A contracting officer asks for a VPAT. You have never heard the word. You get three quotes: $400, $4,000, and $14,000. All three claim to deliver the same thing.
They do not. Here is what separates them.
What a VPAT actually is
A Voluntary Product Accessibility Template is a document in which you state how your product conforms to accessibility standards. The current form is VPAT 2.5, and the completed document is properly called an Accessibility Conformance Report. Section 508 is the law that makes an agency ask for one.
The critical word is voluntary, and it misleads people constantly. Producing the document is voluntary. Being truthful in it is not. A VPAT is a representation made to the government, and a wrong one is a problem of a different category from a bad website.
Why the cheap ones are cheap
At the bottom of the range you are buying a tool export with a cover page. An automated scanner runs against your site, its findings are pasted into the template, and the conformance column is filled in by whatever the tool guessed.
Automated testing catches somewhere around a third of real accessibility failures. It is excellent at the things that are machine-checkable: a missing alt attribute, a contrast ratio, a form field with no programmatic label. It cannot tell you whether your alt text is meaningful, whether your focus order makes sense to someone who cannot see the layout, or whether your error messages actually tell a screen reader user what went wrong.
So a $400 VPAT is a document that says "Supports" in a lot of rows that a human would have marked "Partially Supports". It will pass a cursory read and it will not survive anyone who tests it.
Why the expensive ones are expensive
At the top of the range you are usually buying a consultancy's bench time: manual testing with assistive technology across multiple browsers and platforms, a written remediation plan, and sign-off from someone with credentials. Six weeks is a normal turnaround. Four to five figures is a normal quote.
For a large product with a long compliance history, that is often the right purchase.
What drives the number
- Surface area. A five page brochure site and a logged-in application with forty states are not the same job, and page count is the wrong unit. Unique templates and interaction patterns are the real unit.
- Whether anyone can get behind the login. Gated pages are where failures concentrate, and a report written against only the logged-out site is the single most common reason a VPAT gets rejected.
- Who signs it. A document nobody will put a name to is worth less, and procurement increasingly knows that.
- Whether a remediation plan comes with it. A list of failures tells you that you have a problem. A sequenced plan tells your developer what to do on Monday.
The question to ask any vendor
Ask what percentage of the testing is manual, and ask who signs the finished document. The answers to those two questions explain most of the price difference in the market, and a vendor who is vague about either is selling you the cheap thing at the expensive price.
What we would do first
Before you buy anything, scan your own site. It takes thirty seconds and it costs nothing, and it tells you roughly which end of the range you are in. A site that comes back with four issues does not need a six week engagement. A site with sixty does not need a $400 PDF.
Then ask the agency what they actually need. Some want a full ACR. Some want a conformance statement and a remediation plan. Buying the wrong one is expensive in both directions.
