TL;DR: A WCAG compliance audit is a structured evaluation of a digital asset against the Web Content Accessibility Guidelines published by the W3C. It produces a conformance report documenting which success criteria pass, fail, or partially pass at a given conformance level (A, AA, or AAA). No central authority "certifies" WCAG compliance -- the audit attests conformance at a point in time, not permanent status.

What is a WCAG compliance audit?

A WCAG compliance audit is a formal, manual-led evaluation of a website, web application, or digital product against the success criteria defined in a specific version and level of the Web Content Accessibility Guidelines -- most commonly WCAG 2.2 Level AA as of 2024. The audit produces a detailed report listing every success criterion, its pass/fail status for the pages or screens tested, evidence of the failure, and remediation guidance.

The W3C's Understanding Conformance document states that "conformance to WCAG 2.2 is defined only for web pages," meaning each page either conforms or it doesn't -- there's no partial credit at the page level. This matters. When someone says a "website is WCAG AA compliant," what they actually mean is that each tested page met all Level A and Level AA success criteria at the time of evaluation.

Most audit tools will identify WCAG conformance issues but won't fix them. An audit is diagnostic, not therapeutic. The audit tells you what's broken. Remediation is separate work.

Does official WCAG certification exist?

No. There is no official WCAG certification body. The W3C publishes the guidelines but does not certify, accredit, or endorse any organization's claim of conformance. No government agency -- not the U.S. Department of Justice, not the European Commission -- operates a registry of "WCAG-certified" websites.

This is the single most misunderstood aspect of accessibility compliance, and it matters for procurement. When a vendor says their product is "WCAG 2.2 AA certified," they're using a marketing term. What they likely mean is that they had an audit performed, the results were favorable, and they issued a self-attestation or conformance statement based on those results.

Some third-party audit firms issue certificates or badges after a successful audit and remediation cycle. These are the firm's own attestation, not a government-recognized credential. They carry weight proportional to the reputation and methodology of the firm that issued them.

For enterprise buyers evaluating vendors: ask for the audit report itself, not just the certificate. The report shows methodology, sample size, specific success criteria tested, and evidence. The certificate alone tells you almost nothing.

What is the difference between WCAG, ADA Title III, and Section 508?

These three are related but distinct. Understanding the differences prevents you from conflating a technical standard with a legal obligation.

Standard / Law What it is Who it applies to What it requires
WCAG 2.2 A technical standard published by the W3C Anyone who adopts it voluntarily; referenced by many laws Meeting success criteria at Level A, AA, or AAA
ADA Title III U.S. federal civil rights law (Americans with Disabilities Act, 1990) Private entities operating places of public accommodation Non-discrimination in goods and services; courts have applied this to websites
Section 508 (29 U.S.C. § 794d) U.S. federal procurement law Federal agencies and their contractors/vendors ICT must conform to the Revised 508 Standards, which incorporate WCAG 2.0 Level AA

ADA Title III and websites

The ADA does not explicitly mention websites. However, the Department of Justice has consistently taken the position that websites of public accommodations are covered under Title III. The DOJ's 2022 guidance reaffirmed this, and federal courts in numerous circuits have agreed. The DOJ has pointed to WCAG 2.1 AA as a benchmark, though it is not formally codified as the binding standard for ADA compliance.

This ambiguity is why a WCAG audit is valuable but not a legal guarantee. Conforming to WCAG 2.2 AA is currently the strongest defensible position for a private-sector organization, but it's your legal counsel -- not your auditor -- who determines your ADA compliance posture.

Section 508 and the Revised Standards

Section 508 is more specific. The Revised 508 Standards (effective January 2018) directly incorporate WCAG 2.0 Level A and Level AA success criteria for web content and non-web software. Federal agencies procuring ICT products require vendors to document conformance via a VPAT.

The Section 508 standards still reference WCAG 2.0, not 2.1 or 2.2. However, the U.S. Access Board has signaled interest in updating the reference. For practical purposes, auditing against WCAG 2.2 AA covers everything in 2.0 AA since WCAG 2.2 is backward-compatible.

What does a conformance audit actually test?

