How Often Should You Update a VPAT (ACR)?

By Andrew Szigety, DHS Trusted Tester (TT‑2606‑09221). Published October 14, 2026.

An ACR doesn’t expire on a set date. It describes one version of your product on one date, so update it when the product changes in ways that affect accessibility, such as a major release or a redesign, and when a buyer asks for a newer report, WCAG version or template. Checked on October 14, 2026.

Does an ACR Expire?

No. ITI, which publishes the VPAT, sets no expiry date, and its VPAT page says nothing about how long a finished report stays valid. Section508.gov doesn’t set one either. What it does say, in its ACR FAQ, is that every time a product is changed or updated, such as a version change or a bug fix, an updated ACR may be required to address any changes in the product’s accessibility.

A report covers the version named on its first page, as it was on the report date. ITI’s template asks for the product version and a report date with at least the month and year, so a reader can always tell what was tested and when. Once you ship a version the report doesn’t describe, the report hasn’t expired, but it’s describing a product the buyer can’t buy.

What Should Trigger an Update

• A release that changes the interface. New screens, new flows, a new navigation pattern or a rebuilt component library. Section508.gov’s change-control guidance tells agencies to make sure vendor patches, releases and enhancements come with updated ACRs and accessibility regression testing results.
• A redesign. The same guidance calls for accessibility checks after any significant user interface or user experience change. A new design system can change every row in the report at once.
• A new module, or a product swap in a contract. Section508.gov’s model contract language asks for an ACR for each ICT item that is developed, updated or configured for the agency, and when product substitutions are offered.
• A fix that changes an answer. If your team fixed the problem behind a Partially Supports row, a re-test and a revised report let you show it. The reverse matters too: a regression that breaks a row marked Supports makes the report wrong.
• A buyer asks for a newer WCAG version. A report tested against WCAG 2.1 doesn’t answer a 2.2 requirement. More on that below.
• A buyer asks for the current template. ITI’s current version is VPAT 2.5Rev, dated April 2025. Section508.gov says any VPAT 2.x is acceptable, while its model contract language says the ACR should be based on the latest VPAT version, so read the solicitation. A report built on the Original Section 508 Standards from 2001 has to be redone against the Revised Standards from 2017, and section508.gov says so outright.
• A buyer asks for a report less than a set age. Some do, in writing. See the next section.

How Old Can an ACR Be for an RFP?

It depends on the buyer, and the solicitation decides. We haven’t found an official federal number for how old an ACR can be. Section508.gov’s guidance points at the version instead. It tells agencies to test final, commercially available release versions, and its model contract language asks for an ACR for each item based on the latest VPAT version. A report on last year’s release can fail that test whatever its date says.

Some questionnaires do set a window. The HECVAT that colleges and universities send vendors asks, in its ITAC‑06 question, whether a VPAT or ACR has been created or updated for the solution and version under consideration within the past 12 months, and it’s one of the questions the workbook marks critical. That’s from version 4.1.6, read on September 14, 2026, and how to answer the accessibility questions in a HECVAT covers every row. Outside a document like that, the honest answer is that it varies. If an RFP names a window, that window is the rule. If it doesn’t, a report on the version you’re selling, with a recent date and revisions explained, is the safest thing to send.

Each row was read from the page or document it links to on October 14, 2026. The ITI row comes from the INT edition Word file on that page. Section508.gov dates its own reviews at the foot of each page, and the four above were last reviewed between September 2025 and August 2026.

What to Do Between Full Re-Tests

Not every release needs a new report from scratch. A small release can get a revised report, as long as the revision is honest about what was and wasn’t tested again. ITI’s template gives you the fields for it.

• Keep the version field current. Name the version the report covers. If a release changed nothing a user sees, you can say in the notes that the report also applies to it, but only if that’s true.
• Change the report date and explain why. ITI’s rule is to change the date on a revised report and explain the revision in the notes, or to issue a new report that says it supersedes the old one.
• Keep a short change log in the notes. ITI lists revisions to the document and the product version it covers among the things the notes are for. One line per revision is enough: the date, the version, and what was tested again.
• Date the remarks you change. A remark such as “Fixed in version 4.3 and re-tested October 2026” tells a reviewer which answers are new and which are carried over.
• Re-test before you change an answer. Moving a row from Partially Supports to Supports because a ticket was closed is a claim with nothing behind it. Test the screens that changed against the criteria they touch, and say in the evaluation methods what the revision covered.
• Know when a revision isn’t enough. A redesign, a new design system or a new major version usually touches too many rows to patch. That’s the point to test again in full.

