Section 508 Compliance: What It Means and Who Has to Meet It

What Section 508 actually is

Section 508 of the Rehabilitation Act of 1973 requires US federal agencies to make their electronic and information technology (ICT) accessible to people with disabilities — both employees and members of the public.

The law was significantly updated in 2017 with the Revised Section 508 Standards, which formally adopted WCAG 2.0 Level AA as the technical benchmark for web and software accessibility. That update brought Section 508 into alignment with international standards and clarified that the requirements apply to all ICT the federal government develops, procures, maintains, or uses.

Who has to comply

Section 508 applies to a broader audience than most vendors expect:

• Federal agencies — all executive branch agencies and their digital properties
• Federal contractors and vendors — any company that develops or provides ICT used by a federal agency
• Grant recipients — organizations receiving federal funding must also meet Section 508 requirements for their federally-funded programs
• SaaS and cloud providers — if a federal agency subscribes to your platform, Section 508 applies

Private sector companies with no federal relationship are not directly bound by Section 508. However, the ADA and state laws may still apply.

The standard: WCAG 2.0 Level AA

The 2017 Refresh of Section 508 incorporated WCAG 2.0 Level AA by reference. This means the POUR principles — Perceivable, Operable, Understandable, Robust — and all 38 success criteria at Levels A and AA must be met.

WCAG 2.0 is an older version than today's best practice of 2.2, but all versions are backward compatible. If your product meets WCAG 2.1 or 2.2 at Level AA, it exceeds the Section 508 web requirement.

What counts as ICT

The Revised Section 508 Standards cover a wide range of ICT:

• Websites and web applications
• Software and desktop applications
• Mobile apps
• Documents (PDFs, Word files, spreadsheets)
• Multimedia content (video, audio)
• Telecommunications products
• Hardware (kiosks, printers, copiers)
• Operating systems

VPATs and federal procurement

A Voluntary Product Accessibility Template (VPAT) is the standard format for documenting how your product meets Section 508 criteria. When completed by a vendor, it becomes an Accessibility Conformance Report (ACR).

Federal agencies require ACRs during the procurement process. A missing or inaccurate VPAT can disqualify a vendor. VPATs should be:

• Completed honestly — exaggerated conformance claims are a liability
• Updated whenever the product has a major release
• Based on actual testing, not assumptions
• Specific about which criteria are fully, partially, or not supported

The current VPAT template (v2.5) covers Section 508, WCAG 2.1, and EN 301 549, allowing vendors to address multiple standards in one document.

Section 508 vs the ADA

How to become compliant

• 1. Audit all ICT — Map every product and digital asset your agency or company uses or provides.
• 2. Run automated testing — Catch the most common WCAG 2.0 AA failures quickly across web properties.
• 3. Conduct manual and AT testing — Automated tools catch roughly 30–40% of issues. Screen reader and keyboard testing is essential.
• 4. Remediate and document — Fix issues systematically and track progress.
• 5. Produce accurate VPATs — Complete an ACR for each product. Be specific and honest about partial conformance.
• 6. Maintain a release cycle — Audit on every major release and review VPATs at least annually.