All resources
GuideBy Logan Nathan · Jul 2026 · 20 min read

The Complete ADA Title II Action Plan: A Step-by-Step Guide for Government Web Teams

Ten concrete steps from legal obligation to sustained compliance. Written for government IT directors, web coordinators, and compliance officers who need to act, not just understand.

The Stakes

State and local governments with populations over 50,000 must hit WCAG 2.1 AA by April 26, 2027. Smaller entities and special districts have until April 26, 2028. These deadlines aren't aspirational. They're enforceable under the DOJ's ADA Title II final rule, and missing them exposes your agency to complaints, consent decrees, and reputational damage. For a leadership-briefing version of the deadline picture, see our 2027 DOJ Deadline Survival Guide.

1Understand Your Legal Obligation

Before you act, you need to know exactly what the law demands. The DOJ's April 2024 final rule under ADA Title II says all state and local government entities (cities and counties, school districts, transit authorities, water districts, special districts, universities, libraries, state agencies, and other public entities) must make their websites and mobile applications accessible to people with disabilities at WCAG 2.1 Level AA.

The rule covers all web content and mobile apps a public entity provides or makes available. That's broader than most agencies realize. If a private vendor runs your online permit portal, your agency owns its accessibility. If a third-party event registration system is embedded on your site, that's on you too. If a parks department app is white-labeled from a commercial platform, your agency still carries the compliance obligation. The rule's reach across SLED (state, local, and education) is the reason accessibility now sits alongside cybersecurity as a mandatory public-sector program.

The deadlines are tiered. Entities with a total population of 50,000 or more must comply by April 26, 2027. Everyone else, including smaller jurisdictions and every special district government regardless of population served, has until April 26, 2028. The rule also references preexisting content exceptions for archived materials and conventional electronic documents posted before the compliance date, provided those documents aren't actively used to deliver current services.

Your first move is briefing leadership. City manager, county administrator, superintendent, whoever holds the checkbook. Give them the obligation, the timeline, and the enforcement mechanism in one page. DOJ enforces Title II through complaint investigations that can end in formal consent decrees with court oversight, mandatory remediation timelines, and real reputational cost. Keep the brief short, factual, and end with the path you recommend.

ADA Title II compliance timeline

April 2024 rule

DOJ final rule publication through the two tiered compliance deadlines.

April 2024DOJ final ruleApril 26, 2027Population 50,000+April 26, 2028Smaller entities & special districts~3 year runway+1 year for smaller entities
Two dates, two tiers. Population 50,000 or more hits WCAG 2.1 AA by April 26, 2027. Everyone else has until April 26, 2028.

2Conduct a Baseline Accessibility Audit

You can't prioritize what you haven't measured. A baseline audit gives you a quantified picture of your current WCAG conformance across every web property. Three audit types matter here: automated, manual, and expert. Knowing what each one catches keeps you from over-spending on the wrong tool.

Automated audit

Tools: axe, Lighthouse, WAVE, Deque, Level Access AMP

Automated tools catch roughly 30 to 40% of WCAG 2.1 AA violations, the slice that can be detected algorithmically. Missing alt text attributes, bad heading nesting, color contrast failures visible in the CSS, missing form labels, missing page titles. Fast and cheap. Start here. But don't confuse a clean automated scan with a compliant site.

Manual audit

Methods: keyboard-only navigation, screen reader testing, cognitive walkthrough

Manual testing by someone who knows WCAG catches what tools miss. Focus management inside modals. ARIA that validates but produces confusing screen reader output. Session timeouts that fire too fast. Navigation orders that make no sense when tabbed. Slower and more expensive, and worth every dollar on high-traffic pages and any complex interactive feature.

Expert audit with assistive technology

Methods: testing with NVDA + Chrome, JAWS + IE/Edge, VoiceOver + Safari

The gold standard is testing by people who use assistive tech every day. Expert testers on screen readers, switch access devices, and voice control catch issues that trained WCAG auditors miss, because they know what these tools feel like in daily use. For your highest-traffic pages and critical citizen services, this testing pays for itself.

For most agencies, the practical mix is this. Run automated tools across your full web footprint for a quantified baseline. Add manual testing on your top 20 highest-traffic pages, your main navigation, and every public-facing form or transactional portal. If you want a fast per-URL sanity check without installing anything, drop a page URL into Keyspider's ADA audit or run the WPPersona ADA PDF audit tool for the document side. That combination gives you a prioritized remediation backlog you can actually work.