Every field named above is covered in how to fill out a VPAT, and Harbor’s sample VPAT/ACR shows a finished report with its version, date and notes filled in.

What WCAG 2.2 Means for an Existing Report

WCAG 2.2 became a W3C Recommendation on October 5, 2023. It adds nine success criteria, six of them at Level A or AA, and removes 4.1.1 Parsing. The W3C says content that conforms to 2.2 also conforms to 2.1 and 2.0, and encourages using the latest version.

A report tested against WCAG 2.1 doesn’t become wrong when 2.2 arrives. It’s still an accurate answer to the question it was written for. It just isn’t a 2.2 answer. If a buyer asks for 2.2, or your contracts start naming it, you’ll need to test the six new criteria (Focus Not Obscured, Dragging Movements, Target Size, Consistent Help, Redundant Entry and Accessible Authentication), add their rows, and mark 4.1.1 as not applying under 2.2, which is what ITI’s template says to do. If the product changed since the last test, test the rest again too. Section 508 still incorporates WCAG 2.0, so a 2.2 update isn’t required for that reason alone. The full list of changes is in WCAG 2.1 vs 2.2.

What EN 301 549 V4.1.1 Means for an Existing Report

ETSI published EN 301 549 V4.1.1 in September 2026. Its web, non-web document and software clauses are updated to align with WCAG 2.2, and it adds a way to evaluate products against the European Accessibility Act’s requirements. The standard’s own dates give national standards bodies until May 31, 2027 to publish it and until May 31, 2028 to withdraw conflicting national standards.

The VPAT hasn’t caught up. ITI’s current template, VPAT 2.5Rev, reports against EN 301 549 V3.1.1 and V3.2.1, and its VPAT page announced no new version when we checked on October 14, 2026. So an EU or INT edition report written today is a V3.2.1 answer, and that’s what the template supports. If a buyer asks for V4.1.1 by name, say in the notes which version the report covers, point to the WCAG 2.2 tables if you have them, and ask whether that works for them. When ITI releases a template that covers V4.1.1, that’s a good time to plan the next revision. Which edition carries which standard is in which VPAT edition do you need.

Planning for It

The simplest habit is to tie the report to your release calendar. When a release changes what users see, put a re-test of the changed screens on the release checklist, and plan a full re-test for redesigns and major versions. If a renewal or an RFP is coming, check its wording for a report age, a WCAG version or a template version before you send what you have. If you’re weighing doing the next one in house against paying for it, how much a VPAT costs covers what providers publish and what the fee counts.

How Harbor Does It

Harbor is led by Andrew Szigety, DHS Trusted Tester TT‑2606‑09221. Every unique template is tested by hand against all 55 WCAG 2.2 Level A and AA criteria, and the ACR is tested and signed by a DHS Trusted Tester who is named in it, along with the methods used, the product version and the report date. Every report comes in the INT edition, so one document answers a WCAG, a Section 508 or an EN 301 549 request.

Follow-up reviews are part of every engagement. As your team lands fixes, the changed screens are tested again and the ACR is re-issued after each review, with the revision explained in its notes. When a later release or a redesign needs a new report, it’s scoped the same way as the first, on a free 15-minute call. Harbor doesn’t publish a fee. It follows your unique template count and is fixed in writing before you commit. The VPAT/ACR service page covers what an engagement includes.

Harbor provides technical audits and conformance documentation, not legal advice. What a particular buyer accepts is set by that buyer and its solicitation. VPAT® is a registered service mark of the Information Technology Industry Council (ITI).

• Read the Sample VPAT/ACR
• How to Fill Out a VPAT
• WCAG 2.1 vs 2.2
• Which VPAT Edition You Need
• Book the 15-Minute Call