A11y Audit Skill — WCAG 2.2 AA + VPAT + Remediation

I'm writing the audit scaffold into ./a11y-audit-eu-launch/ first, and then I'll check whether the target and tokens file are reachable.

I'm re-running the evidence-folder write now, using the current working directory, and creating the raw folder alongside it.

The scaffold is in place. Next I'm checking whether the portal and the tokens file are reachable, read-only, one request each.

Quick status: the portal and tokens URLs don't resolve from my environment (DNS failure after 3 attempts), so I can't scan or test live pages. I'm recording that as UNREACHABLE and writing the honest deliverables (verdict NOT TESTED, VPAT with every criterion Not Evaluated). I'm also building a ready-to-run test kit so your team can get real results fast.

Now I'm updating the scaffold files to reflect the blocked state accurately.

Scaffold updated. Next up: the VPAT draft (all criteria honestly Not Evaluated) and the accessible HTML report.

Next I'm writing the test kit so your team can generate real results immediately: a rate-limited, read-only axe script, a token contrast checker, and the screen reader scripts.

Writing is done. Now I'm checking it: JSON validity, script syntax, and a functional test of the contrast checker with a synthetic sample (clearly test data, kept outside the audit folder).

All checks pass. Now I'm delivering the files.

Verdict: NOT TESTED. I can't tell you whether you can ship today, because the audit never got past input validation. The portal and the tokens file both failed DNS resolution from my environment (Name or service not known) across 3 attempts. I haven't scanned a page or run a screen reader, and findings.json has no findings. Zero findings here means zero testing, not conformance.

Severity counts: S1 0 / S2 0 / S3 0 / S4 0, with 0 of 12 pages and 0 of 5 AT configurations covered.

Highest-priority untested areas (not findings):

1. Payments: /payments/new → 3DS → receipt. Your team reports screen reader problems here, and 3DS is third-party.
2. Login, signup/KYC and security: /login, /signup, /settings/security (2FA, QR code and backup codes).
3. Global templates and the /invoices virtualized table, where a single defect has the widest reach.

Files: the canonical results are in findings.json and the full report is accessibility-audit-report.md (an accessible HTML version is alongside it). I also wrote remediation-plan.md, vpat-draft.md, scope.md and a test-kit/ folder. The remediation-plan.md contains unblock steps rather than fixes. vpat-draft.md has every criterion Not Evaluated and must not be published or cited as a conformance claim. The evidence/ and raw/ folders are empty on purpose.

Blockers:

UNREACHABLE: the hostnames don't resolve from here. The fetch tool labels two of the failures ROBOTS_DISALLOWED, but robots.txt was never retrieved, so this isn't a bot block.

• AUTH_REQUIRED: I don't have the audit credentials. Please keep it that way and don't paste them into chat.

AT_UNAVAILABLE: this sandbox has no NVDA, JAWS, VoiceOver, TalkBack or devices, so I can't produce transcripts. No one else can be asked to either; this needs human testers.

• SOURCE_NOT_PROVIDED: I have no repo or DOM snapshots, so static analysis hasn't run.

THIRD_PARTY_EMBED: the chat widget on /support and the 3DS redirect are out of your direct control, and I couldn't assess whether either is a blocker.

My shell network is also restricted, so rendered scanning from here may fail even with a public URL. The faster route is your team running the kit on staging.

What the kit gives you: a read-only axe script that scans sequentially with at least 500 ms between pages, a token contrast checker, and per-flow screen reader scripts with the payments flow first. I syntax-checked the scripts. I exercised the contrast checker only on synthetic sample data, not your tokens, and I haven't run the axe script because there was nothing to point it at.

Which route do you want?

1. Give me a reachable staging URL, or run the kit and send back axe-results.json and the token output.
2. Give me the React repo (GitHub owner/repo or zip) or rendered DOM snapshots per page and state, so I can run static analysis. That can prove some failures but nothing about runtime conformance.
3. Book human AT sessions on the 5-config matrix; I can turn the results into findings, a risk-ordered plan and a real VPAT.

For a launch about a month away, S1/S2 fixes plus a re-test need results within roughly a week. Also ask legal which instrument applies to you; I haven't assessed that. Don't run payment submissions against production.

