ADA Compliance Checklist for 2026: A Practical Audit Guide

ADA website lawsuits crossed 4,500 federal filings in 2025, with another estimated 25,000 to 35,000 demand letters sent that never reached court. Roughly 75 percent of these targeted businesses with no formal accessibility program in place. The pattern is consistent: a plaintiff's law firm runs an automated scan against thousands of websites, identifies properties with obvious WCAG failures, sends a demand letter or files suit, and settles for $5,000 to $50,000. The path to immunity is not complicated, but it does require deliberate work.

This is a practical 2026 checklist for businesses that want to know exactly what to audit, what to fix first, and what to document to protect themselves. It assumes WCAG 2.2 Level AA as the working standard, since that is what most courts and the DOJ now reference. It does not pretend to be legal advice, but it covers the technical and process work that any reputable accessibility partner would walk you through anyway.

Why the 2026 Compliance Landscape Looks Different

Three things changed between 2024 and 2026 that make this checklist different from older ADA guides. First, the DOJ formally adopted WCAG 2.2 AA as the technical standard for state and local government websites under Title II, and most plaintiff's firms now reference 2.2 instead of 2.1 in their demand letters. Second, the rise of AI-powered scanning tools means small businesses are getting hit by automated audits that previously only large enterprises faced. Third, courts have become significantly less sympathetic to "accessibility overlay" defenses — companies that bolted on a widget instead of fixing underlying code are losing cases at a much higher rate than companies that did real remediation.

The result is a higher bar and a smaller margin for error. Sites that were "good enough" under 2.1 in 2023 are getting demand letters in 2026 because new 2.2 success criteria — focus appearance, dragging movements, target size — are surfacing failures that older audits did not catch. The good news: the 2.2 changes are mostly modest extensions of 2.1, not a full rewrite, and a site that was genuinely 2.1 compliant can usually reach 2.2 with focused work over 4 to 8 weeks.

WCAG 2.2 Level AA: The Working Standard

WCAG 2.2 AA is the practical compliance target for almost every commercial website in 2026. AAA is a higher standard typically reserved for government and disability-services sites; A is too low to defend against most lawsuits. AA covers the substantial majority of accessibility user needs without imposing requirements that cannot be met for typical commercial content. The full WCAG 2.2 specification adds nine new success criteria to 2.1, of which six apply at the AA level. The detailed mechanics of meeting each are covered in our deeper guide on WCAG 2.2 compliance services.

The six new AA criteria you need to address: Focus Not Obscured (Minimum), Dragging Movements, Target Size (Minimum), Consistent Help, Redundant Entry, and Accessible Authentication (Minimum). Each one targets a real user-experience failure pattern that older sites routinely violate. Focus appearance and target size in particular are surfacing failures in modern card-based and icon-heavy interfaces that were never tested for keyboard or motor-impaired users.

The 12-Item Practical Audit Checklist

Run through these 12 items in this order. Each maps to a cluster of WCAG criteria and addresses the highest-frequency failures we see in plaintiff demand letters. Most sites fail 4 to 8 of these and can resolve every failure inside 60 to 120 days of focused work.

1. Alt Text on All Meaningful Images

Every image that conveys information needs descriptive alt text. Decorative images need empty alt attributes (alt=""). Logos use the company name. Icons that perform a function (search, menu, close) need text describing the function, not the visual. The most common failure is missing alt text on hero images, product photos, and icon buttons. Fix priority: high. Effort: low to medium depending on site size.

2. Color Contrast Ratios

Text needs a 4.5:1 contrast ratio against its background (3:1 for large text, defined as 18pt regular or 14pt bold). UI components and graphics need 3:1. The common failures: light gray text on white backgrounds, brand colors that look fine to designers but fail at the threshold, and hover states that drop below contrast. Fix priority: high. Effort: medium because brand color changes can require executive sign-off.

3. Keyboard Navigation Throughout

Every interactive element must be reachable and operable using only the keyboard. Tab order has to be logical. Focus indicators must be visible. The common failures: dropdowns that only open on hover, custom dropdowns that trap focus, modals that do not return focus on close, and skip-to-content links that are missing or non-functional. Fix priority: high. Effort: medium to high depending on how custom the interactive components are.

