What Is Section 508 And Who Needs to Be Compliant?

This guide covers what Section 508 actually requires in 2026, who needs to comply, the technical standards it points to, the VPAT/ACR process, exemptions, and how Section 508 relates to the broader landscape of US and international accessibility law.

Where Section 508 Came From

Section 508 is part of the Rehabilitation Act of 1973. The 1973 Rehab Act is the broader anti-discrimination law covering people with disabilities in federal programs and federally-funded activities. Section 508 was added to the Rehab Act by the Rehabilitation Act Amendments of 1998 (Title IV of the Workforce Investment Act of 1998), specifically to require federal accessibility for electronic and information technology.

The original 1998 standards were written when the web was young and framed accessibility around traditional office equipment — copiers, phones, software applications. In 2017, the US Access Board (the federal body responsible for accessibility standards) published the Revised 508 Standards, known as the “Section 508 Refresh,” which took effect in January 2018. The Refresh aligned Section 508’s technical requirements with the international WCAG 2.0 Level AA, reorganized the standards around functional rather than technology-specific categories, and harmonized with Section 255 of the Communications Act (which covers telecommunications products) and with the European standard EN 301 549.

What Section 508 Covers

Section 508 applies to all Information and Communication Technology (ICT) that federal agencies develop, procure, maintain, or use. “ICT” is intentionally broad and includes:

• Websites and web applications (internal and public-facing)
• Mobile apps
• Software applications and operating systems
• Electronic documents (PDF, Word, Excel, PowerPoint, accessible alternatives)
• Multimedia content (video, audio, with captioning and audio description)
• Telephones, smartphones, and video conferencing systems
• Self-service kiosks and ATMs
• Hardware — desktops, laptops, tablets, copiers, printers
• Cloud services and hosted applications
• Electronic content published by federal agencies (reports, forms, announcements)

Anything that transmits, receives, or presents information and is used by a federal agency falls under Section 508 — including ICT that’s only used internally by agency staff, not just public-facing systems.

Who Needs to Comply

Three groups of organizations fall under Section 508 requirements:

• Federal agencies. All executive-branch agencies and most independent agencies must comply directly. Each agency has a designated Section 508 coordinator, and GSA’s Section508.gov provides government-wide guidance and best practices.
• Federal contractors and vendors. Any company selling ICT products or services to the federal government must demonstrate Section 508 compliance. Vendor compliance is documented through VPATs (Voluntary Product Accessibility Templates) and Accessibility Conformance Reports (see below).
• Recipients of federal funding. Organizations receiving federal funds (including many state and local government programs, public universities, and nonprofits) often face Section 508 requirements as flow-down conditions in their funding agreements. Public universities, for example, typically adopt Section 508 for federally-funded programs even though they’re not themselves federal agencies.

Private-sector commercial websites that have no federal funding and don’t sell to the government are not directly subject to Section 508. Those sites typically fall under the ADA instead.

The Technical Standard: WCAG 2.0 Level AA

The 2017 Refresh adopted WCAG 2.0 Level AA as the technical conformance standard for web content, software applications, and electronic documents. This means Section 508 compliance, in practice, means meeting WCAG 2.0 Level AA’s success criteria.

As of April 2026, Section 508 still formally references WCAG 2.0 AA. The Access Board has not yet updated Section 508 to reference WCAG 2.1 or WCAG 2.2 (which was published by the W3C in October 2023). Most federal agencies in practice aim for WCAG 2.1 AA or higher as a forward-looking target, and some explicitly include WCAG 2.2 criteria in new procurements. When the Access Board eventually updates the standards, they’re expected to adopt WCAG 2.1 AA at minimum and possibly 2.2.

The Revised 508 Standards also include functional performance criteria (requirements at the outcome level — e.g., “the product must be usable without vision”) and hardware-specific technical requirements for keyboards, displays, and audio controls that WCAG alone doesn’t address.

