A SaaS accessibility audit is a manual WCAG test of your product’s real user journeys, from sign-up and login to the core workflows, settings and billing, that ends with evidence a buyer can check: a findings report, proof that fixes were re-tested and an Accessibility Conformance Report (ACR) built on the right VPAT edition. If a procurement checklist, RFP or vendor review has just asked you for one, the order to work in is simple: scope the journeys and the standard your buyer names, audit, fix, re-test, and only then write the ACR.
This guide is for SaaS founders, product leaders and sales or compliance leads who need to buy an audit because a deal depends on it. It covers what to test, which standard to test against, what you should receive, how long it takes and what it costs. If your question is how to fill in the VPAT itself, read our companion guide on VPAT for SaaS. This is not legal advice.
Why Enterprise and Public-Sector Buyers Ask SaaS Vendors for Audit Evidence
Accessibility questions in a procurement review are rarely about good intentions. Buyers want a document they can file, and the rules behind three common buyer types explain why.
- US federal agencies need an ACR before they buy. Section508.gov puts it plainly: “While the use of the VPAT itself is not required, it is not voluntary to complete an ACR if you wish the government to consider purchasing your product” (Section508.gov ACR and VPAT FAQ). Federal ACRs are judged against the Revised Section 508 Standards, which incorporate WCAG 2.0 Level AA. For how federal buyers check vendor claims, see our Section 508 testing guide.
- State agencies, cities and public universities are working to a deadline. Under the DOJ’s ADA Title II web rule, their web content and mobile apps must meet WCAG 2.1 Level AA. An interim final rule published on April 20, 2026 set the compliance dates at April 26, 2027 for entities with a population of 50,000 or more, and April 26, 2028 for smaller entities and special district governments. The rule also covers content a public entity provides “when a state or local government has an arrangement with someone else who provides or makes available web content for them” (ADA.gov fact sheet). That is why the SaaS tools those buyers license now come with accessibility questions. More detail is in our DOJ Title II deadline guide.
- Enterprise and European buyers use the same templates. The ITI VPAT comes in four editions, so the same request can arrive as a WCAG, 508, EU (EN 301 549) or INT report. ITI also notes that a VPAT does not normally need a third-party review, but that a government “or other solicitation” may require “a third party audit or review as part of its terms” (ITI VPAT). When a buyer asks for independent testing behind your ACR, that requirement usually comes from the solicitation.
There is also a shortcut buyers have learned to distrust. In April 2025 the FTC approved a final order requiring accessiBe to pay $1 million and barring it from claiming its automated products can make any website WCAG compliant without evidence. A widget on your marketing site will not answer a procurement question about your application.
Match the Audit Standard to the Buyer Who Is Asking
Get the standard right before anyone quotes. Testing against the wrong version means paying for a second round later.
| Who is asking | Standard to test against | VPAT 2.5Rev edition |
|---|---|---|
| Private enterprise buyer, RFP or vendor review | WCAG 2.2 Level AA (covers 2.0 and 2.1 too) | WCAG |
| US federal agency | Revised Section 508 Standards (WCAG 2.0 Level AA plus software and documentation rules) | 508 |
| US state agency, city or public university | WCAG 2.1 Level AA under ADA Title II (testing to 2.2 AA also covers it) | WCAG (or 508 if the buyer asks for it) |
| European public-sector or EU customer | EN 301 549 (incorporates WCAG 2.1) | EU |
| Several of the above | All three standards in one report | INT |
ITI’s own page confirms which WCAG version sits inside each edition: WCAG 2.0 in the 508 edition, WCAG 2.1 in the EU edition and WCAG 2.2 in the WCAG and INT editions. The current template is VPAT 2.5Rev, released on April 24, 2025 (ITI VPAT). If you are unsure, test to WCAG 2.2 Level AA and pick the edition your buyer names.
What a SaaS Accessibility Audit Should Cover
A SaaS product is not a brochure site, so page counts are the wrong unit. Scope by journeys and components. W3C’s WCAG Evaluation Methodology (WCAG-EM) describes defining the scope, exploring the product, selecting a representative sample that includes complete processes, evaluating it and reporting the results. For most SaaS products that sample should include:
- Account access: sign-up, login, single sign-on, password reset and multi-factor prompts.
