Section 508 Compliance Guide for Federal Websites

What is Section 508?

Section 508 of the Rehabilitation Act of 1973 — significantly strengthened by the Workforce Investment Act of 1998 — requires federal agencies to make their electronic and information technology accessible to people with disabilities. The law applies when agencies develop, procure, maintain, or use ICT (Information and Communication Technology), and it extends to any contractor or grantee that provides ICT on behalf of a federal agency.

In short: if you receive federal funding or build technology for a federal customer, Section 508 is binding on you.

The 2017 Refresh: alignment with WCAG 2.0 Level AA

For most of its history, Section 508 operated under its own set of technical standards. In January 2017, the Access Board published a major update — commonly called “the Refresh” — that replaced the old standards with a direct reference to the Web Content Accessibility Guidelines (WCAG) 2.0 Level AA.

This alignment was a significant step. Instead of maintaining a parallel standard, Section 508 now incorporates all WCAG 2.0 Level A and AA success criteria by reference, along with additional requirements for:

• Authoring tools (software used to create web content)
• Electronic documents (PDFs, Word files, spreadsheets)
• Software applications (desktop, mobile, and web apps)
• Hardware (kiosks, printers, phones)
• Support documentation and services

Organizations already working toward WCAG 2.0 AA compliance are covering the majority of their Section 508 obligations for web content. But the broader ICT scope means that websites are only one part of the picture.

Who must comply?

Section 508 applies to:

Federal agencies — all executive branch agencies must comply across all ICT they develop, procure, maintain, or use.

Federal contractors — any vendor providing ICT products or services to a federal agency under contract must meet the standards. This includes SaaS platforms, document management systems, web portals, and mobile apps.

Recipients of federal financial assistance — organizations receiving federal grants are subject to Section 504 of the Rehabilitation Act, which has parallel obligations. Section 508 itself focuses on federal agencies and their vendors, but many grantees face equivalent requirements through their grant agreements.

State and local governments are not directly bound by Section 508, but are subject to the ADA and, if they receive federal funds, to Section 504.

What the standards require for web content

Because Section 508 incorporates WCAG 2.0 Level AA, the web content requirements map directly to the four WCAG principles: Perceivable, Operable, Understandable, and Robust.

Perceivable

• All images, charts, and non-text content must have meaningful text alternatives (alt attributes, aria-label, or equivalent)
• Videos must have synchronized captions; pre-recorded audio must have transcripts
• Color must not be the sole means of conveying information
• Text must be resizable up to 200% without loss of content or functionality
• Content must be adaptable — structure and relationships must be programmatically determinable

Operable

• All functionality must be available via keyboard alone (no mouse required)
• No content should flash more than three times per second (seizure risk)
• Skip navigation links must allow users to bypass repeated blocks of content
• Users must be able to pause, stop, or hide moving, blinking, or auto-updating content
• Pages must have descriptive titles

Understandable

• Language of the page must be identified in the HTML (lang attribute)
• Navigation must be consistent across pages
• Error messages must identify the field in error and describe how to correct it
• Labels and instructions must be provided for all form inputs

Robust

• Content must be compatible with current assistive technologies
• Name, role, and value of all UI components must be programmatically determinable (ARIA used correctly)
• Status messages must be announced to assistive technology without requiring focus

Electronic documents

One of the most frequently overlooked areas of Section 508 compliance is document accessibility. PDFs, Word documents, Excel spreadsheets, and PowerPoint presentations distributed through agency websites or shared with the public must meet the same standards.

For PDFs, this means:

• The document must be tagged (structural tags for headings, paragraphs, lists, tables)
• Reading order must be logical
• Images must have alt text
• Form fields must be labeled
• The document must not require a password that blocks accessibility features

Many agencies have large archives of legacy documents. The Refresh permits a “fundamental alteration” exception for legacy content — but this applies only where compliance would require a fundamental change to the nature of the program, not simply because remediation is inconvenient or costly.

Procurement: the supplier’s obligation

Section 508 has a direct impact on procurement. Federal agencies must consider accessibility when acquiring ICT products and services. This is where the Accessibility Conformance Report (ACR) — often called a VPAT, for Voluntary Product Accessibility Template — becomes critical.

