You are deep in a sales cycle and the deal is moving. Then a vendor questionnaire arrives from the prospect’s procurement team, and one line on it reads: “Please provide your current VPAT/ACR.”
What They’re Asking For
A VPAT (Voluntary Product Accessibility Template) is a standardized document that reports how accessible your product is. The filled-out version is called an ACR (Accessibility Conformance Report). When a buyer asks for your “VPAT,” they want the completed ACR, a detailed evaluation of your product against WCAG 2.2 Level AA success criteria.
It covers things like keyboard navigation, screen reader compatibility, color contrast, form labeling, error handling, and more. Each criterion gets a conformance level and specific remarks about what works and what doesn’t.
Why Your Buyer Is Asking
Enterprise procurement teams include accessibility documentation in vendor evaluation for a few reasons:
- Obligations of their own. Organizations with employees and customers with disabilities have accessibility duties they are already managing. Tools that meet the standard make that easier; tools that do not push the problem onto them.
- Internal policy. Many large organizations have adopted accessibility standards as part of their DEI or IT governance framework.
- Downstream requirements. If your buyer sells to government or regulated industries, accessibility obligations flow through to their vendor stack.
- It’s becoming table stakes. The same way SOC 2 became a default ask, accessibility documentation is following the same trajectory in enterprise sales.
What Happens If You Don’t Have One
Typically one of three things:
- Your product doesn’t advance to the next stage of evaluation.
- You get asked to produce one on a compressed timeline (expensive, stressful).
- Your competitor who does have one wins the deal.
Some vendors try to self-assess or submit a one-page statement. This occasionally works for smaller buyers, but enterprise procurement teams are increasingly specific about what they’ll accept, and a credible third-party evaluation is what they’re looking for.
What a Good ACR Looks Like
| Element | What Buyers Look For |
|---|---|
| Specific remarks | Named UI elements and observed behaviour, with the page and the fix. |
| Testing methodology | Manual testing with a screen reader and a keyboard, on top of the scan. |
| Evaluator credentials | DHS Trusted Tester or IAAP-certified professionals (CPACC, WAS, CPWA). |
| Independent verification | An evaluator outside the team that built the product, named in the report. |
| Recency | Dated within the last 12–18 months and covering the current product version. |
| E&O insurance | The firm backs their work with Errors & Omissions coverage, a signal they stand behind the report. |
What to Do Next
If you’re mid-deal and don’t have an ACR, the move is to get one produced properly rather than rushing a self-assessment that won’t hold up. A properly produced ACR does not have to be slow. Harbor signs and delivers yours on day 45 of a Standard engagement, day 60 on Professional, and that date is committed at signing rather than estimated. Remediation runs behind it, and the full cycle usually lands around day 75. That half is your developers’ engineering time, so we call it an estimate, not a promise. If you have a deadline, say so on the first call and we will tell you honestly whether we can hit it.
Harbor is also independently testing the accuracy of published VPATs across 20 well-known SaaS vendors. See The VPAT Accuracy Report for the pre-registered methodology.