3Run a PDF Inventory

For most agencies, PDFs are the biggest accessibility risk on the site, and the one most likely to be underestimated. Agencies have been uploading PDFs to their sites for 20+ years. HTML pages you can fix by updating templates. Each PDF has to be assessed and remediated individually. The first step is knowing exactly what you have.

To crawl your domain for PDFs, use a link extraction tool. Screaming Frog SEO Spider is commonly used; the free version handles up to 500 URLs. For larger sites, tools like the Deque WorldSpace suite or WPPersona's built-in bulk PDF audit tool can crawl and classify thousands of documents automatically. For a free per-URL scan without a login, run Keyspider's ADA audit against any government PDF and it returns a per-document risk score with tag, contrast, and reading-order checks in under a minute. See our free PDF audit method walkthrough for the step-by-step process.

What to check on each PDF during the scan:

  • Is the document a scanned image? (Open the PDF, try to select text. If you can't select text, it's image-only and completely inaccessible to screen readers.)
  • Does the document have a title set in metadata? (File → Properties → Description in Acrobat; check the Title field.)
  • Are there accessibility tags? (In Acrobat: View → Show/Hide → Navigation Panes → Tags. If the Tags panel is empty, the document is untagged.)
  • Is the reading order logical? (In Acrobat's Reading Order tool, confirm content reads in the correct sequence.)
  • Do tables have proper header cells? (In the Tags panel, look for TH elements tied to table data.)
  • Do images have alt text? (In the Tags panel, Figure elements should have Alt attributes.)

Score every document on a risk matrix. Critical: image-only files and files with no tags. High: documents with heading structure failures, missing alt text on images, or inaccessible table structure. Medium: documents with minor issues. That classification is what drives your remediation order.

4Prioritize Remediation by Impact and Risk

Remediation resources are finite. You can't fix everything at once. Prioritization runs on two axes: impact (how many users affected, and how badly) and legal risk (how likely this content is to show up in a complaint or OCR inquiry). These usually line up. Sometimes they don't.

For HTML pages and web content, work in this order. (1) Global templates and shared components that appear across the whole site: navigation, footer, skip links, ARIA landmarks. (2) High-traffic pages from your analytics, usually home page, news/alerts, services directory, contact info. (3) All public-facing forms and transactional portals, because those gate access to government services and carry the highest legal exposure. (4) Remaining pages in descending traffic order.

For PDF documents, work in this order. (1) Critical-classified documents published in the last 24 months, since these are most likely still in active use and most likely to be cited in a complaint. (2) High-classified documents tied to public benefits, permits, licensing, legal notices, and other services residents actually need. (3) High-classified documents of other types. (4) Medium-classified documents. (5) Documents that qualify for preexisting document exceptions under the rule.

Write your prioritization framework down. If a complaint gets filed, being able to show that you sequenced remediation rationally, focusing first on content most impactful to people with disabilities, is meaningful evidence of good-faith effort. For a worked example, see how a mid-size county sequenced remediation across 8 departments and how a mid-size city worked back from a DOJ complaint in 60 days.

5Evaluate Your CMS

The most important compliance question isn't “what violations do we have today.” It's “can our current CMS stop new violations from being published.” If the answer is no, remediation becomes a treadmill. You fix violations, staff publish new ones, and you're never ahead.

Run your CMS through these six questions:

Does your CMS enforce accessible heading hierarchy?

Or can editors drop H2, H3, H5 in arbitrary order for visual styling instead of semantic structure?

Does your CMS require alt text before images can be published?

Or can editors skip alt text and publish images with no description at all?

Does your CMS scan PDFs at upload for accessibility failures?

Or does the CMS accept any PDF file regardless of accessibility status?

Does your CMS enforce color contrast in its color palette options?

Or can editors pick foreground/background combos that fail WCAG 1.4.3?

Are your CMS templates keyboard-navigable out of the box?

Or do staff have to hand-roll custom ARIA and keyboard handling for every new interactive component?

Does your CMS have a compliance dashboard showing current accessibility status?

Or is the compliance status of your content unknown until you commission an audit?

If your CMS answers “no” to more than two of these, you have a structural problem. Training and policy won't fix it. A platform change is usually the shortest road to sustained compliance. Our Government CMS Buyer's Guide walks the RFP questions and TCO math side by side, and the 2026 State of Government Website Accessibility report shows how much of the compliance gap tracks to CMS choice. For a platform built for this, see the WPPersona CMS.