A conformance audit tests each applicable WCAG success criterion against a representative sample of pages, screens, or states in the digital product. WCAG 2.2 Level AA includes 55 success criteria spanning four principles: Perceivable, Operable, Understandable, and Robust (POUR).

Representative page sampling

Most audits don't test every single page on a large site. Instead, auditors select a sample that covers all unique templates, components, and interaction patterns. For a 500-page marketing site, an audit might cover 20-40 pages. For a SaaS application, it might cover 15-30 distinct screens plus key user flows (signup, login, checkout, settings).

Sample-based auditing is standard practice, and typical turnaround is 1-2 weeks. That timeline is realistic for a focused sample. Full-site audits of large applications can take 4-8 weeks.

Manual testing methodology

A real conformance audit requires manual evaluation. The audit must be conducted fully manually to be an audit; a scan can only be used as a secondary filter. Automated scanners catch roughly 30-40% of WCAG success criteria reliably. The remaining 60-70% require human judgment -- things like whether alt text is actually meaningful, whether focus order is logical, or whether error messages are sufficiently descriptive.

Manual testing typically involves:

  1. Keyboard-only navigation -- tabbing through every interactive element without a mouse
  2. Screen reader testing -- using NVDA (free, Windows), JAWS ($95/year for home license), or VoiceOver (built into macOS/iOS)
  3. Magnification testing -- verifying content reflows properly at 200% and 400% zoom
  4. Color contrast analysis -- verifying minimum contrast ratios (4.5:1 for normal text, 3:1 for large text at Level AA)
  5. Cognitive review -- assessing reading level, consistent navigation, error identification
  6. Code inspection -- reviewing HTML semantics, ARIA attributes, and DOM structure

Deliverables

The output of a conformance audit is typically a report that includes:

  • Executive summary with overall conformance status
  • Per-criterion pass/fail/partial results
  • Screenshots and code snippets showing each failure
  • Severity ratings (critical, major, minor)
  • Remediation guidance for each issue
  • Optional: an Accessibility Conformance Report (ACR) in VPAT format

What is a VPAT and Accessibility Conformance Report?

A VPAT (Voluntary Product Accessibility Template) is a standardized document template created by the IT Industry Council (ITI). When filled out, it becomes an Accessibility Conformance Report (ACR). The VPAT template provides a structured format for documenting how a product conforms to accessibility standards.

Section508.gov describes the VPAT as the primary mechanism for federal buyers to evaluate ICT accessibility. Federal agencies are required to consider accessibility when procuring ICT, and the ACR is the document they review during that process.

There are four VPAT template versions:

VPAT Version Standards Covered
VPAT 2.5 WCAG WCAG 2.x only
VPAT 2.5 Revised Section 508 U.S. Section 508
VPAT 2.5 EN 301 549 European accessibility standard
VPAT 2.5 INT (International) All three combined

For each success criterion, the ACR records one of these conformance levels:

  • Supports -- the product fully meets the criterion
  • Partially Supports -- some functionality meets the criterion
  • Does Not Support -- the product does not meet the criterion
  • Not Applicable -- the criterion is not relevant to the product

Who needs a VPAT?

If you sell software, SaaS, or digital products to U.S. federal agencies, you need a VPAT. Most agencies will not proceed with procurement without one. Many state governments, universities, and large enterprises have adopted the same requirement.

I've seen RFPs from state university systems, Fortune 500 companies, and healthcare organizations that explicitly require a completed VPAT as part of the vendor evaluation. If you're in B2B or B2G sales and don't have an ACR, you're losing deals you never even knew about -- procurement teams simply disqualify you before reaching out.

Why do enterprise and government buyers require audits?

Enterprise and government buyers require WCAG audits and ACRs because they carry legal obligations themselves. Federal agencies must comply with Section 508. Companies with 15+ employees are subject to ADA obligations. Organizations receiving federal funding must comply with Section 504 of the Rehabilitation Act.

But beyond legal obligation, there are three practical reasons:

1. Risk transfer

When an enterprise procures a vendor's software, any accessibility barriers in that software become the enterprise's problem. An ACR lets procurement teams quantify the accessibility risk they're inheriting. A product that "Does Not Support" 12 success criteria represents measurable remediation cost and legal exposure.

