Section 508 -- US Federal ICT Accessibility Standard

Section 508 of the Rehabilitation Act of 1973 requires US federal agencies and their contractors to make information and communication technology accessible. The 2017 revision adopted WCAG 2.0 Level AA by reference for web content -- not WCAG 2.1 or 2.2.[1]

For reference only. a11ybot's automated checks target WCAG success criteria. The core web requirements of Section 508 map to WCAG 2.0 AA, which is a subset of WCAG 2.1 AA. The Functional Performance Criteria and ICT hardware clauses of the Revised 508 Standards require manual review and are outside the scope of automated scanning.

What Section 508 is

Section 508 is a section of the Rehabilitation Act of 1973 (29 U.S.C. § 794d)[2], added by the Workforce Investment Act of 1998 (Pub. L. 105-220)[3] and most recently revised by a final rule published by the US Access Board in the Federal Register on 18 January 2017, effective 18 January 2018.[1]

Two things are distinct: the statute at 29 U.S.C. § 794d creates the legal duty; the Access Board's implementing standards -- the "Revised 508 Standards" at 36 C.F.R. Part 1194 -- define what technical conformance looks like.[4] Knowing the difference matters for procurement conversations: the statute is the obligation, the standards are the specification used to evaluate whether that obligation is met.

Scope: who it applies to

Section 508 applies to US federal agencies -- executive, legislative, and judicial -- when they develop, procure, maintain, or use information and communication technology. The scope includes federal websites and web applications, desktop and laptop software, operating systems, telecommunications products, video and multimedia products, self-contained closed products such as kiosks and copiers, and ICT delivered through contracts with the federal government.

Contractors and vendors that supply ICT to federal agencies must meet Section 508's technical standards as a condition of the contract. The obligation flows through the Federal Acquisition Regulation (FAR), which requires agencies to include Section 508 compliance language in solicitations and contracts for ICT.[5]

Section 508 does not directly apply to state and local governments, private-sector companies (unless they are federal contractors), or non-federal public entities. Those entities may fall under the ADA or applicable state law -- a separate legal framework that this page does not address.

What "ICT" covers

The Revised 508 Standards define Information and Communication Technology broadly to match modern technology procurement. The standard is organized into functional performance criteria and technical requirements for six ICT categories:[4]

  1. Software -- including native applications, web applications, and authoring tools.
  2. Hardware -- physical devices such as computers, printers, copiers, scanners, and kiosks.
  3. Electronic content -- web content, electronic documents, and multimedia content.
  4. Support documentation and services -- product manuals, help desks, and support services.
  5. Two-way voice communication -- telecommunications systems and video conferencing.
  6. Closed functionality -- devices where users cannot attach assistive technology, such as ATMs and kiosks with embedded software.

The Revised 508 Standards were harmonised with EN 301 549 (the European standard) during the 2017 revision to share as much technical vocabulary as possible, though the scopes and legal weight differ significantly between the two systems.

Relationship to WCAG

The Revised 508 Standards adopt WCAG 2.0 Level A and Level AA by reference for web content and software.[4]

This is the single most consequential version-pinning fact on this topic: the 2017 revision incorporated WCAG 2.0, not WCAG 2.1 or WCAG 2.2. The Access Board's rulemaking record closed before WCAG 2.1 was finalized (WCAG 2.1 was published June 2018; the 508 final rule was January 2017). The legal floor set by the statute and Access Board rule is therefore WCAG 2.0 AA.

The practical consequence is a gap. A federal agency that tests only to Section 508's legal floor -- WCAG 2.0 AA -- may unknowingly ship content that fails WCAG 2.1 AA success criteria added in 2018, such as 1.3.4 Orientation, 1.3.5 Identify Input Purpose, 2.5.1 Pointer Gestures, and 4.1.3 Status Messages. Agencies may set internal policy to target WCAG 2.1 AA, and many do -- but that is agency policy, not what the current federal rule requires.

The Revised 508 Standards also include Functional Performance Criteria (FPC) -- outcome-based requirements that cover ICT features not addressed by WCAG, such as use without vision, with limited vision, without color perception, without hearing, and with limited manipulation or strength.[6] The FPC are part of the enforceable standards, not advisory guidance. They apply when a technical standard does not exist for a given feature or when an alternative means of meeting a WCAG criterion is claimed.

Key dates and milestones

  • 1973 -- Rehabilitation Act enacted (Pub. L. 93-112). No ICT-specific provision at this stage.[2]
  • 1998 -- Section 508 added by the Workforce Investment Act (Pub. L. 105-220). Original standards published in 2000.[3]
  • 2000 -- Original Access Board Section 508 standards took effect (December 21, 2000).
  • January 18, 2017 -- Revised 508 Standards published in the Federal Register.[1]
  • January 18, 2018 -- Revised 508 Standards took effect for new and updated ICT procurement. A one-year transition period applied.
  • Ongoing -- GSA Trusted Tester program and the ICT Testing Baseline provide harmonized manual testing methodology for federal agencies.[7][8]

GSA Trusted Tester and the ICT Accessibility Testing Baseline

The Trusted Tester Process is a manual testing methodology developed by the Department of Homeland Security (DHS) and maintained with GSA.[7] It produces a reproducible, documented audit against the Revised 508 Standards. Federal agencies often require Trusted Tester conformance reports as procurement evidence.

