Skip to content

Evidence request lists

US Americans with Disabilities Act (ADA) - Title III Digital Accessibility

Evidence request list. 13 controls, 13 carrying auditor artefact guidance. Generated from the compliance knowledge graph on 12 September 2026. Published by The Art of Service.

Auxiliary Aids and Digital Content

28 CFR 36.303(f)
Accessible website and digital content

Digital platforms of public accommodations must be accessible to individuals with disabilities.

Artefacts an auditor will ask for
  • Accessibility statement published on website
  • VPAT (Voluntary Product Accessibility Template) for procured products
  • Auxiliary aids and services request handling procedure
  • Assistive technology test results (screen readers, voice control)
Where this commonly fails
  • Captioning and transcripts missing for media
  • No documented WCAG conformance level for primary digital channels
  • Mobile apps excluded from accessibility programme scope
  • Procurement does not require VPAT or equivalent

Compliance

USADA-2
Compliance Timeframes and Exceptions

Per DOJ ADA Title II Rule: compliance timeframes (24 months for state/local government >50k population) + exceptions including fundamental alteration and undue burden + record-keeping.

Artefacts an auditor will ask for
  • ADA evidence for USADA-2
Where this commonly fails
  • WCAG + compliance timeline partial

DOJ Web Accessibility Guidance (WCAG 2.1 Level AA)

DOJ-Web-1
Web Content Accessibility Guidelines (WCAG) reference

DOJ references WCAG 2.1 Level AA as the standard for digital accessibility compliance.

Artefacts an auditor will ask for
  • VPAT (Voluntary Product Accessibility Template) for procured products
  • Accessibility remediation backlog and tracking
  • WCAG 2.1 AA conformance audit reports
  • Auxiliary aids and services request handling procedure
Where this commonly fails
  • Procurement does not require VPAT or equivalent
  • No documented WCAG conformance level for primary digital channels
  • Mobile apps excluded from accessibility programme scope
  • Captioning and transcripts missing for media
DOJ-Web-2
Perceivable content

Web content must be presentable to users in ways they can perceive, including text alternatives.

Artefacts an auditor will ask for
  • Accessibility statement published on website
  • Auxiliary aids and services request handling procedure
  • VPAT (Voluntary Product Accessibility Template) for procured products
  • Assistive technology test results (screen readers, voice control)
Where this commonly fails
  • Forms and error messages not programmatically accessible
  • Procurement does not require VPAT or equivalent
  • No documented WCAG conformance level for primary digital channels
  • Mobile apps excluded from accessibility programme scope
DOJ-Web-3
Operable interface

User interface components and navigation must be operable by all users including keyboard-only users.

Artefacts an auditor will ask for
  • Assistive technology test results (screen readers, voice control)
  • Auxiliary aids and services request handling procedure
  • Accessibility statement published on website
  • WCAG 2.1 AA conformance audit reports
Where this commonly fails
  • Forms and error messages not programmatically accessible
  • Captioning and transcripts missing for media
  • Mobile apps excluded from accessibility programme scope
  • Procurement does not require VPAT or equivalent
DOJ-Web-4
Understandable information

Information and operation of the user interface must be understandable to all users.

Artefacts an auditor will ask for
  • WCAG 2.1 AA conformance audit reports
  • Assistive technology test results (screen readers, voice control)
  • Accessibility remediation backlog and tracking
  • Accessibility statement published on website
Where this commonly fails
  • Mobile apps excluded from accessibility programme scope
  • Captioning and transcripts missing for media
  • No documented WCAG conformance level for primary digital channels
  • Procurement does not require VPAT or equivalent
DOJ-Web-5
Robust content

Content must be robust enough to be reliably interpreted by assistive technologies.

Artefacts an auditor will ask for
  • Assistive technology test results (screen readers, voice control)
  • Accessibility remediation backlog and tracking
  • Auxiliary aids and services request handling procedure
  • WCAG 2.1 AA conformance audit reports
Where this commonly fails
  • Captioning and transcripts missing for media
  • Procurement does not require VPAT or equivalent
  • No documented WCAG conformance level for primary digital channels
  • Mobile apps excluded from accessibility programme scope

Enforcement

USADA-4
Enforcement and Litigation Risk

Per ADA Title III: private right of action + DOJ enforcement + class actions + serial litigation risk.

Artefacts an auditor will ask for
  • ADA evidence for USADA-4
Where this commonly fails
  • WCAG + compliance timeline partial

Enforcement and Penalties

28 CFR 36.504
Civil penalties

Civil penalties up to 5,000 for first violation and 50,000 for subsequent violations.

Artefacts an auditor will ask for
  • Written biometric consent forms
  • Retention and destruction schedule
  • Biometric data storage security controls
  • Disclosure log and prohibition attestation
  • Litigation and settlement file
Where this commonly fails
  • Written informed consent missing or generic
  • Retention schedule exceeds statutory 3-year ceiling
  • Disclosure to third parties not logged
  • No publicly available biometric data policy
42 USC 12188(a)
Private enforcement

Individuals may bring civil actions for injunctive relief against Title III violations.

Artefacts an auditor will ask for
  • Written biometric consent forms
  • Retention and destruction schedule
  • Biometric data storage security controls
  • Disclosure log and prohibition attestation
  • Litigation and settlement file
Where this commonly fails
  • Written informed consent missing or generic
  • Retention schedule exceeds statutory 3-year ceiling
  • Disclosure to third parties not logged
  • No publicly available biometric data policy
42 USC 12188(b)
DOJ enforcement

Attorney General may bring civil actions and obtain monetary damages for pattern or practice violations.

Artefacts an auditor will ask for
  • Written biometric consent forms
  • Retention and destruction schedule
  • Biometric data storage security controls
  • Disclosure log and prohibition attestation
  • Litigation and settlement file
Where this commonly fails
  • Written informed consent missing or generic
  • Retention schedule exceeds statutory 3-year ceiling
  • Disclosure to third parties not logged
  • No publicly available biometric data policy

Procurement

USADA-3
Procurement, Documentation, Training

Per ADA: accessible procurement + VPAT + documentation + training + maintain accessibility over time.

Artefacts an auditor will ask for
  • ADA evidence for USADA-3
Where this commonly fails
  • WCAG + compliance timeline partial

Title III Communication

USADA-1
Title III Effective Communication and Web Accessibility

Per ADA Title III + DOJ 2024 Final Rule: effective communication including web + mobile accessibility. WCAG 2.1 Level AA conformance for state and local government per Title II + DOJ guidance for Title III.

Artefacts an auditor will ask for
  • ADA evidence for USADA-1
Where this commonly fails
  • WCAG + compliance timeline partial
Assembled from the framework's own control set. Every line traces to a control in the graph, so this pack is regenerated rather than written, and stays current as the graph does.

Assembled from the framework’s own control set, so this list is regenerated rather than written and stays current as the graph does.