Guide · US federal law
Section 508: accessibility,enforced through the contract.
Section 508 governs the technology the US federal government builds and buys. It rarely reaches you through a courtroom — it reaches you through procurement. If you sell to a federal agency, a buyer will ask for a VPAT before the purchase clears, and that document is where unprepared vendors lose the deal. This guide explains who is covered, which WCAG version applies, and how 508 differs from the ADA.
Last updated · Checked against the U.S. Access Board's Revised 508 Standards, Section508.gov, and the FY2025 GSA governmentwide assessment. Reviewed by the FlexAccesses accessibility team.
This is educational, not legal advice
FlexAccesses is not a law firm. Whether Section 508, Section 504, or the ADA applies to your organisation — and what a specific procurement clause requires — depends on facts we can't assess for you. Use this to ask your counsel and your contracting officer sharper questions.
What Section 508 actually is
Section 508 is part of the Rehabilitation Act of 1973, added by Congress in 1998 and codified at 29 U.S.C. § 794d. It requires US federal agencies to make the information and communication technology (ICT) they develop, procure, maintain, or use accessible to people with disabilities — both federal employees and members of the public. In plain terms: the technology the government builds and buys has to work for everyone.
The technical rules aren't written by the agencies themselves. The U.S. Access Board develops the standards, which were last overhauled in the 2017 "508 Refresh" — the Revised 508 Standards — that agencies and contractors have had to follow since January 2018. The General Services Administration (GSA) then supports agencies and reports governmentwide conformance to Congress each year.
Who it covers — and how it reaches private companies
Directly, Section 508 binds federal agencies, not private businesses. But it has a long reach through one channel: procurement. When an agency buys software, a website, a mobile app, a document, or a hardware device, that product has to meet the 508 standards — so the requirement flows down to the vendor as a contract term. If you sell ICT to the federal government, you are inside Section 508's scope, wherever your company is based.
508 is not the law for ordinary private websites
A frequent mix-up: if you run a private-sector website with no federal customers, Section 508 is not your obligation — the ADA is. 508 is specifically about federal ICT and federal procurement. The related Section 504 of the same Rehabilitation Act covers recipients of federal funding (many universities, hospitals and nonprofits), which is a different trigger again. We separate all three below.
Which WCAG version Section 508 references
The Revised 508 Standards incorporate WCAG 2.0 Level AA by reference for web content and electronic documents. Of the major accessibility regimes, this is the oldest baseline — the ADA's Title II rule points to 2.1 AA, the EAA works through EN 301 549 (also 2.1 AA today), and 508 still sits on 2.0 AA. That sounds like a disadvantage, but it's the opposite for planning: because each newer WCAG version is backwards compatible, a site built to 2.2 AA already satisfies the 2.0 AA that 508 requires.
Many agencies and vendors already test against WCAG 2.1 or 2.2 AA in practice; doing so exceeds the 508 baseline and is entirely acceptable. What is not acceptable is overstating conformance. Whatever version you test to, a VPAT that claims more than your testing supports is a contract risk — accuracy matters more than the version number.
How Section 508 is actually enforced
This is where 508 differs most from the ADA and EAA. There is no stream of consumer lawsuits and no per-violation fine schedule. Enforcement runs on two tracks — and for a vendor, the second one is the one that bites.
For agencies: Section 508 complaints follow the Section 504 complaint procedures, agency Inspector General audits and GAO reports surface failures, and the DOJ has brought enforcement actions over persistent problems, including inaccessible employee-facing systems.
For vendors, enforcement is the purchase order. A federal buyer has to verify accessibility conformance before the purchase clears. That verification step — not a courtroom — is where products get rejected. The path looks like this:
Agency needs ICT
A federal buyer starts to procure software, a site, an app or a device.
Buyer asks for a VPAT
Conformance documentation is required as part of the acquisition.
Conformance verified
The buyer checks the VPAT against the 508 standards. Gaps and inaccuracies show here.
Purchase — or rejection
An adequate report clears the sale. A missing or weak one can lose it.
This is not hypothetical: the GSA has removed products from federal purchasing schedules for missing or inaccurate VPATs, and the FY2025 governmentwide assessment reported a low average conformance score across agencies — evidence that buyers are measuring, and that the bar is real.
What a VPAT actually is
A VPAT — Voluntary Product Accessibility Template — is the standard form a vendor fills in to describe, criterion by criterion, how its product conforms to the 508 standards. Once completed, the filled-in document is called an Accessibility Conformance Report (ACR). In everyday use people say "VPAT" for both. It is the single artefact a federal contracting officer will ask for, and it is only as good as the testing behind it.
