Section 508 is the part of the US Rehabilitation Act that requires federal agencies to make their technology accessible. The statute, 29 U.S.C. § 794d, binds "each Federal department or agency, including the United States Postal Service" when it develops, procures, maintains, or uses electronic and information technology. It requires that people with disabilities, both federal employees and members of the public, get access to information comparable to what everyone else gets. The technical bar comes from the Revised 508 Standards, published by the US Access Board on 18 January 2017 and effective 18 January 2018, which incorporate WCAG 2.0 Level A and AA by reference (U.S. Access Board).
So the short answer on who must comply: federal agencies. Not state governments, not universities, not private companies. If you sell software to the government, Section 508 reaches you through your contract rather than through the statute. And if a state agency has told you it needs "508 compliance," that obligation almost always comes from a grant condition or a procurement clause, not from Section 508 itself. Here is how each piece works.
What does Section 508 actually require?
Two separate things, and people tend to collapse them into one.
The first is the legal duty in the statute: comparable access. An agency has to let a person with a disability get at the same information and do the same things as anyone else, whether that person works there or is a member of the public using the agency's website (29 U.S.C. § 794d). Where meeting the standards would impose an undue burden, the agency still owes the information by some alternative means of access. The duty does not disappear; the delivery method changes.
The second is the technical standard that defines "accessible." That is the Access Board's job, and its answer for the web is WCAG 2.0 Level A and AA, incorporated by reference (U.S. Access Board). In practice that works out to 38 applicable success criteria, and a page that fails even one of them does not conform (Section508.gov).
Note the year on that: WCAG 2.0 is from 2008, and the federal standard has never picked up the criteria added in 2.1 or 2.2. Our Section 508 overview covers the version gap, and the WCAG checklist marks what is new in each version.
Who must comply with Section 508?
Federal departments and agencies, including the Postal Service. That is the whole list. Section 508 is a housekeeping rule the federal government wrote for itself.
The confusion usually comes from the neighboring sections of the same law, which have genuinely different reach:
| Law | Who it binds | What it covers |
|---|---|---|
| Section 501 | Federal employers | Employment discrimination against people with disabilities |
| Section 504 | Federal agencies and recipients of federal financial assistance | Discrimination in programs and activities |
| Section 508 | Federal agencies | Accessibility of the agency's ICT |
| Section 255 (Communications Act) | Telecom equipment manufacturers | Telephones, routers, set-top boxes and similar |
Source for the first three rows: Section508.gov; for the fourth, the Access Board.
Section 504 is the one that follows the money. It applies to programs and activities "receiving federal financial assistance or conducted by executive agencies or the U.S. Postal Service" (Section508.gov). A university with federal research funding is inside Section 504. It is still outside Section 508.
Does Section 508 apply to states, universities, or private companies?
Not directly. Non-federal organizations do end up holding a 508-shaped obligation, though, by three routes with quite different scopes.
A grant condition. The Assistive Technology Act requires a state to give an assurance that activities "supported by Federal funds received under this chapter, will comply with the standards established by the Architectural and Transportation Barriers Compliance Board under section 508" (29 U.S.C. § 3003(d)(5)(G)). Read that scope carefully. It attaches to the AT Act-funded activities, not to every system the state runs.
A contract clause. A federal agency buying your product writes conformance into the solicitation, and it flows down to subcontractors. More on that below.
A different law entirely. For US state and local government websites, the operative rule is ADA Title II, not Section 508, and the DOJ's 2024 rule sets WCAG 2.1 AA as the benchmark there. We covered which one lands on you in Title II vs Title III, and the ADA pillar has the fuller picture. Private US businesses sit under Title III, which is a different question again.
How does Section 508 reach contractors?
Through procurement, which the statute set up on purpose. Within six months of the Access Board publishing standards, the FAR Council had to revise the Federal Acquisition Regulation to incorporate them (29 U.S.C. § 794d), and FAR Subpart 39.2 now carries the accessibility rules for ICT acquisitions (Section508.gov).
What that means day to day is that you are never sued under Section 508 as a vendor. You lose the bid, or you fail acceptance testing. The document that decides it is usually a VPAT, filled in to produce an Accessibility Conformance Report, which a procurement officer reads criterion by criterion. If you have not filled one in before, what a VPAT is and how to complete one walks through it.
What does Section 508 cover besides websites?
More than most teams scope for. Section E205 applies the WCAG criteria to non-web electronic documents regardless of format, naming Microsoft Office files, PDFs, and HTML explicitly, on the view that a web page and a document raise the same accessibility needs (Section508.gov). Your grant application PDF is in scope on the same terms as your homepage, which is why we built a PDF accessibility checker instead of treating documents as someone else's problem.
Beyond content, the standards reach hardware, software, and support documentation and services (U.S. Access Board). A clean web app says nothing about its installer, its admin console, or the phone line people call when it breaks.
What are the exceptions?
Four matter in practice, all from Section E202 of the standards (U.S. Access Board):
- Legacy ICT. A component of existing ICT that met an earlier 508 standard and "has not been altered on or after January 18, 2018" does not have to be brought up to the revised standards. This is the safe harbor, and it is narrower than people hope: touch the component and it comes back into scope.
