How to Fill Out a VPAT 2.5: The Template, Section by Section

By Andrew Szigety, DHS Trusted Tester (TT‑2606‑09221). Published October 14, 2026.

Download the free VPAT 2.5Rev template from ITI and pick the edition your buyer needs. Test the product first. Then fill in the product details, how you tested and which standards you cover, and give every criterion a conformance level and a remark. The finished document is called an ACR. Checked on October 14, 2026.

Step 1: Get the Official Template

ITI publishes the template free on its VPAT page at itic.org, as four Microsoft Word files: the 508, EU, WCAG and INT editions of VPAT 2.5Rev, each dated April 2025. Membership in ITI isn’t required, ITI doesn’t review or approve finished reports, and there’s no VPAT certification. The Word file is a starting point. ITI says you can publish the report as HTML or PDF instead, as long as the final report is accessible. Section508.gov also points vendors to its ACR Editor, which builds the same report in a machine-readable format. How that format and the VPAT relate is in VPAT vs ACR.

Pick the edition before you start, because it decides which tables you fill in. A US federal buyer needs the 508 or INT edition, which section508.gov says is required for federal sales, and it adds that any VPAT 2.x is acceptable. A European buyer needs the EU or INT edition. The WCAG edition covers the guidelines alone. If more than one kind of buyer might ask, use INT. The full comparison is in which VPAT edition do you need.

Then test. Section508.gov says the product owner or developer must first test the product against the standards before completing an ACR. The template records results. It can’t produce them.

Step 2: Know What You’re Filling In

ITI’s template lists what every report has to contain at a minimum, and section508.gov’s guide checks the same fields. In order, these are the parts you fill in. The instruction pages at the front of the Word file are not one of them: ITI says to delete them before you publish.

Read from the INT edition of VPAT 2.5Rev, downloaded from ITI’s VPAT page on October 14, 2026. The 508, EU and WCAG editions carry the same front section and drop the tables they don’t report.

Part 1: Product Information

This is the top of the first page. ITI requires the product name with a version if there is one, a report date with at least the month and year, a short description, contact information (an email is enough) and a notes field, which can be blank. Use the notes for anything a reader needs to know about scope: which screens or modules were tested, what was left out, and whether this report replaces an earlier one. ITI asks that a revised report get a new date and an explanation in the notes.

The examples below are for a made-up scheduling app called Acme Scheduler. The weak versions are the kind that turn up in real reports.

Part 2: Evaluation Methods Used

This is the field a careful reviewer reads first, because it’s the only place the document says how anyone knows. Section508.gov asks for whether testing was manual, automated or both, and the testing tools used. ITI’s best practices add the assistive technology used, whether the testers know how the product is normally used, and, if a published test method was followed, its name, publisher and a link.

Who fills this in is up to you. ITI says a third-party review isn’t required, and a careful self-assessment can do the job. What a reviewer wants is enough detail to believe it. More on that in does a VPAT have to come from a third party.

Part 3: Applicable Standards and Terms

Next comes a small table with a yes or no for each standard: WCAG 2.0, 2.1 and 2.2 at Level A, AA and AAA, the Revised Section 508 Standards, and EN 301 549. ITI says the list must include only the standards used to evaluate the product. If you only report one standard, use the edition built for it rather than leaving empty sections in the INT edition. Which edition a buyer needs is covered in which VPAT edition do you need.

Then the terms. Every report has to define the words used in its conformance column. These are ITI’s definitions, word for word, and you can drop any term you don’t use.

ITI adds a note that trips people up. In the WCAG tables, a report may answer Supports where you’d expect Not Applicable, because under WCAG’s own conformance rules a criterion with no content to apply to is satisfied. Both answers show up in real reports. Whichever you use, say why in the remark, because section508.gov tells buyers to check why a criterion is marked Not Applicable.

