The Department of Justice published the ADA Title II Final Rule (codified at 28 CFR Part 35) in April 2024. It adds specific technical requirements to a 35-year-old civil rights statute: state and local government web content and mobile apps must conform to WCAG 2.1 Level AA. The DOJ extended the large-entity compliance date to April 26, 2027 (interim final rule, April 2026). The obligation is unchanged and litigation exposure is live now. This page is the operational guide for public entities that need WCAG 2.1 AA software that actually defends — not just gives you a dashboard.
The two deadlines
| Entity size | Population threshold | Deadline | Status (2026-05-15) |
|---|---|---|---|
| Large public entities | 50,000+ population (state govts, large cities, large counties, public universities, large school districts) | April 26, 2027 | Extended from Apr 24, 2026 · obligation unchanged |
| Small public entities | Under 50,000 population (small cities, small school districts, smaller counties) | April 26, 2028 | Extended from Apr 26, 2027 |
| Special districts | (varies by service type and federal funding) | April 26, 2028 (ADA Title II) | Extended; §504 runs separately if federally funded |
What "WCAG 2.1 AA conformance" actually requires
50 success criteria across four principles. Below is the structural breakdown — not the full criterion text (the W3C spec is the authoritative source) but the conformance categories you must satisfy:
Perceivable (1.x · 9 criteria at A + AA)
- 1.1.1 Text alternatives for non-text content (alt text)
- 1.2.1-1.2.5 Time-based media (captions, audio descriptions)
- 1.3.1-1.3.5 Adaptable content (semantic HTML, meaningful sequence, ARIA)
- 1.4.1-1.4.13 Distinguishable (color contrast, text resize, focus visible, content on hover)
Operable (2.x · 16 criteria)
- 2.1.1-2.1.4 Keyboard accessible (no keyboard traps, character key shortcuts)
- 2.2.1-2.2.2 Enough time
- 2.3.1 No content known to cause seizures
- 2.4.1-2.4.7 Navigable (skip links, page titles, focus order, link purpose, headings, focus visible)
- 2.5.1-2.5.4 Input modalities
Understandable (3.x · 12 criteria)
- 3.1.1-3.1.2 Readable (language of page, language of parts)
- 3.2.1-3.2.4 Predictable (on focus, on input, consistent navigation, consistent identification)
- 3.3.1-3.3.4 Input assistance (error identification, labels, error suggestion, error prevention)
Robust (4.x · 3 criteria)
- 4.1.1 Parsing (note: superseded in 2.2 but still in 2.1)
- 4.1.2 Name, role, value
- 4.1.3 Status messages
Each of these is a defensibility surface. Each requires evidence at the source-code level — the live HTML, ARIA, semantic structure — not a screenshot of a passing scan. An audit-defensible platform produces signed per-criterion evidence; a compliance automation platform produces dashboards.
Why WCAG 2.1 AA and not WCAG 2.2 AA
WCAG 2.2 (published October 2023) is the more current standard. It adds 9 new success criteria and removes 1 obsolete one. But the ADA Title II Final Rule references 2.1, not 2.2. The DOJ explicitly chose 2.1 as the legal floor — meaning conformance to 2.1 satisfies the federal mandate. WCAG 2.2 is backward compatible (every 2.1 criterion is still in 2.2, except 4.1.1 Parsing which is now obsolete), so meeting 2.2 also meets 2.1. The practical approach: target 2.1 AA for federal compliance, layer 2.2 AA on top for enhancements and modern user-experience improvements (touch-target sizing, focus visibility, accessible authentication).
See our companion WCAG 2.2 AA buyer's guide for the 9 new criteria and when each applies.
Section 508, ADA Title III, and how the federal landscape stacks
| Standard | Who it covers | WCAG version referenced | Authority |
|---|---|---|---|
| ADA Title II Final Rule (28 CFR Part 35) | State and local government entities | WCAG 2.1 AA | DOJ · April 2024 |
| Section 508 (Rehabilitation Act) | Federal agencies and federal contractors | WCAG 2.0 AA (with VPAT 2.5 referencing 2.2) | Access Board · 2017 Refresh |
| ADA Title III | Private entities (places of public accommodation) | No explicit reference; courts have applied WCAG 2.0 AA / 2.1 AA case-by-case | Civil litigation since 1990 · DOJ supplemental |
| European Accessibility Act (EAA) | EU private and public entities | EN 301 549 (which references WCAG 2.1 AA) | EU Directive · enforcement July 12, 2025 |
WCAG 2.1 AA is the common floor across all four. A compliance program built for 2.1 AA satisfies the federal mandate (Title II), aligns with Section 508 procurement, defends against Title III litigation, and meets the EAA threshold. WCAG 2.2 layered on top adds international future-proofing.
What public entities should do this week
For entities preparing for the April 26, 2027 compliance date (or unsure of their classification):
- Run an automated scan today. Free tools like axe-core, Pa11y, WAVE catch ~30% of WCAG violations. The output is your first defensibility artifact — even an imperfect scan, dated, demonstrates good faith.
- Identify your three highest-risk surfaces. Home page, login/authentication flows, and any pages handling benefits applications or critical services. These are where Title II litigation typically lands first.
- Document a remediation timeline. A signed plan with quarterly milestones is itself a partial defense — it demonstrates good-faith compliance effort even if the technical work is incomplete.
- Engage counsel proactively. Don't wait for a demand letter. State attorneys general and the DOJ both have enforcement authority; private plaintiffs can also file.
- Stand up audit-defensible evidence collection. Every page scan from this point forward should produce signed, per-criterion evidence. This is what acipta's A11Y suite does on day one of integration. See our audit-defensible compliance overview.
How acipta produces WCAG 2.1 AA evidence
The A11Y suite is one of acipta's 7 GA suites, all projected from a single canonical Control Mapping Catalog (CMC). The A11Y suite ships 23 specialized agents organized by WCAG principle:
| Agent family | Covers | Output |
|---|---|---|
| Perceivable agents (1.x) | Alt text, time-based media, semantic structure, color contrast, text resize | Per-criterion verdicts · remediation paths |
| Operable agents (2.x) | Keyboard, focus order, navigable structure, link purpose, input modalities | Per-criterion verdicts · keyboard-flow traces |
| Understandable agents (3.x) | Language, predictability, input assistance, error handling | Per-criterion verdicts · form-validation audits |
| Robust agents (4.x) | Parsing (2.1), name/role/value, status messages | Per-criterion verdicts · ARIA usage validation |
| Document agents | PDF UA, Word, PowerPoint accessibility (relevant for public-records and meeting-document obligations) | Document accessibility scoring · remediation paths |
| Evidence agents | Cross-cutting | Ed25519 signing · VPAT 2.5 generation · Determinism Ledger writes |
Every verdict from every agent is Ed25519-signed at write time, RFC 3161-timestamped via independent third-party trusted timestamp authority, hash-chained to the prior verdict, and persisted in the Evidence Locker. The VPAT 2.5 buyers and federal procurement officers read is auto-generated from the same signed evidence — meaning the VPAT is byte-identically derivable from the underlying audit trail.