- National security systems, as defined by 40 U.S.C. 11103(a), are out.
- Undue burden or fundamental alteration. The agency has to document the basis for the claim and still provide alternative access.
- Best meets. Where nothing commercially available fully conforms, the agency buys what best meets the standards for its business needs and provides an alternative means of access.
None of these is a blanket exemption, and each one carries a paperwork trail.
How is Section 508 actually enforced?
Here is the part that surprises people. An individual can file an administrative complaint with the agency, with the remedies of 29 U.S.C. § 794a available, but the complaint route only covers ICT the agency procured. Section 508 does not authorize complaints or lawsuits about technology an agency developed, maintains, or uses in-house, and the window opened on 21 June 2001 (U.S. Department of Justice).
That gap is why I think treating Section 508 as a litigation-risk question gets federal teams to the wrong answer. The legal pressure here is weak by design. The procurement pressure is not, and the person locked out of the benefits form is not hypothetical either.
Are federal agencies actually meeting the standard?
Mostly not, by the government's own measure. GSA's FY 2025 Section 508 Assessment collected responses from 212 agencies, parent agencies, and components, and reported a governmentwide conformance average of 1.96 on a 5-point scale. Fewer than half of agencies' most viewed or used ICT assets were fully conformant, and roughly half of agencies said they do not routinely test ICT for conformance as part of normal business practice (Section508.gov).
The testing number is the one I would fix first. A score of 1.96 is a symptom; not testing is the cause.
Can a scanner prove Section 508 conformance?
No, and anyone selling you that is overstating what automation does. Deque's analysis of more than 2,000 audits found automated testing identified about 57% of issues by volume, while estimates based on how many success criteria a tool can even evaluate land nearer 30% (Deque). Either figure leaves a large share of WCAG that only a person with a keyboard and a screen reader can confirm.
Overstating it has consequences. The Federal Trade Commission approved a final order in 2025 requiring the overlay vendor accessiBe to pay $1 million over claims that its product made websites WCAG compliant (FTC). On a federal contract, an inflated conformance claim is a representation to the government rather than marketing copy. Run the scan, fix what it flags, test the rest by hand, then write the ACR to match.
Frequently asked questions
Does Section 508 apply to private companies?
No. Section 508 binds federal agencies only (Section508.gov). A private company encounters it as a contract requirement when selling ICT to the federal government, or not at all. US private-sector websites are generally addressed under ADA Title III instead.
Which WCAG version does Section 508 require?
WCAG 2.0 Level A and AA, incorporated by reference into the Revised 508 Standards (U.S. Access Board). That is 38 applicable success criteria for a web page (Section508.gov). Building to WCAG 2.2 AA covers 2.0 by definition, since the versions stack.
Is Section 508 the same as the ADA?
No. They are separate statutes with separate scopes. Section 508 is a Rehabilitation Act obligation on federal agencies for their own technology. The ADA covers state and local government under Title II and places of public accommodation under Title III. See Title II vs Title III.
Does Section 508 cover PDFs?
Yes. Section E205 applies the WCAG criteria to non-web electronic documents regardless of format, naming PDF and Microsoft Office files explicitly (Section508.gov).
What is the Section 508 safe harbor?
Section E202.2 of the standards says a component of existing ICT that complied with an earlier 508 standard and has not been altered on or after 18 January 2018 need not be updated to the revised standards (U.S. Access Board). Altering the component ends the exemption for it.
How does Section 508 compare to Europe's rules?
Both point at WCAG, at different versions and through different machinery. The EU route runs through EN 301 549, which adopts WCAG for the web inside a broader ICT standard and reaches the private sector through the European Accessibility Act.
Where to start
If you are responsible for a federal system or you are about to fill in a VPAT, start by finding out what is actually broken. Run a free accessibility scan and you will get the WCAG failures with the exact selector for each one, which is the first half of the work. The second half is manual review, and no tool does that part for you.
Written by Pavel Charkasau, founder of wcagc.com.
Last updated: 16 September 2026.
Sources
- 29 U.S. Code § 794d — Electronic and information technology, Cornell Legal Information Institute. Accessed 16 September 2026.
- Revised 508 Standards and 255 Guidelines, U.S. Access Board. Accessed 16 September 2026.
- Applicability and Conformance, Section508.gov. Accessed 16 September 2026.
- IT Accessibility Laws and Policies, Section508.gov. Accessed 16 September 2026.
- Understanding the Relationship Between Sections 501, 504, and 508, Section508.gov. Accessed 16 September 2026.
- 29 U.S. Code § 3003 — Grants to States, Cornell Legal Information Institute. Accessed 16 September 2026.
- III. Administrative Complaints, U.S. Department of Justice, Civil Rights Division. Accessed 16 September 2026.
- FY 2025 Section 508 Assessment, Executive Summary, GSA / Section508.gov. Accessed 16 September 2026.
- Automated Testing Study Identifies 57% of Digital Accessibility Issues, Deque Systems. Accessed 16 September 2026.
- FTC Approves Final Order Requiring accessiBe to Pay $1 Million, Federal Trade Commission, April 2025. Accessed 16 September 2026.