Utah: standards tied to the most recent WCAG, reviewed every three years

Section 63A-16-209 binds executive branch agencies of the state of Utah. It reaches three things: agency websites, hardware and software agencies procure, and information systems used by agency employees. Local governments and private businesses are not covered.

The chief information officer must set minimum accessibility standards by administrative rule. They must be at minimum consistent with the most recent WCAG published by the W3C, which today means WCAG 2.2, and must include a protocol for testing them with people who have a variety of access limitations. The CIO must update them at least every three years.

The same rule must create a grievance procedure: a way for a person who cannot use an agency's technology to report it to the CIO, and a way for the CIO to respond.

State law here adds to federal law; it does not replace it. Every city, county, school district and special district in Utah is bound by the federal Title II web rule, 28 CFR 35.200, which requires WCAG 2.1 Level AA on web content and mobile apps: from April 26, 2027 for public entities of 50,000 people or more, and from April 26, 2028 for smaller entities and special districts. State agencies are bound by the same rule at the earlier date.

Private businesses open to the public answer to ADA Title III. A private plaintiff can sue for an injunction and ask for attorney's fees; the Department of Justice can sue for damages and civil penalties. No federal regulation names a web standard for businesses, so audits use WCAG 2.1 or 2.2 Level AA as the working benchmark.

Utah's statute itself requires the standards to include a testing protocol involving people with a variety of access limitations. Automated tools find a share of WCAG failures, and the Department of Justice's own guidance warns that a clean automated report does not necessarily mean a page is accessible. A Utah agency, and a vendor selling to one, should plan for keyboard, screen reader and magnification testing by people who use those tools every day.

The phrase most recent WCAG matters to vendors. A product sold to a Utah executive agency should be tested against the current version, and a VPAT written for WCAG 2.0 or 2.1 alone may not answer the question the state is required to ask. Testing with disabled users is written into the statute, so expect a buyer to value human testing over an automated report.