Web Accessibility for Product Teams Shipping UI

Web accessibility means websites, tools, and technologies let people with disabilities perceive, understand, navigate, interact with, and contribute to the Web, per W3C WAI. Tim Berners-Lee called that universality essential. This guide is for PMs, designers, and engineers shipping UI.

95.9% of homepages still fail automated WCAG checks in WebAIM's February 2026 Million. Website accessibility is the same job under a search alias: the interface you ship, including third-party widgets, PDFs, and mobile apps.

Digital accessibility is the broader synonym. Practitioners shorten it to a11y (11 letters between a and y).

Key Takeaways

• W3C WAI defines the work as perceivable, operable, understandable, and robust UI (POUR). See W3C policies: W3C does not make regulations.
• US ADA Title II, US ADA Title III, the EU European Accessibility Act, and Section 508 are four different regimes. There is no single "ADA deadline" for a private SaaS.
• WebAIM's February 2026 Million found detectable WCAG 2 failures on 95.9% of 1,000,000 homepages. Six error types account for 96% of those detected errors.
• Overlay widgets are a liability. The FTC's final $1 million order against accessiBe (22 Apr 2025) bars claiming an automated product makes a site WCAG-compliant without evidence.
• Start with a pinned standard, an inventory, the six WebAIM errors, and a RACI that names the PM as Accountable. Do not start with a script tag.

What Is Web Accessibility?

W3C WAI is the definitional source: people with auditory, cognitive, neurological, physical, speech, or visual disabilities can use the Web, and can contribute to it. The same page notes the work also helps people without a permanent disability (a small screen, ageing vision, a broken arm, sunlight on a laptop, a noisy room, slow bandwidth).

MDN offers a one-line alias: enabling as many people as possible. W3C is the definition.

Inclusive design widens who a product serves. WCAG conformance is a testable bar. You can practice one without proving the other.

The current W3C Recommendation is WCAG 2.2 (12 Dec 2024; first Rec 5 Oct 2023). Content that conforms to 2.2 also conforms to 2.0 and 2.1. WCAG 2.2 is also ISO/IEC 40500:2025.

WCAG 3 is a Working Draft as of March 2026. There is no "2026 WCAG." US Title II pins WCAG 2.1 Level AA. For US product teams, 2.1 AA is the floor and 2.2 is the better target.

Why It Matters in 2026

W3C's business case counts at least one billion people (15% of world population) with a recognized disability, and more than $6 trillion in spending power. The same business-case page puts the extended market at 2.3 billion people controlling $6.9 trillion in incremental disposable income.

Section508.gov (reviewed July 2026) cites a UK study via digital.gov: 71% of web users with a disability will leave an inaccessible site. WebAIM and that same 508 page cite CDC: 1 in 4 US adults lives with a disability.

Ageing raises incidence. W3C notes that direct ROI is hard to measure and a useful case prices inaction.

W3C splits the case into four legs: drive innovation (captions, voice control, curb-cut features that later served everyone), enhance brand, extend market, and minimize legal risk. Barclays, via Paul Smyth, framed the work as reducing legal risk, strengthening brand, and improving customer experience and colleague productivity. Microsoft appears on the same page after public criticism.

WebAIM Million (WAVE on 1,000,000 homepages, February 2026) found detectable WCAG 2 failures on 95.9% of pages, up from 94.8% in 2025. That reversed six years of small improvement.

Full A/AA conformance is "certainly lower than 4.1%." Pages averaged 56.1 detectable errors (up 10.1% from 51).

Six error types have accounted for 96% of detected errors for seven years running. 95.9% is pages that fail; 96% is the share of detected errors in six types.

On r/accessibility, the recurring observation is that the public homepage is rarely the worst surface. LMS tools, HR portals, and untagged PDFs sit behind it. On r/webdev, finance often funds the work only after a federal deadline hits a customer.

A design system is where contrast tokens, focus rings, and labeled inputs either get cheap or stay expensive. If those tokens are wrong, every screen inherits the debt.

How POUR Works: A Product Framework

POUR is the mental model a product team can hold without memorizing success criteria. WebAIM's POUR article maps the same four letters onto everyday UI.

