Section 508 explained: rules, WCAG and VPATs

What is Section 508?

Section 508 is part of the Rehabilitation Act of 1973. In 1998, Congress amended the act to require federal agencies to make their electronic and information technology accessible. Today this is usually called information and communication technology, or ICT.

The goal is that federal employees and members of the public with disabilities get access to information that is comparable to what others get. The US Access Board writes the technical standards, and agencies apply them when they build and buy technology.

Who does Section 508 cover?

Section 508 applies to all federal agencies when they develop, procure, maintain or use ICT. That includes public websites, internal sites, software, electronic documents and hardware.

It doesn't directly cover private companies or their own websites. But it affects them in two ways:

• Vendors: federal buying rules require agencies to consider accessibility when they buy ICT. If you sell software or digital services to an agency, expect to show how your product meets the 508 standards.
• Contractors: if you build or run a website or app for a federal agency, that work must meet Section 508, because the agency provides or uses it.

If no product on the market fully meets the standards, the agency must buy the one that best meets them while still meeting its business needs. For a business's own public website, the ADA is the law that usually matters.

What standard does Section 508 use?

The Access Board refreshed the 508 standards in 2017. The refresh made WCAG 2.0 Level A and AA the rule for web content, electronic documents and software.

The standards also apply WCAG 2.0 to non-web documents, such as PDFs and word processing files. Those documents don't need to meet four success criteria that only make sense for websites, such as offering more than one way to find a page. As of October 2026, the standards still reference WCAG 2.0. The W3C says content that meets WCAG 2.2 also meets 2.0, so building to WCAG 2.2 AA covers Section 508 and prepares you for future updates.

What is a VPAT and an ACR?

A VPAT (Voluntary Product Accessibility Template) is a free template from the Information Technology Industry Council (ITI). When you fill it in for your product, the result is an Accessibility Conformance Report (ACR). Agencies use ACRs to compare products.

The template comes in editions for Section 508, the European standard EN 301 549, WCAG, and an international edition that covers all three. For sales to the US federal government, use the Revised Section 508 edition or the international edition. For each requirement, you choose one of these levels:

• Supports: the product meets the requirement without known defects.
• Partially Supports: some features don't meet it.
• Does Not Support: most features don't meet it.
• Not Applicable: the requirement doesn't apply to the product.

You must test the product before you fill in an ACR, and say how you tested it. An honest report with clear notes is worth more than one that claims support everywhere.

How do you get ready to sell to federal agencies?

1. Test your product against WCAG 2.0 AA, or better, WCAG 2.2 AA.
2. Fix what you find, starting with keyboard access, form labels, alt text and color contrast.
3. Write your ACR with the current VPAT edition, and list the methods and tools you used.
4. Update the ACR when you release major changes.
5. Build accessibility into design, development and testing, so each release stays accessible.

A visitor tool like Octo Assist doesn't change how your product's code performs in a 508 review. The standards apply to the product itself.

This guide is general information, not legal advice. For questions about a specific contract or agency requirement, talk to a qualified lawyer or the agency's Section 508 program manager.