Section 508 binds federal agencies and, through the contracts they write, everybody who sells to them. That second group is where most businesses meet it: a bid asks for a conformance report and suddenly the website, the PDFs and the demo application all have to be measured against a standard nobody in the building has read. The standard itself is not the hard part, because 508 adopts WCAG 2.0 Level AA by reference and the current practice is to audit against WCAG 2.2. The hard part is scope and evidence, which is what this page is about, and what the audit sheet prices: on the worked example a 240-page site sampled at 8% is 19 pages an auditor opens and 220 nobody does.
Who 508 actually binds, and how it reaches a supplier
Section 508 is an obligation on federal agencies: what they buy, build and use has to be accessible. It reaches a private business through procurement, as a clause in a solicitation asking for an accessibility conformance report, and through subcontracts under a prime. If you are not selling to a federal agency, 508 is not your duty and the ADA is: the two overlap almost completely in what they ask of a page, so work done for one counts for the other.
What conformance means, and what the auditor has to see
508 adopts WCAG Level AA, which is 50 success criteria across A and AA in WCAG 2.2. Conformance is claimed per page or per set of pages, not per site, so the scope statement matters as much as the findings: a claim covering the marketing site says nothing about the logged-in application. On the worked example the audit costs $3,480 with $1,800 of that being the write-up, and the retest another $1,392, because the retest is the evidence that the findings closed.
508 remediation, in the order that clears a bid
Fix what a procurement reviewer will open first: the pages named in the bid, the forms a user has to complete, and the documents attached to the response. On the worked example the PDFs alone are 75 of the 401 issues and $2,968 of the $15,872 fix, which is worth knowing before somebody promises a remediated document set inside a two-week bid window.
Questions people ask about 508 compliance
Does Section 508 apply to my business?
Only through a federal contract or subcontract. Without one, the duty you have is the ADA, and the work is substantially the same because both point at WCAG Level AA.
Is 508 the same as WCAG?
508 adopts WCAG Level AA by reference, so the criteria are the same. What differs is who enforces it and what evidence they ask for.
Do we need a conformance report to bid?
Increasingly yes, and one that names the pages it covers. A report claiming the whole site with a sample of nineteen pages is the report that gets questioned.