Part 4: The WCAG Tables

This is the bulk of the report. Table 1 lists the Level A success criteria and Table 2 the Level AA ones, and each row has three columns: the criterion, the conformance level and the remarks. ITI says that when you report on a level, every criterion at that level has to be answered. Table 3 (Level AAA) is optional, and section508.gov notes that Section 508 doesn’t require it. For WCAG 2.2, Levels A and AA together have 55 criteria. Harbor’s sample ACR answers all 55: 37 Supports, 17 Partially Supports and 1 Not Applicable.

In the INT edition each WCAG row does double duty. The template prints which EN 301 549 clauses and Section 508 provisions the row also covers, so the WCAG tables answer EN 301 549 Clause 9 (Web) and parts of Clauses 10 to 12, plus Section 508 provisions 501.1, 504.2 and 602.3. You answer once, and the other sections point back to it. The conformance cell can also be split by type of content, with separate answers for web, electronic documents, software and authoring tools when a product has more than one.

One row is a special case. WCAG 2.2 removed 4.1.1 Parsing. ITI’s template says that for WCAG 2.0 and 2.1, and the standards built on them, the answer is always Supports, because a September 2023 errata update treats the criterion as always met. For WCAG 2.2 it doesn’t apply at all.

Remarks: Strong Ones Next to Weak Ones

Remarks are where a report earns trust. ITI’s instructions say that when a row is Partially Supports or Does Not Support, the remark should name the functions or features with issues and how they fall short. If the criterion doesn’t apply, explain why. If there’s an accessible alternative, describe it. Section508.gov requires remarks on Partially Supports and Does Not Support rows and encourages them everywhere else.

A strong remark names the screen, the element and what happens, so a buyer can judge how much it matters to their users and your developers know what to fix. A weak one makes the buyer ask, and a report full of them usually comes back with a list of questions.

Part 5: The Section 508 Chapters

The 508 and INT editions add a Revised Section 508 report after the WCAG tables. The Revised 508 Standards require web content and software to meet WCAG 2.0 Level A and AA, which is why most of Chapter 5 and part of Chapter 6 say “See WCAG 2.x section” in the template. What’s left is answered directly.

• Chapter 3: Functional Performance Criteria. Nine rows, 302.1 to 302.9, one for each way people use a product: without vision, with limited vision, without perception of color, without hearing, with limited hearing, without speech, with limited manipulation, with limited reach and strength, and with limited language, cognitive and learning abilities. The Access Board standards apply them where Chapters 4 and 5 don’t address one or more functions of the product, and many reports answer them as a summary of what the testing found.
• Chapter 4: Hardware. For physical devices. ITI says a software product can remove the whole chapter, with a note explaining why.
• Chapter 5: Software. 501.1 points to the WCAG tables. 502 covers working with assistive technology through the platform, and 503 covers applications. ITI’s own example says 502 and 503 won’t apply to a web-only application, so they can be summarized with an explanation. For a native app they do, as a VPAT for a mobile app explains. 504 covers authoring tools, and the template says to enter “not applicable” if the product isn’t one.
• Chapter 6: Support Documentation and Services. 602.3 (electronic support documentation) points to the WCAG tables. 602.2 asks whether your documentation lists the accessibility features, 602.4 whether documentation you only offer on paper is available in alternate formats on request, and 603.2 and 603.3 whether your support services can answer accessibility questions and handle the communication needs of people with disabilities.

A federal buyer reads this section closely. Section508.gov says a vendor selling to the US federal government must use the Revised Section 508 or INT edition, and that any VPAT 2.x is acceptable. What a federal buyer does with the report is covered in Section 508 for software vendors.

Part 6: The EN 301 549 Clauses

The EU and INT editions add an EN 301 549 report, the European standard for accessible ICT. It’s longer than the 508 section because it covers more kinds of products, and most of it won’t apply to a web app.

