Vendor accessibility compliance
The agenda portal, the payment page and the permit system are not on your website. They are still your obligation.
What DOJ guidance says about accessibility in vendor contracts, what a conformance report is worth, and clause text you can put in your next solicitation.
See what the clause library coversNo email required.
What you are responsible for but do not host
| System | Typically hosted on | Who a resident blames |
|---|---|---|
| Agendas and minutes portal | granicus.com | The city |
| Utility and fine payments | tylertech.com | The city |
| Website platform and CMS | civicplus.com | The city |
| Permits and licensing | accela.com | The city |
| Job board, GIS viewer, library catalogue | various | The city |
These are systems commonly held under contract by public entities. We make no claim about the accessibility of any named company or product. Whether a particular system conforms is a question for that vendor’s own conformance report, reviewed against the rubric below, and for testing done with the vendor’s authorisation.
The entity is liable for them. They are where the transactions are — the resident who cannot pay a parking ticket is the one who complains. And an evidence packet whose scope statement silently omits the transactional layer is weaker than it appears; a hostile reviewer finds the omission before you do.
The third-party exception, and why it does not cover these
Covered by the exception
Content posted by a third party that is not posted under contract, licence or other arrangement — a resident’s comment, an unaffiliated site you link to.
Not covered
Anything provided under contract, licence or other arrangement: the agenda portal, the payment page, the permit system, the CMS, the job board, the catalogue.
Every system in the table above is under contract. The exception does not apply to any of them.
This is a plain-language summary, not legal advice. Your attorney’s reading of your contracts is the one that matters.
Three mechanisms, in order of leverage
Put it in the contract
The only mechanism that changes vendor behaviour, and the one DOJ guidance points at. It costs nothing at renewal.
Review the conformance report
A Voluntary Product Accessibility Template (VPAT), published as an Accessibility Conformance Report (ACR), is a document about a system, not a test of one. Reviewing it properly tells you what to ask for.
Test what you are authorised to test
Narrow, recorded, and never a crawl.
One row per vendor system, and the state of its evidence
Illustration. The figures are example data, not a customer’s.
| Vendor product | VPAT version | Dated | Evidence state | Contract clause |
|---|---|---|---|---|
| Agenda portal | 2.5Rev | Received, not reviewed | In contract | |
| Payment portal | 2.4Rev | VPAT dated 2 February 2023 — older than 24 months | Stale | Not yet |
| Permit system | None filed | No date | No evidence | Requested |
| Website platform and CMS | not a VPAT at all | Dated 12 June 2023 — older than 24 months | Received, not reviewed | In contract |
| Job board | None filed | No date | RequestedRequested on 6 August 2026 | Not yet |
| Library catalogue | 2.5Rev | AcceptedAccepted by Dana Whitfield on 19 August 2026 | In contract |
Staleness is computed, not stored. A conformance report older than 24 months on an actively developed product is not evidence, and the registry says so without anyone having to remember.
What a conformance report is actually worth
| Signal | Why it matters |
|---|---|
| Which edition — 2.4Rev, 2.5Rev, older, or not a VPAT at all | An old edition often predates the criteria you must meet |
| The date on it | 2 years old on an actively developed product is not evidence |
| Self-assessed or evaluated by a third party | The single strongest signal in the document |
| Are the test methods described? | “Evaluated using automated and manual testing” describes nothing |
| Do the “Supports” rows carry remarks? | A bare “Supports” on all 50 criteria means untested |
| How many “Does Not Support” and “Partially Supports” rows? | Zero is a red flag, not a green one |
| Does the tested version match the version you are running? | Frequently it does not, and nobody checks |
The output of a review is a written conclusion — Accepted, Accepted with conditions, Insufficient, or Refused — with a next-review date. The conclusion is the artifact, not a score. We do not score vendors and we do not rank them against one another.
Testing a vendor system, and the limits we hold ourselves to
- We never crawl a vendor host. Ever.
- A scan runs only against a recorded authorisation, with the clause text recorded, not merely asserted.
- Maximum 25 URLs per vendor system, configurable downward only.
- One request at a time, at least 2 seconds between requests, robots.txt obeyed, one run per scheduled window, and no discovery of any kind.
- Authorisations expire after 12 months and record the exact URL list at the time of signing.
These limits cost us coverage. They are written so that a vendor’s security team reading our traffic finds nothing to escalate.
The clause library
Clause text you can paste into your next solicitation or renewal. Versioned, dated, and plainly labelled as a template rather than legal advice.
The six clauses
| Clause | What it does |
|---|---|
| Conformance standard | Names the standard and version the product must meet |
| Conformance report at proposal | Requires the VPAT or ACR before award, not after |
| Right to test | Your right, and your right to have a third party test |
| Remediation timeline | Named milestones, not “commercially reasonable efforts” |
| Remedies | Withholding, cure periods, termination |
| Notification on change | The vendor tells you when the product changes |
The clause text is not published yet. The six clauses above are what it covers. It will be posted here when it has been drafted and tagged — in both formats, ungated, with no email capture and no account.
v3, last reviewed 8 September 2026
Each clause carries a version and a “last reviewed” date, and a field where you record which contract it went into and when. That last field is what turns a library into evidence.
This is template text, not legal advice; have your attorney review it before you use it.
What appears in your report
Every report and evidence packet carries a scope statement listing, per vendor system: the system name, the host, whether it was tested and under what authorisation, the conformance-report review state, and the contract-clause state. Where a system was not tested, the report says so and says why.
This is the opposite of what an unscoped report does. A scope statement that names its own limits survives cross-examination; one that stays silent does not.
What we will not do
- Crawl a vendor host. Not with your permission, not with theirs.
- Publish findings about a named vendor. Not on this site, not in an article, not anonymised-but-identifiable.
- Share one customer’s vendor findings with another. Two cities using the same portal is not a licence to pool their evidence.
- Present a conformance report review as a conformance determination. It is a review of a document, not a test of a system.
- Score, grade or rank a vendor.
Questions purchasing officers ask
Is the vendor responsible, or are we?
Both, differently. The vendor is responsible for its product under your contract. The entity is responsible under Title II for the services it offers the public, including the ones a vendor delivers.
The vendor will not give us a VPAT. Now what?
Record the refusal in the registry with its date. A refusal is evidence too, and it is the single most useful thing to have in hand at renewal.
Does a VPAT mean the product conforms?
No. It is a document about a system, not a test of one. The rubric above is how to judge what it is worth.
Do you contact our vendors for us?
No. We give you the request text, the register and the review. The relationship is yours and the leverage is in your contract, not in ours.
We are mid-contract. Is there anything to do before renewal?
Request the conformance report now, record what comes back, and ask for a remediation timeline in writing. All three are useful whether or not the contract changes.
Can we use the clause library without buying anything?
Yes. It is free, it is not gated, and there is no attribution requirement. Have your attorney review it before you use it.
The VPAT covers version 8 and we run version 6. Does it count?
Record the mismatch. A conformance report for a version you are not running is not evidence about the system your residents use.