{
  "audit": {
    "id": "A11Y-2026-10-08-001",
    "target": "https://portal.acmepay-eu.example.com",

"scope": ["/", "/login", "/signup", "/dashboard", "/invoices", "/invoices/:id", "/payments/new", "/payments/:id/receipt", "/settings/profile", "/settings/security", "/support", "/help"],

    "conformance_target": "WCAG 2.2 AA",
    "jurisdiction": "EU-EN301549",
    "status": "BLOCKED",

"blockers": ["UNREACHABLE", "AUTH_REQUIRED", "AT_UNAVAILABLE", "SOURCE_NOT_PROVIDED", "THIRD_PARTY_EMBED"],

    "coverage_pct": 0,
    "started_at": "2026-10-08T05:31:00Z",
    "completed_at": null,
    "environment": {
      "browsers": [],
      "os": [],
      "assistive_tech": []
    }
  },
  "summary": {
    "total": 0,
    "by_severity": { "S1": 0, "S2": 0, "S3": 0, "S4": 0 },
    "by_principle": { "perceivable": 0, "operable": 0, "understandable": 0, "robust": 0 },
    "verdict": "NOT TESTED",

"note": "Zero findings reflects zero testing, not conformance."

  },
  "findings": [],
  "manual_review_required": [],
  "not_tested": [
    { "area": "/ (marketing landing)", "reason": "UNREACHABLE: hostname did not resolve (3 attempts)" },
    { "area": "/login (email, password, SSO)", "reason": "UNREACHABLE" },
    { "area": "/signup (multi-step, KYC, T&C)", "reason": "UNREACHABLE" },
    { "area": "/dashboard (SPA, charts)", "reason": "UNREACHABLE; AUTH_REQUIRED" },
    { "area": "/invoices (virtualized 200+ row table)", "reason": "UNREACHABLE; AUTH_REQUIRED" },
    { "area": "/invoices/:id (detail, PDF download)", "reason": "UNREACHABLE; AUTH_REQUIRED" },
    { "area": "/payments/new (card entry, 3DS redirect)", "reason": "UNREACHABLE; AUTH_REQUIRED; 3DS page is THIRD_PARTY_EMBED (out of direct control)" },
    { "area": "/payments/:id/receipt", "reason": "UNREACHABLE; AUTH_REQUIRED" },
    { "area": "/settings/profile", "reason": "UNREACHABLE; AUTH_REQUIRED" },
    { "area": "/settings/security (2FA, QR code, backup codes)", "reason": "UNREACHABLE; AUTH_REQUIRED" },
    { "area": "/support (third-party chat widget)", "reason": "UNREACHABLE; THIRD_PARTY_EMBED (vendor follow-up required)" },
    { "area": "/help (docs, search)", "reason": "UNREACHABLE" },
    { "area": "Global header/footer templates and ~40 design-system components", "reason": "UNREACHABLE; SOURCE_NOT_PROVIDED" },
    { "area": "Design tokens colour-pair pre-check", "reason": "UNREACHABLE: tokens.json could not be fetched" },
    { "area": "Static source analysis (eslint-plugin-jsx-a11y, grep heuristics)", "reason": "SOURCE_NOT_PROVIDED" },
    { "area": "Automated rendered scans (axe, Lighthouse, Pa11y), both viewports", "reason": "UNREACHABLE; raw/ intentionally empty, no tool was run" },
    { "area": "Keyboard-only traversal, all flows", "reason": "UNREACHABLE" },
    { "area": "Visual/perceptual (contrast, 200% zoom, 400% reflow, text spacing, motion, forced colors)", "reason": "UNREACHABLE" },
    { "area": "NVDA 2024.4 + Chrome 131 / Windows 11 (P0)", "reason": "AT_UNAVAILABLE" },
    { "area": "JAWS 2025 + Chrome 131 / Windows 11 (P0)", "reason": "AT_UNAVAILABLE" },
    { "area": "VoiceOver + Safari 18 / macOS 14 (P0)", "reason": "AT_UNAVAILABLE" },
    { "area": "VoiceOver + Safari 18 / iOS 17, iPhone 15 (P1)", "reason": "AT_UNAVAILABLE" },
    { "area": "TalkBack + Chrome / Android 14, Pixel 8 (P1)", "reason": "AT_UNAVAILABLE" }
  ]
}

Accessibility Audit Report — AcmePay EU Customer Portal

Audit ID: A11Y-2026-10-08-001
Target: https://portal.acmepay-eu.example.com
Conformance target: WCAG 2.2 AA (+ EN 301 549 v3.2.1)
Audit date: 2026-10-08 (blocked at input validation)
Verdict: NOT TESTED
Coverage: 0% — see §7

1. Executive Summary

This audit could not be performed. The portal and the design-tokens file did not resolve from the audit environment (DNS failure; three attempts with backoff), so no page was loaded, scanned or tested. No credentials were available for the authenticated areas, no screen reader or test device exists in this environment, and no source repository was supplied. Nothing was run and nothing is reported as a result.

