VPAT vs. ACR: What’s the Difference, and Which Do You Need?

Somewhere in your procurement process, someone has written “vendor must provide a VPAT.” Vendors sign it, everyone moves on, and eighteen months later a screen-reader user can’t complete the workflow that the paperwork supposedly covered. Part of the problem is that the paperwork itself is widely misunderstood — starting with the fact that “VPAT” and “ACR” are two different things, and the one most contracts ask for is, strictly speaking, a blank form.

The one-sentence answer

In everyday procurement speech, “send us your VPAT” is understood to mean “send us your completed ACR,” and vendors will send the right document. But the distinction is worth keeping crisp in your contract language, because it points at the real question: you are not collecting a form, you are collecting a claim— a criterion-by-criterion statement of how the product performs against an accessibility standard, which you can then verify, compare, and hold the vendor to.

What’s actually in an ACR

A completed ACR based on VPAT 2.5 contains the product name and version, the date, the evaluation methods used (vendor self-testing, third-party audit, automated tooling), and then a table for each applicable success criterion. Each row carries one of four conformance levels:

• Supports— the functionality meets the criterion without known defects
• Partially Supports— some functionality does not meet the criterion
• Does Not Support— the majority of the functionality does not meet the criterion
• Not Applicable— the criterion is not relevant to the product

Next to each level is a remarks column where the vendor explains which functionality falls short and how. The remarks are where the truth lives — more on that below.

The four VPAT editions — and which to request

ITI publishes the VPAT in four editions, each keyed to a different legal or technical standard:

• VPAT 508— for the U.S. federal Section 508 standard, whose technical requirements incorporate WCAG 2.0 Level AA. Federal agencies and federally-driven purchases ask for this one.
• VPAT EU— for EN 301 549, the European accessibility standard used in EU public procurement.
• VPAT WCAG— keyed directly to WCAG itself, without a specific procurement law attached.
• VPAT INT— the international edition combining all of the above in one document.

Which should you request? Match the edition to the obligation you carry:

• U.S. federal agencies (and vendors selling to them): the 508 edition.
• State and local governments and public universitiescovered by the DOJ’s ADA Title II rule: your legal standard is WCAG 2.1 Level AA, so request an ACR that reports against WCAG 2.1 AA — the WCAG edition (or INT) completed at that level. A 508-edition ACR only demonstrates WCAG 2.0 AA, which is not quite the standard you are on the hook for.
• Selling into Europe: the EU edition; vendors serving multiple markets often just maintain an INT.

Put the edition and the WCAG version in your solicitation language. “Provide an ACR based on VPAT 2.5, reporting conformance with WCAG 2.1 Level AA, for the product version being proposed” gets you a usable document. “Provide a VPAT” gets you whatever the vendor has lying around.

How to read an ACR without being fooled

An ACR is a self-declaration. Good vendors treat it as an engineering document; weak vendors treat it as marketing. You can usually tell which you are holding in about five minutes:

Green flags

• “Partially Supports” appears. Almost no real product meets every criterion perfectly. An honest ACR admits gaps and describes them.
• Remarks are specific.“Date-picker component cannot be operated with a keyboard; a text-input fallback is provided” tells you a human actually tested the product.
• Methodology is stated— which screen readers, browsers, and tools were used, and whether a third party performed the evaluation.
• It names the version you are buying and carries a recent date.

Red flags

• Every single row says “Supports” with an empty remarks column
• No product version, no date, or a date several major releases old
• A very old template version, suggesting no one has looked at it in years
• Remarks written in marketing language (“we are committed to accessibility”) rather than describing behavior

Whatever the paperwork says, verify the claims that matter: run the two or three workflows your users depend on with a keyboard and a screen reader before you sign, and write acceptance testing into the contract. If you receive ACRs at volume, TheAccessibleReportCardevaluates a vendor’s ACR and scores its credibility and completeness for you — useful when a procurement round produces a stack of them.

Three misconceptions worth retiring

• “An ACR means the product is compliant.”No — an ACR is a disclosure, not a certification. Nobody stamps or approves it, and a truthful ACR can describe a deeply inaccessible product. Its value is that it tells you where to look and gives you something to hold the vendor to in writing.
• “We have a VPAT on file, so procurement is covered.” An ACR describes one version of one product at one point in time. If the document on file predates two major releases, it describes software you are no longer running. Make ACR refresh a renewal-time requirement, not a one-time checkbox.
• “Only federal buyers need this paperwork.”Section 508 created the VPAT’s original audience, but Title II entities now have their own binding standard — and when a vendor platform you offer to the public fails WCAG 2.1 AA, that failure is your compliance problem, not just the vendor’s. The ACR is how you screen for that risk before signing.

If you’re the vendor: producing an honest ACR

Sellers into government and education markets increasingly cannot close deals without an ACR, and a hollow one now costs more than it saves — buyers are learning to spot the all-“Supports” special. The credible path:

• Test before you write. Run automated checks across the product (a scanner like TheAccessibleAuditcovers the machine-verifiable WCAG criteria), then manually test keyboard and screen-reader flows for the criteria automation can’t judge.
• Download the current template (VPAT 2.5) from ITI and complete the edition your buyers ask for — INT if you sell into more than one market.
• Report “Partially Supports” where it is true, with specific remarks and, ideally, a remediation timeline. This reads as competence, not weakness.
• Re-issue the ACR when major releases change the product materially.

The bottom line

VPAT is the template; ACR is the report. Ask vendors for an ACR based on VPAT 2.5, name the edition and WCAG version that match your legal obligation (WCAG 2.1 AA for Title II entities), read the remarks column before the conformance column, and verify the claims that matter with your own hands. The document is the beginning of due diligence, not the end of it.