The Section 508 Refresh is the US Access Board's ICT Final Rule, published on 18 January 2017, which replaced the original 2000 Section 508 standards and the 1998 Section 255 telecom guidelines in a single rulemaking (Access Board, preamble). Federal agencies had to comply with the revised 508 standards from 18 January 2018. Four changes matter most. The rule incorporates WCAG 2.0 Level A and AA by reference for web pages, documents and software. It organizes requirements by what a product does instead of what kind of product it is. It pulls nine categories of non-public agency communications into scope. And it adds a safe harbor for legacy ICT that met the old standard and hasn't been touched since (Access Board, Revised 508 Standards).
If you sell to federal agencies, the Refresh is the reason your VPAT now lists WCAG success criteria instead of the old lettered web provisions. If you have only heard "508 compliance" in a contract, start with what Section 508 is and who must comply; this post is about what changed in 2017 and what it means for your backlog today.
What was the Section 508 Refresh?
It was the first full rewrite of the federal ICT accessibility standards since they were written. The Access Board issued the Section 255 guidelines in 1998 and the original 508 standards two years later, in 2000 (Access Board, preamble). By the 2010s those rules described a world of separate desktop software, separate web pages and separate telephones.
The final rule took effect in March 2017, but the date that counted for agencies was 18 January 2018, when compliance with the 508-based standards became required. The Section 255 half works differently: telecom manufacturers don't have to follow the revised 255 guidelines until the FCC adopts them (Access Board, preamble). The standard itself is direct about who it binds. Compliance "is mandatory for Federal agencies subject to Section 508" (E101.1, Access Board).
One small follow-up worth knowing: on 22 January 2018 the Board issued a correction to restore provisions for TTY access (Access Board).
What changed from the 2000 Section 508 standards?
The short version is in this table. The old standards still exist, republished as Appendix D, because the safe harbor below points back to them (E202.2, Access Board).
| 2000 standards (36 CFR 1194, now Appendix D) | Revised 508 Standards (2017 Refresh) | |
|---|---|---|
| Structure | Product types: software, web, telecom, video, self-contained products, computers | Functions: hardware, software, electronic content, support docs |
| Web and document bar | The Board's own lettered web provisions in 1194.22 | WCAG 2.0 Level A and AA, incorporated by reference |
| Non-web documents | Not a category of their own | WCAG 2.0 applied to documents, minus four page-level criteria (E205.4) |
| Internal agency content | Not singled out | Nine categories of official communications in scope (E205.3) |
| Fallback for gaps | Functional performance criteria | Functional performance criteria (Chapter 3), applied where Chapters 4 and 5 don't reach |
| Existing ICT | No safe harbor | Legacy ICT safe harbor if unaltered since 18 January 2018 (E202.2) |
| Telecom | Separate 1998 Section 255 guidelines | Combined into the same rule, applied as the FCC requires |
The WCAG row is the one that changed daily work for most teams. Under the revised rule, user interface components and the content of platforms and applications "shall conform to Level A and Level AA" of WCAG 2.0 (E207.2, Access Board). That works out to 38 success criteria, and a page that fails even one of them does not conform (Section508.gov). Software gets measured against the same criteria, which is why a desktop app's VPAT now has rows like 1.4.3 Contrast (Minimum).
Why did the Access Board reorganize by function instead of product type?
Because the product types stopped meaning anything. The preamble says the spread of multifunction devices "called into question the ongoing utility of the product-by-product approach," and the rule was written to replace that approach with one based on what ICT does (Access Board, preamble).
A phone in 2000 was a telecom product. A phone in 2017 was also a web browser, a document viewer, a video player and a kiosk-sized touchscreen. Under the old categories a procurement officer had to guess which rule applied. Under the revised standards you ask a different question: does this thing have hardware with operable parts? Does it have a software UI? Does it display electronic content? Each answer pulls in its own chapter.
The functional performance criteria in Chapter 3 then act as the backstop. Where Chapters 4 and 5 don't address a function, that function has to meet Chapter 3 (E204.1, Access Board), which lists nine user situations from "Without Vision" (302.1) to "With Limited Language, Cognitive, and Learning Abilities" (302.9). The EU standard has a nearly identical set, and our post on EN 301 549 functional performance statements shows how they map.
Which documents and internal content does the Refresh cover?
More than most agencies and their vendors scoped for, and this is the change I'd point a contractor to first.
All public-facing electronic content has to conform (E205.2). On top of that, E205.3 brings in non-public content when it "constitutes official business" and falls into one of nine categories (Access Board):
- An emergency notification
- An initial or final decision adjudicating an administrative claim or proceeding
- An internal or external program or policy announcement
- A notice of benefits, program eligibility, employment opportunity, or personnel action
- A formal acknowledgement of receipt
- A survey questionnaire
- A template or form
- Educational or training materials
- Intranet content designed as a Web page
Look at items 7 and 8. If you build an HR platform, an LMS or a forms tool for an agency, the content your product produces for employees is in scope, not only the public website. Records NARA maintains under federal recordkeeping law are exempt unless they are public facing.
