WCAG Compliance Report Template: 7 Parts, Filled Sample Included

Last updated: October 21, 2026. This guide is general information based on public sources and TestParty's observations — it is not legal advice.

A WCAG compliance report is a dated, written statement of a website's conformance status against a named WCAG version and level, for a defined scope, backed by evidence — the document you produce to state where you stand, not the working file used to fix anything. This page walks the seven parts a real report contains, with a filled sample for a composite Shopify brand, and the conformance language that keeps the claim honest.

Key numbers: WCAG 2.2 defines 87 success criteria — one obsolete, leaving 86 in force and 55 at Levels A and AA, the set a Level AA report must account for (W3C). In 2026, 95.9% of the top million home pages carried a detectable WCAG failure, averaging 56.1 errors per page (WebAIM Million 2026). Automated tooling detects roughly 60–70% of issues in TestParty's audit work across 100+ brands; the rest requires manual testing, and a report built on scans alone cannot support a conformance claim. As of 2026, TestParty has remediated 35 million-plus accessibility issues, and in the history of the company, fewer than 1% of its customers have been named in an accessibility lawsuit while on the platform.

What is a WCAG compliance report?

A WCAG compliance report states, as of a specific date, how a website measures up against a named WCAG version and level for a defined scope — the pass/fail tally and the evidence behind it, not a percentage score or a badge.

Enterprise procurement teams request it before a contract closes; counsel requests it before responding to a demand letter; EU trading partners request it — or its close cousin, the accessibility statement — under the EAA; agencies commission it on a client's behalf to move a sales cycle forward. In TestParty's work with Shopify brands, the request usually arrives with a deadline already attached, which is why the report needs to exist before it's asked for. It draws on the audit but isn't the audit itself — the full findings register is the working document engineers fix from; this is the status statement built from it.

What must a WCAG compliance report contain?

A complete WCAG compliance report has seven parts: scope and standard, a conformance summary, methodology, results by POUR category, known exceptions with a remediation timeline, a monitoring cadence, and a signature with a next review date.

The seven-part shell below is what the downloadable template mirrors — copy the headers into a blank document and fill each one in, in order. Every excerpt comes from a composite report for a fictional Shopify home-and-outdoor brand, Cartwell Outdoor.

1. Scope, standard, and date. Name the exact property, the WCAG version and level, the evaluation window, and a version number — without all four, nothing else in the report is checkable.

2. Conformance summary per level. State the pass, fail, and not-applicable count against all 55 Level A and AA criteria — never a percentage, since conformance is scored criterion by criterion, not averaged.

3. Methodology. Name the automated tools, the manual testing performed, and the assistive-technology matrix, then state the automation ceiling outright — a scan-only report cannot support the summary above it.

4. Results by POUR category. Break the pass/fail/not-applicable counts down by Perceivable, Operable, Understandable, and Robust so a reader sees where the risk concentrates instead of one flat number.

5. Known exceptions and remediation timeline. List every failing criterion with its severity and a target fix date — an exceptions list with no dates is a findings register wearing a different cover.

6. Monitoring cadence. State how often conformance gets re-checked between full reports, plus the automated thresholds that count as a regression — not just a calendar note.

7. Signature, owner, and next review date. Name who is accountable for the claim and when it expires — an unsigned, undated report has no one to ask when something regresses.

What does "partially conforms" mean, and when do you claim it?

"Partially conforms" means some content within the defined scope does not fully meet the target standard — the accurate answer for nearly every real website, and the required claim the moment even one criterion fails.

W3C's own conformance-claims section spells out what a claim must state to count: the date, the guidelines version and level, the scope, and how conformance was determined (W3C, WCAG 2.2 conformance claims). Cartwell Outdoor's report above meets that bar — date, version, level, scope, and method are all named. There is no ADA certification and no W3C certification of any website; the Department of Justice points to WCAG as guidance without adopting it as a binding technical standard for private businesses (ADA.gov), so "certified compliant" describes something that does not exist in law. The dated, scoped, partial claim is the one that survives a second look.