4. Form Labels and Error Messages

Every form input needs a programmatically associated label, not just placeholder text. Error messages need to be linked to the field they reference. Required fields must be programmatically marked, not just visually styled. The common failures: placeholder-only labels that disappear on input, error messages that appear only as red text without any programmatic association, and required indicators that are pure visual (asterisks without aria-required). Fix priority: high. Effort: medium.

5. Headings in Logical Hierarchy

Pages need a clear H1 followed by properly nested H2-H6 headings. Heading levels should not skip (no jumping from H2 to H4). Headings should describe the content that follows, not be used for visual styling. Common failures: multiple H1s on a page, H2s used as decorative subheadings on landing pages, missing H1s entirely. Fix priority: medium. Effort: low to medium.

6. Link Text That Makes Sense Out of Context

"Click here" and "Read more" links fail because screen reader users often pull a list of all links on a page. Link text should describe the destination. Multiple links pointing to the same destination should use the same text. Common failures: blog posts with three "Read more" links pointing to three different articles, CTA buttons labeled only with an arrow icon. Fix priority: medium. Effort: low.

7. Focus Indicators Visible and Sufficient

The new WCAG 2.2 Focus Appearance criterion requires that focus indicators have a 3:1 contrast against adjacent colors and a minimum perimeter outline. The default browser focus ring usually meets this. The common failures: CSS that removes the focus outline (outline: none) without a replacement, focus states that match the hover state and are not distinct, focus indicators on dark backgrounds that fail contrast. Fix priority: high. Effort: low.

8. Target Size for Tap and Click Targets

WCAG 2.2 requires interactive targets to be at least 24x24 CSS pixels (with some exceptions for inline text links). The common failures: icon-only buttons sized to 16px or 20px, navigation links packed too tightly together, social media icon clusters in footers. Fix priority: medium to high. Effort: low to medium.

9. Video Captions and Transcripts

All prerecorded video content with audio needs synchronized captions. Audio-only content needs transcripts. Live streams need real-time captioning at AA level. Auto-generated YouTube captions are usually not accurate enough to qualify; human-edited captions are required. Fix priority: high if you have video, otherwise N/A. Effort: medium because caption editing is time-consuming.

10. PDF Accessibility

If you publish PDFs, they need to be tagged correctly with proper reading order, alt text on images, table headers, and bookmarks for long documents. Most PDFs exported from Word or InDesign are not accessible by default. The common failure: dozens of legacy PDFs published over the years that have never been remediated. Fix priority: medium. Effort: high because PDF remediation is per-document work.

11. ARIA Used Correctly (or Not at All)

The first rule of ARIA is do not use ARIA when native HTML works. The most common ARIA failures are misuse: aria-hidden on visible elements, role="button" on a div when a button element would work, conflicting ARIA states. A site that uses no ARIA but proper semantic HTML is more accessible than a site with extensive but incorrect ARIA. Fix priority: medium. Effort: medium and requires expertise.

12. Skip Links and Landmark Regions

A "Skip to main content" link as the first focusable element on each page lets keyboard and screen reader users bypass navigation. Pages should use semantic landmark regions (header, nav, main, footer, aside) so assistive technology users can jump between sections. Common failures: missing skip links, all div-soup pages with no semantic landmarks. Fix priority: medium. Effort: low.

The Audit Process: Manual + Automated Together

An accessibility audit needs both automated scanning and manual testing. Automated tools (axe, WAVE, Lighthouse, Siteimprove) catch roughly 30 to 40 percent of WCAG failures. The remaining 60 to 70 percent require manual testing: keyboard-only navigation through key user flows, screen reader testing with NVDA or JAWS, visual inspection at 200 percent zoom, and color-blindness simulation. A reputable audit produces a prioritized fix list, severity ratings, sample code or design fixes, and a re-audit plan after remediation. The full audit methodology is covered in depth in our work on website accessibility audit services.

Audits should cover representative pages, not every page on the site. A typical commercial site with 50 to 500 pages can be meaningfully audited by selecting 15 to 30 representative pages: homepage, primary landing pages, key conversion flows, transactional pages, and a sample of content templates. Patterns identified on the sample apply across the rest of the site. Re-audit after remediation, then schedule annual re-audits to catch regressions as the site evolves.