The ICT Accessibility Testing Baseline for Web is a test methodology developed jointly by the Access Board and GSA that maps Section 508 requirements to specific, deterministic test conditions.[8] It provides a common standard against which any agency test process can be verified, helping ensure that audits from different organizations are directly comparable.

These are informative resources -- they are not themselves the law. But in the federal procurement context, a Trusted Tester report carries significant weight and a buyer who requires one is asking for nothing beyond the standard practice.

Enforcement and complaint mechanisms

Section 508 is enforced through two primary channels.

Agency self-certification and the GSA program. Agencies are responsible for their own compliance.[9] GSA's Government-wide IT Accessibility Program provides guidance, training, and the Section508.gov portal -- but GSA is an enabler, not an enforcement authority with penalty power over other agencies.

Complaints and litigation. Individuals who are denied access to federal ICT may file an administrative complaint with the relevant federal agency's Section 508 Program Manager or Equal Employment Opportunity (EEO) office, or a complaint under Section 504 of the Rehabilitation Act with the relevant agency or with the Department of Justice. A civil action in federal court may also be available after exhausting administrative remedies.

Whether Section 508 creates a standalone private right of action independent from Section 504 has been litigated with varying outcomes and is not settled law. Organisations with specific litigation questions should route them to counsel.

Relationship to the ADA

The ADA and Section 508 are separate laws with overlapping goals but different scopes, coverage, and enforcement mechanisms. Section 508 covers federal agencies and their ICT contractors. The ADA covers a broad range of public accommodations, employers, state and local governments, and commercial entities. A federal website that fails Section 508 may also fail ADA Title II depending on context -- but the two labels are not interchangeable, and compliance with one does not guarantee compliance with the other.

Pitfalls and common misunderstandings

  • "Revised 508 adopts WCAG 2.1 AA." It does not. The 2017 revision adopted WCAG 2.0 AA. WCAG 2.1 was not finalized until June 2018, after the final rule closed. Misrepresenting this in any procurement context is a factual error with legal implications.
  • "Section 508 applies to all US businesses." Section 508 binds federal agencies and their ICT contractors. It does not directly apply to private-sector companies unless they are procuring ICT for or on behalf of a federal agency under contract.
  • "Passing Section 508 means passing WCAG 2.1 AA." A system can pass Section 508 (WCAG 2.0 AA) while failing WCAG 2.1 AA success criteria added in 2018. Testing only to the 508 floor may miss those newer requirements.
  • "Section 508 and the ADA are the same thing." They are separate laws with different scopes, different enforcement regimes, and different coverage. Conflating them signals unfamiliarity with either law.
  • "GSA's Section508.gov is the enforcement authority." GSA runs the program-support function. Each agency is responsible for its own compliance. There is no single federal body with penalty authority over other agencies' 508 compliance.
  • "Functional Performance Criteria are optional." The FPC are part of the enforceable standards. They apply when no applicable technical standard exists or when a claim of equivalent facilitation is made.[6]

Further reading

References

  1. [1] US Access Board (2017). Information and Communication Technology (ICT) Standards and Guidelines -- Final Rule, 82 Fed. Reg. 5790 (January 18, 2017). Federal Register, Accessed 2026-04-20. https://www.federalregister.gov/documents/2017/01/18/2017-00395/information-and-communication-technology-ict-standards-and-guidelines ↩ ↩ ↩
  2. [2] US Congress (1998). 29 U.S.C. § 794d -- Section 508 of the Rehabilitation Act of 1973. Cornell Legal Information Institute, Accessed 2026-04-20. https://www.law.cornell.edu/uscode/text/29/794d ↩ ↩
  3. [3] US Congress (1998). Workforce Investment Act of 1998 (Pub. L. 105-220). US Government Publishing Office, Accessed 2026-04-20. https://www.govinfo.gov/content/pkg/PLAW-105publ220/pdf/PLAW-105publ220.pdf ↩ ↩
  4. [4] US Access Board (2017). Revised 508 Standards -- ICT Accessibility Standards and Guidelines (36 C.F.R. Part 1194). US Access Board, Accessed 2026-04-20. https://www.access-board.gov/ict/ ↩ ↩ ↩ ↩
  5. [5] General Services Administration, Department of Defense, NASA (2021). Federal Acquisition Regulation (FAR) Subpart 39.2 -- Accessible Information and Communication Technology. Acquisition.gov, Accessed 2026-04-20. https://www.acquisition.gov/far/subpart-39.2 ↩
  6. [6] US Access Board (2017). Revised 508 Standards -- Chapter 3: Functional Performance Criteria (36 C.F.R. § 1194, Chapter 3). US Access Board, Accessed 2026-04-20. https://www.access-board.gov/ict/#chapter3-functional-performance-criteria ↩ ↩
  7. [7] General Services Administration, Department of Homeland Security (2023). Trusted Tester Process -- Section508.gov. General Services Administration, Accessed 2026-04-20. https://www.section508.gov/test/trusted-tester/ ↩ ↩ ↩
  8. [8] US Access Board, General Services Administration (2023). ICT Accessibility Testing Baseline for Web. US Access Board, Accessed 2026-04-20. https://ictbaseline.access-board.gov/ ↩ ↩ ↩
  9. [9] General Services Administration (2024). Section508.gov -- GSA Government-wide IT Accessibility Program. General Services Administration, Accessed 2026-04-20. https://www.section508.gov/ ↩ ↩