VPATs and Accessibility Conformance Reports

Vendors selling ICT to the federal government demonstrate Section 508 compliance through a VPAT — Voluntary Product Accessibility Template. A completed VPAT is called an Accessibility Conformance Report (ACR), documenting how a specific product meets each Section 508 standard.

The VPAT 2.5 (ITI’s current version as of 2025) is the industry-standard format. It includes separate sections for:

• WCAG 2.0 / 2.1 success criteria (A, AA, and optionally AAA)
• Revised Section 508 functional performance and technical criteria
• EN 301 549 (the European harmonized standard, for multinational vendors)

For each criterion, the vendor documents one of four conformance levels: Supports, Partially Supports, Does Not Support, or Not Applicable. Honest VPATs document what’s not fully compliant so agencies can plan around the gaps. Vendors who claim “fully compliant” across all criteria without qualification are often either overstating or haven’t actually tested thoroughly.

Agencies increasingly require a VPAT/ACR as part of procurement, and the document shapes buying decisions for ICT over roughly the $25,000 threshold that triggers formal procurement review.

How to Become Section 508 Compliant

Practical steps for an organization working toward Section 508 compliance:

1. Audit your current ICT. Inventory the websites, applications, and documents your organization produces or uses. For each, establish the current level of WCAG 2.0 AA conformance. Tools like axe DevTools, WAVE, and Lighthouse can run automated scans; manual expert review catches the 60-70% of issues that automation misses.
2. Remediate. Fix accessibility issues in priority order. For web content, that usually means: correcting heading structure, adding alt text to meaningful images, ensuring keyboard accessibility, meeting color-contrast minimums (4.5:1 for normal text), labeling form fields correctly, providing captions and transcripts for multimedia, and ensuring PDF/Office documents are accessible.
3. Test with assistive technology users. Automated scans + manual review + actual user testing with disabled users is the complete picture. See our dedicated guide on coordinating user testing.
4. Document conformance. For vendors selling to the government, complete a VPAT 2.5 as an Accessibility Conformance Report. For federal agencies, document Section 508 conformance as part of your agency’s annual accessibility reporting.
5. Maintain over time. Accessibility regresses easily. Build automated testing into your CI/CD pipeline, train content authors on accessibility basics, and audit periodically. Agencies often designate a Section 508 coordinator to own this process.

For structured training, our guide to accessibility learning resources covers free and paid courses including Deque University’s Section 508 track and the IAAP’s CPACC/WAS certifications.

Exemptions and Undue Burden

Section 508 includes two narrow exemption categories:

National security systems are exempt under the Clinger-Cohen Act of 1996 (the Information Technology Management Reform Act). This exemption covers ICT used by intelligence activities, cryptologic activities, command and control of military forces, equipment that is an integral part of a weapon or weapons system, or systems critical to direct fulfillment of military or intelligence missions. It’s narrowly construed and doesn’t cover ordinary administrative systems in national-security agencies.

Undue burden — agencies can invoke an undue-burden exemption when making a specific item accessible would require significant difficulty or expense. This is genuinely narrow. The agency must document the burden, explain why compliance isn’t achievable with reasonable effort, and provide alternative means of access to the information or service for people with disabilities. “Undue burden” is not a general escape clause; it’s a per-instance determination that’s rarely invoked successfully.

Beyond these two exemptions, Section 508 applies broadly. Agencies cannot exempt a whole system or category of ICT because compliance is inconvenient.

Section 508 and Related Laws

Section 508 sits within a broader framework of US accessibility laws:

• Americans with Disabilities Act (ADA) — broader anti-discrimination law covering public accommodations (Title III) and state/local government (Title II). The April 2024 DOJ Title II Final Rule on web and mobile accessibility, phasing in during 2026-2027, is often confused with Section 508 but applies to state and local government, not federal agencies.
• Section 501 of the Rehabilitation Act — federal employment affirmative action for people with disabilities.
• Section 504 of the Rehabilitation Act — prohibits discrimination in federally-funded programs.
• Section 255 of the Communications Act — accessibility of telecommunications products and services (harmonized with Section 508 via the 2017 Refresh).
• CVAA — covers advanced communications services and video programming, enforced by the FCC.
• EU Accessibility Act — EU counterpart covering private-sector products and services, in force since June 28, 2025. US vendors selling to the EU may need both Section 508 and EAA conformance.

