Why Government Procurement Looks at Your Accessibility Practices, Not Just Your Product
I attended the last Texas Department of Information Resources (DIR) vendor education session of 2026. Marie Cohan, who heads up the Statewide Digital Accessibility Program at DIR, spent the hour on Policy-Driven Adoption for Accessibility (PDAA) and the vendor self-assessment built on it: why the states built them, how DIR reads the self-assessment next to an Accessibility Conformance Report (ACR), and how PDAA relates to the World Wide Web Consortium (W3C) Accessibility Maturity Model.
Where PDAA came from
Government buyers ask for an ACR when a product is on the table. That is still the standard. The problem was that the ACR didn't tell the whole story. A product's report might look good, but the vendor's implementation or support would fall short. Or a development shop would build something accessible, and a later defect or enhancement would undo it.
A few states, Texas among them, decided the company behind the product mattered as much as the product. A workgroup of the National Association of State Chief Information Officers (NASCIO), with contributors from Massachusetts, Texas, and Minnesota, developed PDAA: an approach that builds information and communications technology (ICT) accessibility governance into a vendor's own policies.
PDAA has four components: the Core Criteria, a Maturity Model, a Vendor Self-Assessment Tool, and an Implementation Timetable. The self-assessment gives the buyer a read on the whole company and the vendor a roadmap of its own gaps. Over years of working with the same vendors, DIR can watch the score move. NASCIO wrote up the reasoning in two short 2015 reports: Part 1 covers the problem, and Part 2 covers the Core Criteria, the Maturity Model, the self-assessment, the timetable, and how Texas and Minnesota put them to use.
What the form asks
Texas DIR publishes the PDAA vendor self-assessment as an Excel workbook with three tabs: the assessment with its instructions, a list of frequently asked questions, and a completed example. You start by saying what kind of company you are: manufacturer, service provider, integrator, or reseller or catalog supplier. Then you work through the six PDAA Core Criteria. Each opens with a zero option for no plan, then three lettered sub-criteria. For each sub-criterion, you pick the statement that matches your organization today, scored 1, 2, or 3.
- Develop, implement, and maintain an ICT accessibility policy. Do you have an accessibility policy, a plan to carry it out, and metrics to track it?
- Establish and maintain an organizational structure that enables and facilitates progress in ICT accessibility. Is there a governance system, named owners, and a way to report and keep records?
- Integrate ICT accessibility criteria into key phases of development, procurement, acquisitions, and other relevant business processes. Have you found where accessibility belongs in how you build and buy, and changed those processes?
- Provide a process for addressing inaccessible ICT. Do you test what you sell, set dates to bring inaccessible products into compliance, offer alternative access in the meantime, run a corrective-action process, and keep records? Resellers answer a version about tracking documentation from the vendors they carry.
- Ensure the availability of relevant ICT accessibility skills and other resources within (or to) the organization. Have you defined which roles need accessibility knowledge, found the gaps, and planned the training?
- Make information regarding ICT accessibility policy, plans, and progress available to customers. Is your policy public? Are your ACRs available? Do you publish how you test?
The PDAA Maturity Matrix lays each criterion out in three stages: Launch, Integrate, and Optimize. Those stages match the lettered sub-criteria on the form. Within each sub-criterion, you score 1, 2, or 3 for how far along you are. Cohan said a low score passes. It means there is room to grow. The form itself is blunt about the other case: a missing, incomplete, blank, or zero-score self-assessment receives a failing score and may be disqualified. Answer every sub-criterion with a number, and check that nothing is blank before you submit. She also said DIR will give one courtesy review of a draft if you ask at statewideaccessibility@dir.texas.gov, with the procurement lead copied.
How the self-assessment and the ACR check each other
DIR's own form says the PDAA self-assessment "is an organizational assessment, not an assessment of the products or services listed in the vendor's response," and that it "is not a substitute for and is independent of" other accessibility documentation such as the ACR and the Vendor Accessibility Development Services Information Request (VADSIR), a Texas-only questionnaire for development services. It is also self-reported, so the obvious question is what stops a vendor from inflating it. Cohan's answer was that DIR never reads it alone. It sits next to the ACR, and the VADSIR when development services are in scope, and the documents check each other.
A high self-assessment score next to an ACR that is five years old with no testing method and no explanation of gaps is a red flag. An ACR that reads too good to be true next to a low self-assessment score is also a red flag. Cohan noted that anyone can fill out an ACR, including the salesperson, and the self-assessment helps DIR spot when that happened. If the documents still do not add up, she said, a scan of a few pages on the vendor's own website is the tiebreaker.
DIR reviews for completeness and credibility, Cohan said. Accuracy is on the agencies and local governments buying off the contract. In her words, the closest thing to a real certification today is an ACR backed by the test script from an independent third party.
The W3C model is the bigger umbrella
I asked whether a company following the W3C Accessibility Maturity Model would be in good shape for the PDAA self-assessment. The answer was yes, without hesitation. The W3C model is more detailed and covers more ground. Nothing in the PDAA Core Criteria goes beyond it. Adopt the W3C model, and the self-assessment becomes a summary of work you have already done. The W3C published the model as a Group Note on November 4, 2025, and it includes an assessment spreadsheet.
Where testing fits
The PDAA self-assessment tells a buyer how a company operates. The ACR should tell them whether this version of the product works, and it only carries weight when someone tests the product and explains how. That is the work we do. Our testers hold Department of Homeland Security (DHS) Trusted Tester and International Association of Accessibility Professionals (IAAP) certifications, use assistive technology, and test the way real users work. When we review an ACR, we compare what it claims with how the product behaves for someone on a screen reader, keyboard alone, or magnification.