Does Section 508 apply to private companies?

Not directly. 29 U.S.C. § 794d binds federal departments and agencies. It reaches a company through the contract: FAR Subpart 39.2 requires the applicable standards to be stated in the solicitation and incorporated into the award, so the duty arrives as a term of the deal rather than as a regulator. For a commercial vendor with no award yet, 508 is an evaluation factor — the point where a contracting officer compares your conformance report with a competitor's. The practical exposure is losing the bid, not being fined.

Does Section 508 apply to state and local government?

Through a different door. Every state and territory accepts Assistive Technology Act funding, and an assurance of Section 508 compliance is a condition of that grant, so the enforcement route is a grant finding rather than a 508 action. Separately and more consequentially, the ADA Title II web rule binds public entities to WCAG 2.1 level AA with compliance dates of 24 April 2026 for entities serving 50,000 or more people and 26 April 2027 below that. Where both apply, 2.1 AA is the higher bar and meeting it discharges the 508 content criteria too.

What is an ACR, and is it the same as a VPAT?

The VPAT is the blank template, published by the Information Technology Industry Council; the ACR — Accessibility Conformance Report — is what you have once it is filled in against a specific product release. Use the VPAT 2.x Revised Section 508 edition, or the INT edition if you also sell into the EU and want 508, EN 301 549 and WCAG in one document. Each criterion is recorded as Supports, Partially Supports, Does Not Support or Not Applicable with remarks. A report marked Supports on every row with no remarks reads as marketing and gets treated that way the first time a buyer tests one row.

Does the legacy safe harbour cover our existing systems?

E202.2 excuses unaltered existing ICT that complied with the original 2000 standards, and the load-bearing word is unaltered. Any alteration on or after 18 January 2018 pulls the altered component into the Revised Standards, and a content refresh is an alteration. The exception is also component-level, so one qualifying module does not shelter the system around it. If you are relying on it, write down which components and what evidence supports the original compliance, because the claim is yours to prove.

Is internal intranet content in scope?

Only in nine named categories, and this is the provision misread in both directions. E205.3 covers agency official communications that are emergency notifications, initial or final decisions adjudicating administrative claims, internal or external programme or policy announcements, notices of benefits, programme eligibility, employment opportunity or personnel action, formal acknowledgements or receipts, educational or training materials, intranet content designed as a web page, or survey questionnaires. The last two catch the most: the learning management system is training material, and anything built as an intranet page is in scope whatever it is about.

Can an agency just claim undue burden?

It can claim it, but only in the way E202.6 describes. The determination has to be made by the head of the agency or a designee, in writing, stating the basis, and it must weigh the resources available to the programme or component rather than the agency's total budget. It also does not excuse the outcome: alternative means of access must still provide the individual with the information and data. A determination assembled after a complaint arrives is not a determination, it is a defence written in hindsight.

What about PDFs and videos?

Both are electronic content and both are in scope under E205. A scanned PDF posted to a public page is a WCAG 2.0 SC 1.1.1 failure sitting on an otherwise conforming site, and it is one of the most common findings in a federal assessment because document production usually sits outside the web team. For video, the level AA incorporation carries captions for prerecorded and live media and audio description for prerecorded media — 1.2.2 through 1.2.5. Auto-generated captions do not meet 1.2.2, which requires captions that convey the content.

Does this replace legal advice?

No. This is a reading of 29 U.S.C. § 794d, the Revised 508 Standards at 36 CFR Part 1194 and FAR Subpart 39.2, mapped to the answers you gave. Agency determinations on undue burden, fundamental alteration and best-meets control those questions on your facts, and contract terms can be stricter than the standards. It is a starting checklist, not an opinion.

What does Section 508 actually require of you?

Three questions about where you sit, what you deliver and whether a conformance report exists. You get back the duties that attach under the Revised 508 Standards — the E205 content scope, the Chapter 5 software rules WCAG does not state, Chapter 4 for closed functionality, Chapter 6 for your documentation and help desk, the E202 exceptions that have to be in writing, and the ACR you owe — each with the provision it comes from.

Free, instant, no signup and no card. Nothing you enter leaves your browser.

1 · Where you sit

Section 508 binds federal agencies directly and reaches everyone else through a contract or a grant condition. Which one is you decides the route.

2 · What you deliver, procure or maintain

The Revised Standards scope by ICT type, so each line below pulls in a different chapter. Pick every one that applies.

3 · Do you have a conformance report

The ACR is the artefact a contracting officer actually reads. An old one and a missing one fail differently.

Pick at least one line above, or “None of these”.

The version question has one answer, and it is not the newest one

Three accessibility rules now sit on the same desk and they do not point at the same standard. Section 508 incorporates WCAG 2.0 level AA through E205.4 and E207.2. The ADA Title II web rule at 28 CFR 35.200 sets WCAG 2.1 level AA, with compliance dates in April 2026 and April 2027. The European Accessibility Act reaches 2.1 AA through EN 301 549 clause 9. Part 1194's normative reference has not moved.

The engineering consequence and the paperwork consequence point in opposite directions, and the resolution is to stop treating them as one decision. Build to WCAG 2.1 AA: it is a strict superset of 2.0 AA, every 2.0 criterion is carried forward unchanged, and one build discharges all three regimes. Then write the conformance claim against WCAG 2.0 A and AA, by success criterion, because that is what the contracting officer is comparing against Part 1194. An ACR that cites 2.1 is not wrong about the web — it is answering a question nobody asked, and it comes back.

