If your agency runs a website and serves a population of more than 50,000 people, the Department of Justice has set a hard date for when that website needs to conform to WCAG 2.1 Level AA: April 26, 2027. Smaller jurisdictions and special-purpose districts have one extra year, until April 26, 2028. There is no good-faith exemption. There is no compliance grace period after the deadline. And in the 12 months we have left, the agencies that win are the ones that started the work in 2026.
This is a practical guide to what the rule requires, what most agencies got wrong on their first attempt, and what a defensible 6-month compliance plan looks like for an agency that hasn't started yet. Written for ADA Coordinators, CIOs, and the outside counsel reviewing all of this for liability exposure.
What the rule actually says
The Department of Justice published its Title II web accessibility Final Rule on April 24, 2024 (89 Fed. Reg. 31320), then extended the compliance dates by one year via Interim Final Rule on April 21, 2026. The operative deadlines are now:
| Compliance date | Who's covered |
|---|---|
| April 26, 2027 | Public entities with a total population of 50,000 or more — most state agencies, mid-sized and large counties, mid-sized and large cities, large public university systems |
| April 26, 2028 | Public entities with a population under 50,000, plus all special-purpose districts (water, transit, library, school, etc.) regardless of size |
The standard is WCAG 2.1 Level AA, codified at 28 CFR Part 35 Subpart H. That covers your website, your mobile applications, and the documents you publish online (including PDFs).
Enforcement is direct. The DOJ can investigate on its own initiative. The Office for Civil Rights at HHS or Education can act on a complaint. Individuals can sue under Title II for injunctive relief and attorneys' fees — there's no statutory damages cap that limits exposure, and a single failing user flow on a single page can support a complaint. The pattern from recent DOJ enforcement is that agencies with an audit, a documented roadmap, and a remediation cadence in flight are given a reasonable chance to cure. Agencies with nothing pay outside counsel to defend the absence.
Two shortcuts most agencies tried first. Both fail.
Shortcut #1: Run an automated scanner. Call it done.
Free or low-cost scanners — axe-core, Lighthouse, WAVE, the built-in DevTools accessibility panel — are useful tools. They flag computed-CSS contrast ratios, missing alt attributes, missing form labels, ARIA syntax errors. They run in seconds. They produce a report your team can ship against. The results are real.
What they cannot evaluate is everything that requires actually running the site as a user does. Keyboard interaction order. Focus traps in modal dialogs. ARIA state changes during a user flow. Dynamic content announcements when a result count updates. Contrast between text and a hero image background — the scanner sees the CSS color value, not the actual rendered pixels behind the text. WebAIM's annual Million-page audit consistently finds critical WCAG failures on the majority of homepages that automated scanners pass clean.
A scanner report does not, on its own, satisfy the DOJ Title II Final Rule. Plaintiffs' counsel routinely demonstrate clean-scan sites with failing user flows. The defensible posture requires the automated layer plus the manual layer.
Shortcut #2: Install an overlay widget.
Overlay tools — accessiBe, UserWay, AudioEye, EqualWeb, AllyAble — inject a JavaScript layer that claims to "fix" accessibility automatically. They add a floating button users can click for "accessibility options." They restyle elements at runtime. They sometimes inject ARIA attributes.
They have not worked, and the legal record now reflects it. The Federal Trade Commission fined accessiBe approximately $1 million in April 2025 for deceptive WCAG conformance claims. More than 800 sites running overlay widgets were sued under the ADA in 2024 alone. Disability advocates and screen-reader users have repeatedly demonstrated, on stage at conferences, that overlay-installed sites still fail at every interaction layer the underlying site fails at — because the overlay does not modify the underlying HTML, ARIA, or content.
For public-sector counsel, this matters as a procurement issue. An overlay vendor was, until very recently, on most public-sector pre-approved-vendor lists. Many are being removed quietly as procurement officers read the case law. If you have an overlay installed today, your accessibility statement committing the agency to WCAG 2.1 AA is now in tension with your actual conformance posture, because the overlay isn't producing conformance. That tension is the kind of thing investigators highlight.
What a real compliance program looks like
The defensible posture has three layers running together:
- Automated baseline. Run
axe-core(or the equivalent from Deque, TPGi, Level Access) against every page in scope on a weekly cadence. This is necessary but not sufficient. It catches the majority of mechanically-decidable issues at high confidence. - Manual interaction testing. A human accessibility tester — or a software harness that drives a real browser like a keyboard user — walks every interactive flow on every page in scope. Tab order, focus traps, ARIA state, dynamic announcements, error recovery. This is where the issues that produce lawsuits live.
- Rendered-pixel sampling. The actual rendered pixels under text, sampled against the actual background that ships in production (including images, gradients, and JS-rendered backgrounds). Scanners that read computed CSS color values miss text-on-image contrast failures entirely.
