ADA Title II Website Accessibility for Web Vendors: What Public-Sector Clients Will Ask For Before April 2027

If you design, build, or host websites for a city, county, school district, library, or transit agency, the Department of Justice's Title II web rule is about you too. The rule is written for state and local governments, but it covers the web content and mobile apps they provide "directly or through contractual, licensing, or other arrangements." In plain terms: the pages you build for a public client have to meet the same standard as pages its own staff build.

Short answer: ADA Title II website accessibility for vendors means delivering web content and apps that meet WCAG 2.1 Level AA, and being able to show how you know. The compliance dates are April 26, 2027 for public entities with a population of 50,000 or more, and April 26, 2028 for smaller entities and special district governments. Public buyers are already writing accessibility into contracts and checking vendor claims, so the vendors who win this work will be the ones who arrive with evidence, not promises.

Facts below are as of October 6, 2026, checked against ADA.gov, the Federal Register, W3C, ITI, the FTC, and NASCIO's 2026 survey of state accessibility officers. This is a practical guide for web teams, not legal advice. If you run a private business and want the Title III view, start with our ADA website checklist for small business.

The dates, re-checked today

On April 20, 2026, DOJ published an Interim Final Rule in the Federal Register (91 FR 20902) that pushed both compliance dates back by one year. ADA.gov's fact sheet now shows this table:

Three details matter for vendors:

• The standard did not change. The extension moved dates only. WCAG 2.1 Level AA is still the technical standard.
• DOJ may revisit the substance. The IFR says DOJ "will consider issuing an NPRM" on the rule's substantive requirements. DOJ's regulatory agenda published August 14, 2026 lists that proposal as "To Be Determined." As of today, the Federal Register shows no newer document under the rule's identifier (RIN 1190-AA82).
• The obligation is ongoing either way. In DOJ's words, "No matter the deadline, the rule's substantive requirements bind covered entities." If no new proposal arrives, DOJ says it "fully anticipates implementing the regulation at the new deadline."

Plan to WCAG 2.1 AA now and watch for a proposal. Work you ship this winter will still be live in April 2027.

Why Title II website accessibility reaches vendors

The rule applies to content a public entity "provides or makes available," including through someone else. DOJ's own examples point straight at web teams:

• A county parks page listing addresses and hours must meet WCAG 2.1 AA "even if a local web design company made the web page and updates it for the county," or if the county uses a template created by a private company (Small Entity Compliance Guide).
• A city parking-payment app must meet WCAG 2.1 AA "even if the app is run by a private company."
• If a town hires an outside developer to design and build its website, the town "needs to make sure that the web developer's design complies."

The same guide says this "might mean working with vendors to help ensure they understand these requirements or seeking out vendors with such knowledge." That second option is a procurement filter. If you can't explain WCAG 2.1 AA to a city clerk in plain language, another vendor will.

Who counts as a Title II client

Title II covers all state and local governments and their agencies, plus special purpose districts, Amtrak, and commuter authorities. ADA.gov's examples include:

• Public schools, community colleges, and public universities
• Public libraries, parks and recreation programs, and public transit agencies
• Courts, police departments, and elections offices
• Benefits and social-services offices, public hospitals, and clinics

One timing trap: a school district is not a special district government. A city school district uses the city's population to find its date, a county school district uses the county's, and an independent school district uses the latest Small Area Income and Poverty Estimates. So two districts in the same state can face different dates. Ask your client which date applies before you plan a schedule around it.

What public buyers are checking now

NASCIO's 2026 survey, Here to Stay, Here to Grow, drew responses from 36 of the 40 known state digital accessibility officers. It is state-level data, but it shows what public buyers already expect from vendors:

• 63% of states require accessibility in all RFP language and/or contract terms.
• 77% independently validate vendor claims. The most common methods are Accessibility Conformance Reports (ACRs), in-house testing, and vendor demos.
• 89% use contract accessibility clauses. Fewer require remediation plans (43%), use breach penalties or withholdings (37%), or test after award (20%).
• In NASCIO's rankings, officers put vendor accountability first, ahead of testing improvements and training.
• The hardest compliance areas are document remediation (75% report gaps) and high-traffic systems (70%). And 69% say they lack the resources, staff included, to remediate every state website and app.

Read that as a vendor: public teams are short on capacity and want partners who reduce work, not add review cycles. StateScoop's August 20, 2026 coverage reported the same picture.

The vendor handover kit: eight things to have ready

Here is our working checklist for a Title II project. It is not a DOJ form, but each item maps to something buyers or the rule actually look at.