6Remediate Your Document Archive

PDF remediation is labor-intensive, but manageable with the right workflow. The approach depends on the document type and how it fails. For a deeper walk-through, our PDF Accessibility Remediation Playbook covers document classification, risk scoring, and the Adobe Acrobat workflow end to end, and the step-by-step remediation guide walks each fix in order. You can also run individual documents through the Keyspider AI PDF audit tool before and after remediation to confirm the fix landed (run a scan here).

Image-only PDFs: OCR Processing

Image-only PDFs (scanned pages with no text layer) have to go through optical character recognition before they can be made accessible. Adobe Acrobat Pro's built-in OCR (Tools → Scan & OCR → Recognize Text) can batch-process multiple files. After OCR, the document has a text layer, but you still need tagging, reading order verification, and heading structure. For large volumes of image-only PDFs, dedicated OCR services (ABBYY FineReader, Kofax) or specialized accessibility vendors are faster and more accurate.

Untagged PDFs: Re-export from Source

If you have the source document (Word, InDesign, PowerPoint), the fastest path to an accessible PDF is re-exporting from source with accessibility features turned on. In Microsoft Word: use Styles for headings, add alt text to every image, set the document title in Properties, then export as PDF via File → Save As → PDF with "Document structure tags for accessibility" checked. In Adobe InDesign: use the Paragraph Styles panel for headings, set alt text for every image in Object Export Options, and export with "Tagged PDF" checked.

Tagged PDFs with failures: Acrobat Pro remediation

For tagged PDFs with specific failures (wrong reading order, missing alt text on images, inaccessible tables), remediation happens in Adobe Acrobat Pro's Accessibility tools. The Reading Order tool lets you visually reorder tagged content. The Tags panel lets you edit the tag tree directly. The Set Alternate Text function adds alt text to Figure elements. For table accessibility, the Table Editor lets you set header cells (TH with appropriate scope attributes) and associate header and data cells.

Complex documents: HTML alternative

For documents so complex that proper PDF remediation is impractical (heavily visual annual reports, multi-layer maps, intricate infographic PDFs) the better answer is often an HTML page that carries the same information in accessible web markup. This isn't a workaround. It's usually the better user experience. An HTML version of a financial report is easier to navigate with a screen reader than even a well-tagged PDF.

7Train Your Content Team

Platform-level enforcement catches structural violations. It can't catch bad authoring choices in content that technically passes automated checks. A heading structure that's syntactically correct but semantically meaningless. Alt text that says “image” instead of describing what's in the picture. Tables with proper markup that still describe data so poorly the whole table is useless to a screen reader user. Training fixes the human layer.

Training works when it's role-specific and short. The 6-hour WCAG overview session rarely sticks. Build brief, task-specific modules instead:

  • Content editors: Writing meaningful alt text (20 minutes); heading hierarchy for page structure (15 minutes); accessible link text, no "click here" (10 minutes)
  • Document creators: Word/Google Docs export settings for accessible PDFs (30 minutes); using heading styles in Word (15 minutes); accessible table creation (20 minutes)
  • Communications staff: Accessible social media posts, alt text for images, captions for video (15 minutes); accessible email newsletters (20 minutes)
  • Web developers: ARIA implementation patterns (60 minutes); keyboard event handling (45 minutes); accessible form error handling (30 minutes)

Make training mandatory for anyone who publishes content, uploads documents, or manages web components. Document completion. Training records matter in a compliance inquiry. Build refresher training into annual staff recertification cycles. Our Government Web Accessibility Handbook is a working reference you can hand to editors, developers, and comms staff. WPPersona's accessibility features catch structural mistakes at publish time so training focuses on judgment calls rather than syntax.

Role-specific training minutes

4 roles

Short, task-specific modules replace the 6-hour WCAG overview session.

Content editors
45 min
Document creators
65 min
Communications staff
35 min
Web developers
135 min

Editors

20 + 15 + 10

Documents

30 + 15 + 20

Comms

15 + 20

Developers

60 + 45 + 30

Developers carry the heaviest load at 135 minutes across 3 modules. Communications staff can be current in 35 minutes.

8Publish Your Accessibility Statement

The DOJ's Title II rule doesn't specifically require an accessibility statement, but it's strongly implied. Every voluntary resolution agreement and consent decree the DOJ and OCR have entered into includes one. Publishing a statement signals good faith, gives users with disabilities a channel to report barriers, and creates a dated starting point for your compliance posture.

