Back to reviews and guides

Section 508 Accessibility Requirements: What You Need to Know

A concise guide to Section 508 accessibility requirements: who must comply, what ICT is covered, how the rules map to WCAG 2.0, testing and VPATs, a practical remediation workflow, and common exceptions. Includes a quick checklist and roles to assign for ongoing compliance.

Section 508 Accessibility Requirements: a quick overview

Section 508 accessibility requirements are the part of the Rehabilitation Act that says federal agencies must make their electronic and information technology usable by people with disabilities. The rule set that agencies follow was updated to align web and software rules with WCAG 2.0 Level A and AA. The requirements apply to federal agency ICT and influence public procurement and vendor offers.

Who must follow Section 508

Federal executive agencies must comply when they develop, procure, maintain or use electronic and information technology. Contractors and vendors selling ICT to federal agencies also need to provide accessible products or documentation because procurement teams will require evidence of conformance.

What technologies are covered

  • Websites and web applications
  • Mobile apps
  • Desktop software and cloud apps
  • Electronic documents such as PDF, Word and Excel files
  • Multimedia: captions and audio description for video
  • Hardware with user interfaces, and telecommunications products
  • Support documentation and training materials

How Section 508 maps to WCAG

The technical requirements for web and software generally reference the Web Content Accessibility Guidelines (WCAG) 2.0 at Level A and Level AA. That means many success criteria under the WCAG principles perceivable, operable, understandable, robust are relevant. For non-web ICT there are separate technical provisions and functional performance criteria.

Key terms to know

  • Access Board the federal body that issues the technical standards
  • WCAG Web Content Accessibility Guidelines (commonly referenced in the 508 standards)
  • VPAT / ACR Voluntary Product Accessibility Template or Accessibility Conformance Report used by vendors to declare conformance
  • Functional performance criteria requirements that address real user capabilities such as vision, hearing and manipulation
  • Undue burden legal exception for agencies when accessibility would create significant difficulty or expense, with an obligation to provide alternative access where possible

How to test and document compliance

Testing for Section 508 should combine automated tools, manual inspection and assistive-technology testing. Use automated scanners to find straightforward failures. Add manual checks for keyboard navigation, focus order, visible labels, and semantic structure. Test with screen readers such as NVDA or JAWS and with keyboard only. For video, confirm captions and transcripts match the audio.

Vendors use a VPAT or Accessibility Conformance Report to summarise where a product meets or fails technical criteria. Agencies use those reports in procurement, but a VPAT does not replace hands-on testing.

Step-by-step remediation workflow (practical guidance)

This workflow helps teams fix accessibility problems without losing focus.

  1. Scope and priority

    List public-facing pages, core business applications and high-use documents. Prioritise based on frequency and the number of users affected. Start with critical user journeys: login, forms, data entry, reports.

  2. Baseline testing

    Run automated scans and create a prioritized issue list. Mark issues that block keyboard use, break content reading order or prevent form completion as critical.

  3. Manual validation

    Check critical pages with a screen reader and keyboard only. Verify headings, links, alt text, labels and error messaging. Document each failure with a short description, location, and WCAG success criterion if known.

  4. Fix in sprints

    Group fixes by type: HTML structure, ARIA roles, contrast, keyboard focus. Deploy fixes in short iterations and retest before closing tickets.

  5. Final acceptance testing

    Use an independent tester or a user with disabilities for the final review. Produce an updated VPAT or ACR and keep evidence: screenshots, test scripts, and assistive-technology logs.

  6. Ongoing monitoring

    Schedule regular scans, include accessibility in QA checklists, and require VPATs for new procurements.

Accessibility documentation and procurement

When buying ICT, ask vendors for a current VPAT or ACR. The report should be specific to the product version and include tests used to verify each criterion. Contract language should require accessibility maintenance and timely remediation for defects discovered after delivery.

Common exceptions and points agencies must consider

  • National security systems many standards exclude technologies built for national security
  • Undue burden if compliance creates significant difficulty or expense agencies must document the rationale and provide alternative access
  • Legacy systems old systems may be exempt temporarily but agencies still must seek alternative ways to deliver information

Roles and internal responsibilities

Assign a Section 508 coordinator who manages complaints, procurement reviewers, product owners and developers. Train procurement staff to evaluate VPATs. Give QA teams clear accessibility test cases. Make accessibility part of definition of done for new development.

Quick compliance checklist

  • Confirm whether the product is subject to Section 508
  • Request a current VPAT or ACR specific to the product version
  • Run automated scans on key pages and documents
  • Manually test with keyboard only and at least one screen reader
  • Fix critical failures that block user tasks first
  • Retest and update the VPAT or ACR and procurement records
  • Document any undue burden findings and alternative access offered

Common mistakes to avoid (information gain)

  • Relying only on automated tools. Automated tools catch about 25 to 40 percent of issues depending on the tool and the site. Manual checks are necessary for labels, language, and user flows.
  • Accepting a generic VPAT. A VPAT must be product- and version-specific with supporting evidence.
  • Fixing low-impact contrast issues before addressing keyboard traps or missing labels. Prioritise problems that stop users from completing tasks.

How complaints and enforcement work in practice

Agencies must maintain contact points for accessibility complaints and should have a documented process for responding. If someone cannot access information, they can submit a complaint to the agency. For further action, the complaint pathways may include agency-level review or other administrative remedies. Keep records of every complaint and your response timeline.

Next steps for teams starting compliance work

  • Run a rapid audit of core services and documents
  • Create a remediation register with owners, priorities and target dates
  • Require VPATs in procurement documents and build accessibility acceptance tests into acceptance criteria
  • Invest in basic accessibility training for developers, product owners and procurement staff

Where to learn more

Look for official guidance from the Access Board and agency Section 508 program offices for technical rules and updates. Use WCAG resources to understand web-specific success criteria and test techniques. Industry guidance on VPATs and accessibility testing can help operationalise compliance.