1. A written conformance target. State "WCAG 2.1 Level AA" in the proposal and the statement of work. W3C notes that content meeting WCAG 2.2 also meets 2.1, so testing against 2.2 AA is reasonable headroom. Just keep 2.1 AA as the contractual line. DOJ itself flagged that W3C's quick-reference links can land readers on 2.2 pages, so be precise about which version you mean.
2. An Accessibility Conformance Report. An ACR is a completed ITI VPAT. The current template is VPAT 2.5Rev (April 2025). Its WCAG and INT editions cover WCAG 2.2, the EU edition covers 2.1, and the 508 edition covers 2.0. Each criterion gets one of four levels: supports, partially supports, does not support, or not applicable. "Partially supports" with a clear note beats a wall of "supports."
3. Your evaluation method. Say how you tested. W3C's WCAG-EM 2, published July 23, 2026, gives a five-step structure: define scope, explore the product, select a representative sample, evaluate it, and report. It also recommends involving users with disabilities.
4. Full pages and complete processes. Under WCAG 2.1 conformance, a page only conforms if the whole page does, including each responsive layout, and a multi-step process only conforms if every step does. A permit form that fails on step three fails the process.
5. An embed inventory. List every calendar, map, booking tool, payment widget, chat tool, and video player. ADA.gov says vendor-built tools the government posts do not fall under the third-party exception. Get each embed vendor's ACR, or flag the gap in writing.
6. A documents plan. New PDFs, slide decks, and forms posted after the compliance date generally need to conform. Agree who remediates them: you, the client, or a document specialist.
7. An authoring handoff. Accessible templates break the day an editor pastes an image without alt text or uses bold text as a heading. Hand over CMS guardrails, a one-page editor guide, and a short training session.
8. A feedback path and remediation plan. ADA.gov's planning advice includes giving people a way to request accessibility and report issues. Build the form or contact route into the site, and agree on response and fix times. NASCIO found most states take 30 to 90 days to remediate once an issue is identified. Be specific about what you will do inside that window.

Our web development RFP guide covers how buyers structure the wider proposal. The list above is what to bring when accessibility is on the scoring sheet.

Exceptions vendors tend to misread

The rule has five exceptions. Each has conditions, and none removes the broader duty to communicate effectively, which can mean providing an accessible version on request.

• Archived content qualifies only if all four conditions hold: created before the compliance date, kept only for reference or recordkeeping, stored in a dedicated archive area, and unchanged since it was archived. Council minutes created after the compliance date don't qualify just because they sit in an "Archive" folder.
• Preexisting documents (PDF, Word, slide, or spreadsheet files posted before the compliance date) are generally exempt. Not if people still use them to apply for or access a service. A 2020 business-license PDF that is still the application form must conform.
• Third-party content covers posts by members of the public, not content a vendor posts for the government, and not the platform that hosts public posts.
• Password-protected individualized documents, like a PDF water bill, are exempt. The account portal around them is not.
• Preexisting social media posts made before the compliance date are exempt.

There is also a narrow "minimal impact" provision. ADA.gov's example is a 4.45:1 contrast ratio against the 4.5:1 requirement. It is a defense the entity must prove, not a tolerance band to design to.

What not to promise

• "One script makes you compliant." In April 2025 the FTC finalized an order requiring accessiBe to pay $1 million and barring it from claiming its automated tools can make any website WCAG-compliant without evidence (FTC release). Our ADA checklist post covers why overlays are not a compliance strategy.
• "ADA certified" or "VPAT certified." ITI states plainly that there is no VPAT certification and that it does not review or approve VPATs.
• "AI handles it." In NASCIO's survey, 20% of states use AI for DOJ rule compliance, and most of them called it only moderately effective. AI can speed up scanning and drafts. A person still has to verify the result.
• A guarantee. Conformance is something you test, document, and maintain. A careful "partially supports" is more credible than a blanket promise.

Where a design and development studio fits

Public-sector accessibility is mostly process work: an honest audit, templates that keep editors on the rails, embeds that hold up to scrutiny, and documentation a procurement officer can read. We build that in from the first wireframe rather than bolting it on after launch. If you are a public team planning a rebuild, or a vendor who needs a build partner for a public client, see our web design and web development services.

FAQ

Does Title II apply to my studio if my client is a public school?

Public schools, community colleges, and public universities are Title II entities, so content you build or post for them falls under the rule. Your own company's website is a separate question; our ADA checklist post covers the Title III view.

Which WCAG version should I build to?

WCAG 2.1 Level AA is the standard the rule names. Testing to WCAG 2.2 AA gives headroom, since content that meets 2.2 also meets 2.1. Write 2.1 AA into the contract unless your client asks for more.

Did the extension change what counts as compliant?

No. The April 2026 IFR changed only the dates. DOJ has said it may propose substantive changes, but no proposal had been published as of October 6, 2026.

Is an ACR required?

ADA.gov's summary of the rule doesn't mention one. Buyers ask for them anyway, and NASCIO lists ACRs as the most common way states validate vendor claims. Follow the solicitation if it asks for a third-party audit.

Conclusion

ADA Title II website accessibility for vendors comes down to this: your public client owns the obligation, but the work you deliver has to meet WCAG 2.1 AA, and the client needs proof. The dates are April 26, 2027 and April 26, 2028, the standard is unchanged, and buyers are checking claims. Show up with a written target, an honest ACR, a named test method, an embed inventory, and a plan for documents, editors, and fixes. When you want a team that builds that in from day one, contact us.