Section 508 and WCAG: What Federal Accessibility Law Actually Requires

The Compliance Gap Federal Teams Discover Too Late

A federal agency's IT procurement team spends months evaluating a new content management platform. The vendor's Voluntary Product Accessibility Template (VPAT) claims full Section 508 conformance. After deployment, the agency's Section 508 coordinator runs structured testing and finds that dozens of PDF documents published through the platform fail keyboard navigation and lack proper tag trees—both requirements traceable directly to WCAG success criteria. The purchase stands, the remediation costs fall on the agency, and the compliance clock has already been running.

This scenario repeats across federal and state agencies, contractors, and educational institutions because the relationship between Section 508 and WCAG is widely misunderstood. The short answer: yes, Section 508 requires WCAG—specifically WCAG 2.0 Level AA as the binding technical baseline under the 2018 ICT Refresh. But the full picture involves version distinctions, scope boundaries, and document-level obligations that determine whether any given PDF, web page, or software interface is actually compliant.

What Section 508 Is and Who It Applies To

Section 508 of the Rehabilitation Act of 1973, as amended by the Workforce Investment Act of 1998, requires federal agencies to ensure that the electronic and information technology (ICT) they develop, procure, maintain, or use is accessible to people with disabilities—both employees and members of the public. The law is enforced through the U.S. Access Board's technical standards and by the Department of Justice and agency Inspectors General.

Covered Entities Under Section 508

Section 508 applies to:

• Federal executive agencies — all departments and independent agencies subject to the Federal Acquisition Regulation (FAR)
• Federal contractors and vendors — any private entity selling ICT to the federal government must provide accessible products or document a conformance claim via a VPAT/Accessibility Conformance Report (ACR)
• Legislative and judicial branches — covered by policy directives derived from 508, though the statutory reach is technically to the executive branch

Section 508 does not directly cover state and local governments, private employers, or commercial websites serving the general public—those entities are governed by the Americans with Disabilities Act (ADA), including Title II for state and local government entities and Title III for places of public accommodation. The technical standards overlap significantly, but the legal authority is distinct.

What ICT Means Under Section 508

ICT—Information and Communications Technology—encompasses websites and web applications, software, hardware with information interfaces, electronic documents (including PDFs and Office files), multimedia content, and telecommunications products. If a federal agency develops, procures, maintains, or uses it, and it contains or conveys information, it is almost certainly within Section 508 scope.

What the ICT Refresh Changed in 2018

Before January 18, 2018, Section 508 used a functional performance criteria framework that referenced accessibility concepts without citing WCAG directly. The Access Board's ICT Refresh—effective January 18, 2018—fundamentally restructured the standards by incorporating WCAG 2.0 Level AA by reference. This created a unified technical baseline across web content, software, hardware, and electronic documents.

Key Changes Introduced by the ICT Refresh

• WCAG 2.0 Level AA incorporated by reference — success criteria 1.1.1 through 4.1.2 now apply to federal web content and electronic documents, with limited exceptions
• Electronic documents explicitly covered — PDFs, Microsoft Office files, and other non-web documents distributed publicly or used by agency employees fall within scope
• Authoring tools and support services included — tools used to create accessible content must themselves support accessible output
• Harmonization with international standards — the Refresh aligned Section 508 with EN 301 549 V3.2.1, the European standard that also references WCAG 2.1

The practical effect: any federal web page, PDF form, training video with captions, or software procured after January 18, 2018, must conform to WCAG 2.0 Level AA success criteria unless a specific exception applies (such as archived content predating the Refresh, or content that is not publicly available and is not used by agency employees).

WCAG Version Breakdown: 2.0 vs. 2.1 vs. 2.2 for Section 508 Purposes

Three WCAG versions are now published. Understanding which one Section 508 requires—and which ones carry additional compliance weight under parallel frameworks—is operationally significant for any federal ICT procurement or document remediation program.

WCAG 2.0 Level AA — The Binding Section 508 Baseline

WCAG 2.0, a W3C Recommendation since 2008, defines 38 success criteria across Levels A and AA. The Section 508 ICT Refresh incorporates all of these by reference. Conformance to WCAG 2.0 Level AA is the minimum legal requirement for covered ICT. Failure to meet any single applicable success criterion constitutes a 508 nonconformance.

