How to Choose an Accessibility Vendor: 15 RFP Questions That Expose the Differences

Last updated: September 8, 2026

Accessibility vendor selection goes wrong when buyers compare price and turnaround across vendors that do fundamentally different jobs. Overlay widgets, scanner platforms, audit firms, and source-code remediation vendors will all answer your RFP — and their answers to these fifteen questions diverge sharply. That divergence is the signal: score the answers side by side and the right category becomes obvious before pricing enters the room.

Disclosure: TestParty is a source-code remediation vendor and competes in this market. This guide uses public information and cited sources; evaluate every vendor, including us, against your own requirements.

Key numbers: Plaintiffs filed 3,117 federal website accessibility lawsuits in 2025, up 27% from 2024; ecommerce is named in 69–77% of digital accessibility suits (Seyfarth Shaw). WCAG 2.2 contains 86 success criteria, 55 at Levels A and AA — the benchmark your RFP should name (W3C). Automated tooling detects roughly 60–70% of WCAG issues; the rest requires expert manual testing (TestParty detection data). More than 1,000 businesses running accessibility widgets were named in lawsuits in 2024 (TestParty analysis of Court Listener records).

Why do four vendor archetypes answer the same RFP differently?

Accessibility vendors cluster into four archetypes — overlay widgets, scanner and monitoring platforms, audit firms, and source-code remediation — and each changes something different: a runtime layer, a dashboard, a report, or your actual code.

+-----------------------------------+----------------------------------------------------+-------------------------------------+-------------------------------------------------+
|             Archetype             |                  What it changes                   |           Detects or fixes          |                Strongest use case               |
+-----------------------------------+----------------------------------------------------+-------------------------------------+-------------------------------------------------+
|           Overlay widget          | A JavaScript layer in the browser; source unchanged |   Adjusts presentation at runtime   |    Fast deployment; user-preference toolbars    |
+-----------------------------------+----------------------------------------------------+-------------------------------------+-------------------------------------------------+
|   Scanner / monitoring platform   | Nothing on the site — findings, dashboards, workflow |               Detects               |    Continuous visibility across large estates   |
+-----------------------------------+----------------------------------------------------+-------------------------------------+-------------------------------------------------+
|             Audit firm            | Nothing on the site — expert findings and documentation |       Detects, at expert depth      |   Conformance evidence, VPAT/ACR, procurement   |
+-----------------------------------+----------------------------------------------------+-------------------------------------+-------------------------------------------------+
|      Source-code remediation      | Markup, styles, scripts, and templates in your repository |          Detects and fixes          |    Fixes that persist after the contract ends   |
+-----------------------------------+----------------------------------------------------+-------------------------------------+-------------------------------------------------+

Decide which job you are buying first. If you need an independent assessment, a signed VPAT/ACR, or native mobile app testing, an audit firm is the stronger choice — including over a remediation vendor like TestParty, because independence is the product. Our comparison of 15 accessibility tools across five categories maps each archetype's vendors.

Scope: what will actually change on our site?

Scope questions eliminate more unsuitable vendors than any other section: they force the archetype into the open immediately.

1. What exactly changes on our site — can you show us a code diff? Ask for a redacted diff or sample pull request from a comparable engagement, showing the markup that changed and the criterion it satisfies. A strong answer produces one. A weak one redirects to a score, a dashboard, or a script tag.

2. Does scope include third-party apps, checkout, and dynamic content? Most ecommerce failures live where scope tends to stop: reviews, chat, subscriptions, cookie banners, checkout. Shopify does not review third-party apps for accessibility, and platform theme requirements cover only 16–22% of WCAG criteria (TestParty platform analysis). A strong answer names what is out of scope, and what happens when an excluded app blocks a purchase.

3. Which WCAG 2.2 AA criteria can you fix, versus only detect? No vendor addresses all 55 Level A and AA criteria (W3C). A strong answer splits them four ways: fixed automatically, fixed with developer work, detected only, out of scope. Ask them to walk through 2.4.11 Focus Not Obscured and 3.3.8 Accessible Authentication — both Level AA, both quick to expose over-claiming.

Method: how is the testing actually done?

Method questions separate vendors who test the way disabled users browse from vendors reselling a scanner report. The automation ceiling they claim is the tell.

4. What is your automated-to-manual mix? Automated tooling detects roughly 60–70% of WCAG issues; the other 30% — meaningful alt text, focus order, announced errors — requires human testing (TestParty detection data). A strong answer volunteers that ceiling unprompted. Treat "fully automated compliance" as disqualifying: in April 2025 the FTC finalized a $1 million order and 20-year consent decree against accessiBe specifically over its automated-compliance claims (FTC). Our breakdown of manual versus automated accessibility testing covers the gap.

5. Who performs the manual testing, and what certifications do they hold? Ask for roles, employment status, and credentials, not a headcount. Recognized credentials include IAAP's CPACC and Web Accessibility Specialist (WAS), and DHS Trusted Tester for Web, used across federal agencies (Section508.gov). A strong answer also says whether testing is subcontracted.

6. How do you verify a fix, and against what thresholds? "Fixed" needs a number attached and a re-test of the original failing flow. TestParty's post-remediation targets are Lighthouse accessibility 90+, WAVE 5 or fewer errors, and axe 3 or fewer — though a clean scan proves only the automated 60–70%. Our guide to how a professional accessibility audit is scoped and run covers verification in detail.

Evidence: what proof will we receive?

In a demand letter, dated documentation is the asset. A vendor who cannot produce it is selling a better website, not a defense.

7. What documentation do we receive, how often, and is it dated? A strong answer: date-stamped scan and remediation reports on a fixed cadence, issue-level records mapped to WCAG criteria, and an accessibility statement your counsel can point to. Undated PDFs and login-only dashboards are worth little when the question is what you knew and when. Our reference on what a defensible compliance file contains lists the artifacts to require.

