An accessibility vendor questionnaire can arrive in the middle of a deal. A customer's procurement, vendor-risk or security team sends over a form, and one section asks about accessibility, or the buyer simply asks for your VPAT (Voluntary Product Accessibility Template; once filled in for your product it becomes an ACR, an Accessibility Conformance Report). Someone on your team has to answer it this week.
This guide covers what to send when a customer asks, in three parts: where the accessibility question actually comes from, what to send back, and how a reviewer will judge it. It is written for founders, CTOs, product leads and sales leads at UK and EU software companies, and every term is explained as it comes up.
Is Accessibility in Your Security Questionnaire? Usually Not
We searched SIG, CAIQ and Google's VSAQ, three standard security questionnaire templates that vendor-risk teams send to suppliers, and we could not find an accessibility question in any of them. SIG is paywalled, so treat that as "not found" rather than "absent". We also found no independent data on deals lost or delayed over accessibility.
So you are unlikely to meet the accessibility question in a standard security review. You are much more likely to meet it in an education, public-sector or regulated-bank deal, and usually in a separate place: its own tab in a workbook, its own document, or a line in the buyer's own requirements.
If a buyer does ask, the question is deliberate. Someone on their side has an accessibility requirement to meet, and your answer feeds into it.
The Four Places the Question Reliably Shows Up
1. Universities: HECVAT
HECVAT (the Higher Education Community Vendor Assessment Toolkit) is the vendor questionnaire from EDUCAUSE, the US higher-education IT association. It is the only standard vendor questionnaire where we verified accessibility questions.
HECVAT 3 asks: "Has a VPAT or ACR been created or updated for the product and version under consideration within the past year?" Other HECVAT 3 questions cover a third-party audit, how conformance was verified, which standard you adopted, a roadmap with delivery timelines, keyboard-only use, and whether the product relies on a separate "accessibility mode" or "lite version".
HECVAT 4 gives accessibility its own tab, and some of its accessibility questions carry extra weight by default. It asks for a VPAT or ACR from the last 12 months, whether you will commit to your stated standard (or WCAG 2.1 AA, a level of the Web Content Accessibility Guidelines) in the contract, whether the product substantially conforms to WCAG 2.1 AA, and whether you have a documented process for reporting and tracking accessibility issues.
The Big Ten Academic Alliance Vendor Cookbook, a buying guide from a group of US universities, recommends conformance reports "from a reputable third party" and lists a common buyer question: "Will you provide a functional instance of your product for accessibility testing?"
2. UK public sector
The UK government's "Make things accessible(opens in new tab)" guidance from GDS (the Government Digital Service) is direct: "all suppliers to government have a legal duty to make their technology and services accessible to all", and "You must meet the WCAG 2.2 AA standard as a minimum". We cover WCAG 2.2 in what changed in WCAG 2.2. Buyers may ask you to confirm this "either from you directly, or through a third party certification". On G-Cloud, the UK government's framework for buying cloud services, suppliers answer an accessibility question in the supplier declaration, then give the detail (evidence, assistive technology testing, and how future updates affect it) in the service definition document.
Health is more specific. The NHS DTAC(opens in new tab) (Digital Technology Assessment Criteria) v2.0 puts accessibility in Section D, item D1 Usability and accessibility. D1.4.1 asks: "If your product is a web or mobile application, does it comply with the Web Content Accessibility Guidelines (WCAG) 2.2 scoring AA or higher?" One of the recognised answers is "No, but a plan and timeline for achieving WCAG 2.2 AA or higher is in place". D1.4.3 asks you to "Provide a link to your published accessibility statement." Section D is "a scored element to inform choices between products", and the form states "The assessment is not intended to result in pass or failure". It is a comparison score, not a gate.
One legal note. Section 56 of the Procurement Act 2023, on technical specifications, says nothing about accessibility. The duty reaches UK public tenders another way: through the public sector equality duty in section 149 of the Equality Act 2010, the 2018 public sector accessibility regulations, GDS guidance, and the buyer's own specification. Our UK accessibility regulations overview covers that route.
3. EU public tenders
EU public buying rules already build accessibility in. Article 42(1) of Directive 2014/24/EU says that technical specifications for anything "intended for use by natural persons, whether general public or staff of the contracting authority" shall, "except in duly justified cases", take accessibility criteria into account. In plain English: if people will use it, the tender has to consider accessibility.
The European Accessibility Act (EAA) then fills in what "accessibility criteria" means for the products and services it covers. Article 24(1) of the directive(opens in new tab) says: "As regards the products and services referred to in Article 2 of this Directive, the accessibility requirements set out in Annex I thereto shall constitute mandatory accessibility requirements within the meaning of Article 42(1) of Directive 2014/24/EU and of Article 60(1) of Directive 2014/25/EU." Put simply, for anything the EAA covers, its accessibility requirements become the mandatory ones in public tenders.
