How Section 508 Disqualifies Government Contractors at Bid Time

Most government contractors know Section 508 exists. Very few understand that non-compliance is a hard disqualifier at source selection — not a post-award remediation issue.

What Section 508 Actually Requires

Section 508 of the Rehabilitation Act (29 U.S.C. § 794d) requires federal agencies to procure, develop, maintain, and use information and communications technology (ICT) that is accessible to people with disabilities.

In 2017, the Access Board refreshed the ICT standards, aligning them with WCAG 2.0 Level AA. In 2025, WCAG 2.1 AA became the baseline. This covers websites, software, documents, kiosks, and any digital product sold to the federal government.

The rule for contractors: If you sell an ICT product or service to a federal agency, you must provide documentation that it meets these standards. That documentation is called a VPAT — Voluntary Product Accessibility Template — or its resulting Accessibility Conformance Report (ACR).

The Exact Disqualification Mechanism

Here is how it plays out in a real procurement:

1. The solicitation includes Section 508 requirements (required by FAR Part 39 for ICT acquisitions).
2. Offerors must submit a VPAT/ACR with their proposal or provide a URL where it can be found.
3. The contracting officer or technical evaluation team reviews the VPAT. If the product fails accessibility standards on key criteria — unlabeled form inputs, missing alt text, no keyboard navigation, missing HTML lang attribute — the VPAT fails.
4. A failed VPAT means the product does not conform to Section 508. The solicitation cannot be awarded to that offeror for that product. The offeror is disqualified from that line item.
5. In best-value competitions, even a partial 508 failure can eliminate a contractor from competitive range.

What Automated 508 Testing Checks

CertusAudit runs automated WCAG 2.1 AA checks against your public website as a baseline indicator of your 508 posture. The most common failures we find on contractor websites:

• Missing HTML lang attribute (WCAG 3.1.1) — This is a Level A failure, the lowest bar of 508 conformance. A VPAT cannot claim any conformance level with this missing.
• Unlabeled form inputs (WCAG 1.3.1) — Screen readers cannot identify what a form field is asking. Fails automated VPAT testing instantly.
• Images without alt text (WCAG 1.1.1) — Required for screen reader users. Counts as a VPAT failure for all images missing descriptive text.
• No skip navigation link (WCAG 2.4.1) — Keyboard users must tab through every navigation item on every page without this.
• Missing ARIA landmarks (WCAG 1.3.6) — Screen readers cannot navigate page structure without <main> and <nav> landmark regions.

The 2025 Update: Stricter Standards

The Access Board finalized updated ICT standards in 2025, incorporating WCAG 2.2 as the new baseline. Contractors selling software, portals, or web-based products to federal agencies now face stricter scrutiny at procurement. The DOJ also issued a final rule under ADA Title II requiring state and local government websites to meet WCAG 2.1 AA by April 2026 — this directly affects contractors whose products are used by public-facing government services.

What to Do Before Your Next Solicitation

1. Run your website through an automated 508 checker. CertusAudit scores your site against WCAG 2.1 AA criteria and gives you a specific list of failures.
2. Fix Level A failures first — lang attribute, form labels, alt text. These are instant VPAT disqualifiers.
3. Prepare or update your VPAT. Download the current template from itic.org and document your conformance level honestly.
4. Build a remediation timeline for Level AA failures and include it in your VPAT under "remarks and explanations."
5. Have your VPAT URL ready to include in proposals — a missing VPAT URL is treated the same as a failing VPAT in many evaluations.

Related: SAM.gov Contractor Identity Requirements · CMMC Website Security Checklist