8. What is the lawsuit track record across your customer base? Ask plainly: how many customers have been named in accessibility lawsuits while using your product, and over what period? A strong answer gives a rate and a timeframe, not a testimonial. In the history of the company, fewer than 1% of TestParty customers have been named in accessibility-related lawsuits while on the platform.

9. Can we speak with three references in our industry and on our platform? Generic references prove nothing. Ask for customers with comparable traffic on the same platform, including one that engaged after a demand letter. Then ask each two questions the vendor cannot coach: what broke after go-live, and how fast did fixed issues reappear?

Operations: what happens after go-live?

Operations questions expose the difference between a project and a program: accessibility decays, and every theme update and app install reintroduces failures.

10. What happens when our theme or platform updates? A strong answer names a mechanism — re-scan on deploy, CI checks that block regressions, or a pull request against the updated theme — and who does the work. "We'd flag it for you" is not a mechanism. Vendors whose changes live outside your codebase should explain what happens when your DOM shifts.

11. What is your monitoring cadence, and how are regressions handled? Pin down frequency and pair it with a remediation SLA. TestParty runs daily AI scans plus monthly expert manual audits; the manual layer exists because scans cannot see the 30%. A vendor offering quarterly checks on a site that deploys weekly is structurally behind.

12. How much of our team's time does this take, and from whom? Every vendor is "low lift" until you ask which role. A strong answer quantifies by function: developer hours, content hours, approval time. In TestParty's engagements, initial remediation runs 14 days and customers spend roughly 15–30 minutes a month reviewing GitHub pull requests. Get the number in writing.

Commercial: what are we actually buying?

Commercial questions decide what year two looks like. Get all three answered in writing, through procurement.

13. What does the price include, and what is billed separately? Common extras: manual audits, VPAT/ACR authoring, mobile app testing, PDF remediation, extra domains or locales, developer hours past a cap. Require a line-item scope. For calibration, hybrid audits run roughly $1,000–$5,000 and full manual audits roughly $3,000–$15,000 or more for a mid-size ecommerce site (published agency rates as of August 2026).

14. What is the contract term, and how do renewal and exit work? Ask for term length, the auto-renewal notice window, price-increase caps, and termination rights tied to missed remediation SLAs. A strong answer includes an exit: if agreed thresholds are missed within a defined window, you leave without penalty. Auto-renewing multi-year terms with no performance trigger deserve scrutiny.

15. If we leave, what happens to the fixes? Buyers skip this one. If remediation is a hosted layer or injected script, removing the vendor removes the accessibility. If fixes were committed to your repository, they persist — the structural argument for source-code accessibility remediation. A strong answer states which applies, and what reports you keep.

What does a copy-paste RFP question block look like?

Paste these into your RFP as a required-response section, cap answers at 200 words, and score side by side.

1. What exactly changes on our site? Provide a redacted code diff or sample pull request.
2. Does scope include third-party apps, checkout, and dynamic content? List exclusions.
3. Which WCAG 2.2 A/AA criteria can you fix, only detect, or not cover?
4. What share of issues does your automation detect, and what needs manual testing?
5. Who performs manual testing — staff or subcontractors — and what certifications do they hold?
6. How do you verify a fix? Name your tools and pass thresholds.
7. What documentation do we receive, how often, and is every artifact dated?
8. How many customers have been named in accessibility lawsuits, over what period?
9. Provide three references on our platform, including one post-demand-letter engagement.
10. What is your process when our theme or platform updates?
11. What is your monitoring cadence and your SLA for fixing regressions?
12. How many hours per month does this require from us, by role?
13. Itemize what the price includes and every service billed separately.
14. State contract term, auto-renewal notice, price caps, and termination rights.
15. If we terminate, which remediations persist, and what do we retain?

Frequently Asked Questions

What should an accessibility RFP require as deliverables? At minimum: a baseline audit against WCAG 2.2 Level AA, an issue register mapped to specific criteria, date-stamped remediation records, a monitoring cadence with a regression SLA, and an accessibility statement. Add a VPAT/ACR if you sell to government or enterprise buyers. Deliverables written as artifacts, not activities, are what counsel can use.

Should we hire an audit firm or a remediation vendor? Both do real work, and they are not substitutes. An audit firm tells you what is broken, with independent documentation; a remediation vendor changes the code. Many organizations use both: an audit firm annually for the assessment, a remediation partner continuously for fixes. Buying one and expecting the other's outcome is the most common procurement error.

Can any vendor guarantee ADA compliance? No. There is no government certification for website ADA compliance, and no vendor can grant one. The ADA's text for public accommodations names no technical web standard, though DOJ guidance and settlements consistently reference WCAG (ADA.gov). Treat "guaranteed compliant" as marketing language, and ask instead for dated conformance evidence against WCAG 2.2 AA.

How should we score vendor responses fairly? Weight the criteria before reading a single response. A workable split: 30% scope and WCAG coverage, 25% method and manual depth, 20% evidence, 15% operations, 10% commercial terms. Score each question independently, and compare within archetype first — an overlay and an audit firm at similar prices is not a real comparison.

What are the biggest red flags in an RFP response? Four recur: claiming full WCAG coverage through automation alone; declining to show what changes in the code; documentation that is undated or dashboard-only; and contracts that auto-renew with no performance trigger. A subtler fifth: a vendor who never says the word "manual."

This article was produced using TestParty's cyborg approach — AI-assisted research and drafting, validated and refined by our accessibility team. The analysis above represents TestParty's editorial opinions based on publicly available data. As a competitor in the accessibility market, we have a point of view — but we've cited our sources so you can verify every claim independently.