Documents get WCAG too, with four criteria dropped because they don't make sense outside a set of web pages: 2.4.1 Bypass Blocks, 2.4.5 Multiple Ways, 3.2.3 Consistent Navigation and 3.2.4 Consistent Identification (E205.4, Access Board). A PDF notice of benefits still needs tags, reading order and real text alternatives. Our PDF accessibility checker catches the structural failures; whether the alt text says anything useful is still a human call.
What is the safe harbor for legacy ICT?
It is a grandfather clause with a short fuse. A component of existing ICT that complied with the earlier 508 standard "and that has not been altered on or after January 18, 2018" does not have to be modified to meet the revised standards (E202.2, Access Board).
The word doing the work is "altered." Redesign the login page of a 2015 portal and that page now has to meet WCAG 2.0 AA. The untouched reporting module next to it can stay on the old standard. Eight years after the compliance date, very little federal software has gone untouched, so in practice I treat the safe harbor as close to empty. Plan as if anything you ship in a release is in scope.
How does the Refresh line up with EN 301 549?
Closely, and on purpose. The preamble describes EN 301 549, published in 2014 under European Commission Mandate 376, as "the first European set of specifications on e-accessibility for public ICT procurements," and says its functional requirements were "closely harmonized" with the Board's earlier draft (Access Board, preamble).
You can see it in the structure. Both standards use WCAG for web content, apply it to non-web documents and software, keep a list of functional performance criteria, and cover support documentation (E208.1 in the US, Chapter 12 in EN 301 549). The big difference today is the WCAG version: EN 301 549 V3.2.1 maps to WCAG 2.1, while the Revised 508 Standards still say 2.0. Our EN 301 549 pillar and Section 508 pillar cover each side, and the Section 508 vs WCAG post covers the version gap for vendors.
If you sell in both markets, build to WCAG 2.1 AA and you satisfy the 2.0 floor of 508 along the way. One codebase, two conformance reports.
What did the Refresh not change?
Three things people assume it did.
It didn't move past WCAG 2.0. The incorporation by reference names 2.0, and the 2.1 and 2.2 criteria have never been added (Section508.gov).
It didn't settle real-time text. The Board reserved RTT "to be addressed in a future rulemaking" because the FCC was working on the TTY-to-RTT transition at the same time (Access Board, preamble).
It didn't change who is bound. Section 508 still applies to federal agencies, and it reaches vendors through procurement rather than through the statute (29 U.S.C. § 794d). State and local governments are under ADA Title II instead; see the ADA pillar.
How do you test against the refreshed standards?
Start with WCAG 2.0 AA, because that's where most of the 38 criteria live and where most VPAT rows come from. Automated testing covers part of it. In Deque's study, automated tests found 57% of issues by volume (Deque), and the share of success criteria a tool can fully decide is lower than that. A scanner can tell you that button.submit-claim has no accessible name. It can't tell you whether a screen reader user can follow the error message on page three of a benefits form.
So the honest workflow has two halves: scan every page and document to clear the mechanical failures, then have a person test keyboard flow, screen reader output and content meaning against the criteria a tool can't judge. Our WCAG checklist marks which criteria fall into which half.
Frequently asked questions
When did the Section 508 Refresh take effect?
Federal agencies had to comply with the revised standards from 18 January 2018, a year after the final rule was published on 18 January 2017 (Access Board, preamble).
Which WCAG version does the Section 508 Refresh require?
WCAG 2.0 Level A and AA, incorporated by reference, which is 38 success criteria (Section508.gov). WCAG 2.1 and 2.2 criteria are not part of the federal standard.
Does the Refresh apply to PDFs and Word documents?
Yes, it applies WCAG 2.0 to non-web documents, minus four criteria that only make sense across web pages (E205.4, Access Board).
Does a site built before 2018 still need to meet the new standards?
Only the parts that have been altered since 18 January 2018, provided the untouched parts met the old standard (E202.2, Access Board).
Is the Section 508 Refresh the same as EN 301 549?
No, but they were harmonized on purpose and share most of their structure (Access Board, preamble). The main difference today is that EN 301 549 V3.2.1 uses WCAG 2.1, while Section 508 still uses 2.0.
Want to see where your site stands against the WCAG criteria behind the 508 standards? Run a free scan and get each failure with its selector and success criterion. Then plan the manual review for the rest.
Written by Pavel Charkasau, founder of wcagc.com. I read the Revised 508 Standards and the preamble for this post; the E205.3 list is the part I'd want every federal vendor to see.
Last updated: October 22, 2026
Sources
- U.S. Access Board, Information and Communication Technology: Revised 508 Standards and 255 Guidelines (final rule 18 January 2017; correction 22 January 2018; accessed October 22, 2026).
- U.S. Access Board, Preamble to the Final Rule (accessed October 22, 2026).
- Section508.gov (GSA), Applicability and Conformance Requirements (accessed October 22, 2026).
- Legal Information Institute, 29 U.S.C. § 794d, Electronic and information technology (accessed October 22, 2026).
- Deque Systems, Automated Testing Study Identifies 57 Percent of Digital Accessibility Issues (accessed October 22, 2026).