What is Section 508

What Section 508 says

Section 508 is a short part of the Rehabilitation Act of 1973, added in 1986, rewritten by Congress in 1998 and codified at 29 U.S.C. 794d. It says that when a federal department or agency develops, buys, maintains or uses electronic and information technology, people with disabilities must get access to its information and data comparable to everyone else's. That duty runs to two groups: federal employees, and members of the public who come to the agency for information or services.

The statute itself sets no technical rules. It hands that job to the US Access Board, which writes the Section 508 Standards, and tells the Federal Acquisition Regulation to carry those standards into every federal purchase. GSA runs Section508.gov, the government's guidance site for the program. When meeting the standards would be an undue burden, the agency must still give people the information another way, and national security systems are outside the law altogether.

Who must comply, and who it reaches anyway

Section 508 binds the federal government and nobody else. It does not apply directly to private websites. It still reaches far past federal offices, because agencies buy most of their technology from companies. Find your row:

• A federal agency or the US Postal Service

  Bound directly. Everything it builds, buys, maintains or uses, from its website to its PDFs, must meet the standards unless an exception applies.

• A company selling software, a website build or documents to an agency

  Not bound by 508 itself, but the Federal Acquisition Regulation says an agency's purchases of ICT must meet the standards, so the solicitation names the 508 provisions your deliverable has to meet.

• A nonprofit, university or city that receives federal grants

  Usually not a 508 matter. Section 504 of the same Act covers programs that receive federal money, and the ADA covers state and local governments. Read the grant terms too, which may set accessibility requirements of their own.

• A state agency in a state that adopted 508 by its own law

  Bound by the state law, which points at the federal standards. Section508.gov lists California's Government Code Section 7405 as one example; check your own state's law.

• A small business with an ordinary website

  Not bound. The ADA is the law that reaches you, and DOJ names the Section 508 Standards only as helpful guidance alongside WCAG.

Two details matter to a vendor. Your own office laptops and tools are not covered just because you hold a federal contract: the standards excuse technology a contractor acquires incidental to the contract. And when nothing on the market fully conforms, FAR 39.205 lets the agency buy the product that best meets the standards. That is why an honest report of where your product falls short is worth more than a claim of perfection. How agencies read those reports is in what a VPAT is.

What the 2017 refresh changed

The refresh, published on 18 January 2017 and binding from 18 January 2018 (the dates at the top of this guide), changed the shape of the rules in two ways. The 2000 standards grouped their requirements by product type: software, web, telecommunications, self-contained products and computers. The 2017 standards address what the technology does instead, so a web app, a kiosk and a PDF are judged by the same functions. And they were harmonised with WCAG 2.0 and with European standards, so one piece of work can answer buyers on both sides of the Atlantic.

It also spelled out which content counts. Everything an agency publishes to the public must conform, and so must internal content in nine kinds of official communication, from emergency notices and benefit letters to forms, surveys and training material. The same WCAG 2.0 test now applies to web pages, documents, software and the help files that come with a product. One more rule reaches product makers directly: an authoring tool that exports PDF must be able to export PDF/UA-1, the accessible flavour of PDF. What that means for a single file is in 508 compliant PDF.

Why 508 still points to WCAG 2.0

The standards were written in 2017 and incorporate one fixed edition, WCAG 2.0, at Levels A and AA. That is 38 success criteria. The Title II rule for state and local governments names WCAG 2.1 Level AA, which is 50, and WCAG 2.2 Level AA is 55. Documents and software that are not web pages are excused from four of the 38: 2.4.1 Bypass Blocks, 2.4.5 Multiple Ways, 3.2.3 Consistent Navigation and 3.2.4 Consistent Identification, all of which assume a set of linked pages.

The practical answer is to build to WCAG 2.2 Level AA. W3C says content that conforms to 2.2 also conforms to 2.0 and 2.1, so one build satisfies a federal buyer, a city and a business customer. You then report against whichever version each buyer names; for an agency that is 2.0, which is why the 508 edition of the VPAT® carries WCAG 2.0. The criteria are listed one by one in our WCAG 2.2 AA checklist, and the versions are explained in what WCAG is.

Section 508 and the ADA are different laws

The short version: Section 508 governs what the federal government builds and buys; the ADA is a civil rights law that reaches state and local governments under Title II and businesses open to the public under Title III. The questions that cause the most confusion:

The state and local rule, with its dates and exceptions, is covered in the DOJ Title II web rule; what the ADA asks of a business site is in ADA compliant website: what the law asks.

Selling to an agency: the ACR is how you show it

A company meets Section 508 by showing an agency, in writing, how its product measures up. The document for that is an Accessibility Conformance Report, or ACR: a VPAT® template filled in for one product. GSA's Section508.gov recommends an ACR for any ICT marketed to the federal government, and contracting officials use it in market research and when they evaluate proposals. For a small software or web business, the route is four steps:

1. Read the solicitation's accessibility clause

   It names the 508 provisions your deliverable must meet. Answer those, not a generic promise.

2. Test the product against WCAG 2.0 Level A and AA

   By hand, with a keyboard and a screen reader, plus an automated scan. Build to 2.2 if you can; report 2.0 for this buyer.

3. Write the ACR on the 508 edition of the VPAT®

   The 508 edition carries WCAG 2.0. Say Partially Supports where it is true, with a remark a buyer can act on.

4. Publish it where a buyer can find it

   Section508.gov asks vendors to link the ACR from the product page. GSA's free ACR Editor writes one in the machine-readable OpenACR format.

Trusted Tester: the federal way of testing

The Department of Homeland Security runs the Trusted Tester process: a manual, code-inspection test method for Section 508 conformance, written as step-by-step tests for web content. DHS trains and certifies the people who use it, and agencies that adopt the process accept test results only from certified Trusted Testers.

Behind it sits the ICT Testing Baseline, the federal community's agreed list of what a 508 test must cover. It is not a method or a tool; it is the yardstick methods are checked against, and it comes in two parts, one for the web and one for documents. The document part is what a reviewer works from when your deliverable is a PDF; it is walked through in 508 compliant PDF.

For a vendor, the certificate is a credential for a person, not a product. Hiring a Trusted Tester, or getting someone on your team certified, is a strong answer when a buyer asks how your ACR was tested. The official program sits with the other public lists in our directory of evaluation tools and auditor lists.

Quick reference

This is general information, not legal advice. For your own situation, ask a lawyer.