Overview
A VPAT is a standardized template used to document how accessible a digital product is against recognized standards like WCAG, Section 508, and the EU’s EN 301 549. Once filled out with real testing results, the completed document is called an Accessibility Conformance Report, or ACR. Most ecommerce stores do not need one to operate, but a specific kind of buyer will eventually ask for one.
Who actually asks for a VPAT
Government agencies and public institutions have required VPATs from vendors for years under Section 508. That expanded further as DOJ’s Title II rule pushed state and local governments toward WCAG 2.1 AA procurement requirements. If your store sells to schools, municipalities, or any public-sector buyer, a VPAT request is common.
Enterprise B2B buyers ask for the same thing increasingly often, even outside government. A large retail partner or wholesale account’s procurement or legal team may require an ACR before finalizing a contract, treating it as standard due diligence the same way they would check insurance or data security certifications.
VPAT versus an audit: different documents, different purpose
An audit, like what a real accessibility audit looks like, is a detailed internal-facing document: every issue, its exact location, and an implementation-ready fix, meant for your developer to act on.
A VPAT or ACR is an external-facing summary document, meant for a procurement team to evaluate quickly. It reports conformance at the criterion level using four ratings: Supports, Partially Supports, Does Not Support, and Not Applicable. It does not tell your developer how to fix anything. It tells a buyer whether your product currently meets the bar they need.
In practice, a completed audit is what makes an accurate VPAT possible. You cannot honestly declare full support on a criterion you have not actually tested.
How to get one
The current version is VPAT 2.5, maintained by the Information Technology Industry Council, and it comes in editions depending on which standard a buyer needs, WCAG, Section 508, EU, or international. Most stores that need one either have an accessibility specialist complete it based on a recent audit, or have it prepared as an add-on to an audit engagement, since accurate testing has to happen first either way.
Example
A kitchenware brand landed a wholesale deal with a large retail chain, whose procurement team requested a VPAT as a standard part of vendor onboarding, the same request made of every supplier regardless of industry. The brand had a recent WCAG 2.1 AA audit on file, which its accessibility specialist used to complete an accurate ACR in a few days rather than starting testing from zero.
Common mistake
Filling out a VPAT from assumptions instead of real testing, or hiring someone to write one without an underlying audit. An inaccurate VPAT is worse than none, since a buyer who later discovers a false conformance claim has grounds to consider the vendor relationship compromised, on top of the original accessibility gap still being unresolved.