If you sell software and a federal agency is anywhere in your pipeline, Section 508 is already part of your deal whether anyone has said so yet or not. Agencies are required to buy accessible technology, so the requirement lands on you, the vendor, at solicitation time.
Where the Requirement Comes From
Section 508 of the Rehabilitation Act requires federal agencies to make their information and communications technology accessible to people with disabilities. That covers what agencies build, and it covers what they buy. When an agency procures software, it has to weigh accessibility in the purchase, which is why accessibility documentation shows up in federal RFPs, RFQs, and vendor questionnaires.
The revised Section 508 standards incorporate WCAG (Web Content Accessibility Guidelines) Level A and AA by reference for web content and software, and in practice agencies increasingly ask against the current WCAG version. The document they expect is an ACR, usually on the VPAT template in its Section 508 or INT edition. If those acronyms are new, start here.
What the Reviewer Actually Reads
The person evaluating your submission is rarely the end user. They are a procurement or 508 program office reviewer comparing conformance reports across vendors. Three things separate a submission that survives that reading from one that does not:
- Who performed the evaluation. A named evaluator with a checkable credential reads very differently from an unnamed “internal team.”
- How it was tested. Manual testing with a keyboard and a screen reader, stated plainly, versus an automated scan repackaged as an evaluation.
- Whether the remarks say anything. A row that reads “Partially Supports” with the specific failing component named is credible. A column of bare “Supports” entries with empty remarks is a red flag reviewers know well.
Why the Trusted Tester Methodology Matters
Trusted Tester is the federal government’s own standardized manual test process for Section 508, run by the Department of Homeland Security. Its point is consistency: two certified testers evaluating the same product should reach the same results, which is what lets agencies trust and compare the reports they receive.
For a vendor, that means an ACR produced under the Trusted Tester methodology speaks the reviewer’s own language. Harbor’s evaluator holds the DHS Trusted Tester certification (TT-2606-09221, the certificate is published on this site), and we have published a full worked evaluation of a federal homepage run through this exact process, including every automated finding that manual verification threw out.
How Vendors Disqualify Themselves
| Mistake | How the Reviewer Reads It |
|---|---|
| Self-assessed VPAT written by marketing | No independent evaluation happened. Some agencies discard these outright. |
| Automated-scan-only report | A scanner can decide about six of the 55 criteria on its own. The reviewer knows the rest went untested. |
| Wrong edition | A WCAG-only ACR answers a question the agency did not ask. Federal work wants the Section 508 or INT edition. |
| Stale report | An ACR covering a version you no longer ship documents a product the agency cannot buy. |
| All “Supports,” no remarks | Real products have findings. A spotless report with empty remarks reads as unexamined, not conforming. |
“Partially Supports” Is Not a Failing Grade
Vendors regularly delay federal deals waiting for a clean product before filing an ACR. That gets the document backwards. The ACR reports current state, and agencies routinely buy products whose reports say “Partially Supports” with credible remarks and a remediation plan behind them. What stalls the deal is having nothing credible to send, not having findings.
What to Do Next
If a federal or state opportunity is on your calendar, work backwards from its dates. Harbor delivers a signed VPAT/ACR on day 45 of a Standard engagement, day 60 on Professional, with the date committed at signing and an expedited day-30 option when the solicitation cannot wait. The evaluation runs under the same Trusted Tester discipline the government uses on its own systems, and you can read a full sample deliverable before you spend anything.