Accessibility Audits in 2026: Types, Process, Cost Ranges & Deliverables

Last updated: September 7, 2026

An accessibility audit is a systematic evaluation of a website, app, or document against a defined accessibility standard — usually WCAG 2.2 Level AA — that documents every barrier, where it occurs, who it affects, and how to fix it. This reference covers the full landscape: the four audit types, the process from scoping to read-out, current market pricing, what a professional report contains, and why an audit by itself does not reduce legal risk.

Key numbers: 95.9% of the top one million home pages had detectable WCAG 2 failures in 2026 — up from 94.8% in 2025 — averaging 56.1 errors per page (WebAIM Million 2026). ADA Title III federal filings rose 37% in H1 2025, and ecommerce businesses account for 69–77% of digital accessibility lawsuits (Seyfarth Shaw). WCAG 2.2 spans 86 success criteria (W3C); in TestParty's audit work, automated tools detect roughly 60–70% of issues — the remaining 30% require expert manual testing. Full manual audits run roughly $3,000–$15,000+ for a mid-size ecommerce site (published agency rates as of August 2026). As of August 2026, TestParty has remediated 35 million+ accessibility issues surfaced by audits and automated scans across customer stores.

What is an accessibility audit?

An accessibility audit measures a digital property against a formal standard — WCAG 2.2 Level AA for most commercial websites — and produces an evidence file: every failure, where it lives in the code, which users it blocks, and how to fix it.

The standard matters because "accessible" is not self-defining. US courts and DOJ settlements consistently reference WCAG, and the DOJ's Title II rule codified WCAG 2.1 AA for state and local governments — the first compliance deadline, April 2026 for jurisdictions of 50,000 or more, has already passed (ADA.gov). The European Accessibility Act, enforceable since June 2025, points to EN 301 549, which itself builds on WCAG. WCAG 2.2 contains 86 success criteria across three levels (W3C); Level AA is the de facto legal benchmark. Just as important is what an audit is not: a diagnosis, not a treatment. No auditor can issue an official "ADA certification," because no such certification exists.

What are the four types of accessibility audit?

There are four types of accessibility audit — automated scans, hybrid audits, full manual expert audits, and specialized audits such as VPAT/ACRs, mobile app, and PDF assessments — separated by how much expert human testing each includes.

+---------------------------------------------+----------------------------------------------------+----------------------------------------------------+----------------------+----------------------------------------------------+
|                  Audit type                 |                      Coverage                      |  Typical cost (published agency rates, Aug 2026)   |   Typical timeline   |                  When you need it                  |
+---------------------------------------------+----------------------------------------------------+----------------------------------------------------+----------------------+----------------------------------------------------+
|                Automated scan               | Machine-detectable failures only: contrast, missing alt text, unlabeled inputs, empty links |     Free to low hundreds per month for tooling     |   Minutes to hours   | Triage, budgeting, and monitoring between deeper audits |
+---------------------------------------------+----------------------------------------------------+----------------------------------------------------+----------------------+----------------------------------------------------+
|         Hybrid (automated + manual)         | Scanner coverage plus expert keyboard and screen-reader testing on key templates |               Roughly $1,000–$5,000                |      1–3 weeks       | First professional audit; pre-launch checks; most small and mid-size ecommerce sites |
+---------------------------------------------+----------------------------------------------------+----------------------------------------------------+----------------------+----------------------------------------------------+
|           Full manual expert audit          | Every applicable WCAG 2.2 AA criterion, tested by humans with assistive technology across sampled templates | Roughly $3,000–$15,000+ for mid-size ecommerce; complex enterprise engagements $10,000–$25,000+ |      2–6 weeks       | Litigation posture, conformance claims, procurement requirements, post-demand-letter |
+---------------------------------------------+----------------------------------------------------+----------------------------------------------------+----------------------+----------------------------------------------------+
|   Specialized (VPAT/ACR, mobile app, PDF)   | Conformance documentation, native iOS/Android testing, document tagging and reading order | VPAT/ACR roughly $350–$1,000 per edition on top of an audit; mobile and PDF scoped per platform or document |      1–4 weeks       | Government and enterprise sales; app-based commerce; document-heavy operations |
+---------------------------------------------+----------------------------------------------------+----------------------------------------------------+----------------------+----------------------------------------------------+

The rows differ mainly in human hours, which is why prices climb as manual coverage grows.

