Do You Need ADA/WCAG Certification, or Just an Audit?

If you've gotten a demand letter, a warning from legal, or just a nagging feeling that your site isn't accessible, you've probably searched for "ADA certification" or "WCAG certification." Be careful who you pay for that — there's no such thing, and anyone who says they can sell it to you is selling something that doesn't exist.

Here's what's actually true, and what to do instead.

---

The short answer: no one certifies ADA compliance

The Americans with Disabilities Act doesn't define a technical standard, and there is no single governing body — government or private — that issues an "ADA certified" seal for websites. The DOJ has repeatedly pointed to the Web Content Accessibility Guidelines (WCAG), currently version 2.1 or 2.2 at the AA level, as the practical benchmark courts and settlements reference. But WCAG itself isn't a certification program either — it's a set of testable success criteria published by the W3C.

So when someone says "we'll certify your site as ADA compliant," what they usually mean is one of two things:

1. They'll run an automated scanner and hand you a report (surface-level, misses most real issues)
2. They're a legitimate accessibility firm doing real audit and attestation work, but using "certification" loosely as marketing language

Neither one is a legal shield on its own. Compliance is a moving target maintained through ongoing testing and fixes, not a one-time stamp.

---

What "compliant" actually requires

Courts and settlement agreements generally reference WCAG 2.1 AA as the working standard. That covers things like:

• Keyboard navigation — every interactive element reachable and operable without a mouse
• Screen reader compatibility — proper semantic HTML, ARIA labels where needed, meaningful alt text
• Color contrast — text meets minimum contrast ratios against its background (4.5:1 for normal text, 3:1 for large text)
• Form labeling — every input has a programmatically associated label, errors are announced
• Focus indicators — visible focus states so keyboard users can track where they are
• Captions and transcripts — for video and audio content
• No keyboard traps, no flashing content, logical heading structure

Meeting these criteria is what "compliant" means in practice. There's no certificate — there's a site that actually passes the tests.

---

What an audit actually covers

A real accessibility audit isn't just running your homepage through an automated scanner (though that's part of it). It combines:

1. Automated scanning — tools like WAVE and axe catch the mechanical issues: missing alt text, contrast failures, missing form labels, invalid ARIA usage. Fast, but catches maybe 30–40% of real issues.
2. Manual keyboard testing — tabbing through every page and flow without a mouse, checking that focus order makes sense and nothing is unreachable.
3. Screen reader testing — running critical flows (checkout, forms, navigation) with VoiceOver or NVDA to catch what automated tools can't: confusing announcements, missing context, broken reading order.
4. Manual review of dynamic content — modals, dropdowns, carousels, and JS-driven interactions are where most real accessibility bugs live, and automated tools mostly miss them.

The output should be a prioritized list: what's broken, how severe it is, and what it takes to fix — not just a score.

---

What remediation looks like

Once you know what's broken, remediation is the actual engineering work: fixing markup, adding labels, correcting contrast, rebuilding keyboard traps, captioning video. On a real case we handled — BlackFin Rods, a Shopify store carrying real ADA demand-letter risk — the WAVE/WebAIM accessibility score went from as low as 4.0/10 on some pages to up to 9.5/10 on remediated pages after a full audit and fix pass, with a formal compliance decision memo delivered alongside the technical work.

That combination — audit, fix, documentation — is what actually reduces legal exposure. Not a certificate.

---

When you do need third-party attestation

There are cases where a settlement agreement, a government contract, or an industry requirement calls for formal third-party sign-off — a named accessibility consultant or firm attesting that a site meets a defined standard. That's real and legitimate, but it's a separate step from the audit and remediation work, and it comes from a specific accredited firm, not from your web developer.

Here's the part most people don't expect: when that attestation firm reviews your site, they typically come back with a list of technical gaps to close before they'll sign off — the exact same category of work as an audit and remediation engagement. We work directly with those firms, closing the technical gaps they flag so the certification process moves fast instead of bouncing back and forth for months.

---

Red flags to watch for

• Anyone offering an "ADA certificate" or "WCAG certificate" with no named accrediting body behind it
• A report that's only an automated scan with no manual testing
• A one-time fix with no plan for maintaining compliance as the site changes
• Pressure tactics ("you'll be sued if you don't buy this today") without a specific, documented list of what's actually broken

---

When to hire help

If you've received a demand letter, want to get ahead of one, or just know your site has gaps, start with a real audit: automated scan plus manual keyboard and screen reader testing, prioritized by severity. From there, remediation is scoped engineering work, and if formal attestation is required, we can work alongside whichever firm your situation calls for to close the technical gaps directly.