2. Due diligence documentation

In the event of an accessibility complaint or lawsuit, demonstrating that the organization conducted due diligence -- including reviewing vendor ACRs and conducting audits of their own properties -- is part of a defensible compliance posture.

3. Contractual requirements

Many enterprise contracts now include accessibility clauses that require vendors to maintain WCAG 2.x AA conformance throughout the contract term and provide updated ACRs annually or upon major releases.

How much does a WCAG audit cost?

A third-party WCAG conformance audit typically costs between $5,000 and $35,000 depending on scope. Here's what drives the price:

Factor Lower end Higher end
Number of pages/screens 10-20 50-100+
Product complexity Static marketing site Dynamic web application with forms, dashboards, media
VPAT/ACR included No Yes
Remediation guidance detail Summary-level Developer-ready with code examples
Retesting after remediation Not included One round included
Turnaround time 3-4 weeks 1-2 weeks (rush)

For a typical mid-size marketing website (30-50 templates), expect $8,000-$15,000 for a thorough manual audit with a detailed report. For a SaaS product with a VPAT/ACR, budget $15,000-$30,000.

Overlay widgets (like those marketed as one-click compliance fixes) are not audits and do not produce conformance. The W3C's Web Accessibility Initiative has an entire resource section warning against over-reliance on automated solutions. An overlay does not change your conformance status.

What is the value of a third-party audit?

A third-party audit provides independence, credibility, and expertise that internal reviews typically cannot match.

Independence matters. When the team that built the product also evaluates it, bias is inevitable. Developers and designers have blind spots about their own work. A third-party auditor has no stake in the outcome and no reason to downplay failures.

Credibility matters for legal and procurement contexts. A self-assessment holds less weight in court or during procurement evaluation than a report from an independent firm with documented methodology. This doesn't mean self-assessments are worthless -- they're good practice for ongoing monitoring. But for formal conformance claims, third-party attestation is the standard.

Expertise matters. WCAG success criteria require interpretation. Is a 3.1:1 contrast ratio on a 23px font sufficient? (No -- 23px is below 24px, so the 4.5:1 threshold applies, not 3:1.) These edge cases require practitioners who test accessibility daily, not generalist QA engineers running a scanner once a quarter.

Firms that specialize in accessibility testing develop pattern recognition and interpretive depth that generalist agencies rarely match.

Automated vs. manual audits: what catches what?

Automated and manual testing are complementary, not interchangeable.

Capability Automated tools Manual testing
Color contrast ratios Yes (for text in CSS, not images) Yes (including text in images, gradients)
Missing alt attributes Yes Yes, plus evaluating alt text quality
Form labels present Yes Yes, plus evaluating label clarity
Keyboard operability Partial (can detect some focus issues) Yes (full navigation testing)
Logical reading order No Yes
Screen reader compatibility No Yes
Error identification quality No Yes
ARIA attribute correctness Partial (syntax only) Yes (semantic correctness)
Cognitive accessibility No Partial (requires user testing for full coverage)
  • axe DevTools (Deque) -- browser extension, free tier covers core rules, pro version runs against WCAG 2.2. Widely regarded as the most reliable automated engine.
  • WAVE (WebAIM) -- browser extension, free. Good for visual indicators of issues.
  • Lighthouse (Google, built into Chrome DevTools) -- runs axe-core under the hood. Useful for CI/CD integration but limited scope.
  • Pa11y -- open-source CLI tool, good for pipeline integration. Uses axe-core or HTML_CodeSniffer.
  • SiteImprove -- enterprise-grade scanner with dashboards and trend tracking. Pricing starts around $10,000/year.

Automated tools are necessary for catching low-hanging fruit and monitoring for regressions. We run axe-core in CI for every pull request on our projects, and it catches real issues -- but the most impactful accessibility bugs we find in audits are always the ones no scanner detects.

How to prepare for a WCAG compliance audit

Before engaging a third-party auditor, do these things to make the engagement efficient and the results actionable:

  1. Define scope clearly. List every URL, screen, or user flow you want audited. Include authenticated states (logged-in dashboards, account settings) and transactional flows (checkout, form submission, search).