WCAG 2.1 Level AA — Recommended Best Practice

WCAG 2.1 became a W3C Recommendation on June 5, 2018—five months after the Section 508 ICT Refresh took effect. It added 17 new success criteria addressing mobile accessibility, low vision, and cognitive disabilities. The Access Board formally recommends WCAG 2.1 as best practice because it addresses use cases that WCAG 2.0 does not, but it has not been incorporated into the binding 508 standard through rulemaking. EN 301 549 V3.2.1 (March 2021) does incorporate WCAG 2.1, which means federal agencies operating internationally or procuring from EU-compliant vendors will encounter WCAG 2.1 obligations through those channels.

WCAG 2.2 — Not Yet in Any Mandatory Standard

WCAG 2.2 became a W3C Recommendation on October 5, 2023. It adds 9 new success criteria and deprecates one (4.1.3). As of August 2026, WCAG 2.2 has not been incorporated into Section 508, EN 301 549, or any binding regulatory framework. Agencies planning long-term remediation programs should track its adoption trajectory, but no current legal obligation requires WCAG 2.2 conformance under 508.

Practical Guidance for Compliance Programs

Target WCAG 2.1 Level AA in all new development and remediation work. Doing so satisfies the binding WCAG 2.0 requirement (because 2.1 is a strict superset of 2.0) while future-proofing against Access Board updates and aligning with international procurement standards.

Section 508 Accessibility Requirements: A Structured Checklist

The following checklist maps Section 508 obligations to their underlying WCAG success criteria and document-specific requirements. It is organized by content type and suitable for use in procurement review, internal audits, and vendor ACR evaluation.

Web Content

• All non-text content has programmatic text alternatives (WCAG 1.1.1)
• Pre-recorded audio and video include synchronized captions and audio description (WCAG 1.2.2, 1.2.5)
• Content structure uses semantic HTML — headings, lists, landmarks — not visual formatting alone (WCAG 1.3.1)
• Reading order is logical when linearized (WCAG 1.3.2)
• Color is not the sole means of conveying information (WCAG 1.4.1)
• Text contrast ratio meets 4.5:1 for normal text, 3:1 for large text (WCAG 1.4.3)
• All functionality is keyboard-operable with no keyboard trap (WCAG 2.1.1, 2.1.2)
• Focus is visible at all times (WCAG 2.4.7)
• Error messages identify the field and suggest correction (WCAG 3.3.1, 3.3.3)
• Name, role, and value are programmatically determinable for all UI components (WCAG 4.1.2)

Electronic Documents (PDFs and Office Files)

• Document is tagged — every content element assigned to a structural tag in the tag tree
• Reading order in the tag tree matches the intended visual reading order
• Document title is set in document properties and exposed via the Title entry in the document catalog
• Language is specified at the document level; alternate languages tagged at the element level
• All images carry Alt text or are tagged as Artifact if decorative
• Tables include header tags (<TH>) with scope attributes; no merged cells without proper spanning markup
• Forms have field labels programmatically associated with each input
• Hyperlinks use descriptive link text, not bare URLs or generic anchor phrases like click here
• Document passes PDF/UA-1 (ISO 14289-1:2014) validation as a proxy for WCAG document conformance

Software and Applications

• All interactive controls expose name, role, state, and value to assistive technology APIs
• Keyboard navigation follows logical tab order; focus is never trapped
• Time limits are adjustable or can be turned off
• Flashing content does not exceed 3 flashes per second
• Error prevention controls are present for legal and financial submissions

Authoring Tools

• The tool can produce accessible output by default
• The tool supports creation of accessibility metadata (alt text fields, heading styles, language settings)
• Accessibility checking is integrated or documented

Is WCAG Legally Required — Or Just a Technical Standard?

WCAG itself is not law. It is a W3C technical specification. What makes WCAG legally binding is regulatory incorporation—when a federal rule or directive adopts WCAG by reference, conformance to WCAG becomes a legal obligation enforced through that rule. Under Section 508, WCAG 2.0 Level AA is legally required for covered ICT because the Access Board's standards, having gone through notice-and-comment rulemaking, carry the force of federal law.

The same mechanism applies under ADA Title II: the DOJ final rule published April 24, 2024 mandated WCAG 2.1 Level AA for state and local government web and mobile content. Public entities serving populations of 50,000 or more must comply by April 26, 2027 (extended from the original April 24, 2026 deadline), and entities under 50,000—along with special district governments—have until April 26, 2028 under the DOJ interim final rule effective April 20, 2026. For EU-facing products and services, the European Accessibility Act (Directive (EU) 2019/882) has been in force since June 28, 2025, with conformance commonly demonstrated against EN 301 549 V3.2.1, which incorporates WCAG 2.1 Level AA.

