What Is a VPAT (2.5) — and When a Shopify Merchant Needs One

If an enterprise buyer or a procurement team has emailed you asking for a VPAT, you have probably never heard the term before. This is a plain-language explainer for Shopify merchants: what a VPAT 2.5 is, how it relates to WCAG and an accessibility statement, and the specific moments when a store actually needs one. It is educational, not legal advice. For anything tied to your own legal exposure, consult qualified counsel.

A VPAT in one sentence

A VPAT — a Voluntary Product Accessibility Template, revision 2.5 — is a standardized document, published by the Information Technology Industry Council (ITI), that describes how a product conforms to accessibility standards including WCAG 2.2, Section 508, and the European standard EN 301 549. “VPAT” is a trademark of ITI. The template gives buyers a single, predictable format for reading a vendor's accessibility claims, criterion by criterion, instead of every vendor inventing its own.

The standards a VPAT reports against are the same ones most accessibility work measures against. WCAG 2.2 (the W3C Web Content Accessibility Guidelines, at conformance Level AA) is the technical baseline. Section 508 is the U.S. federal requirement for information and communication technology bought by federal agencies. EN 301 549 is the European harmonized standard referenced by the European Accessibility Act.

VPAT vs ACR vs accessibility statement

Three documents get confused constantly, so it helps to separate them.

• VPAT — the blank ITI template. Empty columns waiting for test results.
• ACR (Accessibility Conformance Report) — that same template once it has been filled in with a product's actual test results. When someone says they “have a VPAT,” they almost always mean a completed ACR.
• Accessibility statement — a public, plain-language page on your own domain that describes your accessibility commitment and gives visitors a real feedback channel. It is written for the public, not for procurement reviewers.

A buyer's vendor-review form asks for the conformance report (the filled-in VPAT). Your customers and a visiting auditor look for the accessibility statement on your storefront. Different audiences, different documents.

The VPAT 2.5 editions, and why buyers ask for 2.5 specifically

VPAT 2.5 is not one form. ITI publishes it in several editions: a WCAG edition, a Section 508 edition, an EU edition keyed to EN 301 549, and an international edition that combines them. Revision 2.5 is the version that aligns with WCAG 2.2.

That is why enterprise and government buyers request “2.5” by name rather than just “a VPAT.” A procurement team buying on behalf of a federal program needs the Section 508 edition. A buyer in the EU needs the EN 301 549 edition. Asking for 2.5 is shorthand for “give me the current edition that maps to the standard I have to satisfy.” A short consumer-facing accessibility summary is not a substitute for the formatted report they are asking for.

When a Shopify merchant actually needs one

Most stores never get asked. The merchants who do tend to hit one of these situations.

• Procurement and B2B vendor reviews. If you sell wholesale, white-label, or B2B into larger organizations, a VPAT or ACR is often a line item in their vendor-onboarding checklist. No document, no contract — the same way they would ask for a SOC 2 report or a certificate of insurance.
• Section 508 alignment for buyers tied to federal programs. Section 508 binds federal agencies, and that obligation flows downstream to the vendors and resellers who supply them. A buyer connected to a federal program may need your Section 508 edition to satisfy their own requirement, even though Section 508 does not bind your store directly.
• Selling into the EU under the EAA. The European Accessibility Act became enforceable on June 28, 2025. In-scope e-commerce services are expected to meet accessibility requirements and publish an accessibility statement. A conformance report keyed to EN 301 549 is the kind of evidence that fits that expectation.

The common thread is that a VPAT is a sales-and-compliance document. You produce one because a counterparty asked, or because you are entering a market that expects conformance evidence — not because a Shopify store is legally required to file one on its own.

What a VPAT is not

This is the part that gets oversold elsewhere, so it is worth stating plainly. A VPAT is a conformance report. It is not a certificate, not a seal, and not a legal guarantee.

• It does not certify that your store is compliant with any law.
• It does not guarantee conformance — it documents your test results, including the criteria you only partially meet or do not meet.
• It does not prevent or resolve litigation.

An honest VPAT is useful precisely because it is candid. It records what the testing found, gaps included. A document that claims everything passes is less credible to a serious procurement reviewer, not more. And no document substitutes for legal advice; if you are weighing your own exposure, talk to counsel.

How to get a VPAT for a Shopify store

Paperfort runs an automated WCAG 2.2 AA scan of your storefront using axe-core, then completes a VPAT 2.5 (an ACR) from the results. The report documents what the automated scan finds, criterion by criterion, and flags where a qualified professional should review further.

That flagging matters because of a well-known limit. Automated tools, axe-core included, detect on the order of 30–50% of WCAG issues — the rest need human judgment (does the alt text actually describe the image, is the reading order sensible, does a keyboard user get stuck). A Paperfort VPAT is honest about that boundary instead of papering over it. You receive the completed VPAT 2.5, a plain-language audit report, and a hosted accessibility statement for your own domain.

If a buyer has asked you for conformance documentation, the practical next step is to run an audit and get your VPAT 2.5. You can also read the deeper walkthrough on getting a VPAT for Shopify.