• Clause 4: Functional Performance Statements. Eleven rows, 4.2.1 to 4.2.11, much like Section 508 Chapter 3, adding photosensitive seizure triggers and privacy.
• Clauses 5 to 8. Generic requirements, two-way voice communication, video capabilities and hardware. Most rows here don’t apply to a web app, but each one still needs an answer or a section note saying why it doesn’t.
• Clause 9: Web. Points back to the WCAG tables.
• Clauses 10 and 11: Non-web documents and software. Mostly covered by the WCAG tables, with a few extra rows, such as caption positioning and user preferences.
• Clause 12: Documentation and support services. The European counterpart of Section 508 Chapter 6.
• Clause 13: Relay and emergency service access. For products that provide them.

Watch the version. VPAT 2.5Rev reports against EN 301 549 V3.1.1 and V3.2.1, which ITI lists together because their criteria are identical, and V3.2.1 is built on WCAG 2.1. In September 2026 ETSI published V4.1.1, updated to align with WCAG 2.2. ITI’s template hadn’t caught up when we checked on October 14, 2026. If a buyer asks for V4.1.1 by name, say in the notes which version the report covers, and ask whether that works for them.

Mistakes That Get a VPAT Sent Back

Most of these are on ITI’s own checklist or section508.gov’s, and a reviewer will spot them in the first few minutes. What buyers check beyond the form, and what they do next, is in how buyers review your ACR.

• The instructions are still in it. ITI and section508.gov both say to delete the instruction pages before you publish.
• The wrong edition. A WCAG edition report sent to a federal agency has no Section 508 chapters, and a 508 edition report on its own is a WCAG 2.0 answer.
• Supports down every row, with blank remarks. Complete as a form, and it says nothing about how anyone knows.
• Missing remarks on failures. Section508.gov requires a remark on every Partially Supports and Does Not Support row.
• Not Evaluated on a Level A or AA row. It’s only allowed on Level AAA.
• Not Applicable with no reason. Buyers are told to check why. A word or two of explanation saves the question.
• Made-up terms. “Supports with exceptions” was replaced by Partially Supports, and section508.gov’s checklist says to use only the standard phrases. If you change a definition, ITI says to explain it in the notes.
• Rows deleted to shorten it. ITI lets you remove whole sections that don’t apply, with a note. Individual criteria can’t be removed.
• No version, or an old date. A report on last year’s release, or with no version at all, doesn’t tell the buyer anything about what they’re buying. When a release calls for a revised report is covered in how often to update a VPAT.
• A blank evaluation methods field. The report gives no way to tell whether anyone tested the product.
• An inaccessible report. ITI says the final report must be accessible. A scanned PDF or untagged export fails the document it’s describing.
• The name changed. VPAT is an ITI registered service mark. ITI asks that the report use “VPAT®” with the mark and not alter the form.

If you’re weighing whether to write it yourself or pay for one, how much a VPAT costs covers what providers publish and what the fee counts. If a buyer’s request is what brought you here, a prospect asked for a VPAT covers what to send.

How Harbor Does It

Harbor is led by Andrew Szigety, DHS Trusted Tester TT‑2606‑09221. Every unique template is tested by hand against all 55 WCAG 2.2 Level A and AA criteria, and the ACR is tested and signed by a DHS Trusted Tester who is named in it, along with the methods used. Every report comes in the INT edition, so one document answers a WCAG, a Section 508 or an EN 301 549 request.

Harbor doesn’t publish a fee. It follows your unique template count and is fixed in writing after a free 15-minute call. The full sample ACR shows exactly what you’d get, and the VPAT/ACR service page covers what an engagement includes.

Harbor provides technical audits and conformance documentation, not legal advice. What a particular buyer accepts is set by that buyer and its solicitation. VPAT® is a registered service mark of the Information Technology Industry Council (ITI).

• Read the Sample VPAT/ACR
• Which VPAT Edition You Need
• What a VPAT Costs
• Does a VPAT Need a Third Party?
• Book the 15-Minute Call