Skip to content
wcagc
←Back to blog
Section 508WCAGVPAT

Section 508 vs WCAG: what federal contractors need

Section 508 vs WCAG, for federal vendors: which WCAG version 508 requires, how it reaches contractors, and what a VPAT actually proves.

P

Pavel Charkasau

Section 508 and WCAG are not two standards you choose between. Section 508 is US federal law; WCAG is the technical yardstick it points to. Section 508 of the Rehabilitation Act (29 U.S.C. § 794d) requires federal agencies to make their information and communication technology accessible to people with disabilities. To define "accessible" for the web, the Revised 508 Standards, published by the US Access Board on 18 January 2017 with a compliance date of 18 January 2018, incorporate WCAG 2.0 Level A and AA by reference (U.S. Access Board). So conformance to the web part of Section 508 is measured against WCAG 2.0 AA, which works out to 38 applicable success criteria (Section508.gov).

If you sell to or build for a federal agency, three facts do most of the work. The law binds agencies, not vendors directly; it reaches you through procurement, when a contract requires the ICT you deliver to conform. The referenced version is still WCAG 2.0 AA, older than the 2.1 or 2.2 that other obligations use. And you document where you stand in a VPAT, which no scanner can honestly fill in on its own. Here is how the pieces fit.

Is Section 508 the same as WCAG?

No. They sit at different layers. WCAG, the Web Content Accessibility Guidelines, is a technical specification from the World Wide Web Consortium (W3C). It defines, in testable success criteria, what accessible web content is. It carries no legal force on its own.

Section 508 is the law that gives a slice of WCAG legal weight in the US federal context. It does not rewrite the criteria; it references them. Clause 702.10.1 of the Revised 508 Standards pulls in the WCAG 2.0 Level A and AA success criteria and conformance requirements by reference (U.S. Access Board). So a success criterion like WCAG 1.4.3 Contrast (Minimum) is the same check whether you call it "WCAG" or "508" — the label changes, the test does not.

The relationship mirrors what Europe does with EN 301 549, which adopts WCAG for the web inside a broader ICT standard. If you have read our piece on EN 301 549 vs WCAG, the pattern will look familiar: a law or standard borrows WCAG's criteria rather than inventing its own.

Which WCAG version does Section 508 require?

WCAG 2.0 Level AA. That is the version frozen into the Revised 508 Standards, and it has been the federal web bar since the 2018 compliance date (Section508.gov). This trips people up, because WCAG has moved on twice since then. WCAG 2.1 arrived in 2018 and added criteria for mobile, low vision, and cognitive accessibility. WCAG 2.2 became a W3C Recommendation on 5 October 2023, adding nine more success criteria (W3C).

Section 508's legal reference has not caught up with either. So the letter of the law asks for 2.0 AA, while the European Accessibility Act route through EN 301 549 asks for 2.1 AA, and new private-sector work increasingly targets 2.2. A federal contractor can be reading three different WCAG versions across three contracts in the same week.

The good news is that the versions stack. WCAG 2.1 contains all of 2.0; 2.2 contains almost all of 2.1. Build to the newest and you have covered the oldest by definition. The gap runs the other way: meeting 2.0 AA leaves out the 2.1 and 2.2 criteria that agencies now often write into their own solicitations, above the legal floor.

Who does Section 508 apply to, and how does it reach contractors?

Section 508 directly binds federal agencies, not private companies. The obligation is on the agency when it develops, procures, maintains, or uses ICT (Section508.gov). You, as a vendor, are not named by the statute.

The requirement reaches you through the buying process. The Federal Acquisition Regulation makes 508 conformance an acquisition requirement: FAR Subpart 39.2 sets the accessibility rules for ICT purchases, and related clauses (FAR 10.001 and 11.002) require agencies to assess and document that what they buy meets the standards (Section508.gov). In practice that turns into contract language, statement-of-work clauses, and acceptance testing. A product that cannot show conformance can be scored down or ruled out before anyone looks at price.

This is where the VPAT comes in. A Voluntary Product Accessibility Template is the reporting format vendors use to describe how a product measures against the Section 508 standards; the completed document is an Accessibility Conformance Report (ACR). Procurement teams read the ACR to see, criterion by criterion, what a product supports, partially supports, or does not support. An honest ACR that says "does not support" on a few rows is more useful, and more defensible, than one that claims a clean sheet it cannot back up.

Does Section 508 cover more than websites?