Why a clean scan is only part of an ACR

The Revised Standards are broader than WCAG in a way that surprises teams arriving from private-sector work. Chapter 5 adds software obligations WCAG never states — 502 interoperability with assistive technology through the platform accessibility services, 503 user preferences and caption controls at the same level of interaction as the media controls, 504 authoring tools that must produce conforming output by default. Chapter 4 governs hardware, and where functionality is closed the device itself has to provide the speech output because there is nothing external to attach. Chapter 6 puts your own manual and your help desk in scope. Chapter 3 sits under all of it as the functional performance backstop when a technical provision runs out.

So the honest split is this. Scope, undue burden and equivalent facilitation are determinations you write down and defend. The WCAG rows are a measurement, and they are the ones you can settle this afternoon — which is what the scan in the result above is for, and the only thing it claims to do.

Common questions

Which version of WCAG does Section 508 require?: WCAG 2.0, level A and level AA. The Revised 508 Standards at 36 CFR Part 1194 incorporate WCAG 2.0 by reference — E205.4 for electronic content and E207.2 for software user interfaces — and that reference has not been updated to 2.1 or 2.2. This matters because the two neighbouring rules moved on without it: the ADA Title II web rule at 28 CFR 35.200 sets WCAG 2.1 level AA, and the European Accessibility Act reaches 2.1 AA through EN 301 549 clause 9. Build to 2.1 AA if you have any of that exposure, because it is a strict superset and one build satisfies all three. Then write the claim against 2.0 AA, because that is the standard the contracting officer is holding.
Does Section 508 apply to private companies?: Not directly. 29 U.S.C. § 794d binds federal departments and agencies. It reaches a company through the contract: FAR Subpart 39.2 requires the applicable standards to be stated in the solicitation and incorporated into the award, so the duty arrives as a term of the deal rather than as a regulator. For a commercial vendor with no award yet, 508 is an evaluation factor — the point where a contracting officer compares your conformance report with a competitor's. The practical exposure is losing the bid, not being fined.
Does Section 508 apply to state and local government?: Through a different door. Every state and territory accepts Assistive Technology Act funding, and an assurance of Section 508 compliance is a condition of that grant, so the enforcement route is a grant finding rather than a 508 action. Separately and more consequentially, the ADA Title II web rule binds public entities to WCAG 2.1 level AA with compliance dates of 24 April 2026 for entities serving 50,000 or more people and 26 April 2027 below that. Where both apply, 2.1 AA is the higher bar and meeting it discharges the 508 content criteria too.
What is an ACR, and is it the same as a VPAT?: The VPAT is the blank template, published by the Information Technology Industry Council; the ACR — Accessibility Conformance Report — is what you have once it is filled in against a specific product release. Use the VPAT 2.x Revised Section 508 edition, or the INT edition if you also sell into the EU and want 508, EN 301 549 and WCAG in one document. Each criterion is recorded as Supports, Partially Supports, Does Not Support or Not Applicable with remarks. A report marked Supports on every row with no remarks reads as marketing and gets treated that way the first time a buyer tests one row.
Does the legacy safe harbour cover our existing systems?: E202.2 excuses unaltered existing ICT that complied with the original 2000 standards, and the load-bearing word is unaltered. Any alteration on or after 18 January 2018 pulls the altered component into the Revised Standards, and a content refresh is an alteration. The exception is also component-level, so one qualifying module does not shelter the system around it. If you are relying on it, write down which components and what evidence supports the original compliance, because the claim is yours to prove.
Is internal intranet content in scope?: Only in nine named categories, and this is the provision misread in both directions. E205.3 covers agency official communications that are emergency notifications, initial or final decisions adjudicating administrative claims, internal or external programme or policy announcements, notices of benefits, programme eligibility, employment opportunity or personnel action, formal acknowledgements or receipts, educational or training materials, intranet content designed as a web page, or survey questionnaires. The last two catch the most: the learning management system is training material, and anything built as an intranet page is in scope whatever it is about.
Can an agency just claim undue burden?: It can claim it, but only in the way E202.6 describes. The determination has to be made by the head of the agency or a designee, in writing, stating the basis, and it must weigh the resources available to the programme or component rather than the agency's total budget. It also does not excuse the outcome: alternative means of access must still provide the individual with the information and data. A determination assembled after a complaint arrives is not a determination, it is a defence written in hindsight.
What about PDFs and videos?: Both are electronic content and both are in scope under E205. A scanned PDF posted to a public page is a WCAG 2.0 SC 1.1.1 failure sitting on an otherwise conforming site, and it is one of the most common findings in a federal assessment because document production usually sits outside the web team. For video, the level AA incorporation carries captions for prerecorded and live media and audio description for prerecorded media — 1.2.2 through 1.2.5. Auto-generated captions do not meet 1.2.2, which requires captions that convey the content.
Does this replace legal advice?: No. This is a reading of 29 U.S.C. § 794d, the Revised 508 Standards at 36 CFR Part 1194 and FAR Subpart 39.2, mapped to the answers you gave. Agency determinations on undue burden, fundamental alteration and best-meets control those questions on your facts, and contract terms can be stricter than the standards. It is a starting checklist, not an opinion.

What does Section 508 actually require of you?

The version question has one answer, and it is not the newest one

Why a clean scan is only part of an ACR

Common questions

Keep reading