VPAT red flags: nine signs a report needs a follow-up

Most vendor VPATs are not dishonest. Many are incomplete, out of date, or written to answer a different question from the one your solicitation asked. The VPAT red flags below are the patterns that should make you pause and send a written question before award. None of them proves the product is inaccessible. Each of them means the report, as written, does not let you tell.

If you want the full walk-through of how to read a report from top to bottom, start with how to read a VPAT. This is the shorter list of things that should stop you.

1. The edition does not match the solicitation

VPAT 2.5 is published in four editions: WCAG, Revised Section 508, EN 301 549 and International. If you asked for WCAG 2.1 Level AA and received a Section 508 edition, the report is answering a question about WCAG 2.0, because the Revised 508 Standards incorporate WCAG 2.0 Level AA, and the 508 edition's tables list WCAG 2.0 criteria only. The 2.1 additions, such as 1.4.10 Reflow and 1.4.11 Non-text Contrast, are simply not there.

The same applies in reverse. A WCAG 2.1 report does not tell you about WCAG 2.2 criteria if your solicitation names 2.2. Our note on which edition to require covers the mismatches in more detail.

Ask: "Please provide a report on the [named] edition covering the standard in section X of the solicitation."

2. No product version, or the wrong one

ITI's template instructions require the report to name the product, "including product version identifier if available." A report titled only with the product name, or one that names version 4 when you are buying version 7, describes software you may not be buying.

For hosted software without numbered versions, a release name or the date the evaluated build was deployed is a reasonable substitute. Nothing at all is not.

3. No date, or an old one

The template requires a report date, at minimum month and year. An undated report cannot be matched to anything. A dated one that is several years old, for a product that ships updates every month, tells you about a product that no longer exists in that form.

ITI also recommends that a revised report change its date and explain the revision in the Notes section. A report with a recent date but no indication of what changed since the last one is worth a question.

4. The evaluation methods section is empty or generic

"Evaluation Methods Used" is one of the required sections. The template's best practices suggest describing testing with assistive technologies, manual and automated tools, and any published test method followed.

Phrases such as "the product was evaluated using industry-standard tools" do not meet that bar. They tell you nothing about whether anyone operated the product with a keyboard or a screen reader. A report that rests on an automated scan alone is weaker evidence, because automated tools cannot judge many criteria, such as whether alt text is accurate or whether focus order is logical.

Ask: "Which assistive technologies, browsers and test methods were used, and was testing manual, automated, or both?"

5. Criteria are missing

When a report covers a WCAG level, ITI's instructions say all criteria for that level must be answered. Level A and AA together contain 50 success criteria in WCAG 2.1. A WCAG 2.1 AA report with 41 rows has nine criteria unaccounted for.

This is the hardest flag to notice because absence is invisible. Count the rows against the standard. Missing is not the same as supported.

6. Blank remarks beside anything other than Supports

The template's instructions are explicit. When a criterion is marked Partially Supports or Does Not Support, the remarks should identify the functions or features with issues and how they fall short. When a criterion does not apply, the remarks should explain why.

A Partially Supports with an empty remarks cell tells you something fails and declines to say what. Our note on Supports vs Partially Supports explains why that value carries almost no information on its own.

7. Everything is marked Supports

A complex product with dozens of screens, forms, charts and uploaded documents that reports full support on every criterion is possible. It is also unusual enough to deserve a question, especially when the remarks column is blank or repeats the same sentence on every row.

The question is not an accusation. It is a request for the evidence:

• "Which assistive technology was the product tested with for 4.1.2 Name, Role, Value?"
• "How were data visualizations tested against 1.1.1 Non-text Content and 1.4.11 Non-text Contrast?"
• "Were PDFs or other documents the product generates included in scope?"

A vendor who tested thoroughly can usually answer these in a paragraph.

8. Not Applicable where the criterion plainly applies

Not Applicable is legitimate when a product has no content of the relevant kind. A product with no audio or video can reasonably mark the 1.2.x media criteria Not Applicable, with a sentence saying so.

The flag is N/A on criteria that almost every interactive product touches: 2.1.1 Keyboard, 2.4.7 Focus Visible, 3.3.2 Labels or Instructions, 4.1.2 Name, Role, Value. If the product has a login form, it has labels.

Note also that ITI's instructions allow "Supports" where there is no content to which a WCAG criterion applies, following WCAG's own conformance guidance. So some reports will use Supports where others use N/A. Either is acceptable if the remarks explain it. Neither is acceptable without explanation.

9. The document is not itself accessible, or not really a VPAT

ITI requires that the final conformance report be accessible. A scanned image of a table, or a PDF with no tagging, is a small but telling signal about how seriously the vendor takes the subject.

Separately, watch for documents that use the name without the structure: a one-page "accessibility statement" or marketing sheet labelled VPAT, with no conformance table. That is a statement of intent, not a conformance report. And anything presented as an accessibility "certificate" should be treated with care. There is no certification body for WCAG or Section 508 conformance.

A note on what the flags are for

A report with red flags is not automatically disqualifying, and one without them is not automatically trustworthy. The flags tell you where the report has stopped being evidence and become assertion. That is where your written questions go.

For each flag, the useful response is one of three things from the vendor:

• the evidence behind the stated conformance level,
• a corrected or more complete report, or
• a remediation commitment with a target release and date.

Keep the questions and the answers with the procurement file. Under the ADA Title II web rule, whose compliance dates fall in April 2027 and April 2028, a public entity's obligation covers web content and mobile apps it provides "directly or through contractual, licensing, or other arrangements". The record of what you asked a vendor, and what they told you, is part of how you show you took that seriously.

If you need a reference for the standards themselves, our page on what a VPAT is covers the four editions and the conformance terms.

---

Sources: ITI VPAT 2.5Rev template instructions (WCAG and Revised 508 editions); W3C WCAG 2.1; 28 CFR 35.200 (the DOJ's Title II web rule). This is general guidance, not legal advice.

GOVvpat reviews the conformance reports your vendors submit, flags these issues against the standard your solicitation names, and returns a dated assessment for the file. Request a quote.