The standard EU public buyers reference is EN 301 549, the EU's harmonised accessibility standard, which incorporates WCAG 2.1 AA. Two national examples show how it plays out:
- Netherlands. Guidance from the Dutch municipalities' association tells councils to reference EN 301 549 and to ask suppliers for a report based on WCAG-EM, the evaluation method from the W3C (World Wide Web Consortium, which publishes WCAG). A supplier that does not fully meet the criteria can still take part with a plan of action. The council, not the supplier, stays responsible for its own accessibility statement.
- Germany. The federal accessibility monitoring body publishes tender text templates for software development that refer to EN 301 549.
4. Named regulated buyers
Some large private buyers publish their requirements. Barclays has a supplier control obligation for digital accessibility. It expects suppliers to show compliance through a VPAT or an equivalent ACR, both when the contract is agreed and again at each material change to the product, and its current version names WCAG 2.2 AA.
Vodafone's supplier resources(opens in new tab) say: "As part of dealing with Vodafone, suppliers will be asked about their product compliance to accessibility standards." For digital services, it points to global standards such as WCAG as benchmarks.
A careful word on the EAA. A customer whose own consumer-facing product or service is covered by the EAA has its own obligations, and the software it builds that service on is part of that picture. We have not found a published contract clause, supplier code or tender passing those obligations down to software suppliers.
How Often Buyers Ask
There is one useful number. Level Access, which sells accessibility services, published its Eighth Annual State of Digital Accessibility Report(opens in new tab) on 16 September 2026. Sapio Research surveyed 2,530 professionals online in June and July 2026; 52% were in the US and 43% in the UK and Europe.
Read that figure with four caveats. It is a vendor-funded survey. The people answering are accessibility and digital-experience professionals describing their own organisation's buying, which is a self-selecting group. The 2025 question was worded differently ("a requirement" rather than "require proof"), so "up from 75%" is Level Access's own comparison, not a controlled trend. And it does not measure how often a 20 to 500 person software supplier gets asked.
So treat it as a signal, not a census. The question is common enough to prepare for, and where it comes up, the buyer wants proof, not a promise.
What to Send: The Accessibility Evidence Pack
Four items cover what the buyers above ask for.
1. A current conformance report. This is an ACR (a completed VPAT) or an equivalent report. For EU buyers, write it against EN 301 549. For UK public sector buyers and the NHS DTAC, write it against WCAG 2.2 AA, because that is what those buyers name. Be honest row by row: "partially supports" where that is true beats a blanket "supports".
2. Your accessibility statement. Publish it at a stable URL you can paste into a form; the DTAC asks for the link directly. What goes in it is covered in our guide to the EAA accessibility statement.
3. A roadmap with dates for the gaps. Buyers in these settings recognise a plan for known gaps: the DTAC accepts a plan and timeline as an answer, Dutch councils accept a plan of action, and HECVAT 3 asks for a roadmap with delivery timelines. Name the issue, the fix and the target date.
4. Independent evidence where it is asked for. GDS allows confirmation through third-party certification. The Big Ten Academic Alliance recommends conformance reports from a reputable third party. A manual audit by an independent tester, checking the product against the standard, is one way to provide that evidence. Some buyers will also ask for a working test instance of your product so their own team can check it.
One thing not to send: an overlay widget as your answer. The Big Ten Academic Alliance Vendor Cookbook is blunt: "Beware of companies that provide or promote overlays (also called widgets or shims) as an accessibility fix; these are proven to be ineffective, and may cause other problems such as security gaps."
How Reviewers Judge What You Send
Reviewers in these settings tend to apply two tests.
Freshness. HECVAT asks for a report created or updated within the past year. Barclays asks again at each material change to the product. Put those together and the rule of thumb is simple: a conformance report older than your last major release is a weak answer. The product the buyer is evaluating is not the one that report describes.
Who tested it. A conformance report you wrote yourself is a claim. Reviewers who know what they are doing will want to see how it was tested. GDS points to third-party certification as one way to confirm, and the Big Ten Academic Alliance recommends reports from a reputable third party. A self-assessment is not worthless, but it carries more weight when you can show the method behind it.
Then the constructive part. You do not need a perfect product to give a strong answer. In the NHS DTAC, a plan and timeline is a recognised answer, scored rather than failed. In Dutch municipal buying, a supplier that does not fully meet the criteria can still take part with a plan of action. Honest partial conformance with a dated plan is a stronger answer than a blanket claim the buyer cannot check.
This is where suppliers can get ahead. The one with a current report, a published statement and a dated plan for known gaps is the easy one to approve. That position is open to any team willing to do the work before the next questionnaire lands.
Where AUDITSU Fits
Your conformance record belongs to you. AUDITSU helps you produce it and keep it current.
AUDITSU walks your team through an audit against EN 301 549, screen by screen, and keeps the findings as a living record rather than a one-off PDF. From that record it generates your accessibility statement, so the statement and the evidence behind it stay in step as the product changes. When a buyer asks for a conformance report, a statement link or a roadmap, you answer from the same evidence. If a buyer wants independent evidence, a manual audit is available too.
If a questionnaire has just landed and you want to talk through your answer, book a call.