How do auditors decide which pages to test?

Auditors test a representative sample of unique templates and user flows rather than every page, following W3C's Website Accessibility Conformance Evaluation Methodology (WCAG-EM).

WCAG-EM calls for a structured sample: common pages, pages containing essential functionality, distinct content types, and a small random selection as a control. The economics follow from templates — one product-page template represents thousands of products, so a 5,000-SKU store might be fully covered by 10–50 sampled URLs. For ecommerce, a competent scope always includes the home page, navigation and search, a collection page, a product page, cart, the complete checkout, account creation, and at least one form — plus their states: empty cart, validation errors, open modals, and mobile breakpoints. Platform context changes the checklist too; our guide to how a Shopify accessibility audit is scoped and run covers theme code, app-injected markup, and checkout constraints specific to that platform.

What does the automated pass find?

The automated pass runs a rules engine such as axe-core — the open-source library behind Google Lighthouse — across every sampled page, flagging machine-detectable failures in minutes.

What it finds is predictable, because the same six error categories account for 96% of all detected failures: low-contrast text (on 83.9% of home pages), missing image alt text (53.1%), missing form labels (51%), empty links (46.3%), empty buttons, and missing document language (WebAIM Million 2026). Starting baselines are equally predictable: based on TestParty's analysis, Shopify's Dawn theme ships with 30–100 detectable violations out of the box, and premium themes carry 100–350. The ceiling is judgment. A scanner verifies that alt text exists, not that it says anything useful — `alt="image123"` passes every automated check. That is why automation covers roughly 60–70% of issues in TestParty's audit work and no more.

What does the manual expert pass cover?

The manual pass is where an audit earns its price: expert testers work every sampled flow with a keyboard alone, then with the screen readers real users rely on — NVDA and JAWS on Windows, VoiceOver on macOS and iOS.

The keyboard pass checks visible focus, logical tab order, skip links, and — the classic blocker — traps where focus enters a widget and cannot leave. Screen-reader passes verify accessible names, announced form errors, and live-region updates when a cart changes. Testers also magnify to 200–400% to confirm content reflows, and run cognitive walkthroughs: can a user complete the task with consistent navigation, plain-language errors, no punitive timeouts, and no redundant re-entry of data — the exact territory WCAG 2.2's newest criteria address (W3C). In TestParty's monthly expert audits of ecommerce stores, the most common blocker automation never flags is a checkout error that displays visually but is never announced — the card is declined and a screen-reader user hears nothing. Our comparison of manual versus automated accessibility testing details what each method structurally can and cannot catch.

How are audit findings classified?

Professional audits classify every finding on three axes: severity — how completely it blocks a task; the WCAG success criterion it violates; and legal risk — how often that failure type shows up in actual complaints.

A typical severity ladder runs blocker (a task is impossible: a keyboard-trapped checkout), critical (a core function is severely impaired), major (significant friction with a workaround), and minor (inconvenience or best-practice gap). The criterion mapping — number plus conformance level — determines what the finding means for a WCAG 2.2 AA claim. The legal axis reflects an uncomfortable pattern: complaints recycle the same detectable failures, chiefly missing alt text, unlabeled buttons, and menus that cannot be operated by keyboard. With 46% of H1 2025 federal ADA cases involving repeat defendants (Seyfarth Shaw), findings on revenue paths deserve the top of the queue regardless of raw counts.

What should an accessibility audit report contain?

A professional audit report contains seven components; a deliverable missing any of them is a scan export with a cover page, not an audit.