W3C's stack is wider than WCAG: UAAG covers browsers, ATAG covers authoring tools, and WAI-ARIA covers dynamic widgets. Product teams own WCAG-shaped UI, not the user's browser.

Perceivable

If the only way to read a status is a red border, a color-blind user misses it. Pair color with text: "Error: email is required," not a crimson outline alone.

W3C designing tips start here: sufficient contrast, do not use color alone, and put image and media alternatives into the design, not into a post-hoc ticket.

ADA.gov web guidance names the same failures: poor contrast, missing alt, no captions. Low-contrast text showed up on 83.9% of Million homepages, averaging 34 instances per page. Missing alt hit 53.1%.

Operable

Keyboard-only use is the cheapest manual test you can run in a review. Tab through the screen.

If focus vanishes in a modal, or a custom dropdown traps the user, the control is not operable. Return focus to the trigger when the modal closes. Visible focus, enough time, and no flashing that can trigger seizures sit in the same bucket.

Apple's Human Interface Guidelines already treat focus, hit targets, and VoiceOver labels as platform requirements. Copy that bar into web components instead of treating access as a web-only tax.

Understandable

Labels on form fields, identifiable feedback, consistent navigation, and headings that match the visual hierarchy. A search input with only placeholder text fails the moment the field is filled.

Self-serve SaaS onboarding fails this principle when a demo, a trial form, or a learning path explains itself only with placeholder text.

AskEARN starts with semantic structure for screen readers, alt text, and keyboard access. Empty links (46.3% of Million pages) and empty buttons (30.6%) are the automated version of "the control does not say what it does."

Robust

Name, role, and value on custom controls. Valid markup. ARIA is a patch for gaps in native HTML, not a layer you sprinkle for a higher Lighthouse score.

82.7% of Million pages used ARIA (excluding landmarks). Pages with ARIA averaged 59.1 detectable errors; pages without averaged 42.

More ARIA correlated with more noise, not less. A native <button> beats a div you then describe.

The Legal Map for Product Teams

Two questions dominate: whether WCAG is legally required, and how it differs from the ADA. Overlay vendors flatten both into one deadline and one widget.

The live map is four columns, not a liability opinion. Involve counsel for facts about a specific product.

ADA Title II: Public Entities Have a Rule

DOJ published the final rule on 24 Apr 2024 (89 FR 31320), adding subpart H to 28 CFR part 35. The technical standard is WCAG 2.1 Level AA for web content and mobile apps that a state or local government provides, including through contractors.

ADA.gov is blunt: "Although WCAG includes the word 'guidelines,' complying with WCAG 2.1 Level AA is required under the rule." That sentence is Title II. It is not a private-sector mandate.

An interim final rule dated 20 Apr 2026 (91 FR 20902) moved both dates out one year. The ADA.gov fact sheet and that IFR carry the current dates. The first-steps page is still written against the original April 2026 / April 2027 calendar.

Original dates were 24 Apr 2026 and 24 Apr 2027. That calendar was Title II, and it has already been extended. It was never a private-SaaS due date.

If you sell to government, procurement will still cite 2.1 AA. DOJ chose 2.1, not 2.2, and not "whatever WCAG is current."

Five exceptions exist on ADA.gov. Archived web content must meet all four definitional points; dumping files into /archive is not enough. The others cover unused preexisting documents, unaffiliated third-party content, individualized password-protected files, and preexisting social media posts.

Excepted content can still owe effective communication and reasonable modifications under the rest of Title II. Hiring a vendor does not move those duties.

The May 2026 HHS Section 504 action for recipients of HHS financial assistance is a different statute and a different agency.

ADA Title III: Private Sites Face Lawsuits Without a Web Rule

ADA.gov web guidance (18 Mar 2022) still carries a banner: the page does not reflect the 24 Apr 2024 Title II rule. Title III covers businesses open to the public.

DOJ says inaccessible web content denies equal access, and that ADA requirements apply to goods and services offered on the web. Then the department is explicit: it "does not have a regulation setting out detailed standards."

Businesses can currently choose how they ensure online access. The longstanding interpretation of nondiscrimination and effective communication still applies.

The ABA recap (August 2025) traces a 1996 DOJ advisory and a matching Title III regulation that never issued. Courts filled the gap, not the same way.

