Virginia: the federal web standard written into state law, with vendor duties

The 2025 amendments (2025 Acts, chapter 571) widened the Act's reach. Covered entities are now state agencies, public school divisions, public institutions of higher education and political subdivisions, so counties, cities and towns are inside it as well as the state. Private businesses are not.

The head of each covered entity must make sure ICT used by people with disabilities gives them access equivalent to others, with information presented in accessible or adaptable formats. The ICT must conform to 28 CFR 35.200, the federal Title II web rule, which means WCAG 2.1 Level AA. Virginia has therefore pulled the federal standard into state law for its own public bodies, including the state agencies the federal rule already covers.

Nonconforming ICT that falls outside the exceptions in 28 CFR 35.201 or the Section 508 general exceptions must be reported, and executive branch agencies report annually to the General Assembly with an estimate of the cost of compliance. A covered entity may designate a digital accessibility coordinator and must publish a named contact on its website along with a process for barrier reports.

The Secretary of Administration writes an ICT access clause for contracts. Vendors certify that what they sell conforms. Where it does not, the covered entity may require an Accessibility Conformance Report prepared by a subject matter expert or a qualified neutral third party, and a Vendor Accessibility Roadmap with timelines, both at the vendor's expense. The clause may allow nonaccessible ICT where people with disabilities are not denied the benefit of any program, service or activity.

State law here adds to federal law; it does not replace it. Every city, county, school district and special district in Virginia is bound by the federal Title II web rule, 28 CFR 35.200, which requires WCAG 2.1 Level AA on web content and mobile apps: from April 26, 2027 for public entities of 50,000 people or more, and from April 26, 2028 for smaller entities and special districts. State agencies are bound by the same rule at the earlier date.

Private businesses open to the public answer to ADA Title III. A private plaintiff can sue for an injunction and ask for attorney's fees; the Department of Justice can sue for damages and civil penalties. No federal regulation names a web standard for businesses, so audits use WCAG 2.1 or 2.2 Level AA as the working benchmark.

A Virginia locality or school division: the state statute and the federal rule now point at the same standard, so one measured WCAG 2.1 AA program serves both. A vendor: budget for a third-party ACR and a credible roadmap, because the statute lets the buyer make you pay for them.