Can you ship? This audit cannot answer that. Zero findings here means zero testing. It is not evidence of conformance, and it is not evidence of failure. For a legally binding EU launch, conformance would have to be established by real testing before the launch decision. The requester also states that the payments flow has user-reported screen reader problems and has never been formally tested; that is context from the requester, not an observation of this audit.

2. Scope & Methodology

Scope is the 12 pages listed in scope.md, against WCAG 2.2 AA with the EN 301 549 v3.2.1 overlay. The intended method is the four-layer approach (automated scan, manual structural inspection, keyboard testing, screen reader testing). None of the layers executed. Details of what was attempted and the blocker labels are in scope.md.

3. Conformance by Principle

Not evaluated.

4. Top Risks

No findings exist. The following are the highest-priority

untested areas, ordered by the stakes the requester described. They are not findings.

1. /payments/new and /payments/:id/receipt: payment flow (sensitive flow; user-reported SR problems; 3DS step is third-party).
2. /login, /signup, /settings/security: authentication and KYC flows (SC 3.3.7, 3.3.8; 2FA/QR alternatives).
3. Global templates and the /invoices virtualized table: a single defect here has site-wide or high-volume reach.

5. Findings

None. No test was run.

6. Remediation Roadmap

No remediation items exist. See remediation-plan.md for the steps needed to unblock the audit, and test-kit/ for scripts your team can run now.

7. Not Tested / Limitations

Everything. Coverage is 0%. The full list, with per-item reasons, is in findings.json under not_tested:

• All 12 pages and all global templates/components.
• Design token colour pairs (tokens.json unreachable).
• Static source analysis (no repo supplied).
• Automated rendered scans on both viewports (nothing run; raw/ is empty by design).
• Keyboard-only traversal and visual/perceptual checks.
• NVDA, JAWS, VoiceOver (macOS), VoiceOver (iOS), TalkBack.
• Third-party chat widget (/support) and 3DS redirect: out of direct control, blocker status unknown.

Environment limitation: this sandbox's shell network is allowlist-limited, so live rendered scanning here may be refused even for a resolvable public URL. Real screen reader testing needs a human tester on real software/devices in any case.

8. Systemic Recommendations

• Run test-kit/ inside your own network or CI against staging and return the output; findings can then be normalized into findings.json.
• Commission real AT sessions using test-kit/at-test-scripts.md; the payments flow first.
• Never run payment submission steps against production with real instruments; use staging or provider test mode.
• After results exist: add axe-core as a merge gate and contrast checks in the token pipeline.

9. Appendix

• A. SC pass/fail matrix: all Not Evaluated (see vpat-draft.md).
• B. Test environment: none established.
• C. Raw tool outputs: none (raw/ empty).
• D. Note: the audit skill's SC matrix is abbreviated and omits 3.2.3 Consistent Navigation, 3.2.4 Consistent Identification and, for EN 301 549 v3.2.1, 4.1.1 Parsing (clause 9.4.1.1). These are included in the VPAT draft and test kit.

<!doctype html>

<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">

<title>Accessibility Audit Report — AcmePay EU Customer Portal</title>

<style>
  :root {
    --bg: #ffffff;
    --fg: #1b1b1b;
    --muted: #4a4a4a;
    --link: #0a4bc4;
    --border: #6b6b6b;
    --panel: #f3f4f6;
    --alert-bg: #fff4e5;
    --alert-border: #8a4b00;
  }
  @media (prefers-color-scheme: dark) {
    :root {
      --bg: #121212;
      --fg: #f2f2f2;
      --muted: #c9c9c9;
      --link: #8fb8ff;
      --border: #9a9a9a;
      --panel: #1e1e1e;
      --alert-bg: #2b1d08;
      --alert-border: #ffb14d;
    }
  }

