Proof of accessibility for PDFs: certificates, reports and audit trails

Sooner or later someone will ask how you know a PDF is accessible. Proof of accessibility is the record you hand over in reply. It names the exact file and version, the standard (WCAG 2.1 Level AA under the ADA Title II and HHS Section 504 rules), how the file was tested, who made the judgment calls, when, and what was not checked. Most offices already hold pieces of it, such as a checker report, a vendor's certificate or an accessibility statement, but each piece proves something different. This guide sorts the kinds of evidence, lists what to keep for each document, and flags the claims that should make you cautious. It covers records, not legal advice, so confirm your approach with counsel.

When you'll be asked for proof of accessibility

The question usually arrives in one of five ways.

• A request or a complaint. A resident who uses a screen reader can't read this month's agenda packet and asks for another format, or files a grievance. Under 28 CFR 35.107, a public entity with 50 or more employees must designate an employee to coordinate its ADA compliance and publish grievance procedures, so your response and its timing become part of the record.
• A federal complaint or investigation. People can file ADA complaints with the Department of Justice's Civil Rights Division, which may refer a complaint to mediation or another federal agency, or investigate it, which "could lead to a settlement or a lawsuit." The HHS Office for Civil Rights enforces Section 504 for programs that receive HHS funding, and Title II for the health and social services programs of public entities.
• Procurement. When you buy a remediation tool or a document platform, you ask the vendor for evidence. When a partner agency or a grantor asks about your documents, you need the same kind of answer.
• Board or council reporting. "We fixed 400 files" is stronger with a record behind each one.
• Internal audit. An auditor samples ten documents and asks to see the evidence for each.

There is one more reason to keep records. The Title II rule treats a shortfall from WCAG as meeting the rule only in the limited case where the entity "can demonstrate" that its impact on access is minimal (28 CFR 35.205). Whether to rely on that is a question for counsel, but it is hard to demonstrate what you never recorded. Our guides to Title II and PDFs and Section 504 and PDFs cover the rules and dates.

What makes accessibility evidence credible

Credible evidence answers six questions. A record that skips one is weaker than it looks.

A fingerprint, also called a hash, is a short code calculated from a file's contents. Microsoft's documentation explains that renaming a file leaves its hash unchanged, but "changing even a single character in the contents of a file changes the hash value of the file." Record the fingerprint, and anyone can later confirm that the PDF on your website is the one that was checked. On Windows, PowerShell's Get-FileHash command calculates a SHA-256 fingerprint by default.

The manual checks deserve the most care, because a checker cannot vouch for them. Record who decided reading order and alt text quality, not only that a tool ran. Our checker comparison explains why a clean automated report is only part of the answer.

Checker reports, VPATs and certificates: what each one proves

This comparison was written by Ockem.

VPATs and Accessibility Conformance Reports

The VPAT is a free template from the Information Technology Industry Council (ITI). Once completed with test results, it is called an Accessibility Conformance Report (ACR). The current version, VPAT 2.5Rev (April 2025), comes in four editions: 508, EU (EN 301 549), WCAG, and INT, which combines all three. Each criterion is marked supports, partially supports, does not support or not applicable, and the form has a field for the evaluation methods used. Section508.gov describes an ACR as explaining how technology products such as software, hardware and electronic content conform to the Revised 508 Standards. Ask vendors for their ACR when you buy, and read the methods field. Don't expect one for each PDF you publish.

WCAG conformance claims

WCAG 2.1 is explicit: "Conformance claims are not required." If you make one, section 5.3 says it must include the date, the guidelines' title, version and web address, the conformance level, a concise description of the pages covered (such as a list of addresses), and the web content technologies relied upon. For a PDF, that means naming the document's address and listing PDF as a technology. WCAG adds that a conformance logo counts as a claim and needs the same components.

Accessibility statements and request logs

W3C's guidance says a statement should at least give your commitment, the standard you apply and how to contact you, and should ideally list known limitations. It also notes that statements "are not technical assessments or declarations of conformity." DOJ's compliance guide suggests telling the public, "in prominent places on your website," how to ask for accessible versions of content that falls under an exception. A log of each request, what you provided and when shows that process working.

