Send a completed Accessibility Conformance Report (ACR): ITI’s free VPAT template, filled in with how your product meets each accessibility criterion and how it was tested. If you don’t have one yet, tell the buyer when you will, and produce it from real testing. You can write it yourself or have an outside evaluator do it.
Key Takeaway
A VPAT is the template; the ACR is the completed report. When a buyer asks for your “VPAT,” they want a filled-out evaluation of your product against the standard their questionnaire names, with enough detail about who tested it and how that they can believe it.
What They’re Asking For
A VPAT (Voluntary Product Accessibility Template) is a standardized document that reports how accessible your product is. The filled-out version is called an ACR (Accessibility Conformance Report). When a buyer asks for your “VPAT,” they want the completed ACR, a detailed evaluation of your product against the accessibility standard they buy to. Every edition of the template includes the WCAG success criteria at Level A and AA. There are four editions, and which one you need depends on who is asking. Why the two names exist, and what each request means, is in VPAT vs ACR.
It covers things like keyboard navigation, screen reader compatibility, color contrast, form labeling, error handling, and more. Each criterion gets a conformance level and specific remarks about what works and what doesn’t.
Why Your Buyer Is Asking
Enterprise procurement teams include accessibility documentation in vendor evaluation for a few reasons:
- Obligations of their own. Organizations with employees and customers with disabilities have accessibility duties they are already managing. Tools that meet the standard make that easier; tools that do not push the problem onto them.
- Internal policy. Many large organizations have adopted accessibility standards as part of their DEI or IT governance framework.
- Downstream requirements. If your buyer sells to government or regulated industries, accessibility obligations flow through to their vendor stack.
- It’s becoming table stakes. The same way SOC 2 became a default ask, accessibility documentation is following the same trajectory in enterprise sales.
What Happens If You Don’t Have One
Typically one of three things:
- Your product doesn’t advance to the next stage of evaluation.
- You get asked to produce one on a compressed timeline.
- Your competitor who does have one wins the deal.
Some vendors send a one-page accessibility statement instead. That doesn’t answer a request for an ACR. Writing the ACR yourself can, because no rule requires a third party, but the buyer will want to know who tested the product and how. What ITI and federal buyers actually say about that is covered in does a VPAT have to come from a third party.
What a Good ACR Looks Like
| Element | What Buyers Look For |
|---|---|
| Specific remarks | Named UI elements and observed behaviour, with the page and the fix. |
| Testing methodology | Manual testing with a screen reader and a keyboard, on top of the scan. |
| Evaluator credentials | DHS Trusted Tester or IAAP-certified professionals (CPACC, WAS, CPWA). |
| Who tested it | The evaluator named in the report, and whether they are independent of the team that built the product. |
| Recency | Covering the version you sell now. The HECVAT that universities send vendors asks whether the report was created or updated in the past 12 months. |
| E&O insurance | The firm backs their work with Errors & Omissions coverage, a signal they stand behind the report. |
To see how each part of the template gets filled in, with a strong remark next to a weak one, read how to fill out a VPAT, section by section.
45
Days to a signed ACR, committed at signing
What to Do Next
If you’re mid-deal and don’t have an ACR, the move is to get one produced properly rather than rushing out a report nobody had time to test. A properly produced ACR does not have to be slow. Harbor signs and delivers yours on day 14 of a Standard engagement, day 21 on Professional, and that date is committed at signing rather than estimated. Remediation runs behind it, and the full cycle usually lands around day 45. That half is your developers’ engineering time, so we call it an estimate, not a promise. If you have a deadline, say so on the first call and we will tell you honestly whether we can hit it.
Common Questions
- What is a VPAT?
- A VPAT (Voluntary Product Accessibility Template) is a free template from ITI for reporting how accessible a product is. Filled in for one product, it becomes an Accessibility Conformance Report, or ACR. Each row covers one accessibility criterion, marked Supports, Partially Supports, Does Not Support or Not Applicable, with remarks explaining the result.
- What is the difference between a VPAT and an ACR?
- The VPAT is the blank template and the ACR is the completed report for a specific product. ITI puts it the same way: a VPAT completed for a specific product is an ACR. Buyers use the two words interchangeably, so a request for your VPAT is a request for your ACR.
- Why is my customer asking for a VPAT?
- Their buying process needs evidence of how accessible your product is before they commit. US federal agencies have to buy accessible technology under Section 508 and ask vendors for an ACR so they can evaluate it, and the HECVAT questionnaire that colleges and universities send vendors asks for one too.
- What should I do if we do not have a VPAT yet?
- Tell the buyer when you will have one and who is doing the testing, then produce it from real testing rather than a quick pass. Section508.gov says a product that does not meet every Section 508 standard is still considered for purchase, so an honest report with Partially Supports rows and specific remarks is worth more than a delay.
- Can we write our own VPAT?
- Yes. No rule requires a third party, and ITI says it does not review or approve completed VPATs. Buyers do ask who tested the product and how, so a self-written report needs its evaluation methods, the assistive technology used, the test dates and honest conformance levels filled in.