Enforcement Mechanisms for Section 508

Section 508 enforcement operates through several channels:

• Administrative complaints — individuals may file with the relevant agency, which must investigate and respond
• Civil litigation — plaintiffs may sue in federal court after exhausting administrative remedies; attorney's fees are available
• DOJ pattern-or-practice investigations — the DOJ Civil Rights Division can investigate systemic 508 failures
• Inspector General audits — agency IGs routinely include ICT accessibility in oversight reviews; findings can trigger corrective action plans
• GAO reports — Government Accountability Office assessments have repeatedly cited widespread 508 noncompliance across federal agencies

For contractors, a 508 nonconformance identified post-award can trigger contract modifications, rejection of deliverables, or termination for cause if the SOW included accessibility requirements. Documenting a conformance baseline through a current, accurate ACR before contract award is a risk management imperative, not a checkbox.

When Is Section 508 Testing Required?

Section 508 testing is required at every point in the ICT lifecycle where accessibility status can be evaluated and documented: procurement, development, deployment, and ongoing maintenance. The Trusted Tester process—developed by DHS and the U.S. Access Board—is the federal standard for manual conformance testing.

Procurement Phase

Before any ICT purchase, the contracting officer and Section 508 coordinator must review vendor-provided ACRs (formerly VPATs). An ACR documents WCAG success criteria conformance against the product version being procured. Outdated or incomplete ACRs require supplemental testing. Agencies that skip this step assume full remediation liability post-deployment.

Development Phase

For custom-built systems, automated scanning should run continuously in the CI/CD pipeline. Automated tools—axe-core, WAVE, IBM Equal Access Checker—detect approximately 30–40% of WCAG failures. Manual Trusted Tester evaluation, including screen reader testing with JAWS, NVDA, and VoiceOver, is required to surface the remainder. Keyboard-only navigation walkthroughs and color contrast analysis must be performed before any public-facing release.

Document Publication Phase

Every PDF, Word document, or spreadsheet published to a federal website or distributed to the public requires accessibility validation before publication. This is where most agencies underperform: automated PDF validators catch tag presence but not tag quality. A document with a tag tree that assigns all content to a single <Part> tag will pass some checkers but fail assistive technology rendering. Full PDF/UA-1 validation combined with screen reader verification is the reliable standard.

Post-Deployment Monitoring

Accessibility is not a one-time certification. Content updates, CMS platform upgrades, and third-party widget integrations can introduce new failures. Agencies should schedule quarterly automated scans and annual manual audits of high-traffic pages and documents. Feedback mechanisms—a visible accessibility feedback link and a documented response process—are also required under Section 508.

PDF Accessibility Under Section 508: Where Agencies Most Often Fail

PDF documents represent the highest-volume Section 508 failure category in federal agencies. Unlike web pages, which can be retested and redeployed rapidly, PDFs are often generated from legacy workflows, distributed through multiple channels simultaneously, and archived without remediation queues.

The Most Common PDF Nonconformances

• Missing or malformed tag tree — a PDF without tags is entirely inaccessible to screen readers; a PDF with a tag tree that misrepresents the reading order may be worse than untagged, because assistive technology attempts to read it and produces garbled output
• Images without Alt text — informational images tagged as <Figure> but missing the Alt attribute fail WCAG 1.1.1
• Decorative images not marked as Artifact — images tagged as content rather than Artifact cause screen readers to pause and announce null content, disrupting reading flow
• Untagged or mistagged tables — tables without <TH> header tags and scope attributes are navigable but semantically opaque; users cannot determine which column or row a cell belongs to
• Form fields without labels — fillable form fields that lack programmatically associated label text force screen reader users to guess field purpose
• Document language not set — without a language declaration, screen readers apply the system default language, producing mispronunciation that makes the document unusable for non-English content
• Logical reading order disconnected from visual order — multi-column layouts and sidebars frequently produce tag trees that read left-to-right across columns rather than top-to-bottom within each column

PDF/UA-1 as the Conformance Target

PDF/UA-1 (ISO 14289-1:2014) defines the technical requirements for universally accessible PDF files. Conformance to PDF/UA-1 is not explicitly mandated by Section 508, but it operationalizes the WCAG success criteria applicable to documents in a PDF-specific framework. Agencies and contractors that target PDF/UA-1 conformance as part of their remediation standard reliably satisfy the underlying 508 document requirements.

RemeDocs' PDF remediation process addresses all of these failure categories systematically—tag tree reconstruction, Alt text assignment, reading order correction, form label association, and PDF/UA-1 validation—producing documents that pass both automated validators and screen reader verification.

