WCAG 2.2 is now ISO/IEC 40500:2025. Discover what the 9 new criteria mean for global procurement, RFPs, and WCAG 2.2 AA requirements in 2026.
WCAG 2.2 AA Is Now an ISO Standard: What It Means for Procurement in 2026
Most companies still treat WCAG 2.2 as optional. They upgraded to 2.1 when regulations required it and quietly decided 2.2 could wait.
That calculation just changed.
In October 2025, WCAG 2.2 was formally approved as an international standard: ISO/IEC 40500:2025. That single event changes the procurement conversation entirely. Government bodies, large enterprises, and international organisations that reference ISO standards in their RFPs now have a formal basis to require WCAG 2.2 specifically, and several are already doing so.
In this article, we are discussing what the ISO approval actually means, which of the 9 new criteria you need to address first, and what your team should do right now to stay competitive in procurement, particularly if you work with public sector, healthcare, or financial services clients.
What is WCAG 2.2 AA?
WCAG 2.2 AA (Web Content Accessibility Guidelines 2.2, Level AA) is the current international benchmark for digital accessibility. Published by the W3C in October 2023 and formalised as ISO/IEC 40500:2025 in October 2025, it defines the technical requirements websites and digital products must meet so that people with disabilities can use them effectively.
Level AA is the conformance level required by most accessibility regulations globally, including the EU Web Accessibility Directive, Section 508 in the US, and the European Accessibility Act. WCAG 2.2 is fully backward compatible with WCAG 2.1, meaning a website that meets all 2.2 criteria automatically satisfies 2.1. You do not lose anything by upgrading.
Why the ISO approval changes things
Here's the thing: the ISO stamp matters specifically because of how procurement documents are structured.
Many public sector bodies, government agencies, and multinational organisations are required, or strongly incentivised, to reference ISO standards when specifying technical requirements in contracts. For years, this created a gap. WCAG 2.1 had ISO recognition as ISO/IEC 40500:2012. WCAG 2.2 was only a W3C recommendation. Procurement teams that wanted to require WCAG 2.2 had to do so outside the ISO framework, which many could not or would not do.
That gap closed in October 2025. ISO/IEC 40500:2025 is WCAG 2.2 in full. Procurement teams across the EU, the Middle East, and Asia-Pacific are already updating their RFP templates to reference it.
The practical question for vendors and website operators has shifted. It is no longer "do we need to bother with 2.2?" It is "Will we be disqualified from a contract we want if we have not built to 2.2?" In the public sector, healthcare, and financial services, the answer is increasingly yes.
The 9 new criteria in WCAG 2.2: what actually changed
WCAG 2.2 adds 9 new success criteria on top of the 2.1 baseline. Most address three areas that earlier versions handled poorly: mobile usability, cognitive accessibility, and authentication.
Here is what each new AA-level criterion requires and why it matters in practice.
Focus not obscured (2.4.11)
When a user navigates your site with a keyboard, the element they are currently focused on must not be completely hidden behind sticky headers, floating banners, or chat widgets. At AA level, the focused component must not be entirely hidden. If your site has a fixed navigation bar and a cookie consent banner stacked at the top, this is worth checking first.
Focus appearance (2.4.13)
The visual indicator showing which element has keyboard focus must meet minimum size and contrast requirements. Many sites have focus indicators that are technically present but far too faint to be seen reliably. This criterion sets a visible floor.
Dragging movements (2.5.7)
Any interaction that requires dragging, whether a slider, a sortable list, or a drag-and-drop interface, must have a single-pointer alternative. A user who cannot perform precise drag gestures needs another way to achieve the same result.
Target size minimum (2.5.8)
Interactive elements like buttons, links, and checkboxes must be at least 24x24 CSS pixels. This addresses the longstanding problem of small touch targets on mobile interfaces. Inline links within blocks of text are exempt, but standalone interactive controls are not.
Consistent help (3.2.6)
If your site offers a help mechanism, whether a contact form, a live chat widget, or a support phone number, it must appear in the same location on every page. Moving your support button between pages fails this criterion.
Redundant entry (3.3.7)
Users should not be required to enter the same information twice within the same session. If someone types their email on page one of a multi-step form and then has to retype it on page three, that is a failure.
Accessible authentication (3.3.8)
This is one of the most impactful new criteria. Authentication processes, such as logins, password resets, or account verification, must not require users to solve a cognitive function test unless an accessible alternative is provided.
That means: no memory-dependent login puzzles, no click-all-the-images CAPTCHAs as the only option, and no tests requiring users to recall or transcribe characters without assistance. At AA level, at least one method of authentication must work without a cognitive function test.
