VPAT services vs. VPAT software
An honest buyer's guide. Last updated: 2026-07-12.
You need a completed VPAT® — an Accessibility Conformance Report — because a buyer asked for one. You have two ways to get it: hire an audit firm, or run a platform that generates it from continuous scans. We sell the second, so read this knowing that — but the guide below names the leading firms and states the genuine trade-offs, because half of you should pick a firm, and the other half shouldn't pay five figures a year for a document that goes stale at your next release.
What audit firms do well
A good consulting audit is a human expert exercising judgment on every criterion — including manual assistive-technology passes with JAWS, NVDA, or VoiceOver, and usability judgment no automation can fully replace. If your buyer is a US federal agency, if your product has complex interaction patterns, or if you need a third party's name on the report for procurement leverage, a firm is the right call. The names that come up most, fairly described:
| Firm | Known for | Best fit |
|---|---|---|
| Deque Systems | Creator of the axe testing engine; large audit practice with deep WCAG expertise | Enterprise product teams that also want developer tooling |
| TPGi (Vispero) | Assistive-technology-centered testing (Vispero makes JAWS); Section 508 depth | Buyers who weight screen-reader usability heavily |
| Level Access | Large enterprise accessibility programs, governance and legal-risk framing | Fortune-500-scale compliance programs |
| Allyant | Manual engineering audit plus validation by native assistive-technology users | Teams that ship frequently and re-audit often |
| Accessible.org | Published pricing; audit → remediation window → final ACR flow | Startups and mid-market on a budget |
| Microassist / TestPros | Section 508 and government-procurement specialization | Vendors selling into US federal, state, and education |
| BarrierBreak | Cost-effective global delivery; testers with disabilities | International procurement (EN 301 549) |
Descriptions are factual summaries of each firm's public positioning; we have no relationship with any of them. Expect a consulting audit to take weeks and cost four to five figures per product per cycle.
Where services fall short
- The report is a snapshot. An ACR documents the build the auditor saw. Ship weekly, and the document drifts immediately; most firms re-audit annually.
- Findings arrive as a PDF. Someone still has to turn prose into tickets, fix the code, and schedule a re-test.
- Cost scales with cadence. Auditing every release the way procurement wishes you would is priced out of reach for most teams.
What a platform approach does differently
Wholisphere generates the VPAT 2.5 INT from live scan evidence instead of a point-in-time audit: 80+ evaluators machine-cover 50 of the 55 WCAG 2.2 Level AA criteria (static rules, real-browser Playwright probes, and vision-model checks), findings auto-file as GitHub issues, and every release regenerates the report from current results. The criteria that genuinely need human judgment aren't faked: they flow to a Human Attestations table on the VPAT itself, signed by your reviewer, so a buyer sees exactly which verdicts were machine-measured and which were human-attested. Approvals are SHA-256-hashed into a tamper-evident chain.
The honest limits: no platform replaces expert human judgment on the judgment-call criteria, and ours reports “unverified — never a false pass” when it can't measure something. If your procurement context demands an independent third-party audit, use a firm — or use both: several of our design partners run continuous scanning between annual audits so the auditor starts from a clean product instead of a backlog.
Decision rule
- Choose a firm when a single high-stakes procurement (federal, healthcare) hinges on a third-party name, or your product's interaction model needs expert AT judgment end to end.
- Choose a platform when you ship continuously, need the VPAT to stay current, and want findings as fixable tickets rather than a PDF.
- Combine them when budget allows: continuous scanning for drift, an annual independent audit for the third-party stamp.
Frequently asked
- Can a VPAT be generated automatically?
- Partially. Automated evaluation can machine-cover most Level AA criteria (Wholisphere covers 50 of 55 with 80+ evaluators, including browser probes and vision-model checks), but WCAG deliberately includes judgment-call criteria that need a human decision. A credible automated VPAT pairs machine verdicts with a human-attestation step for those criteria — and says which is which. Any tool that claims a fully automated, no-human VPAT is overclaiming.
- What is the difference between a VPAT and an ACR?
- The VPAT is the blank template published by the Information Technology Industry Council (ITI). Once a vendor fills it in with conformance claims, the completed document is an Accessibility Conformance Report (ACR). Buyers usually say "send me your VPAT" when they mean the ACR.
- How much does a VPAT service cost?
- Consulting-firm audits that produce an ACR typically run four to five figures per product per audit cycle, depending on product size and how much assistive-technology testing is included. Platform subscriptions are typically a fraction of that and regenerate the document continuously — the trade-off is scope: an auditor exercises human judgment on every criterion; a platform machine-evaluates most and routes the rest to your reviewer.
- Which VPAT edition do I need?
- WCAG edition for most commercial and education buyers, Section 508 for US federal procurement, EN 301 549 for Europe, or INT to cover all three in one document. Wholisphere generates VPAT 2.5 INT, which maps every criterion to WCAG, Section 508, and EN 301 549 simultaneously.
- Does an ACR go stale?
- Yes. An ACR documents the product at the moment of evaluation; every release after that drifts from the document. This is the strongest argument for continuous scanning behind your VPAT: the report regenerates from current findings instead of aging until the next annual audit.
VPAT® is a registered trademark of the Information Technology Industry Council (ITI). Wholisphere is not affiliated with ITI or with any firm named above.