How is this different from a VPAT or an audit report?

Three documents cover three different jobs: the audit report is the internal working file, the WCAG compliance report is a standalone status statement, and a VPAT/ACR is the standardized format a procurement team specifically names in an RFP.

A compliance report answers most of what a VPAT asks, but isn't a substitute for the format itself — when a federal buyer's RFP names a VPAT (see Section508.gov's ACR guidance), send the VPAT; when the question is "where do you stand on WCAG," send this. Both draw on the same audit evidence, so the numbers should never disagree.

How often should you regenerate a WCAG compliance report?

Regenerate the report after every remediation cycle and on a fixed cadence — quarterly or at each release — because a report is only valid for the exact code it tested.

Between full regenerations, treat the part-six thresholds — Lighthouse 90+, WAVE ≤5, axe ≤3 — as a floor, not a finish line; a drifting template needs a new report before its scheduled date. Dated versions matter as more than paperwork hygiene: in one public TestParty matter, a documented remediation trail turned a $74,999 demand into a $2,000 settlement for Dorai Home, because the record showed dated, ongoing work rather than one claim made once and left to age. A report from eighteen months ago is evidence of what a site was, not what it is — accessibility compliance documentation covers what else belongs in that file.

Who should sign a WCAG compliance report?

Two names, not one: an engineering lead who owns the technical findings, and a compliance owner — often counsel or a senior ecommerce leader — who owns the wording of the claim itself.

The engineering lead can defend every number in the conformance summary and the POUR table. The compliance owner is accountable for whether "partially conforms to WCAG 2.2 Level AA" is the right sentence to publish, and to whom. Counsel reviewing a draft typically wants three things confirmed first: the scope names exact URLs and a date; the methodology admits plainly what was, and wasn't, manually tested; and no sentence claims more than the results table supports. A report that clears that review reads short, dated, and slightly boring — which is what makes it hold up under scrutiny.

Frequently Asked Questions

Is a WCAG compliance report legally required? No single US federal law requires this exact document for a private ecommerce business, though the DOJ points to WCAG as its guidance standard and EU trading partners under the EAA may require an accessibility statement covering similar ground. Even without a legal mandate, it is the first piece of evidence procurement teams, insurers, and counsel ask for.

Can we claim our site is "100% WCAG compliant"? Almost never, and the claim should be avoided even after a scan comes back clean. In 2026, 95.9% of the top million home pages still carried a detectable WCAG failure (WebAIM Million 2026), and no ADA or W3C certification exists to back the word "certified" — the defensible claim is a dated, scoped "partially conforms."

How is this different from an accessibility statement? An accessibility statement is a short public page describing a service's overall commitment and known gaps; a WCAG compliance report is the fuller, evidence-backed document behind it, built from an actual audit. VPAT vs. ACR vs. accessibility statement covers how the public statement fits alongside the procurement formats.

Does a clean automated scan justify a full-conformance claim? No. Automated tooling catches roughly 60–70% of real issues in TestParty's audit work; the rest — focus order, meaningful alt text, announced form errors — requires manual testing with assistive technology. A methodology section that names only a scanner is describing a partial evaluation as if it were complete.

What happens if a published report turns out to be wrong? It becomes evidence against the business, not for it. A claim that overstates conformance — especially one a customer or regulator relied on — hands the other side a documented contradiction. The safer posture is a report that slightly undersells a site under active remediation over one that oversells a site frozen at last year's audit.

Like everything at TestParty, this article reflects our cyborg philosophy: AI handles the heavy lifting, humans bring the expertise. The data and opinions here are based on publicly available sources as of publication. TestParty is a participant in the accessibility market — we believe in transparency, so we encourage you to cross-reference our claims and evaluate all options for your business.