WCAG 2.2

WCAG 2.2 Level AA,
checked the way buyers check it.

Enterprise, university and public-sector buyers ask whether your product meets WCAG 2.2 AA, usually in a VPAT. This guide covers what changed in 2.2, what AA means for a SaaS web app, and how to test it properly. A practical guide, not legal advice.

WCAG 2.2Level AA9 new criteria4.1.1 removedVPAT / ACR

Last updated Published by TryTrustableNot legal advice

Short answer

WCAG 2.2 is the current version of the W3C Web Content Accessibility Guidelines. It became a W3C Recommendation on 5 October 2023 (the current edition is dated 12 December 2024). It adds nine success criteria to WCAG 2.1, six of them at Level A or AA, covering focus visibility, dragging, target size, consistent help, redundant entry and accessible authentication, and it removes 4.1.1 Parsing. Level AA is the target most buyers and laws point to. Content that meets WCAG 2.2 AA also meets 2.1 AA and 2.0 AA.

01

What is WCAG 2.2?

The Web Content Accessibility Guidelines (WCAG) are the W3C's standard for making web content usable by people with disabilities: blind and low-vision users with screen readers and magnifiers, people who cannot use a mouse, people who are deaf or hard of hearing, and people with cognitive and learning disabilities. WCAG 2.2 was published as a W3C Recommendation on 5 October 2023, and the current edition of the Recommendation is dated 12 December 2024.

WCAG is organised under four principles (perceivable, operable, understandable, robust), each broken into guidelines and testable success criteria at Level A, AA or AAA. WCAG 2.2 is backwards compatible: if you meet 2.2 AA, you also meet 2.1 AA and 2.0 AA, apart from the reporting point on 4.1.1 below.

02

What is new in WCAG 2.2?

Nine success criteria were added. Six are at Level A or AA, so they matter for procurement; three are AAA.

CriterionLevelWhat it asks, in shortWhere SaaS apps fail it
2.4.11 Focus Not Obscured (Minimum)AAA focused element is not entirely hidden by other contentSticky headers, cookie banners and chat widgets covering the focused field
2.4.12 Focus Not Obscured (Enhanced)AAANo part of the focused element is hiddenAs above
2.4.13 Focus AppearanceAAAThe focus indicator is large enough and has enough contrastFaint or removed outlines
2.5.7 Dragging MovementsAAAnything done by dragging can also be done with a single pointer, without draggingKanban boards, sliders, reorderable lists, file drop zones with no button
2.5.8 Target Size (Minimum)AAPointer targets are at least 24 by 24 CSS pixels, or have enough spacing (with exceptions)Icon buttons in tables, close icons, dense toolbars
3.2.6 Consistent HelpAHelp mechanisms that repeat across pages appear in the same relative orderA help link or chat that moves between pages
3.3.7 Redundant EntryAInformation already entered in the same process is filled in or selectable, not asked againMulti-step onboarding and checkout asking for the same address twice
3.3.8 Accessible Authentication (Minimum)AANo cognitive function test (like remembering or transcribing) to log in, unless an alternative or aid is offeredBlocking paste in password fields, puzzle CAPTCHAs with no alternative
3.3.9 Accessible Authentication (Enhanced)AAAAs above, without the object and personal-content exceptionsAs above

Source: W3C WCAG 2.2 Recommendation. Summaries are ours; read the normative text and the W3C Understanding documents.

03

Why was 4.1.1 Parsing removed?

WCAG 2.2 removes success criterion 4.1.1 Parsing, which required well-formed markup. Browsers and assistive technologies now handle markup errors consistently, and the problems that still matter are covered by other criteria such as 4.1.2 Name, Role, Value. The W3C notes that anyone required by policy to follow an earlier version (for example Section 508, which references WCAG 2.0) may still need to test and report 4.1.1.

04

WCAG levels: A vs AA vs AAA

LevelWhat it isWho asks for it
AThe minimum: without it, some users cannot use the content at allNever enough on its own for procurement
AAA + AA criteria: the practical targetUS federal (Section 508 uses WCAG 2.0 AA), ADA Title II rule (WCAG 2.1 AA), UK public sector (WCAG 2.2 AA), EN 301 549 in the EU, most enterprise contracts
AAAHighest level; W3C does not recommend requiring it for entire sites, as some content cannot meet itRarely required; pick individual AAA criteria where they help your users

When a buyer says "WCAG compliant" they almost always mean Level AA. Ask which version: US federal contracts still cite 2.0 through Section 508, the ADA Title II rule cites 2.1, and the UK public sector and the latest EN 301 549 (V4.1.1, September 2026) align with 2.2. Building to 2.2 AA answers all of them.

