Selling to US government?
Accessibility is in the contract.
Federal agencies, state governments and public universities must buy accessible software, so they ask their vendors to prove it. Here is what Section 508 and the ADA require, the current deadlines, and what that means for a SaaS company. Not legal advice.
Last updated Published by TryTrustableNot legal advice
Section 508 requires US federal agencies to buy and use accessible technology, and the Revised 508 Standards apply WCAG 2.0 Level AA to it, so federal buyers ask vendors for an Accessibility Conformance Report. The ADA Title II rule of April 2024 requires state and local governments, including public universities, to meet WCAG 2.1 Level AA, now from 26 April 2027 (50,000 people or more) or 26 April 2028 (smaller entities), after a 2026 extension. Title III has no web regulation, but courts apply it to business websites. For a SaaS vendor, all three end in the same request: WCAG AA and an honest ACR.
What is Section 508?
Section 508 of the Rehabilitation Act of 1973 requires federal agencies to make the information and communication technology (ICT) they develop, procure, maintain or use accessible to people with disabilities, both employees and members of the public. The US Access Board issues the standards; the current Revised 508 Standards were issued in January 2017 and have applied since 18 January 2018.
The Revised 508 Standards incorporate WCAG 2.0 by reference: web and non-web electronic content and software must conform to WCAG 2.0 Level A and AA. They have not been updated to WCAG 2.1 or 2.2, so a federal ACR reports against 2.0 (including 4.1.1 Parsing, which WCAG 2.2 removed).
Does Section 508 apply to private companies?
Not directly. Section 508 binds federal agencies. But because agencies must procure accessible ICT, the obligation reaches vendors through procurement: solicitations ask for an Accessibility Conformance Report, agencies evaluate it, and contracts can require conformance. GSA's Section508.gov publishes guidance and an ACR editor that agencies use. If you sell to federal agencies, directly or through a reseller, expect to provide an ACR on the VPAT 508 or INT edition.
Section 508 vs ADA: what is the difference?
| Rule | Who it binds | Technical standard | How it reaches a SaaS vendor |
|---|---|---|---|
| Section 508 (Rehabilitation Act) | US federal agencies | Revised 508 Standards: WCAG 2.0 Level A and AA | Agencies must procure accessible ICT, so solicitations ask for an ACR and may evaluate it |
| ADA Title II web rule (28 CFR part 35, subpart H) | State and local governments, including public universities and community colleges | WCAG 2.1 Level AA | Covers services provided through contractors, so agencies pass the requirement into contracts |
| ADA Title III | Businesses open to the public (places of public accommodation) | No regulation; DOJ points to WCAG and the 508 Standards as guidance | Through customer contracts and the risk of complaints and lawsuits |
A summary to plan with, not legal advice.
The ADA Title II web accessibility rule
In April 2024 the Department of Justice published a rule under Title II of the Americans with Disabilities Act requiring state and local governments to make their web content and mobile apps conform to WCAG 2.1 Level AA. It covers public colleges and universities, public schools, courts, transit agencies and other public entities. It also covers services they provide through contractors: if a city contracts a company to run its parking payment app, that app must conform.
Title II compliance dates after the 2026 extension
On 20 April 2026 the Department published an interim final rule extending the compliance dates by about a year.
| Entity | Original compliance date | Current compliance date |
|---|---|---|
| State and local governments with a total population of 50,000 or more | 24 April 2026 | 26 April 2027 |
| Those with fewer than 50,000 people | 26 April 2027 | 26 April 2028 |
| Special district governments (for example school or transit districts) | 26 April 2027 | 26 April 2028 |
Final rule published 24 April 2024 (FR Doc. 2024-07758); dates extended by an interim final rule published 20 April 2026 (FR Doc. 2026-07663). Check ada.gov for any later change.
The rule has five exceptions: archived web content, preexisting conventional electronic documents, content posted by third parties, individualized password-protected documents, and preexisting social media posts. They are narrow and come with conditions; the product a student or resident uses every day is unlikely to fit them.
ADA Title III and websites
Title III covers businesses that are places of public accommodation. The Department of Justice has no regulation setting technical standards for their websites. Its March 2022 guidance says businesses have flexibility in how they comply with the ADA's requirements of nondiscrimination and effective communication, and that WCAG and the Section 508 Standards provide helpful guidance.
