Section 508 Still Says WCAG 2.0. Procurement Officers Already Moved On.

1What the Regulation Literally Says

The revised Section 508 standards, finalized in 2017, incorporate WCAG 2.0 Level AA by reference. That's it. No 2.1, no 2.2, just the 2008 version of the guidelines. A future refresh is expected to update that reference to WCAG 2.1 or 2.2 AA, but as of today, the formal legal baseline is older than most of the accessibility tooling built to test against it.

2What Procurement Actually Expects Right Now

Contracting officers and 508 coordinators aren't waiting on the formal refresh. WCAG 2.1 AA is already the practical floor for new federal and state development, and references to WCAG 2.2 AA are showing up in RFP language with increasing frequency. A bid that cites only 2.0 compliance reads as dated to an evaluator who's been seeing 2.1 or 2.2 language in competing proposals.

DOJ's own Title II web rule set WCAG 2.1 AA as the binding standard for state and local government, which only widens the gap. The thing most agencies are legally required to hit already sits a full version ahead of what Section 508 technically demands.

3What WCAG 2.2 Adds That 2.1 Doesn't Cover

Six of the new success criteria matter most for a government site, four at AA and two at A. None of them are exotic.

4Why the Formal Refresh Is Taking This Long

Updating a federal regulation isn't a find-and-replace on a version number. The Access Board has to run a full rulemaking process, draft language, open it for public comment, respond to that comment, and finalize a rule that technology vendors, federal agencies, and disability advocates all have to be able to live with. That process routinely takes years, which is exactly why the 2017 refresh references a 2008 guideline set and why the next refresh hasn't landed yet even though WCAG 2.2 has been final for a while.

The lag isn't a sign anyone's ignoring the problem. It's a structural feature of how federal rulemaking works, and it's the same lag that let DOJ's Title II web rule set a newer WCAG version as a binding standard for government sites before Section 508's own text caught up to match it.

5States Are Already Ahead of the Federal Text

A number of states have folded WCAG 2.1 AA, and in some cases language anticipating 2.2, directly into their own state IT accessibility policies, independent of whatever Section 508 formally says. A state agency operating under one of those policies is already held to a newer bar than the federal regulation text technically requires, which means "we meet Section 508" can be true and still fall short of what your own state demands. Check your state's IT accessibility policy directly. It may already be stricter than the federal baseline you've been building to.

6Target Size Is the One That Catches Teams Off Guard

We've seen more sites fail the 24 by 24 pixel target size rule than any other new 2.2 criterion, mostly because icon-only navigation looked fine on a designer's monitor and nobody measured the actual tap area on a phone. It connects directly to the mobile screen reader numbers we covered separately: a target that's technically clickable with a mouse can be genuinely hard to hit with a finger or switch device, and 2.2 is the first version of WCAG that puts a number on it instead of leaving it to judgment.

7What to Write Into Your Next RFP

If you're the one drafting procurement language rather than responding to it, name the standard explicitly instead of leaning on "Section 508 compliant," a phrase that technically still means WCAG 2.0 AA. Require WCAG 2.1 AA at minimum, ask vendors to describe their approach to the 2.2 criteria even though it isn't formally mandated, and ask for a current VPAT rather than accepting one dated several years back. Vague procurement language gets vague compliance in return.

8What to Build To

Build to WCAG 2.1 AA as the non-negotiable floor, since that's what DOJ's Title II rule and most current RFPs already demand. Then layer in the 2.2 criteria above, not because any regulation requires it yet, but because the direction of travel is obvious, and retrofitting target sizes and authentication flows later costs more than building them correctly once. Future-proofing isn't a marketing phrase here. It's cheaper math.

Related Articles