In this guide
- 01
Place Section 508
- 02
Find the rule that applies to you
- 03
Plan the work
Who must comply with Section 508?
Federal agencies must comply. The statute applies to “each Federal department or agency, including the United States Postal Service” (29 U.S.C. 794d(a)(1)(A)). Section508.gov puts it the same way:
“The law applies to all federal agencies when they develop, procure, maintain, or use electronic and information technology.”
Section508.gov
The Section508.gov pages reviewed for this piece do not say that Section 508 reaches recipients of federal funds, state or local governments, or private entities. A nonprofit that receives a grant is not directly subject to it.
How does Section 508 work?
What it asks of agencies
Section 508 is a buy-and-use duty on agencies. ICT stands for information and communications technology.
“ICT that is procured, developed, maintained, or used by agencies shall conform to the Revised 508 Standards.”
“Electronic content shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0.”
How it reaches vendors
Procurement is the confirmed route outside government. Section508.gov says conformance “is mandatory for Executive Branch Federal agencies.” Agencies then ask vendors for evidence. Section508.gov’s buying guidance tells agencies to “Request an ACR/VPAT” or other evidence of accessibility testing for each ICT item, and says testing “must be performed regardless of the source, including COTS, open source, or custom-built technology.”
A nonprofit that sells ICT to a federal agency meets Section 508 as a contract term, not as a funding condition. A nonprofit in this position probably does not sell ICT to agencies.
Ask whether your organization sells any product or service to a federal agency. If it does not, Section 508 does not apply to you directly.
Which rule reaches a nonprofit funded by HHS?
Section 504 does, through HHS’s rule at 45 CFR 84.84. Section 504 is a nondiscrimination duty on organizations that take federal money, and HHS applies it to web content and mobile apps. The text of 45 CFR 84.84 as reviewed makes no reference to Section 508.
Paragraph (b)(1) sets the standard and the first date:
45 CFR 84.84(b)(1)
“Beginning May 11, 2027, a recipient with fifteen or more employees shall ensure that the web content and mobile apps that the recipient provides or makes available, directly or through contractual, licensing, or other arrangements, comply with Level A and Level AA success criteria and conformance requirements specified in WCAG 2.1, unless the recipient can demonstrate that compliance with this section would result in a fundamental alteration in the nature of a program or activity or in undue financial and administrative burdens.”
Paragraph (b)(2) uses the same wording, beginning “Beginning May 10, 2028, a recipient with fewer than fifteen employees.” Your headcount sets the date:
An exception depends on the organization being able to demonstrate it. The rule’s own words are “can demonstrate.”
These dates moved a year
An interim final rule, 91 FR 25496, extended both dates. It was effective May 7, 2026 and published May 11, 2026.
| Headcount | Original date | Current date |
|---|---|---|
| 15 or more | May 11, 2027 | |
| Fewer than 15 | May 10, 2028 |
The same rule states that it “does not impose new substantive requirements, and it does not expand the scope of existing obligations.” Older posts that quote May 2026 predate the extension.
A vendor-run or host-run site still counts
The rule covers web content provided “directly or through contractual, licensing, or other arrangements.” Paragraph (a) says the same for mobile apps. A site that a vendor builds or a host serves falls under the same wording.
“The deadline is 2027, we have time”
The date is right, and the date is separate from the work. In NoDrama’s position, a fix holds only if somebody operates the site afterwards. That is our view, not a statement from the rule.
Count your employees, pick the date, and write it down with the funding agreement in the file.
Section 508 vs ADA vs 504 vs WCAG: what is the difference?
Two questions separate the four: who is covered, and which version of WCAG the rule names. The table sets them side by side.
| Regime | Who it covers | Standard | Date |
|---|---|---|---|
|
Section 508
|
Federal agency ICT | WCAG 2.0 Level A and AA (E205.4) | Not covered here |
|
ADA Title II web rule
|
State and local governments. A nonprofit is not a public entity under it. | WCAG 2.1 Level AA | April 26, 2027 for a population of 50,000 or more. April 26, 2028 for under 50,000 and special districts. |
|
HHS Section 504 rule
|
Organizations that receive HHS financial assistance | WCAG 2.1 Level A and AA | May 11, 2027 for 15 or more employees. May 10, 2028 for fewer. |
|
WCAG
|
Nobody. It is a W3C technical standard, not a law. | Versions 2.0, 2.1 and 2.2 | None |
How the ADA web rule differs
The ADA Title II web rule comes from the Department of Justice and covers state and local governments. On ADA.gov, the Department says it “published an Interim Final Rule (IFR) extending the compliance date for State and local government entities with a total population of 50,000 or more to April 26, 2027.” The page also says “complying with WCAG 2.1 Level AA is required under the rule.” A nonprofit is not a public entity under this rule. This piece does not cover ADA Title III.
Where WCAG fits
W3C publishes WCAG. Each regime above names a version of it:
- WCAG 2.0
Published on December 11, 2008 - WCAG 2.1
Published on June 5, 2018 - WCAG 2.2
Published on October 5, 2023
“WCAG 2.0, 2.1, and 2.2 are designed to be ‘backwards compatible’, which means content that conforms to WCAG 2.2 also conforms to WCAG 2.1 and WCAG 2.0.”
“Later versions add new success criteria, and do not change existing success criteria.”
W3C
By that wording, work done to WCAG 2.1 Level AA for the HHS rule also meets the 2.0 Level AA criteria that Section 508 names.
What should an HHS-funded nonprofit do about its website?
Five actions, each ending with something you can file.
- 01
Confirm that HHS is a funder and which headcount date applies. Read the HHS rule against your funding agreement.
Artifact: a dated note of your headcount and the date that applies.
- 02
Read what the standard is. The HHS rule names WCAG 2.1 Level A and AA. NoDrama’s guide to WCAG standards and conformance levels is a starting point.
Artifact: the standard and version your site will be measured against, written down.
- 03
Check what the site is running today. The plugins and themes screens in WordPress admin show the state of the site as it stands.
Artifact: the audit output, saved with its date.
- 04
Decide who operates the site after the fix. In NoDrama’s position, remediation decays with the next content update, so the fix needs an operator. The maintenance side is what NoDrama’s care plans cover.
Artifact: a named owner for the site.
- 05
Keep a dated record of what was changed and when.
Artifact: a change log that sits with the funding agreement.
Open the file. It should hold a headcount and date, the named standard, a dated audit, a named operator and a change log. A missing item is the next action.
A fix needs an operator afterwards.
NoDrama’s care plans keep WordPress, plugins and themes current and include reporting, and each plan is listed on here.
What do people get wrong about Section 508?
What this does not solve
This piece does not cover other funders’ grant terms or ADA Title III. It does not say whether a particular site conforms to any standard. NoDrama’s care plans do not list accessibility work, and NoDrama does not certify or audit conformance.
Conclusion: Section 508 is for agencies, 504 is the rule for your HHS funding
Section 508 binds federal agencies, and the only route to it confirmed here is selling ICT to one. The rule that reaches an HHS-funded nonprofit’s website is the Section 504 rule at 45 CFR 84.84, which names WCAG 2.1 Level A and AA. The date is May 11, 2027 for 15 or more employees and May 10, 2028 for fewer.