Section 508 Compliance: The Complete Guide

What Is Section 508?

Section 508 is a provision of the Rehabilitation Act, the 1973 federal law that prohibits disability discrimination in programs run or funded by the federal government. Section 508 itself was added to the Act in 1986, but the version that matters today comes from the Workforce Investment Act of 1998, which rewrote it into an enforceable mandate: federal agencies must ensure that the electronic and information technology they develop, procure, maintain, or use is accessible to people with disabilities, both federal employees and members of the public.

The 1998 amendment directed the U.S. Access Board, an independent federal agency, to publish technical standards defining what “accessible” means. The Access Board issued its original standards in December 2000, and enforcement began in 2001. Those original standards were written for the technology of their era and grew increasingly out of step with the web, which is why the Access Board eventually replaced them.

Two things distinguish Section 508 from most accessibility laws. First, it is a procurement law as much as a civil rights law: accessibility is baked into how the federal government buys technology, which gives it enormous indirect reach over the private vendors that sell to it. Second, it comes with a concrete technical standard, so “compliant” has a testable definition rather than being argued case by case.

This guide goes deep on the law, the standards, and the process. If you want a shorter, conversational introduction first, start with our blog post Section 508 Compliance Explained and come back here for the detail.

What Counts as ICT?

The Revised Standards use the term information and communication technology (ICT), and it is deliberately broad. If a federal agency develops it, buys it, maintains it, or uses it, and it stores or transmits information, it is likely in scope.

Procurement and the VPAT Process

Because Section 508 operates through purchasing, its paperwork revolves around one document: the Accessibility Conformance Report (ACR), almost universally called a VPAT after the Voluntary Product Accessibility Template it is built on. The template is published by the Information Technology Industry Council (ITI) and comes in editions covering Section 508, WCAG, and the European EN 301 549 standard.

A VPAT walks through each applicable criterion and asks the vendor to declare a conformance level: supports, partially supports, does not support, or not applicable, with remarks explaining each answer. Federal buyers use these reports to compare products during market research and evaluation, and a missing or obviously careless VPAT is a red flag that can cost you the deal.

Three things make a VPAT/ACR credible. First, it is based on actual testing, automated plus manual, rather than aspiration. Second, it is honest about gaps: “partially supports” with a clear remark and a remediation plan reads far better to an experienced buyer than a suspicious wall of “supports.” Third, it is current: buyers discount reports that predate the product version they are evaluating. A VPAT is a disclosure document, not a certification, and nobody certifies you as “508 compliant.” The report simply documents what you tested and what you found.

Prioritizing Remediation

Most audits produce more findings than a team can fix at once. Prioritize by user impact and reach rather than working down the list in order.

• 1. Blockers on core tasks

  Fix anything that prevents a user from completing a primary journey first: forms that cannot be submitted by keyboard, unlabeled required fields, focus traps in modals, and inaccessible authentication. A blocker on one critical path outweighs dozens of cosmetic issues.

• 2. Issues in shared components

  A contrast failure in your navigation or a missing label in a shared form control repeats on every page. Fixing shared templates and components collapses hundreds of findings into a handful of changes, which is the fastest way to move an overall score.

• 3. High-traffic pages and documents

  Weight fixes by how many people encounter them. The homepage, search, top landing pages, and your most-downloaded PDFs come before rarely visited archive content.

• 4. Everything else, tracked and scheduled

  Lower-severity findings still matter for conformance. Track them in your backlog with owners and dates, and reflect the honest current state in your VPAT remarks. Documented, in-progress remediation is a defensible posture; an undocumented pile of known issues is not.