VPAT / ACR — Creating Accessibility Conformance Reports Guide

In this tutorial, you'll learn about VPAT / ACR. We cover key concepts, practical examples, and best practices to help you understand and apply this topic effectively.

A VPAT (Voluntary Product Accessibility Template) or ACR (Accessibility Conformance Report) is a standardized document that evaluates a product's conformance against Accessibility standards like Section 508, EN 301 549, and WCAG — required by most government and enterprise procurement processes.

What You'll Learn

By the end of this guide, you'll understand the VPAT 2.4 format and its sections, how to evaluate your product against each criterion, how to assign accurate conformance ratings (Supports, Partially Supports, Does Not Support, Not Applicable), how to write clear remarks and explanations, and how to avoid common VPAT mistakes that lead to procurement rejection.

Why VPATs Matter

Government agencies and large enterprises require VPATs as part of vendor evaluation. A poorly written VPAT can disqualify you from contracts even if your product is accessible. Conversely, a well-documented VPAT demonstrates transparency and builds trust with Accessibility-conscious buyers. At DodaTech, Durga Antivirus Pro maintains a current VPAT 2.4 that covers both Section 508 and EN 301 549, enabling sales to education, government, and healthcare customers globally.

VPAT Creation Decision Flow

flowchart TD
  A[Product evaluation] --> B[Choose VPAT template]
  B --> C[Select applicable standards]
  C --> D[Section 508]
  C --> E[EN 301 549]
  C --> F[WCAG 2.x]
  D --> G[Evaluate each criterion]
  E --> G
  F --> G
  G --> H[Assign conformance level]
  H --> I[Supports]
  H --> J[Partially Supports]
  H --> K[Does Not Support]
  H --> L[Not Applicable]
  I --> M[Write remarks]
  J --> M
  K --> M
  L --> M
  M --> N[Review and validate]
  N --> O[Publish current VPAT]

{{< callout type="info" icon="sparkles" >}} Prerequisites: Understanding of Section 508, WCAG, and EN 301 549 standards. Experience testing products for Accessibility is helpful. {{< /callout >}}

VPAT 2.4 Structure

The VPAT 2.4 template is published by the ITIC (Information Technology Industry Council). It contains four main tables:

Table 1: WCAG Criteria

This is the core of the VPAT. It lists every WCAG 2.x success criterion with a conformance rating:

Conformance Rating Definitions

Table 2: Section 508 Paragraphs

This table covers the four Section 508 paragraphs that are not covered by WCAG:

Table 3: Hardware (if applicable)

Only required for hardware products.

Table 4: EN 301 549 (if selected)

European standard clauses beyond WCAG, such as closed functionality, biometrics, and preservation of Accessibility information.

How to Evaluate Each Criterion

Follow this Process for every criterion in the VPAT:

// vpat-evaluator.js — Help evaluate VPAT criteria
const vpatCriteria = [
  { id: '1.1.1', name: 'Non-text Content', level: 'A', type: 'WCAG' },
  { id: '1.3.1', name: 'Info and Relationships', level: 'A', type: 'WCAG' },
  { id: '1.4.3', name: 'Contrast Minimum', level: 'AA', type: 'WCAG' },
  { id: '2.1.1', name: 'Keyboard', level: 'A', type: 'WCAG' },
];

function evaluateCriterion(criterion, testResults) {
  const { passCount, failCount, totalTests } = testResults;
  let conformance = 'Does Not Support';

  if (failCount === 0 && passCount === totalTests) {
    conformance = 'Supports';
  } else if (failCount === 0 && passCount < totalTests) {
    conformance = 'Supports';
  } else if (failCount > 0 && failCount < totalTests * 0.2) {
    conformance = 'Partially Supports';
  }

  return {
    criterion: criterion.id,
    conformance,
    passRate: `${((passCount / totalTests) * 100).toFixed(0)}%`,
    remarks: conformance === 'Partially Supports'
      ? `${failCount} known exceptions documented. See appendix for details.`
      : 'Fully meets criterion. No known issues.'
  };
}

const results = evaluateCriterion(
  { id: '2.4.11', name: 'Focus Appearance', level: 'AA', type: 'WCAG' },
  { passCount: 12, failCount: 3, totalTests: 15 }
);

console.log(JSON.stringify(results, null, 2));

Expected output:

{
  "criterion": "2.4.11",
  "conformance": "Partially Supports",
  "passRate": "80%",
  "remarks": "3 known exceptions documented. See appendix for details."
}

Writing Effective Remarks

Remarks are the most important part of a VPAT. They explain why a rating was given and what the user should expect:

Good Remarks

• "All form inputs have programmatically associated labels using the <label for> pattern. No known exceptions."
• "Most text meets 4.5:1 contrast. Some disabled button text at 3.0:1 does not meet contrast minimum. Exception documented in appendix A."
• "Screen reader testing confirms all custom controls announce correct role, name, and State. Tested with NVDA 2024 and JAWS 2024."

