What documents do I need to prove ADA website compliance?

Nine documents form a defensible record: a written accessibility policy, a published accessibility statement, the most recent audit report, a remediation log, training records, vendor and procurement records, a user feedback log, a change-management record, and an incident response plan. Each with dates, owners, and review cadence.

What is the minimum viable compliance documentation for a small business?

Start with three documents: an accessibility policy signed by an executive, a published accessibility statement with a working feedback channel, and a remediation log started today. Consistently maintained, these three are more valuable than all nine done once and never updated.

How often should I update ADA compliance documentation?

Accessibility policy: annually. Accessibility statement: quarterly. Audit: annually at minimum, more often for high-traffic pages. Remediation log: continuously. Training records: after each session. Vendor records: at contract renewal. Feedback log: continuously. Change-management check: quarterly audit of the mechanism.

Who should own ADA compliance documentation?

Name a single accessibility owner, typically a senior product or engineering lead. The executive sponsor (CEO or COO) signs the policy. Legal reviews the public accessibility statement. Engineering owns the remediation log. HR or the accessibility owner owns training records. The index pointing to all of it is the accessibility owner's artifact.

Does compliance documentation prevent an ADA lawsuit?

Documentation does not prevent lawsuits. It changes the settlement math. A defendant with a dated audit, remediation log, and published accessibility statement settles at the low end of the range or not at all. A defendant with no documentation settles at the high end. Courts weigh the paper trail when evaluating good-faith effort.

Documentation

ADA Compliance Documentation Checklist for Small Businesses

Nine documents that prove good faith effort under the ADA. What to include in each, who should own it, and how to keep it current.

Published by Startvest LLC SDVOSBApril 14, 20266 min read

If a demand letter arrives and becomes a federal filing, the question in front of a judge is not whether your website was perfect. It is whether you made a documented, ongoing, reasonable effort to comply with the ADA.

That question is answered by paperwork. This article is the checklist of paperwork.

The nine documents

A defensible ADA compliance file contains nine documents. Each serves a specific evidentiary purpose. All nine should exist. All nine should be dated. All nine should be kept together.

1. Accessibility policy

A one-to-two page internal document that states the organization's commitment to accessibility, names the person responsible for it, and sets a conformance target.

Include. The conformance standard you aim for, typically WCAG 2.1 Level AA. The name and title of the accessibility owner. The review cadence, typically quarterly or annually. The procurement requirement, that new vendors must meet the same standard. The training requirement, that employees who maintain the site must receive annual accessibility training.

Owner. The chief executive or chief operating officer signs it. The accessibility owner maintains it.

Review. Annually, or whenever the accessibility owner changes.

2. Published accessibility statement

A public-facing page on your website. Not the same document as the internal policy. The statement is what a user, regulator, or plaintiff reads first.

Include. The conformance target. The date of the last conformance review. Known limitations and the plan to address them. The feedback channel with an email address and phone number that a real person answers. The assistive technologies you have tested against. The date the statement was last updated.

Owner. The accessibility owner publishes it. Legal should review before it goes live.

Review. Quarterly, or after any major site change.

3. Most recent accessibility audit report

A formal audit report. Either an internal one using a standard framework like WCAG-EM, or an external one from an accessibility firm.

Include. The scope of the audit, which pages or flows. The methodology. The findings list, with severity for each. The remediation recommendations. The date of the audit. The name and qualifications of the auditor.

Owner. The accessibility owner commissions and stores it. The auditor signs it.

Review. Annual at minimum. Many organizations audit more frequently for high-traffic pages.

4. Remediation log

A running log of every accessibility fix.

Include. Date of the fix. WCAG criterion it addressed. Page or feature affected. Description of the change. Engineer who made the change. Link to the commit or ticket if technical.

Owner. Engineering or the accessibility owner. Usually maintained as a spreadsheet or a Jira label.

Review. Continuous. The log is an operational artifact, not a periodic one.

5. Training records

Evidence that people who maintain the site have received accessibility training.

Include. Training material or course name and vendor. Date of each training session. Attendee list with signatures or acknowledgment timestamps. Refresh cadence.

Owner. HR or the accessibility owner. Both work.

Review. After each training session. Audit the roster annually against current site-maintenance staff.

6. Procurement and vendor records

Documentation that vendors whose products appear on your site are accessible, or that your compensating controls address any gaps.

Include. For each major vendor. Their VPAT, also called an Accessibility Conformance Report, if they publish one. Your evaluation notes if they do not. Contract language requiring accessibility where applicable.