What to keep on file for each PDF

A spreadsheet row per document is enough for a small library. Whatever you use, cover these columns.

Red flags in accessibility certificates and reports

• "100% compliant" badges. WCAG treats a conformance logo as a claim that must carry its required components, including the date and what it covers. A badge without them is not evidence.
• Overlay widgets. Overlays are scripts added to a website. The Overlay Fact Sheet notes that they do not repair content in PDF files.
• Machine-only reports that don't say so. A report that lists automated results and is silent on reading order, alt text quality and contrast leaves the hardest questions open.
• No file version. A certificate for "Annual Report 2026" with no version or fingerprint can't be matched to the file on your site.
• Nothing listed as not checked. Every method has limits. A record that admits none is overstating.
• A document edited after it was checked. The evidence now describes a different file.
• Guarantees. Evidence supports your position, but it doesn't settle a legal question. Be wary of anyone who guarantees compliance.

Keep your evidence current

Evidence describes one file at one moment. Each of these produces a new file that needs a new check.

• Editing and re-exporting from Word or InDesign, even to fix a typo.
• Compressing or optimizing the file for the web.
• Adding a cover, a signature page or a stamp.
• Combining files into a packet.
• A vendor or agenda platform re-uploading or re-processing the file.

Compare fingerprints against what is live on a schedule. DOJ's compliance guide suggests that written policies describe how staff will regularly test web content. When you re-inventory your site, our guide to finding every PDF shows how.

What an Ockem Proof certificate records

Ockem Proof, our product, issues a certificate PDF with each certified document, built to answer the six questions above.

• The exact file. A certificate covers one version of one document. Its public verification page shows the SHA-256 fingerprint of the PDF issued, so any copy can be matched.
• Three parts. It states what software verified, what your organization attested, and what is not claimed. If Proof did not test something, the certificate says so: a rule the audit could not evaluate stays pending rather than "not applicable," and a page the audit never read cannot be certified.
• Who attested. Checks that need judgment, such as reading order, are cleared by attestations. The certificate names your organization as the attesting party, and the person too only if your organization chooses. Before attesting, a person accepts an attestation statement, which the certificate cites. An attestation can clear a review item but never overrides a confirmed failure.
• A gate. A document in Needs review or Failed cannot be approved, so nothing is certified while any check, machine or human, is unresolved.
• The standard. It names WCAG 2.1 Level AA as the standard it was scored against, and it can carry your organization's logo.
• A public check. A QR code on the certificate opens a public verification page, so an auditor or a resident can confirm it is genuine without an account.
• An audit trail. Every fix or re-upload creates a new version without overwriting the original, and a status history records who did what and when.
• Current or withdrawn. A new version after approval withdraws the certificate until a fresh check issues a new one, and a re-issued certificate still verifies and points to its replacement. After approval, Proof also lists the published addresses still serving the old copy.

Automatic issuance is off unless your organization turns it on, and a certificate records when it was used. Either way, judgment calls such as confirming reading order or approving AI-drafted alt text are made by a person before anything is certified.

The certificate is evidence, not legal advice, and it says so. The sample verification page (opens an external site), issued October 8, 2026 for a document in the demo library of the City of Alderbrook, a fictional city, states that it "is not a legal determination of compliance with the ADA, Section 508, Section 504 or any other law, and is not a warranty that no accessibility barrier exists." It adds that editing or re-exporting the file voids it. The human-verified checks page explains how attestations reach the certificate.

Next steps

You can try one PDF (opens an external site) of up to 10 pages free, with no account, to see what Proof finds and fixes. The free PDF inventory tool counts the PDFs on your site, which tells you how many records you will need. The WCAG coverage map and its human-verified checks page show which checks software verifies and which a person attests. For the rules behind the evidence, read Title II and PDFs and Section 504 and PDFs, and for the tools, PDF accessibility checkers compared.

Questions

This guide explains the rules in plain language. It isn’t legal advice. Check how they apply to your organization with counsel.