Is There a Section 508 Certification?

By Andrew Szigety, DHS Trusted Tester (TT‑2606‑09221). Published October 14, 2026.

No. There’s no government certification for a product. Section508.gov says vendors are expected to test their own products against the Section 508 standards and report the results in an Accessibility Conformance Report (ACR), and the buying agency checks those claims. The certifications that do exist, such as DHS Trusted Tester, belong to people. Checked on October 14, 2026.

Who Decides Whether a Product Conforms

The rules come from the U.S. Access Board, which section508.gov says Section 508 directs to create and review the accessibility standards. The Revised 508 Standards require electronic content and software to meet WCAG 2.0 Level A and AA. Nobody stamps a product as meeting them.

Section508.gov’s ACR and VPAT FAQ puts the testing on the vendor: you test against the standards that apply and report which ones your product supports. A product that supports all of them is considered compliant. Completing an ACR isn’t voluntary if you want the government to consider your product, and a product that doesn’t meet every standard is still considered for purchase.

The agency makes the call. Section508.gov’s guidance for buyers tells them to verify vendor claims with their own testing where they can, and to use a process such as Trusted Tester for web products. When nothing fully conforming is available, the Access Board’s standards have the agency buy the product that best meets them. The template doesn’t certify anything either: ITI, which publishes the VPAT, says there’s no VPAT certification, no logo or badge for completing one, and that it doesn’t review or approve finished reports.

Certifications That Belong to People

Two kinds of certification come up in Section 508 work. Both certify a person’s skill, not a product.

Trusted Tester is the one tied to Section 508. DHS says its web process meets the minimum requirements of the Revised 508 Standards, and section508.gov says agencies that adopt it accept test results only from certified Trusted Testers. Adoption is each agency’s own decision. DHS’s training page describes the training as free and online, with courses taken in order, 85% needed on the certification exam, and 180 days to finish. It lists Trusted Tester candidates, program managers, developers and system owners as the audience, and section508.gov sends questions about the program to accessibility@hq.dhs.gov. Where to find a certified tester and how to read the certificate are covered in how to find a DHS Trusted Tester.

IAAP’s certification handbook defines a professional certification as a credential awarded to individuals. It lists CPACC, WAS and the Accessible Document Specialist (ADS), plus the CPWA designation for people who hold both CPACC and WAS. Each needs work experience to apply, an exam with a fee, and education credits to renew every three years. IAAP keeps a directory of certified people who opt in.

None of these says anything about a particular product. A certified tester’s name on an ACR tells a buyer who did the testing and what they were trained in. The ACR is still what describes the product.

What Vendors Need Instead

• An ACR on the right edition. Section508.gov’s guide to creating one says federal sales must use the Revised Section 508 or INT edition of the VPAT. VPAT vs ACR explains how the template and the report differ.
• Testing against the Revised 508 Standards. That means WCAG 2.0 Level A and AA for web pages, software and electronic content, plus the standards’ own software and documentation rules. The INT edition adds WCAG 2.2 for buyers who also ask about the newer version.
• The evaluation methods. Section508.gov says the report’s first page should say how the product was tested: manual, automated or both, and with which tools.
• Honest answers, with remarks. Every row answered, every gap explained, and a named contact. How to fill out a VPAT walks through the form, and how buyers review your ACR covers what a reviewer checks.

The wider picture of what federal buyers expect is in what Section 508 requires from software vendors.

What a “508 Certified” Claim Means

Since no government body issues one, a product page or a tool that calls something “508 certified” is describing something else. Usually it’s one of these:

• The vendor’s own claim. That’s what an ACR is too, but an ACR shows its work row by row. A one-line claim doesn’t.
• An automated check that passed. The W3C says evaluation tools can’t determine accessibility on their own and that some checks need human judgment, so a clean automated result covers only part of the standard.
• A person’s credential applied to a product. A company with a certified tester on staff doesn’t have a certified product.

Reviewers are taught to look past the label. Section508.gov tells agencies to examine the ACR in detail and verify claims independently where possible. A “certified” badge with no report behind it gives the reviewer nothing to check, and a claim of full compliance with no caveats is one of the red flags in the university guidance covered in how buyers review your ACR. If a tool offers a badge for your site, the article on overlays covers what those products can and can’t do.

What It Costs

With no product certification, there’s no certification fee. The cost is the testing and the ACR, and it depends on how much of the product is in scope, whether the testing is included or you bring your own results, and which edition you need. Published prices and what each one counts are compared in how much a VPAT costs. For a person, DHS describes its Trusted Tester training as free, and IAAP charges exam fees, listed on its own site.

Each row was read from the page it links to on October 14, 2026, along with section508.gov’s ICT accessibility FAQ and IAAP’s CPACC and WAS bodies of knowledge. IAAP’s handbook is the January 2026 edition. Program details change, so check the DHS and IAAP pages before you plan around them.

How Harbor Does It

Harbor is led by Andrew Szigety, DHS Trusted Tester for Web, certificate TT‑2606‑09221, and the certificate is published in full. Every engagement is tested and signed by a DHS Trusted Tester, Andrew or an additional tester he selects as needed, and whoever signs is named on the ACR. Every unique template is tested by hand against all 55 WCAG 2.2 Level A and AA criteria, with a keyboard and a screen reader.

The report comes in the INT edition, so one document answers a Section 508, a WCAG or an EN 301 549 request. Visual fix guides and follow-up reviews are part of every engagement, with the ACR re-issued after each review. Harbor doesn’t publish a fee. It follows your unique template count, is set on a free 15-minute call and is fixed in writing before you commit. The Section 508 testing page covers what an engagement includes, and you can read a full sample VPAT/ACR first.

Harbor provides technical audits and conformance documentation, not legal advice. Whether an agency requires Trusted Tester results is set by that agency and its solicitation. VPAT® is a registered service mark of the Information Technology Industry Council (ITI).

• Section 508 Testing
• Section 508 for Software Vendors
• How to Find a DHS Trusted Tester
• How Much Does a VPAT Cost?
• Read the Sample VPAT/ACR
• Book the 15-Minute Call