A supplier hands you a PDF titled "Accessibility Conformance Report" and every row says "Supports". Procurement treats it as evidence and signs. But the document is almost always written by the vendor about the vendor, and the baseline it measures against may not be the one your contract needs. For context on how unlikely a clean sheet is: the WebAIM Million, testing the top one million home pages in February 2026, found detected WCAG 2 failures on 95.9% of them, averaging 56.1 errors per page. This guide gives you a 36-point rubric for scoring a supplier's report in about thirty minutes, the version question that invalidates many of them, and the point at which you should refuse to accept the document as evidence at all.
What an ACR is, and what it is not
An Accessibility Conformance Report (ACR) is a completed template, usually the VPAT maintained by the Information Technology Industry Council, currently version 2.5Rev (April 2025). Four editions exist: 508 for revised US Section 508, EU for EN 301 549, WCAG for the W3C guidelines alone, and INT, combining all three.
The VPAT is the blank template; the ACR is the completed report. It is a self-declaration unless it says otherwise, not a certificate, an audit or a warranty, and it carries no legal presumption. What it gives you is a set of testable claims and a paper trail if they prove wrong. We score it like a questionnaire response, not a compliance artifact.
The template's vocabulary is precise, and checking it comes first. The terms are Supports (at least one method meets the criterion without known defects), Partially Supports (some functionality does not), Does Not Support (the majority does not), Not Applicable (not relevant), and Not Evaluated. That last matters: the template permits it only for Level AAA criteria. A report using it on a Level A or AA row is not being conservative; it is non-compliant with its own template, and you can say so.
The version trap: which EN 301 549, and which directive
This is where European procurement goes wrong in late 2026. ETSI published EN 301 549 V4.1.1 on 2 September 2026. It moves the web, document and software clauses from WCAG 2.1 to WCAG 2.2 Level AA (W3C Recommendation, 12 December 2024), revises real-time text in clause 6.2, and adds Annexes ZA and ZB mapping it to the Web Accessibility Directive and the EAA.
Publication is not citation. As the Irish National Disability Authority states, V4.1.1 is not yet cited in the Official Journal, so it confers no presumption of conformity; V3.2.1 (2021, on WCAG 2.1) remains the cited version for the Web Accessibility Directive. The NDA expects citation on 16 December 2026, a forecast rather than a legal fact.
A further point is widely reported incorrectly. For the EAA specifically, analysis of the citation record indicates that no harmonised standard has been cited for Directive (EU) 2019/882 at all; request M/587 was adopted on 14 September 2022, late against the Directive's own timetable. The presumption people attribute to EN 301 549 under the EAA belongs, where it exists, to the Web Accessibility Directive. Treat any claim that EN 301 549 "satisfies the EAA" as unverified.
Two consequences. A report claiming "EN 301 549" conformity without naming a version is unscoreable. And the VPAT EU edition is built on WCAG 2.1, so if you need WCAG 2.2, ask for the WCAG or INT edition.
The 36-point rubric
Nine criteria, scored 0 to 4. Score each independently and do not average away a zero.
| # | Criterion | 0 points | 4 points |
|---|---|---|---|
| 1 | Standard and version named | "WCAG compliant", or EN 301 549 with no version | Template edition, EN 301 549 version and WCAG version stated |
| 2 | Product scope pinned | Company-level claim, no product version | Named product, exact version, modules in and out of scope |
| 3 | Evaluation methods disclosed | Blank, or "internal testing" | Named tools, assistive technology with versions, manual/automated split |
| 4 | Independence | Unsigned self-assessment | Named third-party evaluator with methodology attached |
| 5 | Recency against release cadence | Older than 24 months, or predates the version you are buying | Dated within 12 months and against the version in the quote |
| 6 | Plausibility of the claim profile | Every A and AA row "Supports", no remarks | Mixed profile with specific Partially Supports entries, named defects |
| 7 | Remarks quality | Empty, or boilerplate repeated across rows | Each non-Supports row gives the defect, location and user impact |
| 8 | Correct terminology use | "Not Evaluated" on A or AA rows; unexplained "Not Applicable" | Terms used as defined; every Not Applicable justified in remarks |
| 9 | Remediation commitments | No roadmap, or "planned" | Dated fixes per defect, referenced in the contract |
Decision bands:
- 29 to 36: accept, after spot-checking two claimed-Supports criteria yourself.
- 21 to 28: accept with conditions. Attach remediation dates as deliverables with remedies.
- 13 to 20: return it for re-issue against the correct version and scope.
- 0 to 12: treat the product as unevidenced. Commission your own evaluation at the supplier's cost, or score the bid with no accessibility credit.
How to run it in thirty minutes
- Read the header block only: product, version, date, edition, evaluator. That settles criteria 1, 2, 4 and 5 before any success criterion.
- Read Evaluation Methods. If it names no assistive technology and no versions, criterion 3 is a zero and everything downstream unverifiable.
