What is Section 508 compliance? Section 508 is a federal law requiring that all information and communication technology used, developed, procured, or maintained by federal agencies be accessible to people with disabilities. Compliance is measured against WCAG 2.0 Level AA success criteria. It applies directly to federal agencies and indirectly to any contractor or vendor selling technology, software, or digital services to the federal government.
Introduction
If you sell software, a website, or any digital product to a federal agency, Section 508 is not optional reading. It is a gate you have to pass through before a contracting officer will let you into procurement. Vendors who show up without documentation are not scored lower. They are removed from consideration before evaluation begins.
This guide covers what Section 508 actually requires, who it applies to, how it relates to WCAG and the ADA, what a VPAT is and when you need one, and a practical checklist to work from.
What Is Section 508 of the Rehabilitation Act?
Section 508 is a 1998 amendment to the Rehabilitation Act of 1973 that requires federal agencies to make their electronic and information technology (EIT), now commonly referred to as information and communication technology (ICT), accessible to people with disabilities. It is codified at 29 U.S.C. § 794d.
In 2017, the U.S. Access Board issued a final rule, effective January 2018, that replaced the law’s original technical criteria with direct alignment to the Web Content Accessibility Guidelines (WCAG) 2.0 Level AA. That refresh means the same technical standard now underlies both Section 508 and much of modern ADA website compliance work, which makes it realistic to build once and satisfy multiple frameworks.
Section 508 vs. ADA vs. WCAG, in Plain Terms
- WCAG is the technical standard: a set of testable success criteria for accessible digital content
- Section 508 is a federal procurement and internal-use law that requires federal ICT to meet WCAG 2.0 AA
- ADA is the broader civil rights law. Title II requires state and local governments to meet WCAG 2.1 AA; Title III applies to private businesses operating as public accommodations
If your organization only needs to satisfy Section 508, WCAG 2.0 AA is the floor. If you also work with state or local government clients under ADA Title II, you will need WCAG 2.1 AA, since it is the stricter standard and effectively becomes the practical baseline for any organization operating across both federal and state government sectors.
Who Has to Comply With Section 508
Directly Covered
- Every federal agency and department
- Internal agency systems, intranets, and employee-facing tools, not just public websites
Indirectly Covered
- Any contractor or vendor that develops, sells, or provides ICT to a federal agency, regardless of company size or contract value
- Organizations receiving federal funding to build or maintain digital systems, depending on the terms of the funding agreement, which frequently brings universities, research institutions, and nonprofits administering federal grants into scope
- State agencies administering federally funded programs, in some cases, through their funding agreements
What Counts as ICT
ICT is a broad category that includes:
- Public and internal websites
- Software applications
- Electronic documents, including PDFs, Word files, spreadsheets, and presentations
- Multimedia content, including video and audio
- Hardware such as kiosks, phones, and multifunction devices
- Call centers and telecommunications systems
What a Section 508-Compliant Website or Document Actually Requires
Because Section 508 points to WCAG 2.0 AA, compliance work covers the same four principles used across accessibility work generally, applied specifically to federal content:
- Perceivable: alt text on informative images, captions on video, sufficient color contrast
- Operable: full keyboard accessibility, visible focus indicators, no time limits that block task completion
- Understandable: consistent navigation, clear form labels and error messages, readable content structure
- Robust: clean semantic markup that works reliably with screen readers and other assistive technology
Electronic Document Requirements
A meaningful share of Section 508 findings come from documents, not web pages. An accessible federal PDF or Office document needs:
- A complete, logical structure tree with tagged headings, lists, and tables
- A reading order that matches the visual layout
- Descriptive alt text for images and charts
- Properly associated table headers
- A specified document language
What Is a VPAT and When Do You Need One2222
A Voluntary Product Accessibility Template, or VPAT, is a standardized document that maps your product against Section 508’s technical criteria. The completed document is often called an Accessibility Conformance Report (ACR). For each criterion, it states one of four conformance levels:
- Supports: the product fully meets the criterion
- Partially Supports: the product meets some but not all of the criterion
- Does Not Support: the product does not meet the criterion
- Not Applicable: the criterion does not apply to this product
“Need a current accessibility conformance report? Get a free scan.”
