States Tighten Government Tech Vendor Requirements Ahead of DOJ Accessibility Mandates

Communications and technology companies that provide websites, software, platforms, mobile applications, or other digital tools to state and local governments should expect increasing scrutiny of their digital accessibility compliance in the coming years.

As we have previously reported, the Department of Justice adopted a final rule in 2024 that requires state and local government web content and mobile applications be accessible to people with disabilities by complying with Web Content Accessibility Guidelines (WCAG) 2.1 Level AA. In 2026, DOJ extended the WCAG compliance deadlines to require compliance by April 2027 for public entities serving populations over 50,000 and by April 2028 for smaller entities and special districts. In anticipation of these upcoming deadlines, state and local public entities have accelerated efforts to ensure that their governmental public-facing digital tools comply with WCAG 2.1 Level AA standards.

Concurrent with these plans, many states and public entities are beginning to shift portions of the legal, operational, and remediation burden to third-party information and communications technology (ICT) vendors through procurement requirements, contractual representations, accessibility certifications, and documentation obligations. Several states already require, recommend, or increasingly expect vendors to provide accessibility-related documentation and remediation planning, including:

• Virginia's Information Technology Access Act, which requires vendors to identify accessibility gaps and provide remediation roadmaps.
• New York Executive Law § 170-f, which requires websites provided under state contracts to conform to current WCAG guidelines.
• Texas regulations requiring ICT vendors to provide Voluntary Product Accessibility Templates (VPATs), Accessibility Conformance Reports (ACRs), or similar accessibility documentation.
• Hawaii's Electronic Information Technology Disability Access Standards, which recommend requiring vendors to submit VPATs or ACRs.
• Minnesota guidance providing that state IT solicitations should require vendors to provide ACRs.
• Massachusetts guidance authorizing agencies to request ACRs from ICT vendors.

These developments reflect a broader trend: State and local government customers increasingly expect vendors to demonstrate not only current accessibility compliance but also structured remediation planning and ongoing accessibility governance.

Companies that contract with public entities should therefore consider preparing now for:

• more requests for VPATs and ACRs;
• accessibility testing and audit requirements;
• remediation timelines and roadmap commitments;
• contractual accessibility representations and indemnities; and
• procurement-related certifications tied to WCAG compliance.

Organizations that proactively evaluate their accessibility compliance and develop internal processes for responding to accessibility diligence requests will likely be better positioned as these requirements become more embedded in public-sector procurement and contracting practices.

+++

Maria Browne and Brandon Johnson are partners in DWT's Washington, D.C., office, and John Magliery is a partner in our New York office. For any questions, please contact Maria, Brandon, John, or another member of our communications and technology + privacy & security teams. To stay informed, sign up for our alerts.