VPATs® for SaaS Companies: How to Get an Accessibility Conformance Report (ACR), Win the Contract

VPAT® expert Kris Rivenburgh explains VPATs and ACRs for SaaS companies, walking through a detailed guide that covers terminology, market demand, editions, audits, timelines, credibility, and when to update documentation. The process is straightforward and intuitive once the key concepts are understood. A VPAT is a Voluntary Product Accessibility Template. Once filled in, it becomes an Accessibility Conformance Report, or ACR. These terms are often used interchangeably in the market, but the distinction matters: the VPAT is the template, and the ACR is the finished report. Think of the ACR as a report card on a product or service's accessibility. It is not a marketing document. It is a cold, sterile reflection of the actual state of accessibility at the time of issuance. Demand for ACRs continues to grow through a network effect. More organizations are requiring this documentation as part of procurement, especially universities, enterprises, governments, and public entities. Having an ACR is just the starting point. What really sets a vendor apart is having a clean ACR that shows full or near-full WCAG conformance. If a SaaS company is seeing these requests for the first time, they should expect the demand to only increase. The most commonly used edition is the WCAG edition, which covers web-based SaaS applications broadly. The Section 508 edition applies when selling to the US federal government, and the EU edition applies for European buyers. The INT edition includes all editions and works for companies selling into multiple markets. Filling in a VPAT requires an accessibility audit, where a technical expert evaluates the digital asset against standards like WCAG 2.1 or 2.2 AA. The audit uses diverse evaluation methodologies including screen reader testing, keyboard testing, visual inspection, code inspection, and audible inspection. The resulting report identifies each issue along with its location, associated WCAG success criterion, applicable screenshot, relevant code, and a suggested fix. The soundness of the audit is everything, and right now there are enterprise accessibility companies that are not conducting audits properly because they are farming the work out without adequate quality control. Many SaaS companies choose to pause the process after receiving their audit report so they can fix the issues before their ACR is issued. This results in a much cleaner report card. The fix and validation cycle typically involves a few rounds, and sometimes full WCAG conformance is not achievable due to factors like third-party integrations. Buyers generally understand this and will evaluate one vendor's accessibility against another rather than requiring perfection. A credible ACR comes from an independent, reputable accessibility company using documented evaluation methodologies with a clearly defined scope, detailed remarks and explanations, and a qualified technical accessibility expert conducting the audit. Buyers are scrutinizing these documents closely and are aware of which vendors have poor reputations. Self-issuing an ACR is possible but carries the risk of bias and typically requires in-house expertise that most SaaS companies do not have. ACRs should be updated after significant version releases, major product changes, accessibility improvements, standard upgrades, buyer requests for current documentation, or when the existing ACR has become stale. There is no absolute requirement for annual updates, but freshness matters when a document is multiple years old. Accessible.org VPATs for SaaS companies guide: https://accessible.org/vpats-saas/ Accessible.org contact: https://accessible.org/contact #VPAT #SaaS #VPATs