VPAT, ACR and OpenACR explained
Three terms that get used interchangeably and should not be. The distinction matters when a customer asks you for one.
The three terms
- VPAT
- The blank template, published by ITI. Currently at version 2.5.
- ACR
- The completed report for a specific product and version. This is the thing customers actually want.
- OpenACR
- A machine-readable expression of the same report, as YAML or JSON.
Why machine-readable matters
An ACR as a document is a snapshot that goes stale quietly. As structured data it becomes something you can operate on:
- It diffs. Commit it, and a change to your conformance position shows up in review like any other change.
- It validates. Structure can be checked mechanically, so a report cannot silently omit criteria.
- It regenerates. If the report is produced from test evidence rather than typed by hand, refreshing it is a build step rather than an afternoon.
That last point is the one that changes behaviour. Hand-maintained ACRs are updated when someone remembers; generated ones are updated whenever the evidence is.
The conformance vocabulary
ACRs use a fixed set of terms per criterion, and using them precisely is most of what makes a report credible:
| Level | Means |
|---|---|
| supports | The functionality meets the criterion. |
| partially-supports | Some functionality does not meet the criterion. |
| does-not-support | The majority of functionality does not meet the criterion. |
| not-applicable | The criterion is not relevant to the product. |
| not-evaluated | Not assessed. Permitted only for Level AAA. |
The temptation is to record "supports" wherever nothing was found. Nothing found by an automated scan is not the same as conformance — automated testing reaches roughly a third of accessibility problems. A report built only from a scanner should say so in its evaluation-methods field.
Generating one
The generator produces an OpenACR-conformant report from the same evidence as your accessibility statement, in YAML, JSON, HTML or Markdown. It runs in your browser; nothing is uploaded. The command-line tool does the same in CI, so the report tracks the code rather than a calendar reminder.
Sources
- ITI — VPAT 2.5 and its editions
- GSA OpenACR — the schema and specification
- EN 301 549 and WCAG — the standard the EU edition reports against
Common questions
What is the difference between a VPAT and an ACR?
A VPAT — Voluntary Product Accessibility Template — is the blank template published by the Information Technology Industry Council. An ACR, or Accessibility Conformance Report, is what you have once the template is filled in for a specific product at a specific version. Vendors routinely say "our VPAT" when they mean their ACR. If a customer asks for your VPAT, they want the completed report.
Which VPAT edition applies in Europe?
VPAT 2.5 comes in four editions. The EU edition reports against EN 301 549, which is the one European procurement expects. The INT edition covers WCAG, EN 301 549 and Section 508 together and is the safe choice if you sell into both Europe and the United States. The WCAG and 508 editions cover only their own standard.
What is OpenACR?
OpenACR is a machine-readable format for accessibility conformance reports, developed by the US General Services Administration. It expresses the same information as a VPAT-based ACR as structured YAML or JSON, so a report can be validated, diffed in version control and processed by tooling rather than only read as a document.
Is an ACR the same as an accessibility statement?
No, and you may well need both. An ACR is a detailed per-criterion conformance report, typically produced for procurement and customer due diligence. An accessibility statement is a public-facing document required by European law, naming your compliance status, a feedback route and an enforcement body. They draw on the same evidence and serve different audiences.