Accessibility · Public Sector

Section 508 and WCAG 2.1 AA, explained for the people who have to sign off .

What the law actually requires, what “AA” means line by line, why the PDF backlog is where agencies are exposed, and what remediation involves when it is done properly. Written by a studio that produces to the standard, with every legal claim linked to its primary source.

How remediation works Common questions Talk to the studio
01

The Requirement

What Section 508 actually requires.

Section 508 of the Rehabilitation Act, codified at 29 U.S.C. § 794d and given its modern shape by the 1998 amendments, requires federal agencies to make the electronic and information technology they develop, procure, maintain or use accessible to people with disabilities — members of the public and federal employees alike.

For twenty years it carried its own idiosyncratic technical standard. That ended with the U.S. Access Board’s ICT Final Rule, published in January 2017 with a compliance date of 18 January 2018. The refreshed standard does something simpler and far more consequential: it incorporates WCAG 2.0 Level A and AA by reference, and applies those criteria not only to websites but to electronic documents — the PDF, the spreadsheet, the presentation, the fillable form.

So when a solicitation says “must be 508 compliant,” the operative question is not what Section 508 says. It is which WCAG success criteria the deliverable satisfies, and how anyone knows.

Why most contracts now say 2.1 AA, not 2.0

WCAG 2.0 is what Section 508 incorporates. WCAG 2.1, published by the W3C in June 2018, added seventeen success criteria addressing mobile devices, low vision, and cognitive and learning disabilities — the ways people actually use public services now. Agencies and primes began writing 2.1 AA into requirements long before any rule made them.

Then a rule did. In April 2024 the Department of Justice published a final rule under Title II of the Americans with Disabilities Act setting WCAG 2.1 Level AA as the technical standard for the web content and mobile apps of state and local government. Its compliance dates are 24 April 2026 for public entities serving a population of 50,000 or more, and 26 April 2027 for smaller entities and special district governments. The first of those dates has passed.

The practical reading for anyone scoping work in 2026: specify WCAG 2.1 Level AA. It satisfies the 508 incorporation, it satisfies the Title II rule, and it is what a reviewer will test against. WCAG 2.2, published in October 2023, adds nine further criteria and is where the standard is going next; building to 2.1 AA now does not put 2.2 out of reach.

02

The Standard

What “Level AA” means, line by line.

WCAG organises everything under four principles — content must be perceivable, operable, understandable and robust — and expresses them as testable success criteria at three levels. WCAG 2.1 has seventy-eight criteria in total. Levels A and AA together, the conformance target every public contract means, come to fifty of them.

Fifty is a number nobody negotiates from. These are the ones that fail real deliverables:

Contrast

4.5:1 for body text against its background, 3:1 for large text, and 3:1 for the visual boundary of interface components and meaningful graphics. Brand palettes fail this constantly, and the failure is arithmetic, not opinion.

Keyboard

Every function operable from a keyboard, no trap that a user cannot tab out of, and a focus indicator that is actually visible. If it cannot be done without a mouse, it cannot be done.

Text alternatives

A meaningful equivalent for every image that carries information, and nothing at all for the ones that are decoration. A chart is not described by its caption; it needs its data available as text.

Structure & order

Headings that nest in order, lists marked as lists, tables with header cells and scope, and a reading order that matches the visual one. This is the criterion two-column layouts and exported plans fail most often.

Forms

Every field with a programmatic label, instructions that do not rely on placement alone, errors identified in text, and a suggestion for correction where one is knowable. A fillable PDF is a form and is held to this.

Time-based media

Captions for prerecorded video, an audio description or full text alternative where the visuals carry information the narration does not, and a transcript for audio-only content.

Resize & reflow

Text resizable to 200 percent without loss of content or function, and content that reflows to a 320-pixel-wide viewport without a second scroll axis. This is most of what WCAG 2.1 added, and it is why a desktop-only page fails now.

Not by color alone

No instruction, status or distinction conveyed by color, shape or position by itself. “Fields in red are required” is a failure; so is a legend that is only a swatch.

Language & title

A declared document language and a real title, on the page and in the file’s metadata. Two attributes, thirty seconds, and an enormous share of automated failures.

03

Where Agencies Are Exposed

The website gets the attention. The PDF backlog is the liability.

