Accessibility Audit vs VPAT vs ACR
What GCC Organisations Need to Know
Standards & Compliance
When a buyer asks for your VPAT, they usually want a completed Accessibility Conformance Report. That document is different from an accessibility audit. An audit produces detailed findings that help teams identify and fix barriers. An Accessibility Conformance Report summarises how a specific product or service supports the requirements in a selected accessibility standard. Most organisations preparing an accurate report need a thorough evaluation first, but they do not always need to publish the underlying audit report.
Understanding the distinction prevents two common problems. Product teams avoid commissioning the wrong deliverable, and procurement teams receive evidence that is useful for evaluating a supplier rather than a document prepared only to satisfy a tender requirement.
The Difference at a Glance
Question
Accessibility audit
VPAT
ACR
What it is
A structured evaluation of a defined product or experience
A blank reporting template published by ITI
A completed report based on a VPAT template
Main purpose
Find barriers and guide remediation
Provide a standard reporting structure
Communicate conformance information to buyers
Primary audience
Product owners, designers, developers and accessibility teams
Evaluators preparing a report
Procurement teams, buyers and customers
Typical detail
Issue location, impact, success criterion, evidence and recommended fix
Instructions, tables and rating fields
Criterion-level ratings with explanations and testing information
Does it identify fixes
Usually yes
No
Usually not in implementation detail
Can it support procurement
Yes, as supporting evidence
Not while blank
Yes, this is one of its main uses
Is it a certification
No
No
No
When to update
After material changes or before major validation points
Use the current applicable edition
When the documented product, scope or conformance status changes
What an Accessibility Audit Provides
A professional accessibility audit evaluates a defined website, application, platform or digital service against an agreed standard, usually WCAG at a specified version and level. The scope may also include additional contractual or regulatory requirements. The evaluation should identify the product version, pages or views, user journeys, components, technologies and test environments that were examined.
A reliable audit combines automated checks with expert evaluation. W3C guidance explains that WCAG testing involves both automated testing and human evaluation, because many success criteria depend on context, interaction and an understanding of how people with disabilities use digital products.
A useful audit report normally records:
- the affected page, view, component or user journey
- the relevant WCAG success criterion and conformance level
- the observed barrier and its effect on users
- steps and evidence needed to reproduce the issue
- severity or remediation priority
- practical guidance for correcting the issue
- the result of any retest after remediation
The audit report is primarily a working document. It helps designers, developers, content teams and product owners plan remediation and verify corrections. It is often kept confidential because it can contain detailed defect information, screenshots, test data and internal system context.
Related VisiAble guidance: What Does a Professional Website Accessibility Audit Actually Include and Automated vs Manual Accessibility Testing.
What a VPAT Is
VPAT stands for Voluntary Product Accessibility Template. It is a free reporting template published by the Information Technology Industry Council, commonly known as ITI. The template translates accessibility standards into tables that can be completed for a particular information and communication technology product or service.
A blank VPAT says nothing about the accessibility of a product. It provides the structure, instructions and terminology used to prepare a report. At the time of publication, ITI lists VPAT 2.5Rev, dated April 2025, as the current version.
The Four VPAT Editions
ITI provides four editions for different markets and procurement requirements:
- VPAT 508 covers the Revised Section 508 standards used in United States federal procurement.
- VPAT EU covers EN 301 549, the European accessibility standard for ICT procurement.
- VPAT WCAG covers WCAG 2.0, WCAG 2.1 and WCAG 2.2.
- VPAT INT combines the 508, EU and WCAG requirements in one international edition.
For VPAT accessibility reporting, select the edition that matches the buyer’s requirements. A request concerning Section 508 compliance may require the 508 or INT edition, while another project may require WCAG or EU coverage. Confirm the required edition and standards before evaluation. The ITI VPAT guidance explains the available formats; a completed report communicates evaluated conformance and does not itself certify legal compliance.
What an Accessibility Conformance Report Is
Once a VPAT is completed with documented evaluation results for a specific product or service, the finished document is called an Accessibility Conformance Report, or ACR. In everyday procurement conversations, people often continue to call the completed report a VPAT, but ACR is the more accurate term.
An ACR identifies the product and version being reported, the applicable standards, the report date, the evaluation methods and the conformance status for each applicable requirement. The current ITI template uses the ratings Supports, Partially Supports, Does Not Support and Not Applicable, with explanatory remarks for each reported result.
The intended reader is usually a buyer, procurement officer, accessibility reviewer or customer assessing a product. Section508.gov describes ACRs as documents that help government buyers assess ICT accessibility during market research and proposal evaluation. An ACR therefore needs to be concise enough for procurement review while still explaining limitations honestly.
An ACR Is Not a Certificate
Neither ITI nor W3C certifies an organisation simply because it publishes an ACR. The report records the conformance information declared for a defined product, version and scope. It does not guarantee that every user will encounter no barriers, and it does not by itself establish legal compliance in every jurisdiction.
An organisation may prepare its own ACR or engage an independent evaluator. Independence can strengthen buyer confidence, but the value of the document still depends on the evaluation scope, test methods, evidence, evaluator expertise and accuracy of the remarks. A third-party logo cannot compensate for weak testing or an incomplete scope.
How the Documents Work Together
An accurate ACR needs a defensible evaluation. That evaluation may be delivered as a separate accessibility audit report or conducted specifically to prepare the ACR. The important point is that the conformance ratings must be supported by evidence rather than assumptions or an automated scan alone.
- The audit discovers barriers and gives delivery teams the detail needed to correct them.
- Remediation addresses the findings in code, content, design and product behaviour.