On top of these three layers: a human reviewer triages every machine-flagged finding before it goes into your remediation queue. False positives are dropped. Severity is recalibrated against actual user impact. Each finding maps to a WCAG success criterion (e.g., 1.4.3 Contrast Minimum, 2.4.4 Link Purpose) with a recommended fix. Your developers get a prioritized backlog they can ship against, not a 400-row CSV they have to interpret.
The 6-month roadmap (start now to land April 2027)
If your agency hasn't started, you have time, but barely. Procurement timelines for state and local government are slow — even a $25,000 audit engagement procured under most cooperative contracts takes 60 to 120 days from RFI to first invoice, and a formal RFP for a six-figure remediation engagement takes 9 to 18 months. The math is unforgiving. Here's the cadence that actually lands April 2027:
Month 1: Baseline + procurement path
- Run a free or low-cost preliminary audit on your top 25 public-facing pages to establish where you stand. Goal: a one-page severity summary your CIO and outside counsel can read in 10 minutes.
- Identify the procurement path for a real audit engagement. For most municipalities, a fixed-fee scoped audit at $25,000 or below sits inside the small-purchase or P-card threshold and can be procured by department director with 2–3 informal quotes — no formal solicitation. A larger remediation contract will need NASPO ValuePoint, GSA cooperative purchasing, or a state cooperative.
- Identify your single point of accountability. Title II §35.107 requires every public entity with 50+ employees to have a designated ADA Coordinator with publicly posted contact info. If your agency hasn't done this, do it now — its absence is itself a finding.
Month 2: Audit kicks off
- Engage an audit vendor that runs the three-layer process (automated, interaction trace, rendered pixel) plus human review. The output you need: a signed PDF audit report, a CSV remediation queue, a drafted Accessibility Statement that names the standard correctly (WCAG 2.1 AA — not "WCAG2"), and a drafted VPAT.
- Scope: single-domain audit covering public-facing pages, with the option to extend to login-gated areas and sub-domains separately.
Month 3: First remediation sprint + accessibility statement live
- Receive the audit report. Top 30 findings prioritized by severity × user impact go into your team's sprint backlog.
- Replace your current Accessibility Statement with the audited version. The new statement names WCAG 2.1 AA explicitly, names the ADA Coordinator, describes the alternative-format request workflow, and describes the grievance procedure.
- If the audit found template-level defects (missing
langon the document, no skip-link, navigation lacking landmarks), these get fixed first because one fix propagates across hundreds of pages.
Months 4–5: Burn-down + monitoring
- Weekly automated scans against the previously-audited pages. Regressions get flagged immediately.
- Monthly diff report: what was remediated this month, what remains, what's been added or changed since the last full audit.
- Counsel reviews the audit report. The standing position becomes "we have an active remediation program, here's the cadence, here's the deadline-aligned roadmap."
Month 6: Second-pass audit + counsel sign-off
- Re-audit. Confirm remediated issues stay remediated. Reissue the signed PDF.
- By this point your agency has the artifacts a DOJ investigation expects to see: a current audit dated within the last 6 months, an active remediation queue with completion timestamps, a public Accessibility Statement that names the correct standard and the correct coordinator, a public grievance procedure, and a current VPAT for any procured systems.
If your remediation team has ongoing capacity, this becomes a continuous program. If they don't, the audit + remediation roadmap is the artifact you hand to whichever vendor next refreshes your site, and the cadence becomes annual.
Procurement: how to get this through your purchasing process
The single most common reason public-sector agencies miss federal compliance deadlines is procurement friction, not budget or technical capacity. A scoped, fixed-fee audit engagement at $9,500 to $15,000 sits inside the small-purchase or P-card threshold at most state and local governments. We've verified this against published procurement codes for the City of Tallahassee, Leon County, and the Florida State University System — at all three, a $9,500 engagement is procurable by department director with 2–3 informal written quotes, not by formal RFP.
For larger remediation contracts, the cooperative-purchasing path is usually the fastest:
- NASPO ValuePoint Cloud Solutions — usable by 50 states; vendors are already pre-competed on price and terms.
- GSA Multiple Award Schedule (MAS) — federal procurement vehicle that many state and local jurisdictions can piggyback on through cooperative purchasing.
- State-specific cooperatives — Sourcewell (formerly NJPA), TIPS, OMNIA Partners. Florida agencies can also piggyback on State Term Contracts via the Department of Management Services.
Skipping straight to a formal RFP for first-time vendors is the slowest path; reserve it for engagements above $250,000.
If you want help
Parallax runs the three-layer audit process described above and delivers the artifacts your team needs to defend a Title II investigation. The audit is fixed-fee at $9,500 (single domain, up to 500 pages, signed PDF report + CSV remediation queue + drafted Accessibility Statement + drafted VPAT + 90-day prioritized roadmap). Continuous monitoring is $499/month or $4,990/year. Both tiers are sized to fit under typical state and local government P-card single-purchase ceilings, so they can be procured directly without formal solicitation.
Request a free preliminary audit → See pricing
The free preliminary audit covers up to 25 representative pages, returns a PDF within 24 business hours, and includes a fixed-fee proposal for the full engagement if you want it. No commitment, no card.