Refreshed 508 covers electronic content, not just web pages. A comprehensive plan, an annual report, a public notice, a board packet, a fillable application — each one is a deliverable held to the same criteria as the site it is posted on. Agencies have hundreds of them, produced over years, by people who were never told.

A PDF is accessible when it carries a real tag tree, not when it looks tidy. That means:

  • A tag tree that matches the document, headings nested in order, paragraphs as paragraphs, lists as lists, and a reading order that follows the argument rather than the column.
  • Tables with real header cells, scope set, and no layout tables pretending to be data. A merged-cell financial table is the single most expensive thing on this list to fix after the fact.
  • Alt text on what carries meaning, and none on what does not, with charts, maps and figures given a text equivalent that conveys the finding, not the file name.
  • Form fields labelled and ordered, tooltips set, tab order logical, and required fields identified in text.
  • Title, language and bookmarks, the document title displayed in the window rather than the filename, the language declared, and bookmarks on anything long enough to need them.
  • No scanned text, an image of a page is not a page. Appendices are where this hides.

The failure mode is almost never malice or even carelessness. It is an export. A plan laid out in InDesign or Word and exported without tagging discipline produces a document that passes visual review and fails every criterion above, and the cost of repairing it downstream is a multiple of the cost of laying it out correctly in the first place. That is the entire argument for scoping accessibility into design rather than buying it afterwards as remediation.

04

The Work

What remediation involves, when it is done properly.

  • 01 · Inventory and triage. Every page, template and document in scope, ranked by traffic, legal exposure and how long it will stay published. A ten-year-old board packet nobody opens is not the same problem as the application form. Scope is set here or it is never set.
  • 02 · Audit against the criteria. An automated sweep to clear the mechanical failures, then the part that matters: manual keyboard traversal, screen-reader testing with the assistive technology the audience actually uses, contrast measured rather than eyeballed, and reading order checked in the tag tree. Automated tooling finds only a minority of real failures — roughly a third is the estimate usually cited — and a report built on scanning alone is a report that will not survive a complaint.
  • 03 · Remediate at the source. Fix the template, the stylesheet and the layout file, not the exported artifact. Repairing the export means repairing it again next quarter; repairing the source means the next hundred documents come out conformant without anyone thinking about it.
  • 04 · Verify, and write it down. Re-test against the same criteria, then produce an Accessibility Conformance Report — a VPAT, in the ITI template — that states, criterion by criterion, what supports, what partially supports, and what does not, with the remarks that make each verdict checkable. Partial support honestly documented is worth more to an agency than blanket conformance nobody can defend.
  • 05 · Keep it. Accessibility acceptance criteria written into the contract, an automated gate in the publishing pipeline, and a named owner. Conformance is a state a deliverable is in, not a certificate it was issued once.
05

How We Work

Produced to the standard, not repaired to it.

Great Breads Studio runs a design-led public-sector practice: comprehensive plans, reports and public communications; brand and web systems; and Section 508 / WCAG-conformant document production. Accessibility is scoped into the deliverable rather than sold afterwards as a change order, because as band 03 argues, afterwards is where it becomes expensive.

The working standard is WCAG 2.1 Level AA on public-sector digital deliverables, with accessibility checks — contrast, keyboard, screen reader, alternative text, semantic structure — carried in the QA checklist rather than left to the end, and a conformance report produced per deliverable so the agency has something to hold.

What this page will not claim

The studio’s own compliance index carries one rule above the others: represent only the conformance posture actually maintained, and never make a 508 or VPAT claim that is not backed by real testing. So this page does not assert a conformance result for any deliverable it has not tested, does not publish a certification that does not exist, and does not tell you this website has been independently audited — because it has not been, and that item is still open on the studio’s own checklist.

That is not a small distinction in this market. A supplier who signs off on conformance it has not verified is not absorbing the agency’s risk; it is handing the agency a document to be wrong with. The useful vendor is the one who tells you which criteria partially support and why.

SAM.gov Active · UEI J2JXA434NS13 · CAGE 1Z8P1 · NMSDC Certified MBE · NY State Comptroller Vendor · NAICS 541511 · 541613 · 541430 · 541810

Available on a direct contract or as a Tier 2 subcontractor to a prime already holding the vehicle. The public-sector practice, the full capability statement, and the supplier diversity page carry the registrations, codes and onboarding path. Integral Construction of NY is the published case study closest to this work.