Owner. The accessibility owner coordinates with procurement or legal.

Review. At contract renewal for each vendor.

7. User feedback log

Records of every accessibility complaint or report received from users, with the response.

Include. Date of the report. User's description of the issue. Category. Your response. Resolution date. Link to remediation-log entry if applicable.

Owner. The person who staffs the accessibility feedback channel.

Review. Continuous. The log shows responsiveness, which is a good-faith-effort factor courts weigh.

8. Change management record

Evidence that accessibility is evaluated before code changes go live.

Include. Either a pull request template that requires accessibility signoff, or a periodic audit of merged changes showing the accessibility check was performed. Screenshot or linked example.

Owner. Engineering lead or the accessibility owner.

Review. Quarterly audit of the check's actual use.

9. Incident response plan

A short document describing what happens when an accessibility complaint or demand letter arrives.

Include. Who is notified. Timeline for acknowledgment. Internal investigation process. Remediation triggers. Communication plan for affected users.

Owner. The accessibility owner, with legal concurrence.

Review. Annually, or after any incident.

How to store it

All nine documents live in one folder. Cloud drive, file server, or document management system. Access limited to the accessibility owner, legal, and the executive sponsor.

Each document has a version. Each version has a date. Old versions are retained, not overwritten. A version history is part of the evidence.

The folder has an index. A one-page document listing what is in the folder, where each document is stored, who owns it, and when it was last reviewed. The index is what you hand to counsel on day one of a claim.

What this buys you

If you are sued and reach discovery, this folder is requested. A complete and current folder sends three signals. You knew about the ADA. You took it seriously. You did the work.

A complete folder does not win every case. It does not reverse an accessibility failure. It does not satisfy a plaintiff who wants money.

What it does is shift the conversation. Settlement discussions that start from "we have no documentation, you have us" end at a higher number than those that start from "here is our audit, our remediation log, our training records, our feedback log, and our accessibility statement that predates your letter by eighteen months."

What this does not buy you

A folder is not a substitute for an accessible site. Judges and plaintiffs can read. An accessibility statement that claims WCAG 2.1 AA conformance while the site has three hundred alt-text violations is an admission.

A folder is also not a substitute for responsiveness. A user feedback log with complaints that were never addressed is worse than no log. It shows awareness without action.

The documentation checklist works only when the documentation reflects reality. Build the folder alongside the real accessibility work, not instead of it.

The minimum viable folder

If you do not have the capacity to produce all nine documents right now, build three first.

The accessibility policy. Half a page. Signed by the executive. Dated.

The accessibility statement. Published on your website. Honest about current state. With a feedback email.

The remediation log. Started today. Every fix logged going forward.

Those three, consistently maintained, are more valuable than all nine done once and never updated. Start with three. Add the others at a pace you can sustain.

This article is general information, not legal advice. For the application of this checklist to your specific business, consult a licensed attorney.

Get the documentation a judge will ask for.

Nine documents that courts have accepted as good-faith effort. With owner, review cadence, and fillable fields.

One email. The download link. No newsletter until you opt in.

Don't want to share your email? Read the template online →

Frequently asked questions

What documents do I need to prove ADA website compliance?: Nine documents form a defensible record: a written accessibility policy, a published accessibility statement, the most recent audit report, a remediation log, training records, vendor and procurement records, a user feedback log, a change-management record, and an incident response plan. Each with dates, owners, and review cadence.
What is the minimum viable compliance documentation for a small business?: Start with three documents: an accessibility policy signed by an executive, a published accessibility statement with a working feedback channel, and a remediation log started today. Consistently maintained, these three are more valuable than all nine done once and never updated.
How often should I update ADA compliance documentation?: Accessibility policy: annually. Accessibility statement: quarterly. Audit: annually at minimum, more often for high-traffic pages. Remediation log: continuously. Training records: after each session. Vendor records: at contract renewal. Feedback log: continuously. Change-management check: quarterly audit of the mechanism.
Who should own ADA compliance documentation?: Name a single accessibility owner, typically a senior product or engineering lead. The executive sponsor (CEO or COO) signs the policy. Legal reviews the public accessibility statement. Engineering owns the remediation log. HR or the accessibility owner owns training records. The index pointing to all of it is the accessibility owner's artifact.
Does compliance documentation prevent an ADA lawsuit?: Documentation does not prevent lawsuits. It changes the settlement math. A defendant with a dated audit, remediation log, and published accessibility statement settles at the low end of the range or not at all. A defendant with no documentation settles at the high end. Courts weigh the paper trail when evaluating good-faith effort.