Most organizations don’t need to understand all of these laws in detail — they need to understand which apply to their specific work and build accessibility in a way that satisfies all applicable requirements. Since every one of these laws points to WCAG as its practical technical standard, a single WCAG 2.1 AA conformance program typically satisfies the technical requirements of all of them.

Enforcement and Consequences

Section 508 enforcement happens through several channels:

• GSA and OMB oversight — federal agencies report annually on Section 508 compliance. Failing reports can affect budget and procurement authority.
• Individual administrative complaints — federal employees and members of the public can file Section 508 complaints directly with the relevant agency.
• Civil action — the Rehabilitation Act provides a private right of action. Section 508 suits have been brought successfully against agencies and their contractors.
• Procurement consequences — federal contracting officers may reject non-compliant bids or terminate contracts when vendor ICT doesn’t meet Section 508 requirements.

Enforcement has accelerated over the past decade. Settlement agreements between disability rights organizations and federal agencies now routinely include Section 508 remediation commitments, and GSA has expanded its oversight of agency compliance reporting.

Frequently Asked Questions

Does Section 508 apply to my commercial website?

Only if you sell ICT products or services to the federal government, or if your organization receives federal funding with Section 508 flow-down requirements. If neither applies, your site is covered by the ADA (Title III) rather than Section 508. The good news: WCAG 2.1 AA compliance satisfies both.

Does Section 508 require WCAG 2.2?

Not currently. The 2017 Refresh adopted WCAG 2.0 Level AA as the technical standard, and the Access Board has not yet updated Section 508 to reference WCAG 2.1 or 2.2. Most agencies in practice aim for WCAG 2.1 AA or higher as a forward-looking target. Vendors and agencies preparing for the expected future update are building to WCAG 2.2 already.

What is a VPAT and do I need one?

A VPAT (Voluntary Product Accessibility Template) is the standard document vendors use to report product accessibility to federal agencies. If you sell ICT to the federal government, you need one — the VPAT 2.5 format, published as an Accessibility Conformance Report (ACR), is the industry standard. VPATs are voluntary by name but effectively required in federal ICT procurement.

Is Section 508 the same as the ADA?

No. Section 508 is narrower — it applies specifically to federal agencies and their vendors, and covers ICT specifically. The ADA is broader, covering public accommodations (Title III) and state/local government (Title II). Many organizations are subject to both. The good news: WCAG 2.1 AA conformance generally satisfies both.

How is Section 508 enforced?

Through agency self-reporting, administrative complaints, federal contracting consequences, and private civil actions under the Rehabilitation Act. Settlement agreements are common; actual litigation reaches final judgment less often because agencies typically settle by committing to remediation timelines.

What’s the difference between Section 508 and the 2024 DOJ Title II Final Rule?

Section 508 applies to federal agencies and their vendors. The April 2024 DOJ Title II Final Rule on web and mobile accessibility applies to state and local governments under the ADA, with compliance phased in during 2026-2027. Both reference WCAG 2.1 AA (the DOJ rule does; Section 508 still references WCAG 2.0 AA). Organizations subject to both typically build to WCAG 2.1 AA to satisfy both requirements.

Bottom Line

Section 508 is the federal-government slice of US accessibility law: federal agencies, their contractors, and many federally-funded organizations must make their ICT accessible to people with disabilities, with WCAG 2.0 Level AA as the current technical standard. The 2017 Refresh modernized the standards, aligned them internationally with WCAG and EN 301 549, and established the framework most agencies still work within.

For private businesses, Section 508 is only directly relevant if you sell to the federal government or receive federal funding. For everyone else, accessibility work still matters — but under the ADA, not Section 508. For a broader look at how these laws fit together, see our guides on the ADA, the European Accessibility Act, the CVAA, and involving disabled users in accessibility testing.