  2. Provide test accounts. If the product requires login, create test accounts with realistic data. Auditors shouldn't need to ask for access mid-engagement.

  3. Specify the target standard. Most organizations should target WCAG 2.2 Level AA. State this explicitly in the engagement scope.

  4. Run automated scans first. Fix the obvious issues before the auditor arrives. There's no reason to pay $200/hour for an expert to find a missing alt attribute that axe-core would have flagged for free.

  5. Identify your CMS and tech stack. Auditors need to know if you're on WordPress, a headless CMS like Sanity or Contentful, a React SPA, or server-rendered pages. The tech stack influences which WCAG criteria are most likely to fail.

  6. Assign a remediation owner. Know who will fix the issues before the report arrives. An audit without a remediation plan is a wasted audit.

  7. Plan for retesting. Budget for a validation round after remediation. Conformance claims require evidence that issues were actually fixed, not just flagged.

What happens after the audit?

The audit report is the starting point, not the finish line. Here's the typical post-audit workflow:

Remediation prioritization

Not all failures are equal. A missing skip navigation link is important but low-severity compared to a checkout form that's completely inoperable with a keyboard. Prioritize by:

  • User impact -- how many users are affected, and how severely?
  • Task criticality -- does the failure block a critical user flow?
  • Legal exposure -- does the failure involve a commonly litigated criterion?

Remediation sprint

For teams using agile workflows, remediation is typically handled in a dedicated 2-4 week sprint. The audit report maps directly to tickets. Each ticket references the specific success criterion, the failing element, and the auditor's recommended fix.

Validation and retesting

After remediation, the auditor retests the failed criteria. This is usually scoped at 30-50% of the original audit cost. If everything passes, the auditor can issue an updated report or ACR reflecting the new conformance status.

Ongoing monitoring

Conformance is not a permanent state. Every content update, feature release, or CMS change can introduce new barriers. We integrate automated accessibility checks into CI/CD pipelines (using axe-core via @axe-core/playwright or @axe-core/puppeteer) and run quarterly manual spot-checks.

If your organization needs help preparing for, executing, or remediating after a WCAG audit, our team handles this work regularly across headless CMS builds, React and Next.js applications, and enterprise marketing sites. See our web accessibility compliance capabilities for specifics on how we approach this work.

FAQ

Is there an official WCAG certification?

No. The W3C publishes WCAG but does not certify websites or products. Any "certification" comes from the auditing firm itself, not a central authority. Ask for the full audit report, not just a badge.

What WCAG version should we audit against?

WCAG 2.2 Level AA, published October 2023. It's backward-compatible with 2.1 and 2.0, so conforming to 2.2 AA automatically covers older versions. Section 508 still references 2.0, but auditing to 2.2 exceeds that threshold.

Does a WCAG audit guarantee ADA compliance?

No. ADA compliance is a legal determination, not a technical one. WCAG conformance is strong evidence of accessibility but doesn't constitute legal compliance on its own. Consult legal counsel for your specific obligations.

How often should we re-audit?

Annually at minimum, or after any major redesign, platform migration, or feature release. Automated monitoring between audits catches regressions but doesn't replace periodic manual evaluation.

What's the difference between a VPAT and an ACR?

The VPAT is the blank template published by the IT Industry Council. When filled out with your product's conformance data, the completed document is called an Accessibility Conformance Report (ACR). People often use the terms interchangeably.

Can automated tools replace a manual audit?

No. Automated tools reliably detect only 30-40% of WCAG success criteria. Criteria involving subjective judgment -- like meaningful alt text, logical reading order, and clear error messages -- require human evaluation.

Do accessibility overlay widgets count as compliance?

No. Overlay widgets do not change the underlying code or conformance status of a website. The W3C's Web Accessibility Initiative and numerous accessibility practitioners have documented their limitations. They are not a substitute for proper remediation.

What does a WCAG audit cost for a small website?

For a site with 10-20 unique templates and no complex application logic, expect $5,000-$10,000 from a reputable third-party firm. Prices increase with scope, application complexity, and the inclusion of a VPAT/ACR.