Frequently Asked Questions: Section 508 and WCAG

What does Section 508 require in terms of WCAG?

Section 508, as updated by the ICT Refresh effective January 18, 2018, requires conformance to WCAG 2.0 Level AA for all covered ICT—including websites, software, electronic documents, and hardware with information interfaces. The Access Board recommends WCAG 2.1 as best practice, but the binding legal baseline is WCAG 2.0 Level AA.

Who does Section 508 of the Rehabilitation Act apply to?

Section 508 applies to federal executive agencies and to any contractor or vendor selling ICT products or services to those agencies. It does not directly cover state governments, local governments, or private sector organizations—those entities are governed by the ADA, with WCAG 2.1 Level AA as the applicable technical standard under the DOJ's Title II rule.

What is Section 508 and why is it important?

Section 508 is the federal law requiring that electronic and information technology developed, procured, maintained, or used by federal agencies be accessible to people with disabilities. Its importance is both civil rights-grounded—ensuring federal employees and members of the public with disabilities have equal access to government information and services—and operationally financial: noncompliance creates procurement liability, contract rejection risk, and litigation exposure that remediation costs significantly less than litigating.

Is WCAG 2.1 required for Section 508?

WCAG 2.1 is not the binding legal standard for Section 508—WCAG 2.0 Level AA is. However, because WCAG 2.1 is a strict superset of WCAG 2.0, any ICT that conforms to WCAG 2.1 Level AA also satisfies the Section 508 WCAG 2.0 requirement. Targeting WCAG 2.1 is the recommended approach for all new development and remediation work.

When is Section 508 testing required?

Section 508 testing is required before procuring any ICT product or service (via ACR review), before deploying any custom-built system, before publishing any electronic document to a federal website, and on an ongoing basis through monitoring programs. DHS Trusted Tester methodology is the federal standard for manual testing.

Does Section 508 apply to PDFs?

Yes. Electronic documents, including PDFs distributed publicly or used by agency employees, are explicitly within Section 508 scope under the ICT Refresh. PDF conformance requires a correct tag tree, proper reading order, Alt text for informational images, tagged table headers, associated form field labels, and a document language declaration. PDF/UA-1 (ISO 14289-1:2014) is the document-specific technical standard that operationalizes these requirements.

What is the difference between Section 508 and ADA accessibility requirements?

Section 508 applies to federal ICT and mandates WCAG 2.0 Level AA. The ADA applies to state and local governments (Title II) and places of public accommodation (Title III), mandating WCAG 2.1 Level AA under the DOJ's 2024 Title II rule. The technical requirements overlap substantially, with WCAG 2.1 adding 17 success criteria to WCAG 2.0's baseline. Organizations subject to both frameworks should target WCAG 2.1 to satisfy both simultaneously.

The Regulatory Trajectory: What to Prepare For

The Section 508 technical standard has not been updated since the 2018 ICT Refresh, but the regulatory environment surrounding it has accelerated. Three developments define the near-term compliance trajectory for federal and adjacent organizations.

First, the Access Board has signaled intent to update the 508 technical standards to incorporate WCAG 2.1 or later. When that rulemaking completes, the binding baseline will shift, and agencies that have already remediated to WCAG 2.1 will face no incremental correction effort. Agencies still working from a WCAG 2.0-only baseline will have a gap.

Second, the ADA Title II rule—with its WCAG 2.1 Level AA mandate—is now an active compliance obligation for state and local government entities, with the first tier deadline of April 26, 2027 approaching for entities serving populations of 50,000 or more. Federal contractors that also provide services to state and local governments are simultaneously subject to 508 and Title II, with different WCAG version requirements. Targeting WCAG 2.1 resolves that dual obligation.

Third, the European Accessibility Act has been in force since June 28, 2025. Federal agencies and contractors with EU-facing digital properties or procurement relationships with European entities must meet EN 301 549 V3.2.1 requirements—which incorporate WCAG 2.1 Level AA in full. The convergence of these three frameworks around WCAG 2.1 makes it the operationally unified target regardless of which legal authority applies.

For document-heavy agencies and contractors, the immediate priority is establishing a systematic PDF remediation pipeline. Backlogs of untagged or improperly tagged documents do not resolve themselves through monitoring programs; they require structured remediation workflows with PDF/UA-1 validation at exit. RemeDocs provides that workflow at production scale, with ACR-ready conformance documentation that supports both internal audits and vendor compliance submissions. The agencies that build this infrastructure before the next rulemaking cycle will absorb the WCAG version transition without operational disruption.