The Compliance Gate: Why Accessibility Belongs in Requirements, Not the Backlog

For much of the past decade, accessibility sat in an uncomfortable middle ground: legally required in some contexts, commercially optional in most, and routinely deferred to a phase that never arrived. That middle ground has largely closed. In 2026, accessibility is a gate that buyers, procurement offices, and legal departments close in front of the deal, not a refinement applied afterward.

The shift is visible on several fronts. The Department of Justice's 2024 rule under Title II of the ADA set WCAG 2.1 Level AA as the technical standard for state and local government web content and mobile apps, with compliance deadlines that began falling in April 2026 for larger public entities. Section 508 continues to bind federal agencies and the contractors who serve them. Private-sector litigation under Title III of the ADA remains a persistent risk in states such as California, New York, and Florida. And enterprise buyers now routinely place accessibility questions in their vendor questionnaires and score the answers alongside security and uptime.

The practical consequence for custom software teams is straightforward: accessibility is a requirement, and requirements that arrive after the contract are expensive.

Why retrofit costs so much more than it appears to

Retrofitting accessibility is rarely a matter of adding labels to form fields. It touches information architecture, component design, color systems, error handling, keyboard focus order, media delivery, and the underlying data model that supports alternative presentations of content. On a product with a mature design system, a single conformance issue can propagate across hundreds of screens.

Three costs are commonly underestimated. The first is design debt: contrast and focus-state fixes cascade through every component built on a token that turns out to be noncompliant. The second is schedule risk: remediation work competes with committed feature delivery, and the negotiation over which slips is always political. The third is credibility. A public accessibility statement that cannot be substantiated is worse than no statement at all, particularly for organizations selling into government or education.

A pre-contract checklist

Name the standard precisely. Specify WCAG 2.2 Level AA as the baseline, or WCAG 2.1 AA where a customer's own obligations require it. Ambiguity about version is the most common source of post-launch dispute.

Define the assistive technology matrix. Conformance means working with real tooling: NVDA and JAWS with Chrome, VoiceOver with Safari, TalkBack on Android, keyboard-only navigation, 400 percent zoom, and speech input for form-heavy workflows. Write the matrix into the requirements, not the test plan alone.

Draw the scope boundary explicitly. Decide whether third-party widgets, embedded PDFs and documents, native mobile apps, transactional email templates, and kiosk interfaces are in scope. Buyers increasingly ask, and a vague answer reads as a gap.

Make conformance an acceptance criterion. Accessibility defects should block milestone acceptance the same way failed authentication tests do. Pair this with a severity model so that a missing alternative text on a marketing image is not treated identically to an unusable checkout flow.

Require documentation as a deliverable. An Accessibility Conformance Report or VPAT, an accessibility statement for publication, annotated component library documentation, and reusable test scripts should all be contractual outputs.

Secure remediation commitments. Specify response times by severity, the right to audit, and indemnification for accessibility claims arising from the vendor's work. Where the buyer will operate the system, require training and a handover session for the internal team that inherits it.

Budget for testing with disabled users. Automated scanners catch perhaps a third of real barriers. Manual testing by people who actually use assistive technology is the only reliable way to find the rest, and it should appear in the budget before signature rather than as an unbudgeted surprise.

What delay actually costs

Consider a mid-market retailer that defers remediation until after a platform relaunch. The work itself may be modest, but it lands during the pre-holiday freeze, when no engineering capacity exists and the cost of pulling it forward is measured in lost peak-season revenue. Or a systems integrator pursuing a state contract that requires a current conformance report; a missing or stale VPAT removes them from consideration before a single technical question is asked. Or a healthcare portal that receives a demand letter and finds that the remediation timeline is now set by opposing counsel rather than by its own roadmap, with monitoring obligations attached.

In each case the direct engineering cost is the smallest part of the bill. The larger losses are the deferred deal, the compressed timeline, the legal fees, and the internal attention that has to be redirected from planned work.

Who owns it after go-live

Accessibility decays. New features ship without review, content editors paste in unlabeled images, and a design system upgrade resets focus styles. Ownership must therefore be assigned, not assumed: a named accessibility lead, a checklist step in the definition of done, automated regression checks in CI, and an annual review cycle tied to the published statement.

None of this is exotic. It is ordinary engineering discipline applied to a requirement that has simply become non-negotiable. The organizations treating it that way are discovering that the gate opens more smoothly when it was designed into the building rather than bolted onto the door.