• The testing record — what to hand over when someone asks “how was this tested?”
  • Why the record exists at all
  • The seven sections
  • The sentence to get right
  • How it fits with a VPAT
  • If you are the buyer

Free template, no attribution needed.

§The testing record — what to hand over when someone asks “how was this tested?”

Written for anyone who has been asked to prove their site is accessible and does not know what to hand over.

Not an accessibility expert? The short version. If a client or a procurement form wants a VPAT and you cannot produce one, do not send a scanner’s output and do not claim conformance. Write the testing record instead: what you checked, with what, when, what you did not check, and how to reproduce it. An honest gap survives. A false “Supports” does not.

§Why the record exists at all

US federal buyers usually require an Accessibility Conformance Report built on ITI’s VPAT 2.x, and buyers are told to ask how it was tested. VPAT 2.x has a field for exactly that, “Evaluation Methods Used”. EU rules under the European Accessibility Act ask for a statement of how the requirements are met rather than a list of defects. Enforcement is no longer theoretical: the Dutch ACM found a majority of large sites it checked non-compliant in March 2026, a French court ordered a retailer to fix its site and app in six months or pay a daily penalty, and the Czech authority has issued fines tied to the information in terms and conditions.

An automated scan cannot fill a VPAT’s Supports / Partially Supports cells, because those cover manual criteria. So the honest division of labour is: a human produces the ACR; the testing record is the evidence behind it.

§The seven sections

1. Identification. Product, exact URLs, whether it was production, date and time zone, who or what tested.
2. Method. Standard (WCAG 2.1 AA, 2.2 AA), exact engine and version, browser and version, viewport and states tested, manual-equivalent checks and how they were done, and what you could not do (for example no screen reader session).
3. Coverage, criterion by criterion, marked automated / manual not performed / not applicable. Never leave a criterion blank. A blank reads as “passed”.
4. Findings. For each: the rule, the success criterion, a stable selector, the HTML, a screenshot, severity as reported, the fix, and whether it was confirmed manually.
5. What was NOT tested. Screen reader output, keyboard traps beyond a sampled tab order, reading order, whether alt text is meaningful rather than present, cognitive load, error recovery, anything behind a login, any page not listed in section 1.
6. Reproduction. The command or procedure that regenerates these numbers, plus raw JSON.
7. Statement. One paragraph: measurements at a time and place; not a certification, not a conformance assessment, not a legal opinion; must not be presented as an ACR.

§The sentence to get right

“Automated testing covers a portion of issue volume, not a portion of criteria.” Deque’s own published figure is 57% of issue volume across 13,000 pages. Do not convert one into the other, and do not put a percentage in a report that implies conformance.

§How it fits with a VPAT

The record feeds the ACR; it does not replace it. The vendor makes the claim, even when a consultant writes it. Keep the record dated and versioned. If the vendor cannot say which tool, which version, which date and which criteria were not evaluated, they have not tested — they have asserted.

§If you are the buyer

Ask for the record alongside the ACR. The ACR says what the vendor believes; the record says what was actually done.

I run automated WCAG 2.1/2.2 A and AA checks and write up the measured half, with the not-tested section above always included. Sample report in my notes. But the template stands on its own: copy it, use it, no credit needed.