Bad Remarks

• "Works fine." — Too vague.
• "Mostly accessible." — Not specific enough for procurement evaluation.
• "N/A" on a criterion that clearly applies. — Undermines credibility.

<!-- VPAT conformance statement for website footer -->
<div aria-label="Accessibility conformance">
  <p>
    This product is documented in our
    <a href="/vpat/DodaTech-VPAT-2026.pdf">
      VPAT 2.4 Accessibility Conformance Report
    </a>.
  </p>
  <p>
    Standards covered: Section 508, EN 301 549, WCAG 2.2 Level AA.
    Last updated: June 2026.
  </p>
</div>

VPAT Maintenance and Versioning

A VPAT is a living document. Update it when:

• A new product version is released
• Accessibility fixes are deployed
• A new WCAG version is published
• New features are added
• An audit finds new issues

# VPAT release workflow
# 1. Update criteria evaluation
# 2. Update remarks and explanations
# 3. Update version number and date
# 4. Generate PDF
# 5. Publish to website

# Track VPAT versions in Git
Git add docs/Accessibility/vpat-4.2.pdf
Git commit -m "docs(vpat): Update VPAT to v4.2

- Updated WCAG 2.4.11 rating from Does Not Support to Partially Supports
- Added documentation for new voice control features
- Updated testing methodology section"

Common Mistakes

1. Using the Wrong VPAT Version

VPAT 2.4 is the current version. Using VPAT 2.3 or older may be rejected by procurement. Always use the latest template from ITIC.

2. Rating Everything as Supports

A VPAT with "Supports" on every criterion is not credible. Buyers expect some "Partially Supports" and "Does Not Support" entries. Honest reporting builds trust.

3. Vague or Missing Remarks

A blank or vague remark column makes the VPAT useless. Every "Partially Supports" entry must explain what is not supported and what the user should expect.

4. Not Testing Before Writing

Writing a VPAT based on assumptions rather than actual testing leads to incorrect ratings. Always test the product before completing the VPAT.

5. Ignoring EN 301 549 for European Sales

If you sell in the EU, your VPAT must cover EN 301 549. The VPAT 2.4 template includes EN 301 549 criteria when selected.

6. No Date or Version Number

A VPAT without a date or version number is not a valid procurement document. Every VPAT must include the product version and evaluation date.

7. Not Reviewing Annually

Accessibility standards and product features change. An outdated VPAT (more than 12 months old) may be rejected by buyers.

Practice Questions

1. What are the four conformance levels in a VPAT?

Supports, Partially Supports, Does Not Support, and Not Applicable.

2. Why is "Partially Supports" sometimes better than "Supports"?

Honest reporting of partial support builds trust with buyers. A VPAT that claims full support for every criterion appears untested and may be rejected.

3. What information must every VPAT include?

Product name and version, evaluation date, standards covered (Section 508, EN 301 549, WCAG), conformance rating for each criterion, and remarks for non-"Supports" ratings.

4. When should a VPAT be updated?

On new product releases, Accessibility fixes, new WCAG versions, new features, or annually at minimum.

5. Challenge: Create a VPAT for a product you use or build. Choose WCAG 2.2 AA as the standard. Evaluate at least 10 criteria. Write specific, honest remarks for each.

Real-World Task

Download the VPAT 2.4 template from ITIC. Complete it for a DodaTech product (e.g., DodaZIP). Include: product name/version, evaluation date, standards selected, at least 15 criteria evaluated, and at least 3 "Partially Supports" or "Does Not Support" entries with detailed remarks.

FAQ

Try It Yourself

Create a VPAT excerpt for Durga Antivirus Pro's scan dialog feature:

# VPAT Excerpt: Durga Antivirus Pro v4.2 — Scan Dialog

## WCAG 2.2 AA

| Criteria | Rating | Remarks |
|----------|--------|---------|
| 1.1.1 Non-text Content | Supports | Scan progress icon has alt text "Scan in progress." |
| 1.4.3 Contrast Minimum | Supports | All text meets 4.5:1 contrast. |
| 2.1.1 Keyboard | Supports | All buttons, menus, and dialogs keyboard accessible. |
| 2.4.3 Focus Order | Supports | Focus moves in logical order: scan type, target, start button. |
| 2.4.7 Focus Visible | Supports | 2px blue focus ring on all elements. |
| 2.4.11 Focus Appearance | Supports | Focus indicator meets 3:1 contrast and 2px thickness. |
| 4.1.2 Name, Role, Value | Supports | Custom scan type selector announces role="radiogroup". |

What's Next

Congratulations on completing this VPAT / ACR tutorial! Here is where to Go from here:

• Practice daily — Review one VPAT criterion evaluation per day
• Build a project — Create a complete VPAT for your product
• Explore related topics — Learn React Accessibility patterns next
• Join the community — Discuss with other learners and share your progress

Remember: every expert was once a beginner. Keep coding!