WCAG 2.2 Level AA,
checked the way buyers check it.
Enterprise, university and public-sector buyers ask whether your product meets WCAG 2.2 AA, usually in a VPAT. This guide covers what changed in 2.2, what AA means for a SaaS web app, and how to test it properly. A practical guide, not legal advice.
Last updated Published by TryTrustableNot legal advice
WCAG 2.2 is the current version of the W3C Web Content Accessibility Guidelines. It became a W3C Recommendation on 5 October 2023 (the current edition is dated 12 December 2024). It adds nine success criteria to WCAG 2.1, six of them at Level A or AA, covering focus visibility, dragging, target size, consistent help, redundant entry and accessible authentication, and it removes 4.1.1 Parsing. Level AA is the target most buyers and laws point to. Content that meets WCAG 2.2 AA also meets 2.1 AA and 2.0 AA.
What is WCAG 2.2?
The Web Content Accessibility Guidelines (WCAG) are the W3C's standard for making web content usable by people with disabilities: blind and low-vision users with screen readers and magnifiers, people who cannot use a mouse, people who are deaf or hard of hearing, and people with cognitive and learning disabilities. WCAG 2.2 was published as a W3C Recommendation on 5 October 2023, and the current edition of the Recommendation is dated 12 December 2024.
WCAG is organised under four principles (perceivable, operable, understandable, robust), each broken into guidelines and testable success criteria at Level A, AA or AAA. WCAG 2.2 is backwards compatible: if you meet 2.2 AA, you also meet 2.1 AA and 2.0 AA, apart from the reporting point on 4.1.1 below.
What is new in WCAG 2.2?
Nine success criteria were added. Six are at Level A or AA, so they matter for procurement; three are AAA.
| Criterion | Level | What it asks, in short | Where SaaS apps fail it |
|---|---|---|---|
| 2.4.11 Focus Not Obscured (Minimum) | AA | A focused element is not entirely hidden by other content | Sticky headers, cookie banners and chat widgets covering the focused field |
| 2.4.12 Focus Not Obscured (Enhanced) | AAA | No part of the focused element is hidden | As above |
| 2.4.13 Focus Appearance | AAA | The focus indicator is large enough and has enough contrast | Faint or removed outlines |
| 2.5.7 Dragging Movements | AA | Anything done by dragging can also be done with a single pointer, without dragging | Kanban boards, sliders, reorderable lists, file drop zones with no button |
| 2.5.8 Target Size (Minimum) | AA | Pointer targets are at least 24 by 24 CSS pixels, or have enough spacing (with exceptions) | Icon buttons in tables, close icons, dense toolbars |
| 3.2.6 Consistent Help | A | Help mechanisms that repeat across pages appear in the same relative order | A help link or chat that moves between pages |
| 3.3.7 Redundant Entry | A | Information already entered in the same process is filled in or selectable, not asked again | Multi-step onboarding and checkout asking for the same address twice |
| 3.3.8 Accessible Authentication (Minimum) | AA | No cognitive function test (like remembering or transcribing) to log in, unless an alternative or aid is offered | Blocking paste in password fields, puzzle CAPTCHAs with no alternative |
| 3.3.9 Accessible Authentication (Enhanced) | AAA | As above, without the object and personal-content exceptions | As above |
Source: W3C WCAG 2.2 Recommendation. Summaries are ours; read the normative text and the W3C Understanding documents.
Why was 4.1.1 Parsing removed?
WCAG 2.2 removes success criterion 4.1.1 Parsing, which required well-formed markup. Browsers and assistive technologies now handle markup errors consistently, and the problems that still matter are covered by other criteria such as 4.1.2 Name, Role, Value. The W3C notes that anyone required by policy to follow an earlier version (for example Section 508, which references WCAG 2.0) may still need to test and report 4.1.1.
WCAG levels: A vs AA vs AAA
| Level | What it is | Who asks for it |
|---|---|---|
| A | The minimum: without it, some users cannot use the content at all | Never enough on its own for procurement |
| AA | A + AA criteria: the practical target | US federal (Section 508 uses WCAG 2.0 AA), ADA Title II rule (WCAG 2.1 AA), UK public sector (WCAG 2.2 AA), EN 301 549 in the EU, most enterprise contracts |
| AAA | Highest level; W3C does not recommend requiring it for entire sites, as some content cannot meet it | Rarely required; pick individual AAA criteria where they help your users |
When a buyer says "WCAG compliant" they almost always mean Level AA. Ask which version: US federal contracts still cite 2.0 through Section 508, the ADA Title II rule cites 2.1, and the UK public sector and the latest EN 301 549 (V4.1.1, September 2026) align with 2.2. Building to 2.2 AA answers all of them.
