What is a VPAT (Voluntary Product Accessibility Template)?

What is a VPAT?

A VPAT (Voluntary Product Accessibility Template) is a free template from the Information Technology Industry Council (ITI) that a vendor fills in to state how well a product meets accessibility standards such as WCAG and Section 508. The finished document is called an Accessibility Conformance Report (ACR). In practice buyers say "VPAT" when they mean the completed ACR.

Procurement teams, especially in the public sector, higher education and large enterprises, use it to compare products on the same terms. ITI notes that it does not review or approve VPATs and that there is no VPAT certification: the ACR is the vendor's own statement.

VPAT editions

The current version on the ITI VPAT page is VPAT 2.5Rev (April 2025). It comes in four editions, so you pick the one your buyer asks for:

What is in a completed VPAT (ACR)?

For each criterion of the chosen standard, the vendor records one of four conformance levels: supports, partially supports, does not support, or not applicable. Next to every level goes a remarks column that says what was tested, how, and what is known to fail. Buyers scan the levels first and read the remarks when they evaluate. A column of "Supports" with empty remarks looks like marketing, not testing.

An ACR also names the product, its version, the date, the evaluation methods and the contact person.

Example: filling in one row

Take the WCAG criterion for text alternatives (1.1.1 Non-text Content) for a web app. The vendor checks the interface with a screen reader and finds that icons and photos have text alternatives, but charts exported as images do not. The honest entry is "Partially supports", with remarks such as "Chart images in the export view have no text alternative. Fix planned for the next release." That is more useful to a buyer than a flat "Supports", and it can be defended in a review.

How to prepare one

• Fix the scope: product name, version, and which pages, flows and platforms are covered.
• Choose the edition and the standard version the buyer asked for.
• Test with automated checks and by hand: keyboard-only use, a screen reader, zoom and text resizing, and colour contrast. See automated accessibility testing and manual accessibility tests.
• Record a level and remarks for every criterion, including the ones that do not apply.
• Date it and re-issue it when the product changes in ways that affect accessibility.

Common VPAT mistakes

• Marking everything "Supports" without remarks.
• Testing only the home page instead of the main user flows.
• Reusing an old ACR for a new version of the product.
• Treating an automated score as the evaluation (see below).
• Calling the ACR a certification. It is a self-reported statement.

VPAT, Lighthouse and monitoring

Lighthouse's accessibility score is a weighted average of automated audits, and each audit is pass or fail. Its manual checks, such as focus management and tab order, do not affect the score. Automated checks cover only part of WCAG, and the W3C states that no tool alone can determine whether a site meets accessibility standards. A Lighthouse score of 100 is therefore not evidence for an ACR, and a VPAT needs a manual evaluation by someone who knows the standard.

An automated score is still useful as an early warning. LoadFocus page speed monitoring runs scheduled Lighthouse audits and records the Accessibility category score next to performance, so a deploy that breaks labels or contrast shows up as a drop. LoadFocus does not produce VPATs or ACRs, and the score does not replace the evaluation behind one. For tool coverage see website accessibility testing tools compared.

FAQ: VPAT

What is the difference between a VPAT and an ACR?

The VPAT is the blank template. The ACR is the completed report for a specific product. People often say VPAT when they mean the ACR.

Is a VPAT required by law?

The template itself is voluntary. Whether you need to provide one depends on your buyer, your contract and the rules that apply to you, so check the procurement requirements you are answering.

Which VPAT edition should I use?

The one your buyer names. US federal buyers typically ask for the 508 edition, European public buyers for the EU edition, and the WCAG or INT edition covers the rest.

Does a Lighthouse accessibility score of 100 mean my product conforms?

No. Lighthouse runs a subset of automated checks, and conformance to WCAG also depends on things automated tools cannot judge, such as meaningful alt text, logical focus order and screen reader behaviour.

Who fills in a VPAT and can it be verified?

Usually the vendor, with help from accessibility specialists or an external auditor. ITI does not review or certify VPATs, so buyers rely on the remarks, the methods described and their own testing.