Section 508 of the Rehabilitation Act requires US federal agencies — and anyone selling ICT to them — to make electronic and information technology accessible. The 2018 Refresh aligned it directly with WCAG 2.0 AA.
Section 508 is a provision of the US Rehabilitation Act of 1973, added by amendment in 1998 and substantially refreshed in January 2017 (fully enforceable from January 2018). It requires federal agencies to ensure that the electronic and information technology (ICT) they develop, procure, maintain or use is accessible to people with disabilities — both federal employees and members of the public.
The legal text is short. The operational detail lives in the Access Board’s Revised Section 508 Standards, which incorporate WCAG 2.0 Levels A and AA by reference for web content and software, and add requirements for hardware, platforms, support documentation, and authoring tools.
Critically, Section 508 is a procurement statute: a vendor that sells ICT to the US federal government must demonstrate conformance through a Voluntary Product Accessibility Template (VPAT) or equivalent Accessibility Conformance Report (ACR). Non-conformant products can be rejected at solicitation stage — a commercial consequence more immediate than any fine.
Section 508 applies to every US federal executive-branch agency — and, through procurement, to every vendor in their ICT supply chain.
Federal executive agencies. All 15 cabinet departments plus 60+ independent agencies (EPA, NASA, SSA, VA, FDA, FCC, FTC, etc.). Covers every public-facing website, every internal application, every piece of communication software, every training platform, every form issued to the public.
Contractors and vendors. Any company selling ICT to a federal agency — software, SaaS, hardware, ICT support services — must demonstrate Section 508 conformance. This is where the real compliance pressure lives: every FAR (Federal Acquisition Regulation) solicitation includes a Section 508 requirement, and procurement officers routinely disqualify bids without a valid ACR/VPAT.
Federally-funded programmes. Under Section 504 of the same Act, recipients of federal funding — public universities, hospitals accepting Medicare, research institutions — have parallel obligations. Practically, most align to Section 508 for consistency.
State and local governments — indirectly. Section 508 itself does not bind them, but many states (California, Massachusetts, Minnesota, New York, Texas, Virginia) have adopted Section 508 verbatim as their state standard. The DOJ’s 2024 ADA Title II final rule then separately imposes WCAG 2.1 AA on them.
The Refresh standards are organised by chapter (Chapter 1 – Chapter 7). Web and software obligations (Chapter 5) incorporate WCAG 2.0 AA. Hardware, platform features, documentation and support services add further obligations.
Nine outcome-based criteria: without vision, with limited vision, without perception of colour, without hearing, with limited hearing, without speech, with limited manipulation, with limited reach/strength, and minimise photosensitive seizure triggers.
ICT with “closed functionality” (where users can’t attach assistive tech — kiosks, phones, single-purpose devices) must have built-in features for speech output, audio output, enlarged text, contrast control and tactile controls.
All web content must conform to WCAG 2.0 Levels A and AA. This includes intranet, extranet, public-facing sites, web applications and web-delivered training.
Software and platforms must expose name, role, state, boundary, text and parent/child relationships to assistive technology APIs (MSAA, UIA, AX, AT-SPI).
Native and desktop applications must preserve user-preference settings (colour, contrast, cursor size), support keyboard access, not override AT features, and provide accessible alternatives for caption/description display.
Tools used to create content (CMS, document editors, video editors) must allow authors to create accessible output and to preserve accessibility metadata during editing and conversion.
Product documentation must be available in accessible electronic format, list accessibility and compatibility features, and be free of charge.
Technical support (call centres, chat, email) must be available in accessible formats and must be able to respond to accessibility-related questions about the product.
Section 508 Refresh references WCAG 2.0, ANSI/IEEE C63.19 (hearing-aid compatibility), ITU-T E.161 (telephone keypad layout), IETF RFC 6350 (vCard) and other standards directly.
Vendors must provide an ACR — structured documentation of how the product meets each Section 508 criterion (Supports, Supports with Exceptions, Does Not Support, Not Applicable). ITI’s VPAT 2.5 is the standard template.
Section 508 does not carry civil fines in the way the ADA does. Its teeth are procurement disqualification, administrative complaints, and litigation risk under parallel statutes (Section 504, ADA, state laws).
The most common consequence. Federal buyers routinely reject ICT bids that lack a valid ACR or whose ACR shows material non-conformance. Can disqualify the vendor from an entire contract vehicle.
Individuals with disabilities can file an administrative complaint with the offending federal agency and, on appeal, with the agency’s Inspector General or the DOJ. Remedy is injunctive — fix the system.
After exhausting administrative remedies, individuals can sue a federal agency in federal court. Remedies are injunctive plus attorneys’ fees — no compensatory damages under Section 508 itself.
Where the real financial pain lives. A major federal contractor who ships a non-conformant product isn’t fined by the Access Board — they lose the next recompete. Multi-year ICT contracts with federal agencies routinely exceed $100 M. A Section 508 failure that causes an agency to refuse acceptance of a deliverable can suspend payment on the entire contract.
Parallel statutes. Federal agencies that fail Section 508 can also be sued under Section 504 of the same Act (no separate administrative exhaustion required for many claims), and state and local bodies that adopt Section 508 as their own standard are also subject to ADA Title II, DOJ enforcement and private civil suits under state human-rights acts.
Section 508 has been enforceable since 2001 for original standards, and since January 2018 under the Refresh. There are no future deadlines — the obligation is already continuous.
7 August 1998
The Workforce Investment Act of 1998 adds Section 508 to the Rehabilitation Act, requiring federal agencies to make ICT accessible.
21 June 2001
Original Section 508 Standards (organised by technology type — web, software, telecoms, etc.) become enforceable against federal agencies.
18 January 2017
The Access Board publishes the Revised 508 Standards. Restructured around functional performance + ICT type + WCAG 2.0 AA. Final rule in the Federal Register.
18 January 2018
One-year compliance window ends. Revised standards fully enforceable. All federal ICT — existing and new — must meet the new baseline.
2024 onwards
The Access Board has signalled intent to update the reference from WCAG 2.0 to a newer version, harmonising with the DOJ’s Title II rule (2.1 AA). No formal rulemaking concluded yet — watch the regs.gov docket.
If you sell ICT to the US federal government, conformance is a condition of doing business. If you’re a federal agency, it’s a statutory obligation every time you procure or build.
Our checkers map every failure to the exact Section 508 criterion + WCAG reference, giving you the evidence base to complete an ACR/VPAT without guessing.