’re selling to.

How Harbor Does It

Harbor is led by Andrew Szigety, DHS Trusted Tester TT‑2606‑09221. Every unique template is tested by hand against all 55 WCAG 2.2 Level A and AA criteria, with a keyboard and a screen reader, and the ACR is tested and signed by a DHS Trusted Tester who is named in it, along with the methods used, the product version and the report date. Every report comes in the INT edition, so one document answers a WCAG, a Section 508 or an EN 301 549 request.

Visual fix guides and follow-up reviews are part of every engagement, and the ACR is re-issued after each review, so the gaps a buyer reads about can be closed and shown closed. Harbor doesn’t publish a fee. It follows your unique template count, is set on a free 15-minute call and is fixed in writing before you commit. The VPAT/ACR service page covers what an engagement includes.

Harbor provides technical audits and conformance documentation, not legal advice. What a particular buyer accepts is set by that buyer and its solicitation. VPAT® is a registered service mark of the Information Technology Industry Council (ITI).

Common Questions

How do buyers evaluate a VPAT?: They read the completed report, called an Accessibility Conformance Report (ACR), for whether it covers the version they’re buying on the edition they asked for, whether every criterion is answered, what the remarks say about each gap, and how and by whom the product was tested. Then they check the claims with follow-up questions, a demo or their own testing. Checked on October 14, 2026.
What is on an ACR review checklist?: The checks that come up across section508.gov and public university guidance are: a recent date and the current product version, the right edition and WCAG version, scope that covers the features the buyer will use, a specific remark on every Partially Supports and Does Not Support row, a reason for every Not Applicable, the evaluation methods, a named contact who can answer questions, and plans for the parts that don’t fully conform.
Why would a buyer send a VPAT back?: The common reasons are an old date or an older product version, the wrong edition or an older WCAG version than the buyer asked for, Supports on every row, vague or copied remarks, Not Applicable with no explanation, a report that covers only part of the product, and no evaluation methods or contact. The University of Arizona’s VPAT review guide lists most of these as red flags.
Will Partially Supports get my product rejected?: Not by itself. Section508.gov’s FAQ says a product is still considered for purchase even if all of the Section 508 standards are not met, and its guidance tells buyers to read each Partially Supports row to see what fails. A specific remark and a plan for the gap are what let a reviewer weigh it.
Do buyers test the product after reading the ACR?: Often. Section508.gov tells federal agencies to reserve the right to test before award, on the final commercially available release, and to verify vendor claims independently where possible. University guidance asks for a demo or hands-on testing alongside the report, such as using the product with only a keyboard.
What happens to my ACR after the contract is signed?: It can become part of the contract. Section508.gov’s model language asks for an ACR for each item developed, updated or configured for the agency, lets the agency test before acceptance, and has the vendor repair or replace non-compliant products at no cost to the agency. Its solicitation guidance also lets the agency require remediation to match your original conformance claims before acceptance.