• { box-sizing: border-box; }
  html { font-size: 100%; }

  body {
    margin: 0;
    background: var(--bg);
    color: var(--fg);
    font-family: system-ui, -apple-system, "Segoe UI", Roboto, Arial, sans-serif;
    line-height: 1.6;
  }
  .skip-link {
    position: absolute; left: -9999px; top: 0; z-index: 1000;
    background: var(--bg); color: var(--link);
    padding: .75rem 1rem; border: 2px solid var(--link);
  }
  .skip-link:focus { left: 0; }
  header, main, footer { max-width: 60rem; margin: 0 auto; padding: 1rem; }
  h1 { font-size: 1.75rem; line-height: 1.25; margin: 1rem 0 .5rem; }
  h2 { font-size: 1.35rem; margin: 2rem 0 .5rem; border-bottom: 1px solid var(--border); padding-bottom: .25rem; }
  h3 { font-size: 1.1rem; margin: 1.25rem 0 .25rem; }
  a { color: var(--link); text-underline-offset: .15em; }
  a:focus-visible, :focus-visible { outline: 3px solid var(--link); outline-offset: 2px; }
  @media (forced-colors: active) { :focus-visible { outline: 3px solid Highlight; } }
  dl.meta { display: grid; grid-template-columns: max-content 1fr; gap: .25rem 1rem; margin: 0; }
  dl.meta dt { font-weight: 700; }
  dl.meta dd { margin: 0; }
  .verdict {
    border: 3px solid var(--alert-border);
    background: var(--alert-bg);
    padding: .75rem 1rem;
    margin: 1rem 0;
  }
  .verdict strong { font-size: 1.15rem; }
  table { border-collapse: collapse; width: 100%; margin: .75rem 0 1rem; }
  caption { text-align: left; font-weight: 700; padding: .25rem 0; }
  th, td { border: 1px solid var(--border); padding: .5rem .6rem; text-align: left; vertical-align: top; overflow-wrap: anywhere; }
  thead th { background: var(--panel); }
  code { font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; font-size: .95em; overflow-wrap: anywhere; }
  nav ul { padding-left: 1.25rem; }
  @media (max-width: 40rem) {
    dl.meta { grid-template-columns: 1fr; }
    th, td { padding: .4rem; }
  }
  @media print {
    .skip-link { display: none; }
    body { background: #fff; color: #000; }
    a { color: #000; }
    h2 { break-after: avoid; }
    table, .verdict { break-inside: avoid; }
  }
</style>
</head>
<body>
<a class="skip-link" href="#main">Skip to main content</a>

<header>

<h1>Accessibility Audit Report — AcmePay EU Customer Portal</h1>

  <dl class="meta">
    <dt>Audit ID</dt><dd>A11Y-2026-10-08-001</dd>
    <dt>Target</dt><dd>https://portal.acmepay-eu.example.com</dd>

<dt>Conformance target</dt><dd>WCAG 2.2 AA (plus EN 301 549 v3.2.1)</dd>
<dt>Audit date</dt><dd>2026-10-08 (blocked at input validation)</dd>
<dt>Coverage</dt><dd>0% (see <a href="#limitations">Not tested and limitations</a>)</dd>

  </dl>
  <div class="verdict" role="note" aria-label="Verdict">
    <strong>Verdict: NOT TESTED.</strong>

No page was loaded or tested. Zero findings reflects zero testing, not conformance.

  </div>
  <nav aria-label="Report sections">
    <ul>
      <li><a href="#summary">1. Executive summary</a></li>
      <li><a href="#scope">2. Scope and method</a></li>
      <li><a href="#blockers">3. Blockers</a></li>
      <li><a href="#risks">4. Highest-priority untested areas</a></li>
      <li><a href="#findings">5. Findings</a></li>
      <li><a href="#roadmap">6. Roadmap to unblock</a></li>
      <li><a href="#limitations">7. Not tested and limitations</a></li>
      <li><a href="#recommendations">8. Recommendations</a></li>
    </ul>
  </nav>
</header>

<main id="main" tabindex="-1">

<section aria-labelledby="summary">
  <h2 id="summary">1. Executive summary</h2>
  <p>This audit could not be performed. The portal and the design-tokens file did not resolve from the audit environment (DNS failure; three attempts with backoff), so no page was loaded, scanned or tested. No credentials were available for the authenticated areas, no screen reader or test device exists in this environment, and no source repository was supplied. Nothing was run and nothing is reported as a result.</p>
  <p><strong>Can you ship? This audit cannot answer that.</strong> For a legally binding EU launch, conformance would have to be established by real testing before the launch decision. The requester states that the payments flow has user-reported screen reader problems and has never been formally tested; that is context from the requester, not an observation of this audit.</p>
  <table>
    <caption>Summary metrics</caption>
    <thead><tr><th scope="col">Metric</th><th scope="col">Value</th></tr></thead>
    <tbody>
      <tr><th scope="row">Findings</th><td>0 (nothing tested)</td></tr>
      <tr><th scope="row">S1 / S2 / S3 / S4</th><td>0 / 0 / 0 / 0</td></tr>
      <tr><th scope="row">Pages audited</th><td>0 of 12</td></tr>
      <tr><th scope="row">Assistive-technology configurations run</th><td>0 of 5</td></tr>
      <tr><th scope="row">Estimated remediation</th><td>Cannot be estimated</td></tr>
      <tr><th scope="row">Legal risk</th><td>Unassessed. Legal should confirm the applicable instrument(s); this is not legal advice.</td></tr>
    </tbody>
  </table>
</section>