- Onboarding: first-run setup, product tours and empty states.
- Core workflows: the two to five tasks your customers bought the product for, tested end to end.
- Complex components: data tables, filters, drag and drop, date pickers, rich text editors, charts and dashboards.
- Forms and errors: labels, required fields, inline validation and error recovery.
- Dialogs and live updates: modals, toasts, notifications, loading states and anything that changes without a page reload.
- Settings, roles and billing: admin screens, user management, plan changes and invoices.
- Outputs: exported PDFs, emails your product sends, and help or documentation pages buyers will check.
- Platforms: desktop browsers, plus responsive or native mobile views if your contract covers them.
Each journey should be tested with a keyboard alone, with screen readers (for example NVDA and JAWS on Windows and VoiceOver on macOS and iOS), at 200% and 400% zoom, and with automated checks for coverage. Automated tools help, but W3C is clear that evaluation tools “can not determine accessibility, they can only assist in doing so”. The difference matters in a procurement review, because an ACR’s remarks have to describe what was actually tested.
What You Should Receive at the End
Ask every vendor to list deliverables in the proposal. For a SaaS procurement audit, this is the set that answers a buyer’s questions:
| Deliverable | What it should contain | Why the buyer cares |
|---|---|---|
| Audit report | Each finding with the WCAG success criterion, severity, exact location, steps to reproduce and a recommended fix | Shows the product was really tested, and gives your developers a backlog |
| Scope and method statement | Product version, environments, journeys, assistive technologies and browser versions used | Lets the buyer see what the conformance claims rest on |
| Re-test results | Each fixed issue re-checked with the same steps and assistive technology that found it | Proves the fixes worked |
| Remediation log | Every finding closed with its fix, re-test result and date | A dated audit trail for the next buyer who asks |
| Accessibility Conformance Report | The chosen VPAT 2.5Rev edition, a conformance level for each criterion (Supports, Partially Supports, Does Not Support, Not Applicable) and remarks that explain exceptions | The document procurement files |
| Roadmap for open issues | Known gaps with planned fix dates | An honest exception with a planned date reads better in a review than a vague claim |
You can see how our findings are written on the sample audit report page. Two things are worth knowing before you promise a buyer anything. ITI states there is no VPAT certification, so be wary of anyone selling one. And Section508.gov advises that every time a product changes, “an updated ACR may be required” (Section508.gov FAQ). A SaaS ACR is a living document, so plan for re-testing after major releases.
Timeline: The Order Matters More Than the Speed
Writing an ACR before the audit documents your failures for procurement to read. Fixing before the audit means fixing what you guess is broken. The sequence that holds up is:
- Scope (days, not weeks). Agree the product version, journeys, roles, platforms, standard and VPAT edition.
- Audit. Manual and automated testing of every journey in scope.
- Remediate. Fix shared components first, so one change clears the same issue across the app.
- Re-test. Close each finding only after it passes the same test that found it.
- Write the ACR. Base every conformance level and remark on the re-tested product.
How long this takes depends on how many journeys are in scope, how quickly you provide test accounts and how fast your team can ship fixes. As one reference point, our SaaS audit and VPAT case study ran audit, remediation and the VPAT/ACR as three consecutive contracts over about six weeks end to end. If your deal has a hard date, tell vendors up front and ask them to show the plan backwards from it.