Without a regulation, the law is shaped by court decisions, and federal courts do not agree on every point, including whether a business that exists only online is a place of public accommodation. What is consistent is that WCAG 2.x Level AA is the yardstick plaintiffs, courts and settlements refer to. For a B2B SaaS company the risk usually arrives through customers: a retailer, bank or university that is covered asks you to conform because your interface is part of its service.
What this means for a SaaS vendor
Whatever the rule behind it, the request is the same. Build to WCAG 2.2 Level AA, which meets the 2.0 AA and 2.1 AA requirements the US rules cite. Document it in an ACR. Be ready for these:
| What buyers ask | What to have ready |
|---|---|
| "Send your VPAT" or "ACR" | A dated ACR on the 508 or INT edition, with evaluation methods |
| Conformance to WCAG 2.1 AA (state, local, universities) | An audit against WCAG 2.2 AA, which covers 2.1 AA |
| Contract clause on accessibility | Know what you can commit to; offer a remediation plan for known gaps |
| Accessibility roadmap | Dated fixes for Partially Supports and Does Not Support items |
| Who to contact about barriers | A named contact and a way for users to report issues |
| Testing during evaluation | Expect the buyer's team to test core workflows with a screen reader |
Public universities are a good example of the timing: they are covered by Title II, and the large ones face a 26 April 2027 compliance date, so expect WCAG 2.1 AA questions and clauses at your next renewal with them.
How to prepare, step by step
- Audit your product against WCAG 2.2 AA with automated, manual and screen reader testing (see the WCAG 2.2 checklist).
- Fix the barriers in sign-in, navigation and your core workflow first.
- Write the ACR on the official ITI template, choosing the edition your buyers need.
- Publish an accessibility page with a contact for reporting barriers.
- Add accessibility checks to design review and CI so the next release does not undo the work.
- Re-test and re-issue the ACR on major releases and at least yearly.
Where TryTrustable fits
TryTrustable scans your public pages against the WCAG 2.2 Level A and AA rules with axe-core, the open-source accessibility engine, and maps each failure to its success criterion with the element and how to fix it. It then gives your team a worksheet of all 55 A and AA criteria to set the conformance level and remarks for each, and issues a sealed Accessibility Conformance Report based on the VPAT® 2.5 WCAG edition. Automated rules find only some failures, so the product never marks a criterion "Supports" by itself: that needs manual testing with a keyboard, a screen reader and zoom, by your team or a specialist. It does not yet scan pages behind a login or produce the 508, EU or INT editions. Government and university buyers also run security, privacy and reliability reviews, and that is where we help: SOC 2 and ISO 27001 evidence, a trust center, vendor records and performance evidence. See the enterprise readiness guide.
The things people ask us
Which WCAG version does Section 508 require?
WCAG 2.0 Level A and AA. The Revised 508 Standards, in effect since 18 January 2018, incorporate WCAG 2.0 by reference and have not been updated to 2.1 or 2.2.
When is the ADA Title II web rule deadline?
After the interim final rule of 20 April 2026: 26 April 2027 for state and local governments with a population of 50,000 or more, and 26 April 2028 for smaller ones and special district governments.
Does the ADA Title II rule apply to vendors?
It binds state and local governments, but it covers the services they provide through contractors, so governments and public universities pass WCAG 2.1 AA requirements to vendors in contracts.
Is there an ADA website regulation for private businesses?
No. The DOJ has no Title III regulation with technical standards for websites. Its 2022 guidance points to WCAG and the Section 508 Standards as helpful guidance, and courts commonly use WCAG AA as the benchmark.
Do I need a VPAT to sell to the federal government?
Agencies routinely ask for an Accessibility Conformance Report, usually on the VPAT 508 or INT edition, and may evaluate it in the award.
Does TryTrustable test Section 508 conformance?
Partly. It scans against WCAG 2.2 A and AA, which covers the WCAG 2.0 AA criteria the Revised 508 Standards use for web content except 4.1.1 Parsing (removed in WCAG 2.2), and produces a WCAG-edition ACR your team completes. It does not produce the 508 edition with its other chapters.
Government buyers check more than accessibility.
Thirty minutes on the security, privacy and reliability evidence public-sector and university procurement asks for, and how to share it from a trust center.