Yes, and this catches vendors who think "508" means "the website." The Revised 508 Standards apply WCAG 2.0 AA to both web and non-web electronic content. Section E205 scopes electronic content to non-web documents regardless of format, which explicitly includes Microsoft Office files, PDFs, and HTML (Section508.gov). The standards take the position that there is no meaningful accessibility difference between a web page and a PDF, so the same criteria apply to both.

Beyond content, the standards cover hardware, software, and support documentation and services (U.S. Access Board). If your deliverable is a laptop fleet, a desktop application, or a user manual, those have 508 requirements that WCAG alone never addresses. A perfectly accessible web app says nothing about whether its installer, its admin console, or its onboarding PDF conforms. Scope your VPAT to everything you are actually shipping, not just the pages a browser renders.

Should you build to WCAG 2.0, 2.1, or 2.2?

Build to 2.2 AA, even though the law only asks for 2.0. This is the one opinion I will state plainly, and it is a practical call, not a compliance dodge. The delta from 2.0 to 2.2 is small in engineering terms: better focus visibility, larger touch targets, accessible authentication that does not force a memory test. Agencies are already citing 2.1 in solicitations, and some are asking for 2.2 on new development (Section508.gov). Treating WCAG 2.0 as a ceiling is how a vendor passes the letter of a contract and still loses the next one.

If you build to 2.2 AA, your Section 508 ACR is satisfied by construction, your EN 301 549 web clauses are covered for any EU-facing work, and you are ready for whatever an agency adds above the floor. You do the newest version once instead of the oldest version three times. Our WCAG checklist tracks the criteria and marks which ones are new in 2.1 and 2.2, so you can see the gap you are closing.

Can a scanner prove Section 508 conformance?

No, and this is the honest limit worth stating before you sign anything. Automated testing finds a real share of issues, but not all of them. Deque's analysis of more than 2,000 audits found automation identified about 57% of issues by volume, while estimates based on the share of success criteria a tool can even evaluate put the figure nearer 30% (Deque). Either number leaves a large part of WCAG that only a person with a keyboard and a screen reader can confirm.

That gap is exactly why a VPAT asks a human to attest, criterion by criterion, rather than pasting a tool's score. It is also why overlay widgets that promise instant compliance draw regulatory attention: the Federal Trade Commission approved a final order in 2025 requiring the overlay vendor accessiBe to pay $1 million over claims that its product made websites WCAG compliant (FTC). For a federal contract, an inflated conformance claim is not just a marketing risk; it is a representation to the government. The workable method is old-fashioned: fix what a scanner finds, test the rest by hand, and write the ACR to match what you actually found.

Frequently asked questions

Is Section 508 the same as WCAG?

No. Section 508 is a US federal law (29 U.S.C. § 794d) requiring federal agencies to make ICT accessible. WCAG is the W3C technical specification it references. The Revised 508 Standards incorporate WCAG 2.0 Level A and AA by reference for web content, so 508 web conformance is measured against WCAG.

Which WCAG version does Section 508 require?

WCAG 2.0 Level AA. That is the version incorporated into the Revised 508 Standards, effective for the 2018 compliance date. It has not been updated to WCAG 2.1 or 2.2, even though both are newer W3C Recommendations.

Does Section 508 apply to private companies?

Not directly. Section 508 binds federal agencies. It reaches private vendors and contractors through federal procurement: the FAR requires agencies to buy and document ICT that conforms, which becomes a contractual obligation on the supplier.

What is a VPAT and do I need one?

A Voluntary Product Accessibility Template is the format vendors use to report how a product meets the Section 508 standards; the completed report is an Accessibility Conformance Report. Federal buyers routinely ask for a current ACR during evaluation, so for practical purposes a federal contractor needs one.

Does Section 508 only cover websites?

No. It applies WCAG 2.0 AA to web and non-web electronic content, including PDFs and Office documents, and it also sets requirements for hardware, software, and support documentation that WCAG does not cover.

Check your Section 508 baseline against WCAG

Since Section 508's web requirements are WCAG 2.0 AA, the useful first step is to measure your pages against that bar and the newer criteria above it. Run a free scan to surface the machine-detectable issues on your key pages and documents, then work through the manual checks a scanner cannot judge. You will have a real baseline to write an honest VPAT from, instead of a number you cannot defend to a contracting officer.

Pavel Charkasau, founder, wcagc.com. Last updated 5 August 2026.

Sources