WCAG 2.2 AA checklist for a SaaS web app
| Area | Check | Key criteria |
|---|---|---|
| Keyboard | Every action works with a keyboard alone, in a logical order, with no keyboard trap | 2.1.1, 2.1.2, 2.4.3 |
| Focus | Focus is always visible and never hidden behind sticky bars, banners or chat widgets | 2.4.7, 2.4.11 |
| Names and roles | Buttons, links, inputs and custom widgets expose a name, role and state to assistive technology | 4.1.2, 1.3.1 |
| Forms | Every field has a visible label; errors are identified in text with a suggestion; nothing is asked twice | 3.3.1, 3.3.2, 3.3.3, 3.3.7 |
| Sign-in | Password managers and paste work; no puzzle CAPTCHA without an alternative; magic links or passkeys welcome | 3.3.8 |
| Contrast | Text at least 4.5:1 (3:1 for large text); UI component boundaries and icons at least 3:1 | 1.4.3, 1.4.11 |
| Zoom and reflow | Usable at 200% text size and at 320 CSS pixels wide without two-direction scrolling | 1.4.4, 1.4.10 |
| Pointer | Targets at least 24 by 24 px or spaced; every drag action has a click alternative | 2.5.8, 2.5.7 |
| Dynamic updates | Toasts, validation and loading states are announced via status messages | 4.1.3 |
| Structure | One logical heading outline, landmarks, page titles, data tables with header cells | 1.3.1, 2.4.2, 2.4.6 |
| Media | Captions for prerecorded video, transcripts for audio | 1.2.2, 1.2.1 |
| Help | Help, contact and chat links in the same place on every page | 3.2.6 |
| Timeouts | Users are warned before a session times out and can extend it | 2.2.1 |
| Colour | Status is never shown by colour alone (charts, badges, validation) | 1.4.1 |
A working checklist for a typical SaaS web app, not the full standard. WCAG 2.2 AA has more criteria than listed here.
How to test for WCAG 2.2 AA
Accessibility testing has three layers, and you need all three.
- Automated scanning. Browser extensions and CI checks find missing labels, contrast failures, missing alt text and invalid ARIA quickly. They catch only part of the issues: they cannot judge whether alt text is meaningful, whether focus order makes sense or whether a custom widget works with a screen reader. Put them in CI so regressions are caught on every pull request.
- Manual testing. Unplug the mouse and complete every core workflow by keyboard. Zoom to 200% and 400%. Check focus visibility around sticky elements. Check every error state.
- Assistive technology testing. Use a screen reader on the main workflows: NVDA or JAWS with a Windows browser, VoiceOver on macOS and iOS, TalkBack on Android. Include people who use these tools daily where you can; they find what developers miss.
Record what you tested, with which tools and on which version. That record is the "evaluation methods" section of your VPAT.
Who requires WCAG 2.2?
No law requires WCAG 2.2 of private companies everywhere, but it is the version buyers and newer rules point to. The UK public sector must meet WCAG 2.2 AA. In the EU, the European Accessibility Act relies on harmonised standards, and the September 2026 EN 301 549 V4.1.1 is aligned with WCAG 2.2. In the US, the Section 508 and ADA rules cite 2.0 and 2.1, which 2.2 AA conformance also satisfies.
Where TryTrustable fits
TryTrustable scans your public pages against the WCAG 2.2 Level A and AA rules with axe-core, the open-source accessibility engine, and maps each failure to its success criterion with the element and how to fix it. It then gives your team a worksheet of all 55 A and AA criteria to set the conformance level and remarks for each, and issues a sealed Accessibility Conformance Report based on the VPAT® 2.5 WCAG edition. Automated rules find only some failures, so the product never marks a criterion "Supports" by itself: that needs manual testing with a keyboard, a screen reader and zoom, by your team or a specialist. It does not yet scan pages behind a login or produce the 508, EU or INT editions. We also help with the rest of the buyer's checklist: security and privacy evidence, a trust center, and frontend performance and API load test evidence. See the enterprise readiness guide.
The things people ask us
Is WCAG 2.2 a legal requirement?
Not everywhere. It is required for UK public sector websites and apps, and it is what new contracts and the latest EN 301 549 reference. US rules cite WCAG 2.0 (Section 508) and 2.1 (ADA Title II), which 2.2 AA conformance also meets.
What changed from WCAG 2.1 to 2.2?
Nine new success criteria (six at A or AA: Focus Not Obscured (Minimum), Dragging Movements, Target Size (Minimum), Consistent Help, Redundant Entry, Accessible Authentication (Minimum)) and the removal of 4.1.1 Parsing.
What is the WCAG 2.2 target size requirement?
Success criterion 2.5.8 (Level AA) asks for pointer targets of at least 24 by 24 CSS pixels, or enough spacing around smaller targets, with exceptions such as inline links in text and targets whose size is set by the browser.
Is WCAG 3.0 replacing WCAG 2.2?
WCAG 3.0 is a W3C working draft, not a Recommendation. WCAG 2.2 is the current standard to build and report against.
Can an automated tool make my site WCAG compliant?
No. Automated scanners find only part of the issues. Manual keyboard testing and screen reader testing are needed to claim conformance. Overlay widgets do not make an inaccessible product conform.
Does TryTrustable test WCAG?
Yes, the automated part: it runs the WCAG 2.2 A and AA rules with axe-core on your public pages and maps each failure to its success criterion. Manual testing is still needed for the criteria automated rules cannot judge.
Accessibility in hand? Get the security and reliability evidence ready too.
Thirty minutes on SOC 2 or ISO 27001 evidence, a trust center, and performance results buyers can check, for enterprise and public-sector deals.