Reviewed November 4, 2026

A VPAT Is Not a Website Conformity Claim: Where Stores Overstate

A VPAT is a reporting template, maintained by the Information Technology Industry Council, and the finished document is an Accessibility Conformance Report (ACR) stating, criterion by criterion, whether a product supports, partially supports, or does not support the standard, with remarks. It is a disclosure document, not a certification, and no body approves it. Claims beyond what the ACR actually examined invite the same demand letters the document was meant to prevent.

Somewhere in procurement, a VPAT became a talisman. A vendor produces one, a buyer files it, and both sides relax as if a certificate had been issued by somebody. Nobody issued anything. The document is the vendor's own structured statement about its own product, and its value depends entirely on whether the statements survive contact with the product.

For websites and storefronts the overstatement pattern repeats: an ACR written for the marketing site is waved at the checkout, a supports rating covers a template the audit never opened, and the public accessibility statement upgrades the whole thing into a conformance claim in plain English.

What the document is, precisely

The VPAT template asks for a level per criterion: supports, partially supports, does not support, or not applicable, with a remarks column for the explanation and the known exceptions. An honest ACR is full of partial ratings and specific remarks. An ACR that reads supports down fifty rows with empty remarks was not produced by an audit. It was produced by optimism.

Evaluations behind a credible ACR combine automated scanning with manual testing, including keyboard work and assistive technology passes, on a stated set of pages and user flows. The report should name its methods, its date, and its scope. Absent those three, the document cannot be checked, and an uncheckable conformance document is a marketing asset wearing a compliance costume.

Where the legal exposure actually sits

Publish a claim that the site is WCAG conformant and a plaintiff's expert will test the claim, not the intention. The gap between the public statement and the lived checkout becomes the exhibit. This is the sense in which an overstated ACR is worse than none: it supplies the standard, the promise, and the proof of shortfall in the other side's favorite order.

Section 508 procurement in the federal market formalized the ACR because buyers needed comparable disclosures. Private businesses borrowed the artifact without the discipline. If your store publishes an accessibility statement, keep its language matched to your actual audit scope and remediation state, and date it. Conformance in progress, honestly described, ages far better in a dispute than conformance claimed and quietly untrue.

Handling a vendor's ACR as a buyer

Read the remarks before the ratings. Ask which flows were tested, whether checkout and account pages were in scope, what assistive technology was used, and when. Ask what changed in the product since the report date, because an ACR describes a version, and storefront platforms ship weekly.

Then verify a sample yourself. Take three criteria rated supports and test them on your own storefront as configured, since your theme, apps, and content are not the vendor's demo. The ACR covers their product. Your liability covers your store. The overlap is the part you are actually buying.

Frequently asked questions

Is a VPAT a certification of accessibility?

No. A VPAT is a template for a self reported Accessibility Conformance Report. No authority certifies or approves it. Its credibility comes from the evaluation methods, scope, and honesty of its per criterion remarks.

What does supports mean in an ACR?

It is the vendor's statement that the product fully meets that criterion, ideally backed by the remarks column describing how it was evaluated. Ratings of partially supports or does not support, with specifics, are normal in an honest report.

Can I publish that my store is WCAG conformant based on a vendor ACR?

That is risky. The vendor's report covers their product as tested, not your configured store with your theme, apps, and content. Public conformance claims should match your own audit scope and current state.

What should I check before relying on a supplier's ACR?

Its date, the version and flows tested, the methods used including manual and assistive technology testing, and whether the remarks support the ratings. Then spot check a few supports ratings on your own storefront.