- Retesting checks whether the corrections work and whether related regressions were introduced.
- The ACR summarises the resulting conformance position for buyers using the selected VPAT edition.
- Ongoing review keeps the report aligned with the product as features, interfaces and content change.
Preparing the ACR before remediation is possible, but the report may contain many Partially Supports or Does Not Support ratings. That can still be honest and useful if the remarks explain the limitations clearly. It should not be presented as evidence of full accessibility.
Which Deliverable Your Organisation Needs
You Need a Remediation Roadmap
Choose a professional accessibility audit. Your team needs issue-level evidence, prioritisation and correction guidance. A completed ACR is too high-level to serve as the main development backlog.
A Buyer or Tender Requests a VPAT
Confirm that the buyer wants a completed ACR and ask which VPAT edition, standard and product version must be covered. The work will normally include an accessibility evaluation followed by completion of the appropriate template. If the product has significant barriers, remediation and retesting should be planned before the final report is issued.
You Are Preparing a Major Product Release
Use an audit or conformance evaluation to identify release risks. Prepare or update the ACR if customers rely on it for procurement. The report date and product version should match the release being offered to buyers.
You Are Evaluating a Supplier
Request a current ACR for the exact product and version being purchased. Review the evaluation methods, scope, remarks and nonconforming items rather than checking only whether a document exists. For important workflows, reserve the right to test the product or request supporting evidence. Section508.gov procurement guidance recommends complete ACR information and recognises that agencies may perform their own testing.
You Operate a Website Without a Procurement Request
A detailed accessibility audit may provide more immediate value than an ACR because it tells the website team what to fix. An ACR becomes useful when a customer, contract, procurement policy or market entry requirement asks for a standardised conformance report.
What a Reliable ACR Should Contain
- the exact product or service name and version
- a clear report date and reporting period
- the applicable VPAT edition and accessibility standards
- a defined scope, including material exclusions and third party components
- the evaluation methods, tools, platforms, assistive technologies and test environments used
- evidence-based ratings for every applicable requirement
- specific remarks that explain support, limitations and known barriers
- contact information or a process for accessibility questions
- an accessible document format that people with disabilities can use
Be cautious when every row says Supports but the report gives little information about testing, scope or product limitations. Also question reports with no product version, an old date, missing tables, generic remarks or conclusions based only on automated scanning. These weaknesses do not automatically prove the product is inaccessible, but they reduce the report’s value as procurement evidence.
What Procurement Teams Should Ask
- Does this ACR cover the exact product, version and configuration we plan to purchase?
- Which standard and VPAT edition were used, and do they match the tender requirement?
- Who performed the evaluation and what methods were used?
- Were keyboard use, screen reader interaction, zoom, reflow, focus behaviour and error handling tested?
- Which critical workflows were included?
- What does each Partially Supports or Does Not Support rating mean for users?
- Is there a remediation plan and a date for retesting?
- How will the supplier keep the ACR current after product changes?
Considerations for GCC Organisations
Organisations in the Gulf may encounter ACR requests when supplying technology to government entities, universities, large enterprises or international partners. The VPAT format was developed for ICT procurement and includes editions for United States, European, WCAG and international requirements. Its usefulness in a GCC tender depends on what the buyer actually requests.
If a tender asks for WCAG evidence but does not name a VPAT edition, the requirement should be clarified before preparing the report. The buyer may need a detailed audit, an ACR, a remediation plan, evidence of testing in Arabic and English, or a combination of these. Arabic interfaces should be evaluated as real product experiences, including right-to-left layout, language markup, mixed-direction content, keyboard order, forms and assistive technology output.
A Practical Decision Rule
Choose the deliverable according to the decision it must support. Use an accessibility audit when the organisation needs to understand and fix barriers. Use an ACR when a buyer needs a structured statement of product conformance. Use the current VPAT edition as the template for preparing that ACR. When procurement and remediation are both important, commission the audit first and prepare the ACR from the validated results.
Questions Organisations Ask
Is a VPAT the same as an ACR?
No. The VPAT is the blank template. The completed document for a specific product or service is the Accessibility Conformance Report. In informal procurement language, people often use VPAT to mean the completed report.
Does an ACR prove that a product is fully accessible?
No. It documents conformance information for a defined scope and date. It may record partial support or known failures, and it does not provide universal legal certification.
Can automated testing produce an accurate ACR?
Automated tools can support the evaluation, but they cannot assess every WCAG requirement or every user interaction. Human evaluation is needed for context, keyboard operation, assistive technology behaviour, meaning and complete workflows.
Do we always need a separate audit report before preparing an ACR?
A reliable ACR requires a thorough evaluation, but that evaluation does not always need to be issued as a separate document. A detailed audit report is valuable when remediation teams need issue level findings.
Which VPAT edition should we use?
Use the edition requested by the buyer or required by the relevant market and contract. Confirm the requirement before testing begins.
How often should an ACR be updated?
Update it when a material product release, redesign, new component, changed scope or remediation work affects the reported conformance position. The report should continue to match the version being sold or procured.
Does every website need a VPAT or ACR?
No universal rule requires every website to publish one. A detailed website audit may be the more useful starting point unless a buyer, tender, contract or procurement policy requests an ACR.
How VisiAble Can Help
VisiAble can define the evaluation scope, conduct professional accessibility testing, document findings at success-criterion level, support remediation and retesting, and prepare an Accessibility Conformance Report using the appropriate VPAT edition. For procurement-led projects, the deliverables can be aligned with the tender requirements while keeping every conformance statement tied to evidence.
Explore Professional Accessibility Audit, review Our Standards, or contact VisiAble to discuss the correct deliverable for your organisation.
