Six months to the ADA web rule: the vendor question nobody has asked

If you run the web presence of a US public university, the Title II web rule now gives you until 26 April 2027 to bring your web content and mobile apps to WCAG 2.1 Level AA [1][2]. Most planning treats that as a question about the main website. It is not. The regulation covers web content you provide “directly or through contractual, licensing, or other arrangements” [2], which is a careful way of saying that your registration system, abstract platform, learning management system and that event microsite a supplier spun up last year are all yours for compliance purposes, whoever hosts them. The question nobody seems to be asking the vendors is: prove it.

What the rule says about things you did not build

The dates moved this spring. A Department of Justice interim final rule of 20 April 2026 pushed the compliance date for public entities serving 50,000 or more people from 24 April 2026 to 26 April 2027, and for smaller entities and special districts to 26 April 2028 [1][3]. A state university counts by the population of its state, which puts nearly every public university in the 2027 group [4][5]. We covered what to do with the extra year, and why your document library is the likeliest gap, in August; this post is about the second gap.

Two caveats. The DOJ says it will consider further rulemaking on the rule’s substance during the extension and otherwise “fully anticipates implementing the regulation at the new deadline” [1][3]. And the National Federation of the Blind sued in May 2026 to have the extension set aside and the original dates restored [6]. Those dates are already behind us. Whichever way that goes, the deadline can only come closer.

Now the vendor part. The rule’s third-party content exception covers content posted by members of the public, such as a forum comment. It explicitly does not cover a third party “posting due to contractual, licensing, or other arrangements with the public entity” [2]. The DOJ’s fact sheet names the tools it has in mind: calendars, scheduling tools, maps, reservation and payment systems built by outside technology companies, and websites a company designs or manages for you [4].

WCAG adds a wrinkle of its own. Its conformance rules say that when a web page is one step in a process, “all web pages in the process conform at the specified level or better” [7]. A registration journey that starts on your WordPress site and ends in a supplier’s checkout is one process. If the checkout fails, so does your claim.

What real conformance evidence looks like

Ask a vendor about accessibility and you will usually be sent a VPAT. Strictly, the VPAT is the blank template, maintained by the Information Technology Industry Council; the completed document for a product is an Accessibility Conformance Report, or ACR [8]. The vendor fills it in. ITI does not review or approve them, and there is no certification [8]. Idaho’s state IT office puts it plainly in its 2026 rubric: “An ACR is a starting point, not proof of compliance” [9].

So the document is only as good as the questions you ask of it. The University of Arizona’s procurement process and Idaho’s rubric, read together, give you six [9][10].

• Does it match the product you are buying? Same product, same version, the WCAG 2.1 AA edition of the template. Last year’s report on a different module is not evidence [9][10].
• Is it current? The two sources disagree in degree: Idaho flags any report older than twelve months, Arizona accepts up to two years [9][10].
• Who did the testing, and how? A credible report names the organisation that carried out the audit and describes both manual and automated testing, including screen reader and keyboard checks [9]. Arizona encourages third-party evaluation, especially where the vendor has no in-house accessibility expertise [10].
• Does every row say “Supports”? Both treat a uniform column of passes as suspicious rather than reassuring [9][10].
• Are the remarks specific? Idaho calls the remarks column “often the most important part” of the report [9]. You want described behaviour and named limitations, not a repeated “meets criteria”.
• Is there a roadmap? For anything marked “Partially Supports” or “Does Not Support”, look for planned fixes with dates, and be prepared to write them into the contract [9][10].

Then do the one test no document can replace. Arizona recommends a keyboard-only run through the product before purchase and treats a failure as a strong sign of deeper problems [10]. Run it on your three most important journeys, not the vendor’s demo. Register for the congress. Submit an abstract. Renew a membership. Unplug the mouse first. An hour of your attention will tell you more than the report did.

When the vendor will not play

Some suppliers will send nothing, or a marketing page with the word “accessible” on it. You have three instruments, in ascending order of friction.

The first is the contract. Arizona’s accessibility rider is a useful public model: WCAG 2.1 AA conformance; an updated report on request and with each major release; a remediation plan within 30 days of a reported defect; critical barriers fixed within 90 days or an interim accommodation provided; a right to test at any time; and termination without penalty if a material failure is not fixed within 90 days of written notice [10]. You need not copy the numbers. You do need numbers, because “the vendor is working on it” is not a timeline.

The second is the rule’s own escape hatches, which are narrower than vendors assume. A conforming alternate version is permitted “only where it is not possible to make web content directly accessible due to technical or legal limitations” [2]; the DOJ warns against running an inaccessible main page alongside a separate accessible one [4]. The undue burden and fundamental alteration defence exists, but the regulation places the burden of proof on you, requires the decision to be made by the head of the entity or their designee, and requires a written statement of reasons [2][11]. Even then you must do whatever would not be a burden [2]. “Our supplier would not fix it” is none of those things on its own. With a paper trail, it might become part of a documented decision.