• Executive summary — conformance status against the target standard, issue totals by severity, and the top risks in plain language.
• Scope and methodology — exact URLs and templates tested, the assistive-technology and browser matrix, the standard and version, test dates, and tester credentials.
• Findings register — per issue: a unique ID, the WCAG criterion and level, precise location (URL plus component or selector), reproduction steps, user impact, severity, and evidence such as a screenshot or code excerpt.
• Fix specifications — developer-ready remediation guidance for each finding, ideally at code level; "make the menu accessible" is not a spec.
• Prioritized roadmap — sequencing by severity, legal exposure, and traffic.
• Retest terms — whether verification of fixes is included and within what window.
• Appendices — full tool output, the page inventory, and any commissioned VPAT/ACR.

What happens at the audit read-out?

The read-out is a working session, not a handoff: the auditor walks engineering, design, and legal through the findings, defends severity calls, and leaves every fix with a named owner.

Ownership is the real agenda. On an ecommerce site, findings split across theme code, third-party app markup, platform-controlled surfaces, and content operations — four different owners with four different fix paths. Expect debate on severity; a good auditor can tie each rating to user impact rather than tool output. Legal or compliance stakeholders should leave with the dated report and remediation plan, and the session should end with two dates on the calendar: ticket conversion and the verification retest.

What do VPAT, mobile app, and PDF audits involve?

Specialized audits answer narrower questions: a VPAT/ACR documents conformance for buyers, a mobile app audit tests native iOS and Android code with VoiceOver and TalkBack, and a PDF audit covers documents that HTML testing never touches.

A VPAT is the blank template; the completed document is an Accessibility Conformance Report, produced in WCAG, Section 508, EN 301 549, or combined international editions. Procurement teams in government, education, and enterprise increasingly require one — and an ACR is only as credible as the testing behind it, since reviewers do check claims. Mobile audits evaluate native controls, gestures, and focus management that web tooling cannot reach. PDF audits assess tags, reading order, and form fields against PDF/UA. Where these artifacts sit in a defensible paper trail is covered in our guide to accessibility compliance documentation.

How much does an accessibility audit cost in 2026?

Automated scanning costs nothing to low hundreds per month; hybrid audits run roughly $1,000–$5,000; and full manual WCAG 2.2 AA audits run roughly $3,000–$15,000+ for a mid-size ecommerce site (published agency rates as of August 2026).

Enterprise and multi-property engagements commonly reach $10,000–$25,000 and beyond at published rates, and VPAT/ACR production adds roughly $350–$1,000 per edition on top of a completed audit. Four factors move a quote more than anything else: the number of unique templates, the volume of dynamic states a human must exercise, the breadth of the assistive-technology matrix, and whether a verification retest is included. Rush delivery carries a premium. For line-item benchmarks, published rate cards, and how to compare quotes, see the 2026 accessibility audit cost breakdown.

How long does an accessibility audit take?

Automated scans return results in minutes; hybrid audits typically take one to three weeks; full manual audits two to six weeks; and enterprise or multi-platform engagements four to eight weeks or more.

The calendar is driven by manual-tester scheduling and scope, not software. Add roughly a week for VPAT/ACR production after testing closes, and build in the retest window — typically 30–90 days after remediation begins — before treating the engagement as done. Plan backwards from hard dates: a procurement deadline, an EAA market entry, or counsel's response date on a demand letter. A vendor promising a "full manual audit" of a complex store in three days is describing a scan.

Why don't audits alone reduce legal exposure?

An audit changes nothing on your website. Unfixed findings do not reduce legal exposure, because plaintiffs' firms test what your site does today — not what its owners know about it.

The market data makes the point bluntly: after years of record audit spending, 95.9% of the top one million home pages still failed WCAG 2 checks in 2026 — worse than 2025's 94.8%, with average errors per page up 10% to 56.1 (WebAIM Million 2026). Two forces produce that gap. First, findings are not fixes: reports land in backlogs while sprints fill with revenue work. Second, drift: every theme update, app install, and product upload can introduce new violations, so a report starts aging the day it is delivered. Closing the loop means funding website accessibility remediation alongside the audit — TestParty pairs its audits with source-code fixes on a 14-day initial remediation cycle, and in the history of the company, fewer than 1% of customers have been named in accessibility lawsuits while on the platform.