06

Check This Yourself

Every claim above, at its source.

Nothing on this page should be taken on a studio’s word. These are the primary texts, and they are the ones a reviewer will cite back at you.

07

Common Questions

What compliance officers ask first.

What is the difference between Section 508 and WCAG?
Section 508 is United States law, requiring federal agencies to make their information and communications technology accessible. WCAG is the technical standard, published by the W3C, that says what accessible means. Since the Access Board’s 2017 refresh, Section 508 incorporates WCAG 2.0 Level A and AA by reference, so in practice “508 compliant” means “conforms to those WCAG criteria.”
Should we require WCAG 2.0 AA or WCAG 2.1 AA?
Require 2.1 AA. It is what the Department of Justice’s 2024 ADA Title II rule sets for state and local government web content and mobile apps, it satisfies the WCAG 2.0 AA that Section 508 incorporates, and it covers mobile and low-vision use that 2.0 predates. WCAG 2.2, published in 2023, is the next step rather than a different direction.
Does Section 508 apply to us if we are not a federal agency?
Section 508 binds federal agencies directly, and reaches contractors through the deliverables those agencies buy. State and local government are reached instead by the ADA, whose Title II rule sets WCAG 2.1 Level AA with compliance dates of 24 April 2026 for entities serving 50,000 or more people and 26 April 2027 for smaller entities and special districts. Many states also impose their own standards, and recipients of federal funds have obligations under Section 504. The correct question is rarely whether a standard applies, only which one.
Do PDFs and Word documents have to be accessible too?
Yes. The refreshed Section 508 standard applies to electronic content, not only to web pages, so plans, reports, notices, board packets and fillable forms are held to the same criteria as the site hosting them. In most agency inventories the document backlog, not the website, is the larger share of the exposure.
Is an automated accessibility scan enough?
No. Automated tooling reliably catches mechanical failures — missing alternative text, unset language, contrast arithmetic — but only a minority of real ones, roughly a third by the estimate usually cited. Reading order, meaningful alternative text, keyboard traps, focus management and whether a chart’s equivalent actually conveys the finding are all manual judgments. A conformance claim built on scanning alone will not survive a complaint.
What is a VPAT, and do we need one?
A VPAT, the Voluntary Product Accessibility Template published by ITI, is the form an Accessibility Conformance Report is written on. It states for each success criterion whether the deliverable supports, partially supports or does not support it, with remarks. Federal buyers routinely request one during market research and evaluation; state and institutional buyers increasingly do too. An honest report showing partial support is more useful, and far more defensible, than a blanket claim of conformance.
How long does remediating a document take?
It depends on how the document was made, which is why no honest answer is a number quoted before someone has looked. A text-led report exported from a well-structured source file is quick. A two-column plan with merged-cell tables, chart images and a scanned appendix is a rebuild. The inventory-and-triage step exists precisely to answer this before anyone commits to a schedule.
Can accessibility be added at the end of a project?
It can be, and it costs a multiple of what building to the standard costs, because the failures are structural: reading order, table semantics, color contrast and focus behavior all live in the layout and the design system rather than in the exported file. Scoping conformance into design is the cheaper path, and it is the one this studio contracts for.
Does Great Breads Studio do this work?
Yes. The studio runs a design-led public-sector practice covering comprehensive plans, reports and public communications, brand and web systems, and Section 508 / WCAG-conformant document production, working directly or as a Tier 2 subcontractor to a prime. It is an NMSDC Certified MBE, SAM.gov registered and active under UEI J2JXA434NS13 and CAGE 1Z8P1, and a registered New York State Comptroller vendor.
Will you certify that our site is compliant?
The studio will test a deliverable against WCAG 2.1 Level AA and report what it found, criterion by criterion, in a conformance report you can hand to a reviewer. It will not sign a blanket compliance certificate for work it has not tested. That is a deliberate limit: a conformance claim a supplier cannot defend does not transfer the agency’s risk, it documents it.
08

Accessibility & Compliance Inquiries

Send us the deliverable. We will tell you where it stands.

A plan, a report, a form, a template, or the site itself. The first useful conversation is a scoped read of what you already have, against the criteria a reviewer will apply.

mark@greatbreadsny.com The Public-Sector Practice Capability Statement