Somewhere right now, a sales team is watching a deal they spent six months building slip away, not because of price, not because of features, but because a procurement officer asked one question they could not answer: “Can you send us your VPAT?”

If you have ever been on the receiving end of that question and quietly opened a search tab, you are in the right place. And here is the twist that confuses almost everyone: the buyer who asked for a VPAT almost certainly wants an ACR. The two get used interchangeably in every RFP and procurement meeting in the country, and knowing the difference, VPAT vs ACR, is the fastest way to sound like you have done this before. Let us untangle it in plain English.

The 30-second answer

A VPAT (Voluntary Product Accessibility Template) is a blank form. It is a free, standardized template published by the Information Technology Industry Council (ITI) that lists accessibility requirements line by line and leaves space for you to say how your product measures up against each one.

An ACR (Accessibility Conformance Report) is what you get when someone actually tests the product and fills that form out. It is the finished document: the one with real answers in it.

The cleanest way to remember it: the VPAT is the blank tax form; the ACR is your completed return. Nobody wants to see your blank tax form. When a buyer says “send us your VPAT,” what they want is the completed version, your ACR. The habit of calling the finished report “a VPAT” is so widespread that even accessibility professionals do it, so you will hear both words for the same document. Now you know which is which.

Why buyers ask for one in the first place

It starts with Section 508, the law that requires federal agencies to buy technology that people with disabilities can use. Before an agency signs a contract for software, a website platform, or almost any digital product, someone in procurement has to evaluate whether it is accessible. They cannot test every product themselves, so they ask each vendor for an ACR and compare.

That practice spread far beyond Washington. State governments, public universities, school districts, hospital systems, and increasingly large private companies all ask for the same document, because it answers a question every buyer has: if we build our service on your product, are we taking on your accessibility problems? A missing or shoddy report reads as “yes, you are”, and in a close competition, that is often the whole ballgame. If you sell to government at any level, our team offers VPAT and ACR preparation services built around exactly this moment.

What is actually inside an ACR

Open a finished ACR and you will find a long table. Each row is one accessibility requirement, things like “all functions work from a keyboard” or “text has sufficient color contrast”, drawn from WCAG, the widely used accessibility standard, and from Section 508. For each row, the report gives one of a few plain verdicts:

• • Supports — the product meets this requirement.
  • Partially Supports — some parts meet it, some do not.
  • Does Not Support — it does not meet this requirement.
  • Not Applicable — this requirement does not apply (for example, video captioning rules for a product with no video).

Next to each verdict is a remarks column, and this is the part experienced buyers read first. “Partially Supports, date-picker component cannot be operated by keyboard; fix scheduled for Q1” tells a buyer you know your product and you are honest about it. A report that just says “Supports” two hundred times in a row tells them something too, and not what the vendor hoped.

One more detail worth knowing: the template comes in several editions, one built around Section 508, one for the European standard, one for WCAG alone, and an international edition that covers all of them. Your buyer’s location and market decide which edition you need; a vendor selling to U.S. government typically uses the 508 or international edition.

Who actually needs one

You need an ACR if you sell software or digital services to the government, federal, state, or local. It will be requested in RFPs, and “we don’t have one” is often a silent disqualification.

You need one if you sell to universities, school districts, or healthcare systems. These buyers face their own accessibility obligations, and they push the requirement down to every vendor they use.

You should ask for one if you are the buyer, a city clerk choosing an agenda platform, an IT director choosing a payment portal. The tools your vendors provide on your behalf are your responsibility, and an ACR is how you check before you sign.

And an increasing number of companies produce one simply as proof, a credible, standardized way to say “we take accessibility seriously” that carries more weight than a marketing page, because it names the things that are not perfect yet.

How a trustworthy ACR gets made

Here is the part that separates a real report from an expensive piece of fiction: an ACR is only as good as the testing behind it. The honest process looks like this.

• • 1. Test the product for real. Automated scans plus hands-on testing — keyboard-only navigation, screen readers, contrast checks, forms. Automated tools alone find only a fraction of the issues, which is why a real evaluation looks a lot like the audits described in our website accessibility audit cost guide.
    2. Record what was found, exactly. Every requirement gets its verdict and a specific remark. The goal is accuracy, not flattery.
    3. Fill out the right edition of the template and note the testing methods, the product version, and the date — details reviewers check.
    4. Keep it alive. Software changes with every release, so a serious ACR gets refreshed after major updates or roughly once a year. A report dated three years ago describes a product that no longer exists.

Red flags, whether you are writing one or reading one: a report with no remarks, a report where everything “Supports,” a report with no date or version number, and a report the vendor filled out themselves without any actual testing. Procurement reviewers see hundreds of these documents; the hollow ones are easier to spot than most vendors think. And a word of caution in the other direction, too, an ACR that overstates conformance is not just useless, it is a liability, because the buyer relied on it in writing.

The strategic upside most vendors miss

Most companies treat the ACR as paperwork, a box to tick after a buyer asks. The smarter ones flip it. Producing an ACR forces a genuine accessibility evaluation of your product, which surfaces the barriers you would eventually be forced to fix anyway, on a deadline, under contract pressure, at the worst possible time. Doing the work early means the report becomes a sales asset instead of a scramble: while competitors ask for two more weeks, you attach a current, honest ACR to the proposal the same day. Buyers notice. And if the testing reveals real problems, that is not a reason to skip the report, it is the start of a fix-it plan, the same remediation process we walk through for websites.

Frequently asked questions

Is a VPAT legally required?

No law says “every company must have a VPAT”, the V stands for voluntary. But federal buyers are required to consider accessibility when they purchase technology, and the ACR is the standard way vendors demonstrate it. In practice: not legally required, practically unavoidable if you want government contracts.

Can we fill out the VPAT ourselves?

You can, the template is free and nothing stops you. The catch is that filling it out accurately requires real accessibility testing skills: screen reader use, keyboard testing, WCAG knowledge. Self-completed reports without that testing tend to be wrong in ways reviewers recognize instantly, which can cost more credibility than having no report at all. Most vendors have an experienced third party test the product and prepare the report.

How long does an ACR take, and how long is it good for?

For a typical web application, expect the testing and report together to take a few weeks, depending on the product’s size and complexity. Treat the finished report as current for about a year, or until your next major release — whichever comes first. Buyers routinely check the date.

The bottom line

VPAT is the blank form; ACR is the finished report; buyers say the first and mean the second. If a procurement officer is waiting on yours right now — or you want one ready before the next RFP lands our VPAT and ACR service tests your product by hand and prepares an accurate, current report you can attach with confidence. You can see how we approach accessibility work in our web accessibility workspace, current rates are on the pricing page, and if you are not sure where your product stands, start with a free audit.