Your accessibility statement should include, at minimum:

  • A statement of your commitment to WCAG 2.1 Level AA conformance under ADA Title II
  • The conformance status of your current website (fully conforms / partially conforms / does not conform), with the date the statement was last updated
  • A description of any known non-conformances and the timeline for remediation
  • A description of content that's exempt from the accessibility requirement (archived content, preexisting documents) with a process for providing accessible alternatives on request
  • Contact information for your ADA web coordinator: name, phone number, and email address
  • A mechanism for users to report accessibility barriers: a web form, phone number, or email address
  • A statement of the feedback and complaint process: how long the agency will take to respond, and what options are available if the user isn't satisfied with the response

Link to your accessibility statement from the footer of every page on every site. Reachable from any page in no more than two clicks. Publish it at a stable, predictable URL like yourdomain.gov/accessibility or yourdomain.gov/accessibility-statement. For a working template you can adapt, see WPPersona's own accessibility statement.

9Establish Ongoing Monitoring

Getting compliant once is meaningless if you can't stay there. Government websites aren't static. Content is added daily, PDFs get uploaded, plugins update, new features ship. Every change is a chance to introduce a regression. Ongoing monitoring is what turns a compliance project into a compliance program.

Set the following monitoring cadence:

Continuous

Platform-level enforcement. PDF scanning at upload, alt text required for image publish, heading hierarchy enforced by template. These should be structural constraints in your CMS, not manual checks somebody has to remember.

Weekly

Automated scan of main pages. Run axe or WAVE against your 50 highest-traffic pages. Review violations. Assign remediation tasks. Track the week-over-week trend.

Monthly

Compliance dashboard review. Look at aggregate PDF risk status, new document uploads, and outstanding remediation items. Brief the web coordinator and ADA coordinator.

Quarterly

Manual testing of key user journeys. Keyboard-only navigation test, screen reader test of top forms and transactions. Document results. Address findings within 30 days.

Annually

Full accessibility audit. WCAG 2.1 AA audit of the primary website and every significant web application. Third-party audit is preferable for defensibility. Update accessibility statement and remediation plan based on findings.

WPPersona's compliance dashboard and PDF accessibility scanning handle the Continuous and Monthly cadences at the platform layer. For a weekly per-URL spot check, Keyspider's ADA audit gives you a shareable report link you can drop into a ticket.

10Prepare Your Documentation for Procurement Review

If your compliance work includes procuring a new CMS, hosting platform, or third-party application, procurement documentation is both a compliance requirement and a risk-management tool. Three documents matter most for government technology accessibility procurement:

VPAT (Voluntary Product Accessibility Template)

A VPAT is a standardized document where a vendor self-reports the accessibility conformance of their product against WCAG 2.1 Level AA (and optionally other standards). Ask for a VPAT from every CMS or application vendor you evaluate. Read it critically. A VPAT that claims "Supports" across every criterion with no explanation should prompt follow-up questions. A credible VPAT documents specific testing methodology, tested platforms and assistive technologies, and known limitations. Ask for the test report or audit report the VPAT is based on.

SOC 2 Type II Report

Not strictly an accessibility document, but a SOC 2 Type II report shows the vendor runs security and availability controls consistently over time. For government CMS procurement, requesting the SOC 2 report (typically under NDA) verifies the vendor has the operational maturity to run a government-grade platform. A vendor that can't produce a SOC 2 report probably doesn't have the security posture government deployment requires.

Data Processing Agreement (DPA)

A DPA governs how the vendor handles data your agency provides, including citizen data, employee data, and any personally identifiable information processed through the CMS. The DPA should specify data retention, deletion, breach notification requirements, sub-processor obligations, and data residency. For agencies, this matters for compliance with state privacy laws, records retention rules, and federal requirements if the agency receives federal funding.

For an example VPAT to compare vendor claims against, see the WPPersona VPAT. Before you sign off on procurement, walk the Government Website ADA Compliance Launch Checklist against the vendor's claims. If your agency buys off cooperative contracts, vendors on the Carahsoft co-op are pre-cleared for SLED procurement, which cuts weeks off the paper cycle.

Ready to Put This Plan into Action?

WPPersona was built to make Steps 3, 5, and 9 structural instead of manual, with built-in PDF scanning, WCAG-compliant templates, and a real-time compliance dashboard. See how it works.

Schedule a Free Demo