Resources

You’re deep in a sales cycle. The deal is moving. Then someone from your prospect’s procurement or security team sends over a vendor questionnaire and one line stops you cold: “Please provide your current VPAT/ACR.”

If you don’t know what that means, you’re not alone. Here’s what’s happening and what you need to do about it.

What They’re Actually Asking For

A VPAT (Voluntary Product Accessibility Template) is a standardized document that reports how accessible your product is. The filled-out version is called an ACR (Accessibility Conformance Report). When a buyer asks for your “VPAT,” they want the completed ACR — a detailed evaluation of your product against WCAG 2.2 Level AA success criteria.

It covers things like keyboard navigation, screen reader compatibility, color contrast, form labeling, error handling, and more. Each criterion gets a conformance level and specific remarks about what works and what doesn’t.

Why Your Buyer Is Asking

Enterprise procurement teams include accessibility documentation in vendor evaluation for a few reasons:

• Legal risk. Companies with employees or customers with disabilities face litigation risk if their tools aren’t accessible. Your buyer is managing their own exposure.
• Internal policy. Many large organizations have adopted accessibility standards as part of their DEI or IT governance framework.
• Downstream requirements. If your buyer sells to government or regulated industries, accessibility obligations flow through to their vendor stack.
• It’s becoming table stakes. The same way SOC 2 became a default ask, accessibility documentation is following the same trajectory in enterprise sales.

What Happens If You Don’t Have One

Typically one of three things:

• Your product doesn’t advance to the next stage of evaluation.
• You get asked to produce one on a compressed timeline (expensive, stressful).
• Your competitor who does have one wins the deal.

Some vendors try to self-assess or submit a one-page statement. This occasionally works for smaller buyers, but enterprise procurement teams are increasingly specific about what they’ll accept — and a credible third-party evaluation is what they’re looking for.

What a Good ACR Looks Like

What to Do Next

If you’re mid-deal and don’t have an ACR, the move is to get one produced properly rather than rushing a self-assessment that won’t hold up. A managed engagement typically takes about 60 days from kickoff to delivered report. If you have a deadline, start now.

If you’ve never been through an accessibility audit, the process can feel opaque. Here’s what actually happens, what your team needs to do, and what the deliverable looks like at the end.

Before the Audit Starts

You’ll need to provide access to your product. For most SaaS products, that means:

• A staging or production URL the evaluator can access
• Test accounts for each user role (admin, standard user, read-only, etc.)
• Any setup steps needed to reach key workflows (sample data, feature flags)

The evaluator will also confirm scope — which pages, flows, and roles are being tested. Not every screen in a large product needs individual evaluation. The focus is on distinct templates and critical user paths.

What the Evaluator Actually Does

A proper audit combines multiple testing methods:

The evaluator tests each WCAG 2.2 Level AA success criterion against your actual product and documents what they find.

What You Get Back

The primary deliverable is a completed ACR — the filled-out VPAT template with your product’s results. Each criterion includes a conformance level (Supports, Partially Supports, Does Not Support, Not Applicable) and specific remarks explaining the finding.

Depending on your engagement, you may also receive:

• A detailed findings report with screenshots and fix guidance
• Follow-up reviews after your team remediates issues
• An independently verified final report signed by a second credentialed reviewer

How Long It Takes

Total is typically about 60 days from kickoff to delivered report. Simpler products with responsive teams can finish faster.

What Your Team Needs to Do

Your involvement is minimal but important: provide access, answer questions about intended behavior, and (if your engagement includes remediation) fix the issues your evaluator flags so the final report reflects your product’s actual state.

The biggest source of timeline delays is slow access provisioning and unanswered evaluator questions. Have a point person ready before kickoff.

Accessibility questions in RFPs used to be rare. Now they show up in almost every enterprise vendor evaluation — and how you respond directly affects whether you advance.

What You’ll Typically See

Accessibility questions in enterprise RFPs generally fall into a few categories:

• “Provide your current VPAT/ACR.”
• “Describe your product’s conformance with WCAG 2.1 AA.”
• “What is your accessibility testing methodology?”
• “Describe your accessibility roadmap and remediation process.”
• “Do you have a dedicated accessibility team or use a third-party evaluator?”

The underlying question is always the same: can we trust that this product won’t create accessibility liability for us?

Responding When You Have an ACR

If you already have a current, third-party evaluated ACR, this is straightforward: attach it. The document speaks for itself. A few things that strengthen your response:

• Note when the evaluation was performed and which product version it covers.
• Mention the evaluator’s credentials ( DHS Trusted Tester and IAAP certifications signal demonstrated expertise).
• If your ACR was independently verified, say so — it distinguishes your report from self-assessments.
• Include a brief note about your maintenance plan (how often you re-evaluate).

Responding When You Don’t Have One

This is more common than you’d think. The worst response is silence or a vague statement like “we are committed to accessibility.” Procurement teams see through that immediately.

A stronger response acknowledges the gap and shows a concrete plan:

• State that a third-party evaluation is in progress (or scheduled) with an expected completion date.
• Describe what you’ve done so far (automated scanning, internal testing, known remediations).
• Commit to delivering the completed ACR by a specific date.

Many procurement processes have evaluation periods of 30–90 days. If you can deliver a credible ACR within that window, you’re still in the running.

Turning It Into a Differentiator

Most of your competitors either don’t have an ACR or have a weak one (automated-only, self-assessed, outdated). A properly evaluated, independently verified report with specific remarks and recent dates puts you ahead of the field. It signals:

• You take the requirement seriously, not as a checkbox exercise.
• Your product has been evaluated by someone with actual expertise.
• You maintain it — it’s not a one-time artifact gathering dust.

Common Mistakes