Section 508 Compliance: Complete Guide
Federal accessibility law applies to every agency, every contractor, and every vendor selling into federal procurement. The 2018 Refresh aligned it with WCAG 2.0 AA. That standard is still the requirement today.
This guide covers who is covered, what compliance requires technically, what a VPAT is and when you need one, and where enforcement actually lands.
2018
Section 508 Refresh
Aligned to WCAG 2.0 AA
WCAG 2.0 AA
Technical standard required
access-board.gov
Federal + Vendors
Who it covers
section508.gov
VPAT
Procurement document required
For federal vendor sales
What Is Section 508
Section 508 is part of the Rehabilitation Act of 1973, amended in 1998 to require federal agencies to make their electronic and information technology accessible to people with disabilities.
For most of its history, the law used its own technical criteria. The 2018 Refresh changed that. It replaced the original standards with direct alignment to WCAG 2.0 Level AA, the same Web Content Accessibility Guidelines that underpin ADA website compliance.
The result: a single technical standard now runs through both laws. If you build for WCAG 2.0 AA, you are building for Section 508 conformance.
Scope
Who Section 508 Applies To
Section 508 is not limited to government IT teams. It extends to any organization that interacts
with federal systems, receives federal funding, or sells technology to federal buyers.
Technical Standard
The 2018 Refresh: Section 508 and WCAG 2.0 AA
The original Section 508 standards, written in 2000, did not map cleanly to how the web had evolved.
The Access Board recognised this and spent years developing an updated rule.
Published January 18, 2017 and effective January 18, 2018, the Revised Section 508 Standards
replaced the original technical criteria with direct incorporation of WCAG 2.0 Level AA.
This means Section 508 compliance now requires meeting the four WCAG principles.
These principles apply to every page, every component, every update.
Frameworks Compared
Section 508 vs ADA vs WCAG
Three frameworks, one technical standard. Understanding where each begins and ends prevents both gaps and duplication.
| Section 508 | ADA (Title III) | WCAG 2.0 AA | |
|---|---|---|---|
| Who it covers | Federal agencies and vendors | Private businesses open to the public | All — technical standard, not a law |
| Technical standard | WCAG 2.0 AA (2018 Refresh) | WCAG 2.0 AA (DOJ Final Rule 2024) | Is the standard |
| Enforcement body | US Access Board, DOJ, agency IGs | DOJ, private litigants | W3C publishes. Laws adopt. |
| Private right of action | No direct — complaint to agency or DOJ | Yes — plaintiffs can sue directly | N/A |
| Key document | VPAT | No required document | Accessibility Statement |
| Applies to private companies | Only if selling to federal agencies | Yes | Where adopted by law |
Enforcement Reality
What Happens When Agencies and Vendors Fail
Section 508 enforcement is real. The consequences differ depending on whether you are a federal agency or a vendor selling into the federal market.
Federal Procurement
The VPAT: Your Federal Procurement Document
VPAT stands for Voluntary Product Accessibility Template. The word 'voluntary' refers to the disclosure format, not to whether you need one. If your product is in a federal procurement process, a VPAT is required before purchase approval. Federal buyers who do not receive one will request it or disqualify the vendor. There is no federal contract for a vendor who cannot produce one.
Federal agencies are required by Section 508 to evaluate whether the technology they purchase meets accessibility standards before completing a purchase. The VPAT is the document that makes that evaluation possible. It is a structured disclosure of how a product or service conforms to Section 508 requirements, section by section.
When you need a VPAT
Any vendor responding to a federal RFP, listing a product on GSA Advantage, or selling software to a federal agency will be asked for a VPAT. Buyers who do not receive one will disqualify the vendor. In competitive federal procurement, a vendor without a VPAT does not lose on price or features, they are removed from consideration before evaluation begins.
What a VPAT covers
A VPAT maps each Section 508 technical criterion to a conformance level: Supports, Partially Supports, Does Not Support, or Not Applicable. It names known exceptions and states the evaluation methodology.
