ADA Title II28 CFR § 35.200Government ProcurementIT Vendor ContractsWCAG 2.1 AA

What to Put in Your IT Vendor Contracts Under 28 CFR § 35.200: A Government Procurement Officer's Drafting Guide

March 2026 · 9 min read · CertusAudit

Most procurement guidance on web accessibility cites FAR Part 39.2 or Section 508. If you are a state or local government contracting officer, neither applies to you. FAR governs federal procurement. Section 508 (29 U.S.C. § 794d) covers federal executive branch agencies. Your authority is 28 CFR § 35.200(b) — the DOJ's ADA Title II web accessibility rule, effective June 24, 2024.

This guide is written for the person drafting the RFP and reviewing vendor deliverables — not for the agency explaining its compliance obligations, and not for the vendor explaining what it must do. Here is what your contracts need, what authority to cite, and what to do when a vendor fails post-delivery.

Your Legal Authority — Not FAR, Not Section 508
State/local authority
28 CFR § 35.200(b) — ADA Title II Final Rule, eff. June 24, 2024 (89 FR 31320)
Technical standard required
WCAG 2.1 Level AA — all success criteria, Level A and AA
Procurement hook language
§ 35.200(a): 'directly or through contractual, licensing, or other arrangements'
NOT applicable to you
FAR Part 39.2 (federal only) · Section 508 (federal executive branch only)

What § 35.200 Requires From Your Vendors

The key language in § 35.200(a) creates a pass-through obligation:

“A public entity shall ensure that web content that a public entity provides or makes available, directly or through contractual, licensing, or other arrangements, [is] readily accessible to and usable by individuals with disabilities.”

Your agency cannot outsource its ADA obligation. The third-party content exception in § 35.201(c) explicitly excludes contractors acting under a contractual arrangement. When your vendor delivers a non-compliant website, your agency bears the liability. Your contracts must flow that obligation back to the vendor.

The 4 Contract Practices the DOJ Explicitly Endorses

The DOJ's First Steps guidance (ada.gov) identifies four specific vendor contract practices drawn from public comments to the rule. These are the closest the DOJ comes to prescribing contract language:

01
Require accessibility information before signing

Before executing the contract, require the vendor to provide detailed documentation of the accessibility of their product or service. For existing products, this means a completed VPAT or Accessibility Conformance Report (ACR). For custom development, require a written accessibility plan.

Sample clause language
"Prior to contract execution, Vendor shall provide an Accessibility Conformance Report (ACR) documenting conformance with WCAG 2.1 Level AA for each information and communications technology product or service to be delivered under this contract."
02
WCAG 2.1 AA warranty — and prohibit disclaimers

Include a warranty statement confirming WCAG 2.1 AA conformance. The DOJ specifically endorses prohibiting vendors from disclaiming accessibility warranties. This is the most operationally important clause — it is what makes the Bashin False Claims Act theory viable.

Sample clause language
"Vendor warrants that all deliverables under this contract conform to WCAG 2.1 Level AA success criteria as required by 28 CFR § 35.200. Vendor may not disclaim this warranty. Non-conforming deliverables shall not be accepted."
03
Pre-acceptance ACR for each deliverable

Before final acceptance of any ICT deliverable, require the vendor to provide a completed ACR. This is the federal model from GSA's section508.gov adapted to ADA Title II authority. It converts acceptance from a subjective review to a documented conformance check.

Sample clause language
"Before final acceptance of any deliverable, Vendor shall provide an updated ACR confirming WCAG 2.1 Level AA conformance. Acceptance shall not occur until [Agency] verifies ACR completeness and accuracy."
04
Indemnification for accessibility warranty breaches

Require the vendor to indemnify your agency for accessibility complaints, investigations, or litigation arising from non-conforming deliverables. Review how your standard procurement templates handle warranty breach indemnification — not all cover ADA/WCAG specifically.

Sample clause language
"Vendor shall indemnify and hold harmless [Agency] from any claims, damages, or costs arising from Vendor's failure to deliver ICT that conforms to WCAG 2.1 Level AA as warranted under this contract."

State Law Overlay — Texas, California, New York

The ADA Title II rule is the federal floor. Several states add procurement-specific requirements on top:

Texas
Gov. Code § 2054; 1 TAC §§ 206, 213
Texas has the most procurement-specific framework. DIR contracts require vendors to submit accessibility documentation with solicitation responses. 1 TAC § 213 explicitly ties vendor deliverables to WCAG 2.1 AA. If you procure through DIR, your vendors are already contractually bound — confirm they understand this.
California
Gov. Code §§ 7405, 11135; AB 434
Any entity contracting with a state or local entity subject to § 11135 must 'agree to respond to, and resolve any complaint regarding accessibility of, its products or services.' This is weaker than the DOJ rule — complaint-response, not proactive conformance — but broader in entity coverage. The ADA Title II rule supersedes this minimum.
New York
NYS-P08-005
State agencies must ensure vendor/contractor ICT deliverables meet the standard. Policy currently references WCAG 2.0 — the ADA Title II rule's WCAG 2.1 AA requirement takes precedence for covered entities. Local governments are not directly bound by NYS-P08-005 but the ADA Title II rule applies.

When a Vendor Delivers Non-Compliant Work

Without explicit contract language, your options on non-compliant delivery are limited. With proper clauses in place:

→
Reject the deliverable
ACR requirement + warranty clause = non-conforming deliverables are not accepted. No payment until ACR confirms compliance.
→
Require remediation at no cost
GSA's model clause (adapted): 'If contracting officer determines any furnished ICT is not in compliance, Vendor shall, at no cost to the agency, repair or replace the non-compliant items.'
→
Withhold final payment
Tie final milestone payment to a satisfactory ACR. This is the most effective lever — remediation happens before payment releases.
→
Pursue indemnification
If a complaint or investigation arises from non-compliant vendor work post-acceptance, the indemnification clause gives you a contractual path to cost recovery.

What to Ask Vendors in Your RFP

These RFP requirements translate the contract clauses above into evaluation criteria:

1.Submit a current VPAT/ACR for each proposed product or service, completed within the last 12 months
2.Describe your internal WCAG 2.1 AA testing process (automated tools used, manual testing coverage, remediation workflow)
3.Identify any known WCAG 2.1 AA non-conformances and describe your remediation timeline
4.Confirm willingness to include WCAG 2.1 AA warranty language and indemnification clause in the contract
5.Provide the name and contact for your accessibility compliance contact for post-award issues
6.Describe how you will test government-specific content (PDFs, forms, video) for accessibility compliance
Know Your Current Baseline Before Writing the RFP

A free WCAG 2.1 AA scan of your current government site gives you the baseline you need to write accurate requirements and evaluate vendor claims against a known standard.

Run a Free Government Site Audit

Related Articles

ADA Title II and Web Contractors: Your False Claims Act Exposure →How Section 508 Disqualifies Government Contractors at Bid Time →ADA Title II 2026 Deadline: What Cities and Counties Must Do Now →