Different laws. One technical standard underneath.
Accessibility obligations arrive from several directions at once — federal civil rights law, procurement rules, funding conditions, and international regulation. Almost all of them resolve to the same place: WCAG Level AA. The question worth answering first is which ones reach you, and what evidence you'd need if asked.
What each rule covers.
ADA Title II — state and local government
The most specific digital accessibility rule in U.S. law. The Department of Justice's 2024 rule adopts WCAG 2.1 Level AA as the technical standard for web content and mobile apps. Public entities serving 50,000 or more people were required to comply by April 24, 2026; entities under 50,000 and special district governments have until April 26, 2027. It reaches everything you offer the public — including services delivered through third-party portals.
ADA Title III — public accommodations
Covers most private businesses that serve the public. There is no codified web standard here, which is precisely why litigation drives the practice: courts and DOJ consent decrees have repeatedly used WCAG 2.0 or 2.1 Level AA as the measure. Retail, hospitality, healthcare, and financial services see the most activity.
Section 508 — federal agencies and their vendors
Requires federal agencies to make their electronic information technology accessible, incorporating WCAG Level AA by reference through the Revised 508 Standards. In practice, most organizations meet Section 508 as sellers: it's what drives buyers to ask for a VPAT before signing.
Section 504 and Section 1557
Section 504 of the Rehabilitation Act reaches recipients of federal financial assistance — schools, universities, many nonprofits and health programs. Section 1557 of the Affordable Care Act reaches covered health programs and activities, with HHS rulemaking extending to patient-facing digital services.
European Accessibility Act
In application since June 28, 2025 across EU member states, covering products and services sold into the EU: e-commerce, consumer banking, e-books, ticketing, and transport among them. Conformance is generally demonstrated through EN 301 549, which itself incorporates WCAG Level AA. It applies based on where you sell, not where you're incorporated.
AODA and other regional rules
Ontario's Accessibility for Ontarians with Disabilities Act has required WCAG 2.0 Level AA for covered organizations' public websites since January 2021, with reporting obligations. Other provinces and a growing number of U.S. states layer procurement and agency accessibility requirements on top of federal law.
This page is a plain-language summary of how these rules work in practice, not legal advice. Which obligations apply to your organization, and how, is a question for your counsel — we're built to work alongside them, providing the technical assessment and evidence they need.
You can't certify compliance. You can document conformance.
There is no accrediting body, no certificate, and no permanent status. What exists is a conformance claim: a statement that a defined set of content meets a specific WCAG version and level, at a point in time, supported by testing evidence.
That's what regulators, plaintiffs' counsel, and procurement teams actually ask for — and it's why the durable answer is a program with policy, testing, and monitoring rather than a one-time project with an end date.
What you'd need to produce
- A written accessibility policy naming your standard
- Current audit findings and testing methodology
- A dated remediation plan with named owners
- An accessibility statement with a working feedback path
- Evidence of training and procurement requirements
- A record of how reported barriers were resolved
Four assumptions that cause trouble.
"We're small, so we're exempt."
Size thresholds affect deadlines under the ADA Title II rule, not whether the obligation exists. Small entities got more time, not an exemption — and Title III has never had a small-business carve-out for accessibility.
"Our vendor handles compliance."
Your vendor handles their product. You remain responsible for the services you offer the public through it. Vendor accessibility is managed with VPAT requests, contract language, and renewal leverage — not delegated away.
"We have an accessibility statement, so we're covered."
A statement that isn't backed by testing and a real feedback path is documentation of intent, not conformance. It can also become an admission if it overstates where you actually are.
"We passed a scan, so we're compliant."
Automated tools evaluate only a portion of WCAG success criteria. A clean scan is a reasonable starting signal and a poor conformance claim.