When You Need a VPAT
Any vendor responding to a federal RFP, listing a product on GSA Advantage, or selling software or digital services to a federal agency should expect to be asked for a VPAT. Federal contracting officers are generally required to review accessibility conformance documentation before completing a purchase. A vendor without a current, accurate VPAT is typically disqualified at that stage rather than scored down later in the process.
Common VPAT Mistakes
- Submitting an outdated VPAT that does not reflect the current product version
- Overstating conformance in a way that does not hold up under review, which creates both procurement risk and later legal exposure
- Treating the VPAT as a one-time deliverable rather than something to update after major product changes
Section 508 Compliance Checklist
Use this as a working checklist for a new or existing federal-facing product:
- Confirm keyboard accessibility for every interactive element, with no keyboard traps
- Verify visible, high-contrast focus indicators on all interactive elements
- Add descriptive alt text to informative images; mark decorative images appropriately
- Confirm text and UI color contrast meets WCAG 2.0 AA ratios
- Use semantic HTML and a logical heading structure throughout
- Test with at least one screen reader (NVDA or JAWS) and keyboard-only navigation
- Tag all distributed PDFs and Office documents with a proper structure and reading order
- Provide captions for video content and transcripts for audio content
- Ensure forms have programmatically associated labels and clear error messaging
- Document known issues, exceptions, and remediation timelines in a current VPAT
- Build a recurring review cycle, since a VPAT reflects a point in time and can go stale
- Train content authors and developers on accessible authoring practices so new content does not reintroduce issues
Enforcement and Real-World Risk
Section 508 enforcement runs primarily through procurement rather than fines in the way some other accessibility laws work. Federal contracting officers are required to verify Section 508 conformance before awarding ICT contracts, which means the practical consequence of non-compliance is losing or being excluded from federal business, not a flat penalty. The Consolidated Appropriations Act of 2023 also requires GSA to submit annual Section 508 compliance reports to Congress, adding an additional layer of visibility and accountability across federal agencies.
For agencies and contractors that also touch state or local government work, DOJ’s 2024 ADA Title II final rule, which requires WCAG 2.1 AA for state and local government websites, has raised the general level of attention on accessibility obligations across the public sector, including among federal contractors and the procurement community that supports them.
How Accessify Helps Federal Contractors and Agencies
Accessify’s AI-powered scanning identifies WCAG 2.0 and 2.1 AA issues across your website and application in minutes, then applies real-time, non-destructive fixes so your team is not starting a remediation project from zero. For contractors preparing a VPAT, Accessify ongoing monitoring gives you a documented, current record of conformance status, exactly the kind of evidence a contracting officer wants to see and the kind of documentation that protects you if a claim is ever made against a submitted VPAT.
Start a free Section 508 scan of your site →
FAQ Section
Q: What is the difference between Section 508 and the ADA?
Section 508 is a federal procurement and internal-use law that applies to federal agencies and their vendors. The ADA is a broader civil rights law; Title II covers state and local governments and Title III covers private businesses. Section 508 and ADA Title II both point to WCAG, though Title II requires the stricter WCAG 2.1 AA standard.
Q: Does Section 508 apply to private companies?
Only indirectly. Private companies without federal contracts or federal funding are not directly subject to Section 508, though they may still be subject to the ADA.
Q: What WCAG version does Section 508 require?
WCAG 2.0 Level AA, following the 2017 Access Board refresh that took effect in 2018. Many agencies now informally expect WCAG 2.1 or 2.2 AA as a more future-proof benchmark.
Q: What is a VPAT and who creates it?
A Voluntary Product Accessibility Template is a standardized report, typically created by the vendor or a third-party accessibility auditor, that documents a product’s conformance against Section 508’s technical criteria.
Q: Is Section 508 the same as PDF/UA?
No. PDF/UA (ISO 14289) is a separate international standard specifically for accessible PDF structure. Meeting PDF/UA generally satisfies the document-related portions of Section 508, but Section 508 covers a broader range of ICT beyond PDFs.