The table below maps the key new AA criteria to what they address and whether automated tools can detect the issue:
Criterion | Level | What it addresses | Automated? |
|---|---|---|---|
Focus not obscured (2.4.11) | AA | Keyboard focus not hidden by overlays | Partial |
Dragging movements (2.5.7) | AA | Pointer alternative for drag actions | No |
Target size minimum (2.5.8) | AA | 24x24px minimum touch targets | Yes |
Consistent help (3.2.6) | AA | Help feature in same location site-wide | No |
Redundant entry (3.3.7) | A | No re-entry of same data in session | No |
Accessible authentication (3.3.8) | AA | No cognitive tests required at login | No |
What WCAG 2.2 means for your procurement strategy
If you sell to public sector clients, large enterprises, or international organisations, treat ISO/IEC 40500:2025 as the operative standard right now. Do not wait for local regulation updates. Procurement documents in many jurisdictions are already ahead of local law.
Three things to act on immediately.
Update your ACR. If your Accessibility Conformance Report (also known as a VPAT) still references WCAG 2.1, update it. Procurement teams are now requesting ACRs that reflect WCAG 2.2. An outdated report can disqualify a vendor before the evaluation stage even begins.
Expect ISO/IEC 40500:2025 in new RFPs. Particularly in EU public procurement, healthcare, and financial services. If you are quoting or bidding into those sectors, your team needs to be ready to demonstrate WCAG 2.2 AA conformance, not just 2.1.
Pair automated testing with manual review. Several of the new criteria, particularly accessible authentication and consistent help, require human evaluation. Automated tools can flag some issues but cannot assess user experience or context-dependent criteria reliably. Serious procurement expects both.
How Clym supports your accessibility efforts
Getting from "we roughly meet WCAG 2.1" to "we can demonstrate WCAG 2.2 AA" takes more than a one-time audit. It takes a way to identify issues, test across your pages, and build a documented picture of where you stand.
Clym offers two free tools to help you get there. The Accessibility Scanner automatically tests your pages for WCAG 2.2, Section 508, and EN 301 549 issues, giving non-technical teams a clear view of where problems exist without needing to work through the full specification.
Clym's Accessibility Testing and Audit software goes further, combining automated scanning with structured audit tools that help you build the kind of documented conformance evidence procurement teams and ACR writers actually need.
For organisations that need an ongoing user-facing solution, Clym's Accessibility Widget brings together assistive browsing tools in a single embeddable component, including pre-configured profiles for users with visual impairments, cognitive differences, and motor limitations. It does not replace the work of meeting WCAG criteria directly, but it makes your site meaningfully more usable for a wider range of users while you work through remediation.
Clym also combines accessibility and cookie consent management in one platform, which matters when procurement documents require both data privacy and accessibility standards to be met.
Conclusion
WCAG 2.2 AA is no longer just a W3C recommendation. It is ISO/IEC 40500:2025, an international standard with real procurement weight behind it.
The 9 new criteria are not dramatically difficult to implement, but several of them require manual review and thoughtful design decisions rather than a quick code fix. Accessible authentication, consistent help placement, and drag-and-drop alternatives all need human evaluation. The teams that move now will be the ones with an up-to-date ACR when the next RFP lands.
Start with a scan to understand where you stand. Build a remediation plan around the new AA criteria. Update your VPAT to reference WCAG 2.2. And make WCAG 2.2 AA your default target going forward, not something you negotiate toward only when a client requires it.
Frequently asked questions
WCAG 2.2 AA is the current international web accessibility standard, formalised as ISO/IEC 40500:2025. It defines the technical requirements websites must meet to support users with disabilities, with Level AA being the conformance target required by most global regulations including the EAA, EU Web Accessibility Directive, and Section 508.
Yes. WCAG 2.2 is fully backward compatible with WCAG 2.1. A site that meets all WCAG 2.2 criteria automatically satisfies WCAG 2.1. There are no conflicts between the two versions, so upgrading does not require undoing anything built for 2.1.
WCAG 2.2 introduces 9 new success criteria. Key AA-level additions include keyboard focus visibility, minimum touch target sizes of 24x24 CSS pixels, alternatives to drag-and-drop interactions, consistent help placement across pages, avoiding repeated data entry, and accessible authentication without cognitive function tests.
Many public sector and enterprise procurement frameworks require ISO-referenced standards in contracts and RFPs. Before October 2025, only WCAG 2.1 carried ISO recognition. Now that WCAG 2.2 is ISO/IEC 40500:2025, procurement teams can formally require it. Several are already doing so across EU, Middle East, and Asia-Pacific markets.
An accessibility conformance report (ACR), also called a VPAT, is a structured document recording how a product or website conforms to WCAG and related standards. Procurement teams use ACRs to evaluate vendors during tendering. An up-to-date ACR referencing WCAG 2.2 is now expected in most public sector and enterprise RFPs.
Compliance Content Manager | CPACC (IAAP)
Alex is a Compliance Content Manager at Clym, where he researches and writes about everything related to data privacy and web accessibility compliance for businesses, helping them stay informed on their compliance needs and spreading awareness about making the web safer and more inclusive. When he's not writing about compliance, Alex has his nose in a book or is hiking in the great outdoors.