← Blog

Reference

VPAT 2.5 in 3 days for $2,500: what it covers and who it is right for

May 27, 2026

Level Access charges $20,000 to $35,000 for a VPAT. Deque starts lower but the final invoice for a SaaS product with real complexity lands in the same range. That price is not a rip-off. It reflects a cost structure built around enterprise sales cycles, multiple accessibility specialists on staff, and client management overhead that a large firm carries regardless of whether your project uses it.

My cost structure is different. I work alone, I have no enterprise sales overhead, and I do not cross-sell you into a $150,000 "accessibility transformation program." The $2,500 VPAT 2.5 flat fee is not a loss leader. It is the correct price for the work, given how I operate.

What a VPAT 2.5 actually is

VPAT stands for Voluntary Product Accessibility Template. Version 2.5 is the current version, published by the Information Technology Industry Council. A completed VPAT produces an Accessibility Conformance Report, or ACR, that documents how a product conforms to WCAG 2.2 AA, Section 508, and EN 301 549 (the European standard). For most US government procurement, Section 508 and WCAG 2.2 AA are the two tables that matter.

The ACR is not a certification. No government body certifies VPAT accuracy. The document is a disclosure, and the entity that signs it takes responsibility for the accuracy of the claims. A VPAT signed by a shop with inflated conformance ratings is a liability, not an asset.

A VPAT covers roughly 50 success criteria across three conformance levels: Supports, Partially Supports, Does Not Support, and Not Applicable. For each criterion, the evaluator tests the product and documents the actual behavior. Vague language like "partially supports" with no description of the failure gets flagged by government procurement reviewers. A useful VPAT has specific language for every partial or non-conformance entry.

What WCAG 2.2 AA actually requires

WCAG 2.2 added three new success criteria over WCAG 2.1. The ones that matter most for SaaS products:

Focus Appearance (2.4.11, Level AA) requires that keyboard focus indicators be visible enough to meet a specific contrast ratio against adjacent colors. A lot of SaaS applications use thin blue outlines that technically show focus but fail the contrast math. This is one of the most common findings on first-time audits.

Dragging Movements (2.5.7, Level AA) requires that any functionality using drag-and-drop also be operable by a single pointer without dragging. If your product has a drag-to-reorder table or a drag-to-resize panel, this criterion applies. It is also one of the simpler fixes once identified.

Target Size (Minimum) (2.5.8, Level AA) sets a 24x24 CSS pixel minimum for interactive targets, with specific exceptions. Small icon buttons fail this regularly.

Beyond WCAG 2.2, the 2024 ADA Title II rule update (effective April 2026 for larger entities, later for smaller ones) formally adopts WCAG 2.2 AA as the technical standard for state and local government web content. This is why SaaS vendors selling into the government market are under new pressure to produce VPATs now. The rule does not grandfather products that were previously acceptable under weaker standards.

What the $2,500 deliverable covers

The engagement has four components.

Automated scan. I run the product through axe-core and WAVE. Automated scans catch roughly 30% to 40% of accessibility issues, and they catch them reliably. Everything flagged in automated testing gets documented.

Manual keyboard and screen reader testing. Automated tools cannot test focus order, logical tab sequences, or whether a screen reader announcement makes sense in context. I test the product's primary user flows with keyboard-only navigation and with NVDA on Windows. I document what I find, not what the automated tool assumes.

Completed ACR. The output is a fully completed VPAT 2.5 Accessibility Conformance Report with accurate conformance language for all 50+ criteria. Criteria that do not apply to your product (no video, for example) are marked Not Applicable with a brief note.

Remediation priority list. A separate document, outside the formal VPAT, that ranks the findings by severity and effort. Most clients want to fix the easy high-impact issues before the VPAT goes to a customer. This list makes that triage practical.

What the $2,500 deliverable does not cover

I am not going to oversell this. The flat fee covers one round of testing on one product. It does not cover:

Remediation work. If the audit finds 15 issues, fixing them is a separate engagement. I will quote the fixes separately, but the audit fee does not include any code changes.

Repeat testing after remediation. If your engineering team fixes the issues, the corrected VPAT requires another review pass. I offer a one-time re-test at $750 if requested within 60 days of the initial audit.

Native mobile apps. The $2,500 price covers web-based SaaS accessed via browser. Native iOS or Android accessibility testing is a different scope. Ask about pricing separately.

Complex enterprise products. If your product has more than roughly 15 primary user flows or is built on a heavily customized component library, the testing scope is larger and the flat fee does not apply. We scope those separately.

Who this is right for

The best-fit client is a SaaS vendor with one core web product, 5 to 15 primary user flows, and a government procurement requirement in play. You need the VPAT to attach to an RFP response or a state contract renewal. You have 2 to 4 weeks to get it done. The engineering team is not currently planning an accessibility sprint, so you need the disclosure document before the fixes happen.

Second-best fit: a company that has received an accessibility complaint from a government customer and wants a documented audit before the next conversation with that customer.

Not a fit: a company that needs a full accessibility remediation program, ongoing compliance monitoring, or VPAT-as-a-service across multiple products on an annual cycle. For that kind of scope, a firm with dedicated accessibility staff is the better option.

On the independence question

When a vendor signs their own VPAT, procurement reviewers know the numbers may be optimistic. When a third party signs, the document carries more weight. My name goes on the document alongside the vendor's. My reputation depends on the accuracy of what I write. I will not sign a VPAT that overstates conformance. If a finding is "Does Not Support," the VPAT says "Does Not Support" with a plain-language description of the failure.