What a SaaS Accessibility Audit Costs
At HalfAccessible the audit is a fixed price, and the ACR is quoted after a short scoping review, usually within 1 to 2 business days. All prices are on our pricing page:
| Option | Price | What it covers | Best for |
|---|---|---|---|
| Free 30-minute call | Free | A first discussion about your product, your buyer’s request and the deadline, so we can scope and quote | Teams facing their first procurement accessibility question |
| 1-hour technical consultation | $100 | A working session to walk through an existing audit or ACR, talk with your developers or review issues in your app live | Teams that already have findings or a draft ACR |
| Quick Audit | $500 | Manual WCAG 2.2 AA testing of up to 5 templates with a top-issues report | Testing one or two critical journeys before a bigger commitment |
| Complete Audit | $2,000 | Up to 25 templates or key user flows, a re-test of fixed issues and 90 days of support | A full SaaS application ahead of a procurement deadline |
| VPAT / ACR documentation | Quoted after scoping | The ACR in the edition your buyer needs, based on tested results | Any deal where procurement asks for an ACR |
What moves the price for a SaaS product is mostly scope: the number of distinct journeys and complex components, the number of user roles, whether mobile apps are included, and whether you need one VPAT edition or the INT edition covering all three standards. For how audit pricing compares across the market, see our accessibility audit cost guide.
Prepare These Before You Ask for Quotes
A clear brief gets you accurate quotes and a faster start. Send vendors:
- The buyer’s exact wording, plus any named standard, VPAT edition or deadline.
- The product version and the environment testers will use, ideally a stable staging copy.
- Test accounts for each user role, with realistic sample data.
- Your list of core journeys, in priority order.
- Any existing ACR, earlier audit or known issues list.
- Who on your team will fix issues, and when they are available.
If you want a quick look at obvious problems first, run your public login page or marketing site through AccessibilityScore.in, HalfAccessible’s free single-page WCAG scan powered by axe-core. It is a useful starting point for code-level issues such as missing labels or contrast, but it scans one public page at a time and cannot test keyboard use, screen reader behaviour or the logged-in journeys a manual audit covers.
Red Flags in a SaaS Audit or ACR Proposal
- “We’ll fill in the VPAT from a scan.” A scan cannot support remarks about keyboard access, screen reader output or complete workflows.
- “VPAT certification.” ITI says there is no such thing.
- No named standard or edition. You may end up with a WCAG 2.2 report when your federal buyer needed the 508 edition.
- Page-count pricing for an application. It hides the cost of complex components and roles.
- An ACR delivered before fixes are re-tested. It locks your pre-fix failures into the document buyers read.
- “Full compliance” or lawsuit guarantees. Honest reports include exceptions, and nobody can promise immunity.
- An overlay offered as the fix. It does not change your application, and the FTC order shows how such claims are treated.
For a broader checklist you can use with any vendor, see how to choose an accessibility audit company.
How HalfAccessible Runs SaaS Accessibility Audits
- Proof: In our SaaS audit and VPAT case study, one team ran the audit, carried out code-level remediation, re-tested each fix and only then wrote the VPAT/ACR, over about six weeks. All three contracts were rated 5.0 out of 5 on Upwork. Our VPAT for SaaS case study with Happeo covers a documentation-focused engagement.
- Who tests: Founder-led work. Audits are led and reviewed by Mohammad Shadab Saifi (IAAP CPACC, WAS and CPWA, DHS Section 508 Trusted Tester), with manual testing in NVDA, JAWS and VoiceOver plus keyboard-only checks. Certification details are on the International Association of Accessibility Professionals site.
- One accountable team: the same specialists can handle the audit, accessibility remediation, re-testing and VPAT and ACR documentation, so findings, fixes and claims stay consistent.
- After the deal: re-tests after major releases and monitoring and governance keep your ACR current for the next buyer.
Everything we offer software companies is on our SaaS and B2B software accessibility page.
Next Step: Get Procurement-Ready Evidence for Your Next Deal
If a buyer is waiting on accessibility evidence, start with a scoped quote rather than a guess.
- A buyer just asked? Book a free 30-minute call. Bring the buyer’s wording and your deadline, and leave with a fixed-price scope for the audit and ACR.
- Procurement needs an ACR? Request a VPAT quote. Share the edition, platforms and user journeys, and most quotes come back within 1 to 2 business days.
- Ready to test your core journeys? Start a $500 Quick Audit on up to 5 templates, or move straight to the $2,000 Complete Audit for the full application.
- Already have findings or a draft ACR? Book the $100 one-hour technical consultation to review them with your developers.
- Want to compare first? See pricing, the sample audit report and our case studies.