Vendors seeking to sell ICT to federal agencies are expected to provide an ACR documenting how their product meets each applicable Section 508 standard. Agencies use ACRs to compare products and document due diligence. An inaccurate or inflated ACR creates legal exposure for the vendor if the product does not actually meet the claimed standards.

If your organization sells or intends to sell technology to federal customers, maintaining an accurate, current ACR is not optional — it is a commercial expectation.

Exceptions under Section 508

The standards include several recognized exceptions:

Undue burden — an agency may claim that compliance would impose a significant difficulty or expense. This is a high bar and must be documented; the agency must still provide an alternative means of access to the information or functionality.

Fundamental alteration — compliance is not required where it would require a fundamental change to the nature of the program or activity.

Back-office exception — ICT used exclusively by agency employees with no interaction with the public is exempt, provided there is no employee with a disability who needs to use that ICT.

Legacy ICT — pre-Refresh ICT acquired before January 18, 2018 is not automatically required to be upgraded, but any new procurement or significant upgrade triggers compliance.

Note that exceptions must be documented and are not self-executing. Claiming an exception without adequate documentation does not insulate an agency from complaint.

Enforcement and complaints

Section 508 is enforced through two primary channels:

Internal agency grievance procedures — each agency must establish procedures for employees and members of the public to file Section 508 complaints.

Federal agency oversight — the General Services Administration (GSA) and the Access Board provide guidance and oversight. The Department of Justice reports to Congress on agency compliance.

Civil litigation — although Section 508 does not create a private right of action, individuals may bring claims under Section 504 of the Rehabilitation Act, which prohibits disability discrimination by recipients of federal financial assistance. Courts have found that Section 508 violations can form the basis of a Section 504 claim.

A practical compliance roadmap

Step 1: Inventory your ICT

Map everything that falls within Section 508’s scope — websites, intranets, web applications, documents, software, and any hardware with user interfaces. You cannot remediate what you have not identified.

Step 2: Assess current conformance

Run automated accessibility scans to identify detectable WCAG failures quickly. Follow up with manual audits to surface the issues automated tools miss — keyboard-only navigation, screen reader behavior, cognitive load.

Step 3: Prioritize by impact

Address barriers that most directly affect users’ ability to access core services and information first. Checkpoint flows (login, form submission, document download) should be prioritized over decorative or secondary content.

Step 4: Fix and retest

Remediation without verification is incomplete. After each fix, retest with both automated tools and assistive technology to confirm the issue is resolved and no regression has been introduced.

Step 5: Embed accessibility in procurement

Update your procurement templates to require ACRs from vendors. Review ACRs critically — check claimed conformance levels against actual product behavior where possible. A vendor claiming full conformance for a product that fails basic keyboard navigation is providing an inaccurate ACR.

Step 6: Maintain

Section 508 compliance is not a one-time certification. New content, new features, and new integrations can introduce barriers. Automated monitoring, embedded in your development and content workflows, keeps compliance continuous rather than reactive.

Section 508 and WCAG 2.1 / 2.2

The Refresh references WCAG 2.0, not WCAG 2.1 or 2.2. This creates a modest gap: WCAG 2.1 added 17 new success criteria (particularly around mobile accessibility, low vision, and cognitive accessibility) and WCAG 2.2 added 9 more. Meeting WCAG 2.1 or 2.2 AA automatically satisfies Section 508’s web content requirements, but the reverse is not true.

For organizations building modern digital services, targeting WCAG 2.1 or 2.2 AA is strongly advisable — it addresses a broader range of user needs and positions you for future standard updates.

Summary

Section 508 is one of the most comprehensive ICT accessibility frameworks in the world. Its 2017 alignment with WCAG means that web accessibility and Section 508 compliance share a common technical foundation — but the law’s scope extends significantly beyond websites to cover documents, software, and procurement.

Federal agencies and their technology suppliers that treat accessibility as a continuous quality practice — rather than a one-time audit exercise — are best positioned to meet the standard, reduce legal exposure, and serve all users effectively.