The uncomfortable part for our own industry
An accessibility widget cannot produce a truthful VPAT. A VPAT is a claim about your product's real conformance, criterion by criterion, backed by testing — and an overlay doesn't change the underlying code a screen reader meets. Multiple federal agencies have rejected overlay-based solutions, the U.S. Access Board does not recognise them, and in 2025 the FTC required an overlay vendor to pay $1 million over claims that its product made websites WCAG compliant. Fill in your VPAT from real testing, disclose gaps honestly, and show a remediation plan; an accurate report with known gaps beats an inflated clean one.
Section 508 vs the ADA vs Section 504
These three get blurred together constantly, and the difference decides which rules you're actually under. Here is the clean version.
Section 508
- Covers
- Federal agencies + the vendors who sell ICT to them
- Standard
- WCAG 2.0 AA
- Enforced by
- Procurement, VPAT checks, Section 504 procedures
ADA
- Covers
- Private businesses open to the public (III) + state/local government (II)
- Standard
- WCAG 2.1 AA (Title II rule; 2.1 AA de facto for III)
- Enforced by
- Lawsuits and demand letters
Section 504
- Covers
- Recipients of federal funding — many universities, hospitals, nonprofits
- Standard
- WCAG 2.1 AA under the 2024 HHS rule (first date 11 May 2026)
- Enforced by
- Funding conditions, DOJ, private lawsuits
Where to start
If you sell to the federal government — or expect to — the goal is a VPAT you can stand behind. That starts, as always, with knowing your real state against WCAG AA, and it ends with honest documentation you can hand a contracting officer.
Scan against WCAG AA
A free scan gives you a dated baseline. Test to 2.1/2.2 AA — it covers the 2.0 AA that 508 requires.
Fix, then re-test
Close the clear failures — contrast, labels, keyboard, alt text — before you write anything down.
Complete the VPAT honestly
Report real results criterion by criterion. Disclose gaps and pair them with a remediation plan.
Keep it current
Re-scan on each release so the VPAT you hand over reflects the product you're actually shipping.
Common questions
What is Section 508?
It is part of the Rehabilitation Act of 1973, added by Congress in 1998 (29 U.S.C. § 794d). It requires US federal agencies to make the ICT they develop, procure, maintain or use accessible to people with disabilities. The U.S. Access Board sets the standards; the GSA reports conformance to Congress.
Which WCAG version does Section 508 require?
WCAG 2.0 Level AA, incorporated by reference in the Revised 508 Standards effective January 2018 — the oldest baseline of the major regimes. Testing to 2.1 or 2.2 AA exceeds it and is fine; building to 2.2 AA satisfies 508 automatically because WCAG is backwards compatible.
Does Section 508 apply to private companies?
Not directly — it binds federal agencies. But it reaches private companies through procurement: any vendor selling ICT to the federal government must demonstrate conformance, usually via a VPAT. If you run an ordinary private website with no federal customers, your obligation is the ADA, not 508.
What is a VPAT?
A Voluntary Product Accessibility Template — the standard form a vendor completes to describe, criterion by criterion, how a product conforms to the 508 standards. The filled-in version is an Accessibility Conformance Report (ACR). Federal buyers request it before purchase; an inaccurate or missing one can disqualify the product.
How is Section 508 enforced?
For agencies, 508 complaints follow the Section 504 procedures, and DOJ has brought enforcement actions. For vendors, the real enforcement is procurement: a buyer verifies conformance before purchase, and a product without an adequate VPAT can be rejected — GSA has pulled products from purchasing schedules for missing or inaccurate ones.
How is Section 508 different from the ADA?
Section 508 covers federal agencies and their vendors and references WCAG 2.0 AA, enforced through procurement. The ADA covers private businesses open to the public and state/local governments and references WCAG 2.1 AA, enforced through lawsuits. Section 504 — same Act as 508 — covers recipients of federal funding. Different triggers, different standards, easy to confuse.
Sources. U.S. Access Board — Revised 508 Standards and 255 Guidelines (opens in a new tab); Section508.gov — laws and policies (opens in a new tab) and the FY2025 Governmentwide Section 508 Assessment; Congressional Research Service overview of Section 508 (29 U.S.C. § 794d); FTC case 2223156, final order April 2025 (opens in a new tab); W3C WAI, WCAG 2 Overview (opens in a new tab). Standards, procurement rules and figures change; verify current requirements against the primary source and any applicable contract clause. Educational only, not legal advice.
Selling to the government?Start with the scan.
A free scan against WCAG 2.1/2.2 AA — which covers the 2.0 AA Section 508 requires — with each finding labelled by who fixes it. The honest first step toward a VPAT you can defend.