Holland & Knight documented the vacatur (Gil v. Winn-Dixie Stores, Inc., 2021 WL 6129128; docket 17-13467). The "websites are never public accommodations" holding is not live Eleventh Circuit law.

W3C's business-case page still narrates the older district-court outcome as history.

Filing volume is counsel data, not a statute. Seyfarth (Vu and Launey, 25 Mar 2026) counted 3,117 federal website-accessibility cases in 2025. That is up 27% from 2,452, and 36% of all Title III.

Those website cases clustered in New York (1,021), Florida (961), and Illinois (585). California federal courts had four.

All Title III federal filings were 8,667 (−2% vs 8,800 in 2024; peak 11,452 in 2021). On that broader count, California (3,252), Florida (1,823), and New York (1,471) still lead. New York's federal drop on the all-Title-III series reflects tighter standing and some migration to state court.

Private product teams sit in a high-volume demand-letter environment, not a Title II calendar. 2025 website filings concentrated in NY, FL, and IL; California's Title III volume is mostly not website cases. WCAG 2.1 AA is the measuring stick many courts already use.

DOJ has not adopted WCAG as the Title III standard. A February 2026 Statement of Interest in Alcazar versus Fashion Nova opposed a proposed class settlement.

Seyfarth reports a footnote: the United States does not endorse WCAG as the appropriate or necessary Title III standard for auxiliary aids.

On r/webdev, the recurring confusion is treating a demand letter or overlay upsell as a government scanner that "flagged" the site. There is no ADA website flag system.

The European Accessibility Act Is Already in Force

Directive (EU) 2019/882 (17 Apr 2019, OJ L 151, 7.6.2019) is the European Accessibility Act. Article 31: Member States transpose by 28 June 2022 and apply from 28 June 2025.

The Commission lists computers and OS, ATMs and ticketing, smartphones, digital-TV equipment, telephony, and AV-media access. Passenger-transport digital surfaces, banking, e-books, and e-commerce sit on the same list.

Services provided to consumers after 28 June 2025 are in force, including existing services. New products placed on the market share that date. Article 32's transition to 28 June 2030 covers products used to provide those services, plus limited contract and terminal rules, not extra calendar for an EU storefront.

Exemptions include microenterprises providing services (≤€2 million turnover and under 10 employees on the EUR-Lex summary). Other carve-outs cover some pre-recorded media and office files published before 28 June 2025, archive sites not edited after that date, and fundamental alteration or disproportionate burden.

Confirm the microenterprise threshold on EUR-Lex before relying on it. EN 301 549 is the usual technical benchmark in national transpositions. Published ETSI text is EN 301 549 V3.2.1 (2021-03); later drafts are not a substitute for the Official Journal.

Website requirements are expected to sit close to WCAG 2.2. WCAG conformance is necessary and not always sufficient for listed EU services.

US product teams with EU customers, localized storefronts, or EU app-store listings can be in scope for e-commerce even when HQ is in the US. Enforcement is national.

Section 508 If You Sell to Government

Section508.gov is GSA technical assistance so federal agencies buy and build accessible ICT under Section 508 of the Rehabilitation Act. The Access Board ICT refresh is dated 18 Jan 2017. It is not ADA Title III.

Reuse the RACI as a shipping model. A private product team is not "Section 508 covered" unless it sells to the US government.

Overlay Widgets Are a Liability

Overlay vendors still leak into head search results. Refuse the category. The vendors are not experts.

The FTC's proposed order landed 3 Jan 2025. The final order is dated 22 Apr 2025: accessiBe Inc. / Ltd. to pay $1 million.

The company claimed accessWidget could make any website WCAG-compliant. The FTC alleged those claims were false, misleading, or unsubstantiated, and that paid "independent" reviews were undisclosed.

The order bars claiming automated products make any website WCAG-compliant, or keep it compliant over time, without evidence. Samuel Levine, FTC Bureau of Consumer Protection Director, called overstating AI capabilities without evidence deceptive. The January release is the quote source.

Lainey Feingold documented BloomsyBox: the shop bought UserWay in July 2023 and was still sued that December by a blind person who could not use the site. BloomsyBox then sued UserWay for misrepresentation. A magistrate recommended key claims proceed (February 2026 update).

