ADA/WCAG Document Accessibility Audits

Overview

The Department of Justice has set new ADA Title II compliance deadlines for state and local government web content and documents: April 26, 2027 for entities with a population of 50,000 or more, and April 26, 2028 for smaller entities and special district governments. See Extension of Compliance Dates for Nondiscrimination on the Basis of Disability in the Federal Register. On May 21, 2026, the National Federation of the Blind sued in federal court asking that the extension be held unlawful and set aside; see National Federation of the Blind challenges the Title II deadline extensions from Seyfarth Shaw.

Fixed price: $4,950 for one website, up to 5,000 documents; $9,950 for up to 3 websites, up to 20,000 documents. Larger scopes are quoted.

Request an Audit See Pricing

As a cybersecurity firm, we approach digital accessibility the same way we approach any other organizational risk: not as a one-time content fix, but as a gap in your risk management program that carries real legal liability if it goes unaddressed. The same independent, evidence-based methodology we use to assess application security, verify a claim, document the gap, and provide attestation your stakeholders can rely on, applies directly to document accessibility compliance.

Rietta reviews government document corpora, PDFs, Word files, and Excel spreadsheets, for the metadata-based accessibility deficiencies that remediation vendors most often miss. This is not a remediation service; we are not in the business of rewriting your documents. What we provide is independent, documented evidence of whether an active compliance program is actually working, which should self-evidently carry more weight than a vendor’s own self-attestation of that same work.

What We Look For

Most accessibility discussion focuses on image alt text, which matters, but our reviews are built around the metadata-based deficiencies we see most often in government document corpora:

• Blank or empty document titles. WCAG 2.4.2 Page Titled requires a descriptive title, and for PDFs specifically the PDF18 technique defines setting that title in the document properties as sufficient. Screen reader users rely on it to know what they’ve opened.
• Missing or untrustworthy date information, which matters directly for whether a document can legitimately claim one of the law’s archival exemptions (see below).
• Undefined document language, which breaks screen reader pronunciation and navigation.

We also look at findings the rest of the industry tends to under-discuss, like a vendor stamping every document with the same generic title, which is corpus-wide non-compliance even when it passes a document-by-document check. Tracing defects like that back to the shared template or workflow that produced them is a question of document provenance.

Archival Exemptions, Done Correctly

The DOJ rule has two separate exceptions, often informally called exemptions, that can take older documents out of scope, and we identify candidates for both:

• The archived web content exception, in 28 CFR § 35.201(a), covers content created before the compliance date, or reproducing a paper original that was, which meets all four criteria defined in § 35.104. One of those criteria concerns the website, not the document: the content must be stored in an area clearly identified as archived.
• The preexisting conventional electronic documents exception, in 28 CFR § 35.201(b), covers PDF, word processor, presentation, and spreadsheet files already posted before the compliance date, with no archive requirements, but not if they are still used to apply for, access, or participate in a service. A decades-old form people still fill out does not qualify.

Both turn on dates, and a document’s own metadata date is often unreliable, for example, a court order issued decades ago but only digitized recently. Metadata Minder’s TrueDate™ analysis finds the best supported date for each document from its text, its visual content, and its metadata together, rather than trusting the metadata date alone. TrueContext™ then examines the website pages that link to each document for the evidence the archived content exception requires, clear archive messaging and an area identified as archived. Together they score each candidate for exception qualification, and our findings document the evidence behind every score. Whether a document actually qualifies is a legal determination for your counsel, which is one reason we wrote about when to involve legal counsel in an ADA/WCAG audit. Getting this right can mean not remediating documents that already qualify, rather than paying for changes that were never legally required.

A document qualifying for an exception does not take it out of our document provenance analysis. Neither exception covers anything created or posted after the compliance date, so if the same template, tool, or workflow that produced an excepted document’s defects is still in use, every new document it produces is non-compliant from the day it is published. Excepted files are often the best evidence of where those defects come from, which makes fixing the source critically important to our clients, even when the excepted files themselves never need to be touched.

Continuous, Not One-Time

A single point-in-time scan only solves half the problem. Agencies keep publishing new documents after the compliance deadline passes, and each one is a fresh opportunity to fall out of compliance. Metadata Minder can continuously validate newly published documents as they appear, the same way continuous integration validates new code before it reaches production, so compliance is a standing practice rather than a project you finish once.

Where We Work

ADA Title II applies to state and local governments in every state, the District of Columbia, and the U.S. territories, all of which fall under the regulation’s definition of a State in 28 CFR § 35.104 Definitions. Rietta is headquartered in Alpharetta, Georgia, in Metro Atlanta, and our home region is the Southeast, including Georgia, Florida, Alabama, Tennessee, South Carolina, and North Carolina. We take on engagements nationwide, and most are handled remotely. On-site visits are available when the engagement calls for one. Reports are delivered both electronically and as printed, bound copies shipped overnight on request.

Independent Attestation

Frank Rietta, a life member of OWASP, can provide signed attestation or bridge letters documenting your organization’s compliance posture, the same independent-evidence approach we use for our OWASP ASVS, MASVS, and SAMM assessments. An attestation letter is an optional add-on to the audit, billed hourly and estimated with you on the onboarding call; see document accessibility audit pricing and add-ons.

Pricing

Single-Site and Multi-Site audits are two-week engagements covering scan, findings, and reporting, and timelines for larger scopes are set on the onboarding call.

The per-document figures below assume a corpus at the tier’s document limit. The audit is priced per engagement, so a smaller corpus costs more per document.

• Single-Site Document Audit

  $4,950

  $4,700 when paid by card, due on receipt

  $0.99 per document at the 5,000-document limit

  One website, up to 5,000 documents.

  Executive Brief, WCAG findings summary, and a findings CSV for your remediation team or vendor.

• Multi-Site Document Audit

  $9,950

  $9,450 when paid by card, due on receipt

  $0.50 per document at the 20,000-document limit

  Up to 3 websites, up to 20,000 documents.

  Full four-report bundle.

• Larger scope, custom quote

  Custom quote

  More than 3 websites or more than 20,000 documents.

  We scope and price it with you on the onboarding call. Many agencies start with a Single-Site or Multi-Site audit as a first engagement.

Requesting an audit asks for an onboarding call and is not an order or a binding agreement. No fee is invoiced until after that call, once we have confirmed your agency, scope, and tier together, and nothing is owed unless your agency signs the Master Services Agreement and Statement of Work that follow.

Request an Audit

Related Audits

This audit covers the documents your agency publishes. If your agency also runs a custom web application, such as a permit or records portal, our fixed-price authentication and access control audit reviews how that application signs users in and controls what each user can reach. For everything we audit, see security and accessibility audits.

Learn More

We’ve written more about this work on our blog:

• The Real ADA Title II Deadline for Government Documents
• Real ADA Title II Findings for Government Documents
• The Five Pillars of Information Security (And Why We Audit Accessibility)
• Threat Modeling for ADA/WCAG Compliance
• Document Provenance: Finding the Common Ancestor of Inaccessible Documents
• When to Involve Legal Counsel in an ADA/WCAG Audit
• Metadata in WordPerfect: ADA and WCAG 2.1 Compliance

For every post on the subject, see all of our accessibility articles. For plain definitions of the terms used on this page, see the Rietta Glossary. You can also learn more directly on our dedicated Metadata Minder website.