VPAT Services: What They Include, Who Needs Them, and How to Choose a Provider

VPAT services are increasingly important for organizations that sell to government agencies, serve regulated industries, or want to reduce accessibility risk while building inclusive digital experiences. A VPAT (Voluntary Product Accessibility Template) is the standardized format used to produce an Accessibility Conformance Report (ACR) describing how a product meets accessibility requirements such as WCAG, Section 508, and (in many cases) EN 301 549.

But “VPAT services” can mean very different things depending on the provider: some vendors only fill out a template, while others perform rigorous testing, provide remediation guidance, and support procurement questions. Below is a practical, standards-based guide to what VPAT services should include, who needs them, and how to choose a provider you can trust.

What VPAT services actually cover

At a minimum, VPAT services should result in a complete ACR that’s accurate, defensible, and aligned to the correct standard(s). Most buyers need more than a document—they need reliable testing evidence and a clear plan to address gaps.

Common deliverables

• Scoping and applicability review: Identify what’s in scope (web app, mobile app, PDFs, support portals), supported platforms/browsers, and any third-party components.
• Testing against the chosen standard: Typically WCAG 2.1 AA or WCAG 2.2 AA, plus Section 508 (U.S.) and/or EN 301 549 (EU procurement).
• Findings with evidence: Issues mapped to criteria, with steps to reproduce, impact, and affected user groups (screen reader users, keyboard-only users, low vision users, etc.).
• Completed VPAT/ACR document: Conformance levels stated honestly (Supports / Partially Supports / Does Not Support), with remarks and exceptions.
• Remediation guidance: Prioritized fixes and implementation notes for design and engineering teams.
• Executive summary for procurement: A plain-language overview that procurement, legal, and security teams can evaluate quickly.

VPAT, ACR, WCAG, Section 508, EN 301 549: how they connect

VPAT is the template; ACR is the filled-out report; WCAG is the web accessibility standard; Section 508 is U.S. federal procurement accessibility law; EN 301 549 is the European accessibility standard used in public procurement.

If your buyers ask for a “VPAT,” they usually mean an ACR produced in the VPAT format. For context on what an ACR is and how it should be structured, see Accessibility Conformance Report: What It Is, Why It Matters, and How to Create One.

Which VPAT edition should be used?

Many organizations now use VPAT 2.5 (or later) because it aligns better with modern requirements, including WCAG 2.2. The right choice depends on customer requirements, the jurisdiction, and the procurement language. If you sell in the EU or to EU public sector entities, EN 301 549 mapping is especially relevant—read EN 301 549 Compliance: A Practical Guide for Digital Accessibility for practical details.

Who typically needs VPAT services

VPAT services are not just for massive enterprises. Any organization that provides digital products or platforms may be asked for an ACR during procurement or vendor onboarding.

Common scenarios

• SaaS and software vendors selling to government, education, healthcare, or large enterprise customers.
• Organizations responding to RFPs where accessibility is a scored requirement.
• Fintech and regulated industries where trust and risk management drive accessibility maturity (see Digital Accessibility for Fintech Startups: Build Trust, Reduce Risk, and Scale Faster).
• Global companies navigating multiple standards and regional expectations, such as EU procurement requirements and country-specific guidance (for example, Germany’s Accessibility Standards, Decoded: What Digital Teams Need to Know).

What a high-quality VPAT service process looks like

A reliable ACR is built on repeatable testing, not guesswork. Look for a process that combines automation (for scale) with manual testing (for accuracy) and real-user considerations.

1) Discovery and scoping

The provider should document product versions, UI frameworks, supported assistive technologies, user flows to test, and content types (including PDFs and embedded widgets). A good scope avoids two common pitfalls: testing only the marketing site while missing the app, or testing a narrow set of screens that doesn’t represent real usage.

2) Testing methodology: automated + manual

Automated checks catch patterns quickly (missing labels, color contrast issues, empty links), but they can’t validate everything (keyboard traps, meaningful focus order, correct ARIA usage, error recovery, captions quality). Manual testing should include:

• Keyboard-only navigation through primary workflows
• Screen reader testing (commonly NVDA/JAWS on Windows and VoiceOver on macOS/iOS)
• Zoom and reflow checks (e.g., 200–400% zoom)
• Forms and error handling (labels, instructions, validation, alerts)
• Non-text content (alt text, transcripts, captions)

3) Writing the ACR in plain, defensible language

The best VPAT services don’t “overpromise.” They clearly state limitations and exceptions, identify partial support, and document workarounds where applicable. Procurement teams often follow up with clarifying questions; an honest report reduces friction and builds trust.

Red flags to avoid when buying VPAT services

• “We can do a VPAT without testing”: A VPAT is only as good as the evidence behind it.
• All criteria marked “Supports”: Nearly every real-world product has some partial support; perfection claims are a credibility risk.
• No assistive technology coverage: If they can’t tell you which screen readers and browsers were tested, the report may not stand up to scrutiny.
• No remediation path: A VPAT is a snapshot in time—teams need actionable fixes to improve conformance.
• Unclear ownership and versioning: If your product updates monthly, the ACR must be maintainable.

How long VPAT services take (and what affects cost)

Timelines vary by scope and product complexity. A small marketing site might be evaluated in a week or two; a large SaaS platform with multiple roles, complex components, and documents can take several weeks. Factors that affect pricing include:

• Number of unique screens/templates and user flows
• Web + mobile coverage
• Document accessibility (PDF/Office files)
• Depth of assistive technology testing
• Whether remediation support and retesting are included

Maintaining your VPAT over time (the part most teams miss)

Accessibility conformance changes as your product changes. New components, UI redesigns, and content updates can introduce regressions. Maintaining an ACR is easier when accessibility is embedded in delivery workflows: design reviews, QA, CI checks, and regular monitoring.

This is where platforms like Corpowid (corpowid.ai) can help by running automated accessibility audits and ongoing monitoring to catch recurring WCAG issues earlier, so your VPAT updates are based on current, evidence-backed status rather than last year’s snapshot.

Practical maintenance habits

• Version your ACR (product version, date, tested environments)
• Track issues to closure with accessibility-specific acceptance criteria
• Retest high-risk flows (login, checkout, onboarding, form-heavy areas) each release
• Keep an accessibility statement current so users know how to request help and report barriers

How to choose the right VPAT service provider

Use these evaluation questions to compare providers:

• What standards will you cover? (WCAG 2.2, Section 508, EN 301 549)
• What assistive technologies will you test? Ask for exact versions and browsers.
• Will you provide reproducible evidence? Screenshots, code references, steps to reproduce, and impacted criteria.
• Who writes the conformance remarks? A strong narrative is as important as the checkbox.
• How do you handle third-party components? Clarify what can be tested vs. what must be noted as a dependency.
• Can you support ongoing monitoring? Consider pairing periodic manual reviews with tooling for continuous visibility—Corpowid (corpowid.ai) is one option teams use to keep accessibility issues from creeping back in between formal assessments.

Final takeaway: VPAT services are about trust, not paperwork

A VPAT is often a gatekeeper to revenue and partnerships, but it’s also a signal of how seriously you take inclusive design. The best VPAT services produce a report you can stand behind—grounded in testing, transparent in limitations, and connected to a remediation plan that measurably improves accessibility over time.

If you operate across regions, it can also help to understand local expectations and maturity patterns; for example, Digital Accessibility in Georgia: Bridging the Gap offers perspective on how accessibility efforts evolve in different markets.