ACM ASSETS '24 (Makati, Tigwell, Shinohara) found overlays often fail, increase challenges, and conflict with assistive technologies. Some blind and low-vision users, seeing an overlay, assume the underlying site is inaccessible.

That paper is user research, not a legal map. Its related-work section mis-summarizes the 24 Apr 2024 DOJ rule as applying beyond government.

The ABA line is short: widgets and overlays are a "quick fix" and are not recommended. Installing one to "turn on accessibility" confuses a Chrome or Android user setting with building the product.

Where to Start This Sprint

Checklists already exist at WebAIM and the A11Y Project. Ranking pages skip who is Accountable this sprint.

Pin a Standard and Inventory What You Ship

US public-sector and procurement work: WCAG 2.1 AA. EU e-commerce: EAA / EN 301 549, close to WCAG 2.2. US product UI: 2.1 AA as the floor, 2.2 as the better target.

Inventory the surfaces: web, app, PDFs, third-party widgets, social embeds, the checkout you do not own. ADA.gov is clear that contracting a vendor does not move the duty.

Documents and apps belong in the inventory if you ship them, not in a later phase.

Fix the Six Errors First

WebAIM Million has named the same six types for seven years. They are 96% of detected errors, not 96% of pages.

A PM can demand these in one sprint: contrast tokens in the design system, alt in the design file, labels on every input, no icon-only links or buttons without an accessible name, lang on html. Related UI design statistics collect the same WebAIM numbers in a broader set.

Assign Owners, Then Test With Users

Section508.gov's RACI puts the PM Accountable for goals and scope, with a business analyst Responsible. UX, engineering, and QA are consulted or informed; a 508 SME is consulted. The content author is Responsible and Accountable for content.

The agile matrix puts accessibility acceptance criteria in user stories and in the definition of done. UAT includes keyboard-only, screen reader, and contrast. "The designer will get to it" is not a RACI.

Involve users with disabilities. W3C's point is cost: involvement is cheaper than retrofit.

Order of operations used by practitioners is plan, automated checks, manual checks, then users, plus a fix and retest loop. Disabled testers are not QA0 for an untested build.

Automated checkers catch a subset; ADA.gov already says that. WAVE and axe are methods, then stop.

Skip the Widget and Keep a Feedback Path

Skip the overlay. Publish an accessibility statement and a real feedback path (an EAA service obligation, and good practice everywhere).

W3C's maturity model (Group Draft Note, 28 Aug 2025) is optional framing that this is a program, not a ticket. IAAP (accessibilityassociation.org) is how some teams professionalize (CPACC, WAS). Neither is law.

Common Mistakes to Avoid

Treating the Title II Calendar as a Private SaaS Deadline

The 26 Apr 2027 / 26 Apr 2028 dates are Title II. Private ecommerce sits under Title III (no DOJ web rule) and, if you sell into the EU, under the EAA (already in force). Mixing the three is how teams either panic or stall.

Installing an Overlay to "Pass ADA"

The FTC order is the primary source. A script tag does not repair HTML, forms, or keyboard access. Some users treat the icon as a warning that the site underneath is broken.

Calling Lighthouse 100 an ADA Certification

There is no ADA certification. On r/webdev, the recurring confusion is treating a Lighthouse 100 as one. Automated tools catch a minority of WCAG, and a Lighthouse score is a method, not a shield.

Reading 2030 as the EAA Website Deadline

Article 32 is a transition for products used to provide covered services. E-commerce as a service applied from 28 June 2025.

Adding ARIA Until the Scanner Quiets Down

Million pages with ARIA had more detectable errors, not fewer. Native controls first. ARIA when HTML cannot express the widget.

NPR Transcripts in Practice

W3C's business case still uses NPR This American Life transcripts as a worked example. Search traffic rose 6.86%, unique visitors rose 4.18%, and 7.23% of visitors viewed at least one transcript.

Captions and transcripts started as access for deaf and hard-of-hearing audiences and then showed up in search and skimming. That is the curb-cut pattern in one dataset, not a promise that every remediation lifts traffic 7%.

W3C also records NFB v. Target (2008) as legal-risk history: class damages of $6 million, plaintiff legal fees over $3 million, and years of court oversight. Current filing stats belong to Seyfarth, not that 2008 case.