VPAT vs ACR vs Accessibility Statement: The Differences

Last updated: October 6, 2026

A VPAT is the blank ITI template, an ACR is that template filled out for your product, and an accessibility statement is a public commitment page — buyers ask for the first two, regulations increasingly require the third. All three describe accessibility; none of them create it. This guide compares what each document is, who prepares it, and how they connect to actual conformance work.

Key numbers: The VPAT is currently in its 2.5Rev edition (April 2025), published in four versions — 508, EU, WCAG, and INT — by the Information Technology Industry Council (ITI). WCAG 2.2 defines 86 success criteria, 55 at Levels A and AA — the set a VPAT's WCAG or INT edition maps against (W3C). The EAA sets penalties up to €500,000 per member state and requires covered service providers to publish an accessibility statement explaining how their service meets the requirements (Directive (EU) 2019/882, EUR-Lex). TestParty has remediated 35 million-plus accessibility issues to date across 100+ brands — the underlying evidence base a credible ACR or statement has to describe accurately. In TestParty's audit work, automated tooling detects roughly 60–70% of issues; the rest requires manual testing, and any ACR's methodology section should say so.

What's the actual difference between a VPAT, an ACR, and an accessibility statement?

A VPAT is a blank form; an ACR is that form completed for a specific product; a statement is a standalone public page about a service, not a product-by-product form at all. Confusing the three is the single most common procurement mistake.

What are the VPAT editions, and which one do you need?

ITI publishes four VPAT 2.5Rev editions, and picking the right one is mostly about which buyer is asking and which country's law they answer to.

Most SaaS and ecommerce-platform vendors default to INT because one document serves every RFP that lands on their desk. A vendor selling only to US federal agencies has no reason to complete the EU columns. Our full VPAT and Accessibility Conformance Report guide walks the section-by-section completion process for each edition.

What separates a credible ACR from a marketing document?

A credible ACR states "Supports," "Partially Supports," "Does Not Support," or "Not Applicable" for every applicable criterion, with a remarks column explaining each non-"Supports" answer — and it names the methodology behind those answers.

An ACR where every row reads "Supports" is a red flag, not good news: no product tested against all 55 WCAG 2.2 Level A/AA criteria clears every one, and a spotless ACR usually means the vendor never ran a real test against the rows it filled in. The remarks column is where credibility actually lives — "Partially Supports: form error messages are announced visually but not to assistive technology; fix scheduled Q1" is a usable answer; a blank remarks column next to "Partially Supports" is not. Who prepared it matters too: an internal ACR reflects the vendor's own testing, while a third-party-audited ACR carries an independent auditor's name and methodology, which is what most public-sector and enterprise security reviews specifically ask for. A formal WCAG audit — sample, tool-and-screen-reader matrix, findings register — is the raw material either way; see a full sample audit report for what that evidence actually looks like section by section.

What does an accessibility statement need to say?

An accessibility statement names the service it covers, the standard it targets, how the service meets that standard, its known limitations, and a feedback channel — and, for EU-covered services, it is a legal requirement, not a courtesy.

Annex V of the EAA requires covered service providers to publish an explanation of how their service meets the accessibility requirements, in their terms and conditions "or equivalent," available in an accessible format (Directive (EU) 2019/882). We cover that obligation in detail for Shopify stores selling into the EU. A good voluntary statement — the kind US brands publish with no EAA exposure at all — follows the same shape W3C's WAI recommends in its accessibility statement guidance: specific, dated, honest about gaps, and never claiming "fully accessible" when an audit says otherwise. Overclaiming in a statement is worse evidence than publishing nothing, because it hands a contradiction to anyone who tests the site.

When does an ecommerce brand actually need each document?

Ecommerce brands need a VPAT/ACR pair when selling software or a platform to an enterprise or government buyer, and an accessibility statement whenever the storefront itself faces consumers — those are different triggers, and a brand can face both at once.

A platform vendor selling to a school district needs an ACR; the same vendor's own storefront, if it sells to EU shoppers, separately needs a statement. One document does not substitute for the other.

How do these documents connect to actual conformance work?

None of the three documents create accessibility — they describe testing that already happened, which means the audit has to come first or the document is fiction. Treat it as a pipeline: audit, then ACR or statement, then republish when the product changes.

In TestParty's audits of ecommerce and platform customers, the pipeline runs the same way every time: a scoped WCAG evaluation produces a findings register, the findings register becomes the "Partially Supports" remarks in an ACR or the "known limitations" section of a statement, and remediation work closes specific rows rather than rewriting the whole document from memory. TestParty's own compliance posture — daily automated scans plus monthly expert manual audits, with date-stamped reports — exists precisely so that an ACR or statement built from it stays current instead of describing a version of the product that shipped a year ago. The broader documentation practice, not just these two forms, is covered in our guide to accessibility compliance documentation.

What happens when a document outruns the site's actual state?

A VPAT, ACR, or statement that claims more conformance than an independent test would find is not a paperwork error — it is a false representation, and in procurement that can expose a vendor to a false-claims dispute, not just a retest.

Buyers increasingly know to check: a government evaluator can request a redacted sample finding behind an ACR's "Supports" rows, and a plaintiff's expert in an EU statutory complaint can simply test the site against the statement's own claims. The safer posture, in TestParty's experience supporting these documents, is a document that slightly undersells a product actively being remediated over one that oversells a product frozen in whatever state it was in when someone last filled out the form.

Frequently Asked Questions

Is a VPAT the same thing as an ACR? No. A VPAT is the blank template ITI publishes; an ACR is that template completed with actual test results for a specific product. People use "VPAT" loosely to mean the completed document too, which is where most of the confusion in procurement conversations comes from.

Does having a VPAT or ACR mean a product is accessible? No. Both documents are self-reported representations, not certifications — there is no government or W3C certification of accessibility. An ACR is only as reliable as the testing behind it, which is why the remarks column and the stated methodology matter more than the headline conformance level.

Who should prepare our company's ACR — us or a third party? Either is acceptable, but a third-party-audited ACR carries more weight with government and enterprise reviewers because it names an independent tester and methodology. An internally prepared ACR is faster and cheaper, and is often sufficient for smaller commercial buyers who don't require independent verification.

Do we need an accessibility statement if we already have a VPAT/ACR? Usually yes, and they serve different audiences. An ACR answers a specific buyer's procurement question about one product; a statement is a public page about your overall service, and under the EAA it is a separate legal requirement that a VPAT or ACR does not satisfy.

How often should an ACR or accessibility statement be updated? Whenever the underlying product or site changes materially, and at minimum annually. A dated document describing a version of the product that no longer exists is worse than no document, since it invites a direct comparison between the claim and the current site.

Where can we get the actual VPAT template to fill out? Download the current edition directly from ITI's VPAT page. For US federal procurement specifically, Section508.gov's ACR guidance also covers the OpenACR machine-readable alternative to the traditional VPAT format.

This article was produced using TestParty's cyborg approach — AI-assisted research and drafting, validated and refined by our accessibility team. The analysis above represents TestParty's editorial opinions based on publicly available data. As a competitor in the accessibility market, we have a point of view — but we've cited our sources so you can verify every claim independently.