Before starting a VPAT, you need product scope, the target WCAG version and conformance level, the correct VPAT edition, evaluation methods, and audit data that maps to each success criterion. Without these inputs, the resulting Accessibility Conformance Report will be incomplete or inaccurate. The VPAT is the template. The ACR is the completed document. Filling it in requires real evaluation evidence, not assumptions about how a product behaves.
Buyers reading an ACR look for specific, defensible language. That language only comes from a product owner who has gathered the right inputs first.
| Input | What It Covers |
|---|---|
| Product scope | The exact product, version, and components covered by the ACR |
| Standard and level | WCAG 2.1 AA or WCAG 2.2 AA, plus Section 508 or EN 301 549 if needed |
| VPAT edition | WCAG, Section 508, EN 301 549, or INT |
| Evaluation methods | Manual review, assistive technology checks, code inspection, user evaluation |
| Audit data | Issue findings mapped to each success criterion with severity and location |
| Product details | Company information, product description, contact details, report date |
What does product scope mean for a VPAT?
Scope defines what the ACR actually covers. A SaaS company might issue an ACR for the entire web app, or only for the customer-facing portal and not the admin dashboard. Both are valid as long as the document states it clearly.
Before starting, document the product name, version number, build date, and the specific screens, flows, or modules in scope. If the product has a mobile app and a web app, decide whether one ACR covers both or each gets its own. Buyers read scope first. Vague scope makes the rest of the document hard to trust.
Which standard and conformance level applies?
WCAG 2.1 AA remains the most common standard for SaaS companies issuing an ACR. WCAG 2.2 AA is increasing in buyer requests, particularly from procurement teams that have updated their RFP language. Section 508 applies for U.S. federal contracts. EN 301 549 applies for European public sector and EAA-related procurement.
Pick the standard your buyer expects. If multiple buyers ask for different standards, the INT edition of the VPAT covers WCAG, Section 508, and EN 301 549 in one document. Confirm the version and level in writing before any evaluation work begins.
Which VPAT edition should you select?
The VPAT comes in four editions, and each one structures the document differently. The WCAG edition is appropriate for most commercial buyers. Section 508 edition for U.S. federal procurement. EN 301 549 edition for European procurement. INT edition when the same product is sold across multiple regulatory contexts.
Picking the wrong edition means redoing the document. Confirm the edition with the buyer or procurement contact before any work starts. The VPAT and ACR overview covers edition selection in more depth.
What evaluation methods will be documented?
Every ACR includes an evaluation methods section. This describes how conformance was determined, including manual review against each success criterion, assistive technology checks (screen readers, keyboard-only navigation, magnification), code-level inspection, and any user evaluation performed.
Buyers scrutinize this section. An ACR backed only by automated scanning is a red flag, since scans only flag approximately 25% of issues. The evaluation methods section needs to reflect the depth of the work that produced the conformance claims.
Why is audit data the foundation?
An ACR without audit data is guesswork. The conformance table at the heart of the document, where each success criterion is marked Supports, Partially Supports, Does Not Support, or Not Applicable, has to map directly to evaluation findings.
An accessibility audit identifies issues at the criterion level with severity, location, and recommended remediation. That data feeds the Remarks and Explanations column of the ACR. Without it, the document either inflates conformance or stays vague enough that buyers reject it. The distinction between an audit and a VPAT matters here: the audit is the evaluation, the VPAT is the template, and the ACR is the finished deliverable.
What product details go into the document header?
The opening section of the ACR includes the company name, product name, product version, report date, contact information for accessibility questions, and a brief product description. Have these ready before drafting begins.
Accessibility contact information is often overlooked. Procurement teams check whether a real person or team can be reached about the report. Generic info@ inboxes weaken the document. A named accessibility contact strengthens it.
How does AI factor into VPAT preparation?
Real AI assists in mapping audit findings to success criteria and drafting Remarks and Explanations language. It does not replace the evaluation work. Accessible.org Labs is actively researching how AI can support faster, more accurate VPAT workflows when paired with manual audit data.
The boundary is firm: AI can speed up document preparation when the underlying evaluation is sound. AI cannot determine WCAG conformance on its own.
Frequently Asked Questions
Can you start a VPAT without an audit?
Technically yes, but the resulting ACR will not be defensible. Without audit data, the conformance table is filled in based on assumptions. Buyers and procurement teams increasingly request the audit report alongside the ACR, and an ACR without supporting evaluation evidence raises immediate concerns.
How long does it take to gather VPAT inputs?
Scope, standard selection, edition selection, and product details can be confirmed in a few days. Audit data takes longer because the evaluation itself requires time. For a typical SaaS web app, plan for the audit to be the longest input to prepare.
Who at the company should gather these inputs?
Usually a product manager, compliance lead, or accessibility owner coordinates the inputs. Engineering provides product details and supports the evaluation. Sales or procurement contacts confirm which standard and edition the buyer expects.
Does the same input list apply to a WCAG 2.2 AA ACR?
Yes. The inputs are the same regardless of WCAG version. The audit work covers different success criteria depending on whether 2.1 AA or 2.2 AA is the target, but the preparation checklist does not change.
Gathering these inputs upfront is what separates an ACR that wins contracts from one that gets sent back with questions. Preparation is the work that makes the document credible.
Contact Accessible.org to start the audit and ACR process for your product.