Accesstive's compliance documentation tools scan against WCAG 2.0 AA criteria and generate structured conformance reports that form the technical basis of a VPAT. See /compliance-reports. Full VPAT generation and ACR structuring at /vpat (activate when live).
| Field | Detail |
|---|---|
| Required by | Federal agencies before any software purchase approval |
| Maps to | Section 508 / WCAG 2.0 AA criteria, criterion by criterion |
| Levels | Supports / Partially Supports / Does Not Support / Not Applicable |
| Includes | Evaluation methodology, known exceptions, contact for accessibility issues |
| Source | section508.gov |
The Full Platform
The Platform That Makes the VPAT Possible.
Every step feeds the next. Install, scan, fix, and prove. The VPAT is the output of the whole system.
01 Install
Accessibility Toolkit
User controls from day one.
Every visitor.
02 Find
Scanner
Every WCAG issue across your
full domain.
03 FIX
Fix Hub
Assign. Fix with AI.
Verify. Close.
04 PROVE
Audit Report
Audit Report
The Ongoing Obligation
Continuous Compliance vs One-Time Audit
Section 508 compliance is not an audit you complete and file away. Federal procurement contracts require ongoing conformance. New content, new features, and third-party integrations all introduce new accessibility risks.
The 2018 Refresh did not change this reality. It strengthened it by aligning Section 508 with a living technical standard. WCAG 2.0 AA criteria apply to every page, every component, every update.
Organisations that treat Section 508 as a point-in-time certificate find themselves cycling through the same audit findings. The ones that build continuous scanning and documented remediation into their workflow are the ones who can produce a current VPAT when procurement asks. The ones who don't lose contracts to vendors who can.
Accesstive
How Accesstive Supports Section 508 Compliance
Accesstive's Find, Fix, Prove approach maps directly to what Section 508 requires: continuous scanning,
real remediation, and structured documentation for procurement.
Documentation
Accessibility Statement
Federal agencies and federally funded organisations are required to publish accessible contact information for accessibility-related feedback and complaints. For many agencies, this appears as a formal Accessibility Statement.
A published Accessibility Statement is not a Section 508 statutory requirement for vendors. However, federal procurement officers increasingly treat its absence as a signal of incomplete compliance practice. A VPAT documents your current state. An Accessibility Statement shows you maintain it.
An Accessibility Statement documents conformance status, known limitations, the evaluation methodology, and a contact point for accessibility concerns. The Accesstive Accessibility Statement Generator produces a compliant statement in minutes. Link: /statement-generator
| Component | Detail |
|---|---|
| Conformance status | Current level of WCAG 2.0 AA conformance (Fully / Partially / Not) |
| Known limitations | Specific content or features with known accessibility gaps |
| Evaluation method | How conformance was assessed (automated, manual, user testing) |
| Contact point | How users can report accessibility issues and receive assistance |
| Last updated | Date the statement was last reviewed and updated |
FAQs
Section 508 applies directly to federal agencies and organisations receiving federal funding. It also applies to private companies that sell to or contract with federal agencies. If your product is in a federal procurement process, a VPAT documenting Section 508 conformance will be required before purchase approval.
VPAT stands for Voluntary Product Accessibility Template. It is a structured document that discloses how a product or service conforms to Section 508 technical criteria. Federal buyers require a VPAT before approving software or technology purchases. Despite the word "voluntary" in the name, a VPAT is effectively mandatory for any vendor in federal procurement. Source: section508.gov.
The ADA applies to private businesses open to the public. Section 508 applies to federal agencies and their vendors. Both now use WCAG 2.0 AA as the technical standard. The key practical difference: ADA compliance can be enforced through private lawsuits. Section 508 complaints go to the agency or DOJ. Section 508 procurement also requires formal VPAT documentation that ADA compliance does not.
Vendors who cannot demonstrate Section 508 conformance risk losing federal contract eligibility. Federal buyers are required to verify conformance before completing purchases. Persistent failures can result in contract termination or disqualification from future procurement. Source: access-board.gov.
Since the 2018 Refresh, WCAG 2.0 AA is the technical standard that Section 508 requires. Meeting WCAG 2.0 AA means meeting Section 508's technical criteria. WCAG 2.1 and 2.2 contain additional criteria not yet required by Section 508, but meeting them demonstrates stronger conformance. Source: access-board.gov/ict.
Your site's Section 508 conformance level is measurable.
The scan identifies where your platform fails WCAG 2.0 AA, the same standard a federal procurement officer measures against. Two minutes. No account required.