How to Generate a VPAT in 30 Seconds (Without Hiring an Auditor)

If you sell software to enterprises, government agencies, or educational institutions, you have probably run into a procurement requirement for a VPAT. Maybe a sales prospect sent you a questionnaire with “Please provide your current VPAT” buried in item 47. Maybe you lost a deal because you could not produce one. This article explains what a VPAT is, what it contains, and how to generate one quickly without engaging an auditing firm.

What Is a VPAT?

VPAT stands for Voluntary Product Accessibility Template. It is a standardized document, maintained by the Information Technology Industry Council (ITI), used to describe how a product meets accessibility standards. It is “voluntary” in the sense that there is no law requiring you to publish one — but government procurement rules (especially under Section 508 of the Rehabilitation Act in the US) require agencies to evaluate vendor products for accessibility before purchasing, and a VPAT is how vendors communicate their accessibility status.

In practice, a VPAT is a claim by the vendor about their product's accessibility. It is self-attested — there is no certification body that validates it. An auditing firm can produce a more defensible VPAT based on their independent testing, but the format and the attestation are always the vendor's responsibility.

Why Procurement Teams Demand It

Section 508 requires US federal agencies and federally-funded organizations to ensure that the ICT (information and communication technology) they buy is accessible. The law puts the burden on the procurement team to evaluate accessibility. A VPAT gives them something to evaluate without doing the testing themselves.

Enterprise procurement teams at large companies have adopted the same pattern. It is easier to ask vendors “do you have a VPAT?” than to run accessibility tests on every product under evaluation. Universities, hospitals, state and local governments all use VPATs as a procurement filter. Without one, you are at a disadvantage against competitors who have them — even if your product is more accessible.

The Five Sections of VPAT 2.4

The current version is VPAT 2.4, released in 2021. A complete VPAT covers three standards:

1. Section 508: The US federal accessibility standard, which since 2017 has incorporated WCAG 2.0 AA by reference (plus some additional hardware/telephony requirements).
2. WCAG 2.x: Typically WCAG 2.1 AA for current products. The VPAT template includes columns for A, AA, and optionally AAA criteria.
3. EN 301 549: The European harmonized standard for ICT accessibility, which maps to the EAA. Required if you sell into the EU market.

The document itself follows this structure:

1. Product description and contact information — who made it, what it is, who to contact with accessibility questions
2. Evaluation methods used — automated testing, manual testing, assistive technology testing, user testing
3. Section 508 conformance table — row per criterion, columns: Conformance Level (Supports / Partially Supports / Does Not Support / Not Applicable) and Remarks
4. WCAG 2.x conformance table — same format, all 78 Level A and AA success criteria
5. EN 301 549 conformance table — same format, references the WCAG section plus additional non-web clauses

Sample VPAT Excerpt

Here is what a few rows of the WCAG section look like in a real VPAT:

Cost Comparison: Auditor vs. Certvo Generator

A professionally produced VPAT from an accessibility auditing firm typically costs $5,000–$30,000 depending on the complexity of the product, the number of pages and components in scope, and whether the firm needs to test with multiple screen readers and browsers.

The advantage of a professionally audited VPAT is defensibility: if a procurement team pushes back, you can say an independent firm conducted the testing. The disadvantage is cost and time — a full audit takes 4-8 weeks and requires significant back-and-forth with the auditing team.

Certvo's VPAT generator at /tools/vpat-generator produces a VPAT based on your Certvo scan results. It is free for users on paid plans. Important caveats to understand:

• Self-attested: The VPAT reflects what Certvo's automated scanner found plus your own inputs on manual testing. It is not independently certified.
• Valid for most procurement purposes: The vast majority of enterprise and government procurement teams accept self-attested VPATs as a starting point. Federal agencies do as well — the law requires them to evaluate the VPAT, not to demand a third-party audit for every purchase.
• Not a substitute for compliance: A VPAT documents your accessibility status; it does not create it. If your product has significant accessibility gaps, the right fix is to remediate, not to produce a more optimistic VPAT.

For most SaaS companies selling to enterprises, a Certvo-generated VPAT will unblock procurement conversations that are currently stalled. For companies selling to US federal agencies as a significant contract, investing in a professionally audited VPAT is worth the cost.

How to Generate Yours in 30 Seconds

1. Run a Certvo scan on your product
2. Review the results and mark any issues as “Known Issue (remediation planned)” or “Not Applicable” where relevant
3. Go to /tools/vpat-generator
4. Enter your product name, company name, and evaluation methodology
5. Click Generate — the VPAT downloads as a Word document in the official ITI format

The generator pre-fills conformance levels based on your scan results and leaves the remarks fields editable so you can add context about known issues and remediation timelines. The resulting document looks exactly like a manually-produced VPAT — because the template is the same.