The third is to move. Arizona’s risk assessments end in one of three outcomes: proceed, proceed with conditions, or seek alternatives [10]. If you have never once reached the third, your process is a formality.

A note from the other side of the table

We build congress registration and abstract submission systems for societies and universities, so we are a vendor in exactly the sense this rule means. A careful buyer asking the six questions above is doing us a favour. A report that admits, say, that a reviewer dashboard still signals status by colour alone, with a dated fix, is worth more to your compliance file than a wall of green. If your supplier cannot produce one, the problem is not the paperwork.

This month’s afternoon of work

Inventory before investigation. One spreadsheet, one named owner. List every system your staff, students or members touch that you did not build: registration, abstracts, LMS, payments, directories, ticketing, surveys. For each, note the contract end date, whether you hold a current ACR for the version in use, and the date you asked for one. Sort by how many people pass through it. Start the vendor conversations at the top.

This is a US rule for US public bodies. But the questions are not American. UK and EU readers will recognise their shape from their own public-sector regimes, and the vendor evidence worth having looks much the same wherever you sit. Ask for it now, while the deadline is still politely in the distance, and you will be the person in the room who already has the answer.

References

1. US Department of Justice, Civil Rights Division. Extension of Compliance Dates for Nondiscrimination on the Basis of Disability; Accessibility of Web Information and Services of State and Local Government Entities (interim final rule). Federal Register, 20 April 2026. https://www.federalregister.gov/documents/2026/04/20/2026-07663/extension-of-compliance-dates-for-nondiscrimination-on-the-basis-of-disability-accessibility-of-web. Accessed 19 October 2026.
2. US Government Publishing Office. 28 CFR Part 35, Subpart H: Web and Mobile Accessibility (§§ 35.200–35.205). Electronic Code of Federal Regulations, current as of 15 October 2026. https://www.ecfr.gov/current/title-28/chapter-I/part-35/subpart-H. Accessed 19 October 2026.
3. Palamountain, C. DOJ Extends ADA Title II Website Accessibility Deadlines for Governmental Entities—But Litigation and Compliance Risks Remain. Seyfarth Shaw, ADA Title III News & Insights, 20 April 2026. https://www.adatitleiii.com/2026/04/doj-extends-ada-title-ii-website-accessibility-deadlines-for-governmental-entities-but-litigation-and-compliance-risks-remain/. Accessed 19 October 2026.
4. US Department of Justice. Fact Sheet: New Rule on the Accessibility of Web Content and Mobile Apps Provided by State and Local Governments. ADA.gov, updated 2026. https://www.ada.gov/resources/2024-03-08-web-rule/. Accessed 19 October 2026.
5. DiMaggio, J. DOJ Extends Accessibility Deadline to April 2027. UPCEA Policy Matters, 30 April 2026. https://upcea.edu/doj-extends-accessibility-deadline-to-april-2027-policy-matters-april-2026/. Accessed 19 October 2026.
6. Seyfarth Shaw. National Federation of the Blind Challenges Last-Minute Deadline Extensions for Website and Mobile App Accessibility. ADA Title III News & Insights, June 2026. https://www.adatitleiii.com/2026/06/national-federation-of-the-blind-challenges-last-minute-deadline-extensions-for-website-and-mobile-app-accessibility/. Accessed 19 October 2026.
7. W3C. Web Content Accessibility Guidelines (WCAG) 2.1, section 5.2.3 Complete processes. W3C Recommendation, 6 May 2025. https://www.w3.org/TR/WCAG21/. Accessed 19 October 2026.
8. Information Technology Industry Council. VPAT (Voluntary Product Accessibility Template). ITI, n.d. https://www.itic.org/policy/accessibility/vpat. Accessed 19 October 2026.
9. Idaho Information Technology Services. Digital ADA Evaluation Guide & Rubric, version 1. State of Idaho, March 2026. https://its.idaho.gov/wp-content/uploads/2026/03/A3-ADA-Evaluation-Guide-Rubric-FINAL-v1-rev-3-26.pdf. Accessed 19 October 2026.
10. University of Arizona, Digital Accessibility. Accessible Procurement Process. University of Arizona, n.d. https://accessibility.arizona.edu/procurement/accessible-procurement-process. Accessed 19 October 2026.
11. Orbis Cascade Alliance. Undue Financial or Administrative Burden (ADA Title II documentation). Orbis Cascade Alliance, last modified 20 March 2026. https://www.orbiscascade.org/programs/dux/documentation/ada-title-ii/undue-burden/. Accessed 19 October 2026.