The Accessibility Statement: What It Should Say

Every site that takes accessibility seriously should publish an accessibility statement linked from the footer. The statement is not a magic legal shield, but it does demonstrate good faith and provides a documented contact channel for users to report barriers. A defensible statement includes: the standard you are committing to (WCAG 2.2 AA), the date of the last audit, known limitations and remediation timeline, contact information for accessibility issues, and the response time commitment for accessibility complaints.

What the statement should not do: claim full compliance you cannot back up, list features without context, or use the statement as a substitute for actual remediation work. A poorly-written statement can actually be used against you in litigation by demonstrating that you knew about issues and did nothing. The full structure and wording approach is covered in our guide on website accessibility statement services.

Why Accessibility Overlays Are Not the Answer

The accessibility overlay industry — widgets that promise to make any site instantly compliant by adding an icon in the corner — is in legal retreat. Multiple federal courts have explicitly rejected overlay-only defenses. The DOJ has stated that overlays do not meet ADA requirements. Plaintiff's firms now actively target sites running overlays because the overlay frequently introduces its own accessibility failures while masking the underlying problems. Roughly 30 percent of demand letters in 2025 went to sites running an overlay.

Real accessibility requires real code work. Overlays cannot fix missing alt text accurately, cannot restructure broken heading hierarchy, cannot make custom widgets keyboard-accessible. They can resize text and adjust contrast for users who configure the widget — but most users with disabilities use their own assistive technology and either do not see the widget or find it interferes with their existing tools. Spend the overlay subscription budget on real remediation instead.

Cost, Timeline, and Ongoing Maintenance

A full audit and remediation project for a 50-to-500-page site typically runs $8,000 to $35,000 in initial cost (audit plus remediation work) and 4 to 16 weeks in timeline. Annual maintenance — re-audits, content review, training for the team that produces new content — runs $3,000 to $15,000 per year. Larger sites and ecommerce platforms scale up from there. The investment is significant but it is small compared to the cost of even a single ADA lawsuit settlement, and it produces a better experience for all users — including the substantial percentage of customers using assistive technology that businesses do not realize they have.

Ongoing maintenance is the part most companies skip and later regret. Sites drift out of compliance as new content gets added by people who were not trained on accessibility, new features get launched without accessibility review, and CMS templates get updated by developers who were not on the original audit. A quarterly review process plus content-creator training keeps the site compliant over time. Companies that invest in serious end-to-end ADA website compliance programs build it into the development workflow itself, so accessibility never becomes a project that has to be redone every two years.

The Litigation Risk Profile by Industry

Some industries get sued more than others. Retail and ecommerce lead by a wide margin (roughly 75 percent of all federal filings in 2025), followed by hospitality, healthcare, education, financial services, and entertainment. Plaintiff's firms target industries with deep pockets, public-facing transactions, and sites that show obvious failures on a first pass. B2B sites with restricted access, internal tools, and niche industrial products see lower volume but are not immune.

The risk multipliers within an industry: site size (larger sites = more potential failures), e-commerce capability (transactional sites face higher scrutiny), sensitive content (healthcare, finance), and visible brand recognition (well-known brands attract more attention). A small B2B site with 30 pages and no e-commerce might face one demand letter every several years; a large retail site with 5,000 product pages might face several per year if compliance is not actively managed.

What to Do This Quarter

If your site has never been audited, start with an automated scan from axe DevTools or WAVE. Catalog the top 50 issues by severity and frequency. Prioritize the four highest-frequency failure categories (alt text, contrast, keyboard, forms) and remediate them first. Publish an accessibility statement with a real contact email. Schedule a manual audit by a qualified third party for the following quarter. Train any team member who creates content (writers, designers, developers, marketers) on the basics so new content does not introduce new failures.

If your site has been audited but not re-audited in 18+ months, run a fresh automated scan to catch regressions, review the original remediation report against the current state, and check whether any WCAG 2.2-specific criteria need attention. The compliance work is never finished, but it is manageable as ongoing maintenance once the initial baseline is established. Most companies that build accessibility into their normal release cycle spend less per quarter on compliance than companies that try to catch up every two years through emergency remediation projects. The cost of staying ahead is a small fraction of the cost of catching up after a demand letter arrives.