How often should you re-audit a website?

Re-audit on the cadence at which your site changes: for ecommerce, continuous automated scanning with monthly expert manual review; for slower-moving sites, quarterly scans with an annual full manual audit.

Ecommerce earns the aggressive cadence because it changes daily — and because only 11% of cart and checkout pages meet minimum WCAG standards to begin with (2025 eCommerce Accessibility Study). TestParty's operating model reflects this: daily AI scans plus monthly expert manual audits, producing date-stamped compliance reports as a running record. Certain events warrant an immediate off-cycle audit regardless of schedule: a replatform or theme change, a checkout redesign, entry into EU markets under the EAA, or a demand letter. Between full audits, accessibility monitoring is what catches regressions while they are cheap to fix.

How do you choose an accessibility auditor?

Evaluate auditors on three things: certified people, a methodology you can inspect before signing, and fix specifications a developer can act on without translation.

On credentials, look for IAAP certifications — CPACC for foundational knowledge, WAS for hands-on technical auditing, CPWA for both — or DHS Trusted Tester certification, which validates testers against the federal Section 508 test process. On methodology, the statement of work should name the sample, the assistive-technology and browser matrix, the standard and version, and the severity model; a vendor that will not show its method before payment is selling a black box. On fix quality, ask for a sample finding: if it lacks a code-level remediation spec, your developers will pay the translation cost later. Two red flags end conversations quickly: promises of "certified ADA compliant" status, and scan output resold as a manual audit.

Frequently Asked Questions

Is an accessibility audit required by law? No statute requires an audit; the laws require an accessible site. The ADA (as applied by courts), the DOJ's Title II rule for public entities, and the European Accessibility Act all target outcomes, not paperwork. An audit is the standard way to know where you stand, and a dated audit-plus-remediation record is widely used to demonstrate good-faith effort when a claim arrives.

What standard should an accessibility audit test against? WCAG 2.2 Level AA for most commercial websites. The DOJ Title II rule specifies WCAG 2.1 AA for state and local government; the European Accessibility Act works through EN 301 549, which builds on WCAG. Because WCAG 2.2 is backwards compatible (W3C), auditing against 2.2 AA also covers the 2.1 and 2.0 requirements regulators cite.

What is the difference between an accessibility audit and an automated scan? A scan is software output: fast, cheap, and limited to machine-detectable failures — roughly 60–70% of issues in TestParty's audit work. An audit adds human judgment: assistive-technology testing, complete task flows, severity ratings, and developer-ready fix specifications. Scans are the right triage and monitoring layer; only an audit supports a conformance claim.

How many pages does an accessibility audit need to cover? Audits are scoped by unique templates and flows, not raw page count. Under W3C's WCAG-EM methodology, a structured sample of 10–50 URLs covers most sites, provided it includes every template, essential functionality end to end, and key interaction states. For a store, that means the full purchase path — home to order confirmation — plus errors, modals, and mobile views.

Can we run an accessibility audit in-house? Partially. Any team can run free automated tools and a basic keyboard pass, and should. Full audits are harder to self-serve: screen-reader proficiency takes real training, and internal teams tend to inherit the assumptions baked into the code they built. Independent audits also carry more weight with procurement reviewers and counsel precisely because they are independent.

What should we do first after receiving an audit report? Convert the findings register into tracked developer tickets before momentum fades, fix blockers on revenue paths first, and book the verification retest. Then stand up monitoring so new releases don't silently rebuild the problem. Document dates at every step — the value of an audit in a dispute comes from the dated record of finding and fixing, not the PDF alone.

TestParty practices a cyborg approach to content: AI assists with research and drafting, our accessibility experts validate every claim. This article represents our editorial perspective based on public data as of the publication date. We compete in the digital accessibility space — which means we have informed opinions, but also a vested interest. All sources are cited so you can draw your own conclusions.