16 September 2026

Your supplier's accessibility statement does not cover you

Ask a site owner about accessibility and you often hear a version of the same answer: we use Google, or Shopify, or a big platform, so it is taken care of. It is worth looking at what those suppliers actually publish. Google publishes 35 accessibility conformance reports, and not one of them covers reCAPTCHA, the Maps embed or the YouTube player. Those are the three Google parts most likely to sit on a small business site, and one of them stands between a visitor and your contact form.

What Google does publish

On its accessibility site, Google publishes Accessibility Conformance Reports based on the ITI VPAT template. Counted on 13 August 2026: 35 of them. They cover Workspace (Docs, Sheets, Slides, Gmail, Drive, Forms, Calendar, Chat, Meet and more), Chrome on Windows and macOS, ChromeOS, the education products, and a handful of communication apps.

That is a real amount of transparency, and more than most suppliers offer. It is worth saying plainly before the next part.

What is not on that list

Three things are missing, and they are the three you are most likely to have embedded:

• reCAPTCHA, which usually sits on the contact form
• the Maps embed, the route map at the bottom of almost every local business page
• the YouTube player, the company video on the homepage

Google Forms, by contrast, does have a report. So this is not a case of a supplier that publishes nothing. It is a case of a supplier that publishes a lot, and where the parts that end up on your pages happen to fall outside it.

The CAPTCHA is the one to look at first. The W3C put it this way in its note on the subject: the nature of the task inherently excludes many people with disabilities, resulting in a denial of service to these users. That is not a styling issue. If someone cannot get past the check, they cannot reach you at all.

Why a supplier declaration was never your cover

Here is the part that surprises people, and it holds even for a supplier that does publish a report for the exact component you use.

The European Accessibility Act puts the obligation on the service provider. Article 13(1): service providers shall ensure that they design and provide services in accordance with the accessibility requirements of this Directive. That is you, for your site. Not your CMS vendor, not your plugin author, not Google.

And conformity is presumed in one specific way. Article 15(1) says products and services that comply with harmonised standards whose references have been published in the Official Journal of the European Union are presumed to be in conformity. A VPAT is a template from ITI, a US industry association. It is not a harmonised standard, and it is not published in the Official Journal.

So a supplier declaration is a useful, checkable fact about that supplier. It is not a presumption of conformity for your service, and it says nothing about the version running on your site or about what you configured.

What buyers actually ask for

There is a second half to this. A supplier declaration only helps if someone asks for one, and most buyers do not. Disability:IN publishes an annual benchmark, the Disability Index, in which large employers answer 76 yes or no questions about how they handle disability inclusion. In the 2026 edition, 421 organisations took part, all of them with more than 500 employees, all of them volunteering to be measured. Among that group, 48 percent require suppliers to meet physical and digital accessibility requirements as a condition of purchase, and 47 percent have a formal process to fix accessibility problems that originate with a supplier.

Read those two numbers carefully, because the sample flatters them. These are companies that put themselves forward for a disability inclusion benchmark, so they are the half of the market that already cares. Even there, roughly one in two buys software without asking the accessibility question, and roughly one in two has no route to get a supplier problem fixed once it surfaces. The declaration you were counting on was never going to cover you. In most purchases, nobody even asked for it.

What a conformance report is actually good for

Three things, and they are worth having:

• It tells you which standard and level the supplier is aiming at, and who assessed it. A report written by an external accessibility firm is a different signal from a self-declaration.
• It names the exceptions. This is the most useful part and almost nobody reads it. Suppliers write down where their own claim stops, and that is exactly where your problems will be.
• It tells you which supplier to measure first.

What it cannot do is stand in for a measurement. A report describes a version on a date. Your visitors use the version you shipped, with the settings you picked.

What to do with this

Two practical steps, neither of which needs a budget.

First, find out what you have embedded. Most sites carry more third party components than their owners remember: a CAPTCHA, a map, a video player, a chat widget, a booking form, a review badge. Each of those is code you did not write, on a page you are responsible for.

Second, for the ones that block something (a form you cannot submit, a booking you cannot complete), check whether there is an accessible alternative route to the same outcome. A phone number and an email address that a person actually reads is a legitimate answer, and often a faster one than replacing the component.

We are not going to tell you whether your site is compliant, because that is not a thing a scan can decide. What we do is measure what is measurable, say clearly what automated testing cannot see, and tell you which parts of your page came from someone else.

Counts and absences in this article were verified on 16 September 2026 on Google's own conformance report page. Suppliers add and withdraw reports, so check the source before relying on it. The buyer figures come from the 2026 Disability Index Report, published by Disability:IN on 27 July 2026; participation is voluntary and the answers are self-reported. Quotations from Directive (EU) 2019/882 are from the official text. This article is information, not legal advice.