05

WCAG 2.2 AA checklist for a SaaS web app

AreaCheckKey criteria
KeyboardEvery action works with a keyboard alone, in a logical order, with no keyboard trap2.1.1, 2.1.2, 2.4.3
FocusFocus is always visible and never hidden behind sticky bars, banners or chat widgets2.4.7, 2.4.11
Names and rolesButtons, links, inputs and custom widgets expose a name, role and state to assistive technology4.1.2, 1.3.1
FormsEvery field has a visible label; errors are identified in text with a suggestion; nothing is asked twice3.3.1, 3.3.2, 3.3.3, 3.3.7
Sign-inPassword managers and paste work; no puzzle CAPTCHA without an alternative; magic links or passkeys welcome3.3.8
ContrastText at least 4.5:1 (3:1 for large text); UI component boundaries and icons at least 3:11.4.3, 1.4.11
Zoom and reflowUsable at 200% text size and at 320 CSS pixels wide without two-direction scrolling1.4.4, 1.4.10
PointerTargets at least 24 by 24 px or spaced; every drag action has a click alternative2.5.8, 2.5.7
Dynamic updatesToasts, validation and loading states are announced via status messages4.1.3
StructureOne logical heading outline, landmarks, page titles, data tables with header cells1.3.1, 2.4.2, 2.4.6
MediaCaptions for prerecorded video, transcripts for audio1.2.2, 1.2.1
HelpHelp, contact and chat links in the same place on every page3.2.6
TimeoutsUsers are warned before a session times out and can extend it2.2.1
ColourStatus is never shown by colour alone (charts, badges, validation)1.4.1

A working checklist for a typical SaaS web app, not the full standard. WCAG 2.2 AA has more criteria than listed here.

06

How to test for WCAG 2.2 AA

Accessibility testing has three layers, and you need all three.

  1. Automated scanning. Browser extensions and CI checks find missing labels, contrast failures, missing alt text and invalid ARIA quickly. They catch only part of the issues: they cannot judge whether alt text is meaningful, whether focus order makes sense or whether a custom widget works with a screen reader. Put them in CI so regressions are caught on every pull request.
  2. Manual testing. Unplug the mouse and complete every core workflow by keyboard. Zoom to 200% and 400%. Check focus visibility around sticky elements. Check every error state.
  3. Assistive technology testing. Use a screen reader on the main workflows: NVDA or JAWS with a Windows browser, VoiceOver on macOS and iOS, TalkBack on Android. Include people who use these tools daily where you can; they find what developers miss.

Record what you tested, with which tools and on which version. That record is the "evaluation methods" section of your VPAT.

07

Who requires WCAG 2.2?

No law requires WCAG 2.2 of private companies everywhere, but it is the version buyers and newer rules point to. The UK public sector must meet WCAG 2.2 AA. In the EU, the European Accessibility Act relies on harmonised standards, and the September 2026 EN 301 549 V4.1.1 is aligned with WCAG 2.2. In the US, the Section 508 and ADA rules cite 2.0 and 2.1, which 2.2 AA conformance also satisfies.

08

Where TryTrustable fits

TryTrustable scans your public pages against the WCAG 2.2 Level A and AA rules with axe-core, the open-source accessibility engine, and maps each failure to its success criterion with the element and how to fix it. It then gives your team a worksheet of all 55 A and AA criteria to set the conformance level and remarks for each, and issues a sealed Accessibility Conformance Report based on the VPAT® 2.5 WCAG edition. Automated rules find only some failures, so the product never marks a criterion "Supports" by itself: that needs manual testing with a keyboard, a screen reader and zoom, by your team or a specialist. It does not yet scan pages behind a login or produce the 508, EU or INT editions. We also help with the rest of the buyer's checklist: security and privacy evidence, a trust center, and frontend performance and API load test evidence. See the enterprise readiness guide.

Questions

The things people ask us

Is WCAG 2.2 a legal requirement?

Not everywhere. It is required for UK public sector websites and apps, and it is what new contracts and the latest EN 301 549 reference. US rules cite WCAG 2.0 (Section 508) and 2.1 (ADA Title II), which 2.2 AA conformance also meets.

What changed from WCAG 2.1 to 2.2?

Nine new success criteria (six at A or AA: Focus Not Obscured (Minimum), Dragging Movements, Target Size (Minimum), Consistent Help, Redundant Entry, Accessible Authentication (Minimum)) and the removal of 4.1.1 Parsing.

What is the WCAG 2.2 target size requirement?

Success criterion 2.5.8 (Level AA) asks for pointer targets of at least 24 by 24 CSS pixels, or enough spacing around smaller targets, with exceptions such as inline links in text and targets whose size is set by the browser.

Is WCAG 3.0 replacing WCAG 2.2?

WCAG 3.0 is a W3C working draft, not a Recommendation. WCAG 2.2 is the current standard to build and report against.

Can an automated tool make my site WCAG compliant?

No. Automated scanners find only part of the issues. Manual keyboard testing and screen reader testing are needed to claim conformance. Overlay widgets do not make an inaccessible product conform.

Does TryTrustable test WCAG?

Yes, the automated part: it runs the WCAG 2.2 A and AA rules with axe-core on your public pages and maps each failure to its success criterion. Manual testing is still needed for the criteria automated rules cannot judge.

Book a walkthrough

Accessibility in hand? Get the security and reliability evidence ready too.

Thirty minutes on SOC 2 or ISO 27001 evidence, a trust center, and performance results buyers can check, for enterprise and public-sector deals.