- Scan the conformance column, not the remarks, and count the distribution. An all-Supports A and AA profile, against a 95.9% real-world failure rate, is the strongest single signal that nobody tested.
- Read the remarks on every non-Supports row, plus two Supports rows tied to your workflow: keyboard-only completion of the main task, and the forms staff use daily.
- Score, band, and draft the contract condition before talking to the supplier.
Five findings that should stop the procurement
- "Not Evaluated" on Level A or AA rows, which the template forbids.
- A report dated before the version you are being quoted.
- An overlay cited as remediation for form labels, focus order or name/role/value.
- Scope written as the company, not the build you will install.
- A claim of EAA conformity "per the harmonised standard".
Turkey changes who has to ask
For buyers in Turkey the obligation is already live. Presidential Circular 2025/10, in the Resmî Gazete of 21 June 2025 (issue 32933), requires covered organisations to meet standards referenced to WCAG 2.2 and a Level A checklist from the Ministry of Family and Social Services, each forming an internal review commission that reports to a Monitoring Commission chaired by the Minister. Deadlines are staged: public institutions, municipalities, universities, banks, private hospitals and electronic communications companies were given one year, placing that date in June 2026; e-commerce providers two, placing theirs in June 2027.
Against the rubric: Turkish public bodies are past their date and inheriting supplier risk directly, so criterion 9 is the one to enforce hardest. An e-commerce buyer signing a multi-year contract now will be inside the obligation before it ends, making criterion 5 a forward-looking test. The transferable point elsewhere is that the Turkish regime attaches a named commission and a ministry reporting line, creating an identifiable owner you can name in the contract. Where your jurisdiction has none, name one in the statement of work.
Where this breaks down
This rubric scores a document, not a product. A supplier with a weak writer and a strong product scores badly; one with a good compliance team and a poor product can score 30. That asymmetry is the method's main limit, and why 29 and above still requires testing two criteria yourself.
It also handles non-web deliverables poorly. EN 301 549 clause 10 (non-web documents), clause 12 (product information and support) and clause 13 (relay and emergency access) each need their own questions, and a VPAT WCAG edition will not touch them. It says nothing about authoring tools, where the real question is whether your staff can produce accessible output. It is not a legal opinion: re-check the Official Journal before relying on the citation position in a contract. And it assumes leverage. Against a near-monopoly supplier the realistic output is a documented risk register and a remediation schedule, not rejection.
FAQ
Which VPAT edition should we ask for?
The edition matching the law that binds you. The EU edition maps to EN 301 549 but is built on WCAG 2.1. If you need WCAG 2.2, which V4.1.1 references, ask for the WCAG or INT edition, or the EU edition plus a WCAG 2.2 delta.
Does conformity with EN 301 549 mean we comply with the European Accessibility Act?
Not automatically. A presumption of conformity requires the reference to be published in the Official Journal for that specific Directive. On the published record none has been cited for the EAA, and V4.1.1 is not yet cited for the Web Accessibility Directive either. Conforming remains the right engineering target; it is the legal shortcut that does not exist.
Should we accept a self-assessed report at all?
Yes, with conditions. Most ACRs are self-assessed, and refusing all of them removes most of the market. Score independence as criterion 4, accept the lost points, and convert the gap into a contractual right to audit.
Can an accessibility overlay satisfy a supplier's claim?
Not for structural criteria. Overlays act on the rendered page and cannot reliably fix programmatic names, roles, values, focus order or semantic structure. An overlay cited as remediation for those is a finding, not a fix.
What if the supplier has no ACR at all?
Score it zero rather than leaving the criterion blank, then offer the template. A supplier willing to complete a VPAT honestly in three weeks is often a better partner than one with a polished all-Supports report.
Does Circular 2025/10 bind our suppliers or us?
The obligation sits with the covered organisation, which is why it must flow down through procurement. Your supplier is not the regulated party; you are. Contract terms are the only mechanism that transfers the risk.
Run this on your next bid
Score the reports in your procurement file against the nine criteria above, or send us the bid pack and the shortlisted ACRs and we will score them, test the claimed-Supports criteria that matter to your workflow, and draft the contract conditions. Start with our accessibility audit tooling.
Sources
- WebAIM Million: Accessibility Analysis of the Top 1,000,000 Home Pages, February 2026 data
- ITI, Voluntary Product Accessibility Template (VPAT 2.5Rev, April 2025)
- VPAT 2.5 WCAG Edition: a completed report showing the Terms section
- ETSI, EN 301 549 version directory (V4.1.1, 2 September 2026)
- EN 301 549 V4.1.0 draft text: clause structure and Annexes ZA and ZB
- W3C, WCAG 2.2, Recommendation 12 December 2024
- National Disability Authority (Ireland), on the citation status of EN 301 549 V4.1.1
- Legalithm, on the absence of an OJ citation under Directive (EU) 2019/882 and request M/587
- Directive 2014/24/EU on public procurement, recitals 76 and 99
- Presidential Circular 2025/10, Resmî Gazete 21 June 2025, issue 32933