<section aria-labelledby="scope">
  <h2 id="scope">2. Scope and method</h2>

<p>Scope is 12 pages against WCAG 2.2 AA with the EN 301 549 v3.2.1 overlay: <code>/</code>, <code>/login</code>, <code>/signup</code>, <code>/dashboard</code>, <code>/invoices</code>, <code>/invoices/:id</code>, <code>/payments/new</code>, <code>/payments/:id/receipt</code>, <code>/settings/profile</code>, <code>/settings/security</code>, <code>/support</code>, <code>/help</code>. The intended method is four layers: automated scan, manual structural inspection, keyboard testing, and screen reader testing. None of the layers executed.</p>

</section>

<section aria-labelledby="blockers">
  <h2 id="blockers">3. Blockers</h2>
  <table>

<caption>Blocking conditions and their effect</caption>
<thead><tr><th scope="col">Label</th><th scope="col">Evidence</th><th scope="col">Effect</th></tr></thead>

    <tbody>
      <tr><th scope="row"><code>UNREACHABLE</code></th><td>Portal and tokens.json each failed 3 attempts (backoff 3 s, then 6 s). First error: name or service not known (DNS). Later attempts: robots.txt could not be fetched, consistent with the same DNS failure (not independently confirmed). No bot denial was observed, so this is not <code>BOT_BLOCKED</code>.</td><td>No live page loaded; token pairs not checked.</td></tr>
      <tr><th scope="row"><code>AUTH_REQUIRED</code></th><td>No credentials in this session. Seven account pages are presumed to need login (inferred from route names, not observed).</td><td>Authenticated areas not tested.</td></tr>
      <tr><th scope="row"><code>AT_UNAVAILABLE</code></th><td>Linux sandbox; no NVDA, JAWS, VoiceOver or TalkBack; no iPhone or Pixel.</td><td>All five AT configurations not tested; no transcripts exist and none were fabricated.</td></tr>
      <tr><th scope="row"><code>SOURCE_NOT_PROVIDED</code></th><td>No repository, zip or DOM snapshots supplied.</td><td>Static analysis not run.</td></tr>
      <tr><th scope="row"><code>THIRD_PARTY_EMBED</code></th><td>Chat widget on <code>/support</code>; 3DS redirect on <code>/payments/new</code>.</td><td>Out of direct control; blocker status unknown.</td></tr>
    </tbody>
  </table>
</section>

<section aria-labelledby="risks">
  <h2 id="risks">4. Highest-priority untested areas</h2>

<p>No findings exist. These areas are ordered by the stakes the requester described. They are not findings.</p>

  <ol>
    <li><code>/payments/new</code> and <code>/payments/:id/receipt</code>: payment flow (sensitive; user-reported screen reader problems; 3DS step is third-party).</li>
    <li><code>/login</code>, <code>/signup</code>, <code>/settings/security</code>: authentication and KYC (SC 3.3.7, 3.3.8; 2FA and QR alternatives).</li>

<li>Global templates and the <code>/invoices</code> virtualized table: a single defect has site-wide or high-volume reach.</li>

  </ol>
</section>

<section aria-labelledby="findings">
  <h2 id="findings">5. Findings</h2>

<p>None. No test was run. See <code>findings.json</code> (canonical).</p>

</section>

<section aria-labelledby="roadmap">
  <h2 id="roadmap">6. Roadmap to unblock</h2>
  <table>

<caption>Actions needed before an audit can produce results</caption>
<thead><tr><th scope="col">#</th><th scope="col">Action</th><th scope="col">Suggested owner</th><th scope="col">Effort</th></tr></thead>

    <tbody>
      <tr><th scope="row">1</th><td>Provide a URL reachable from where testing runs (public staging, or run the test kit inside your network).</td><td>Platform / DevOps</td><td>XS</td></tr>
      <tr><th scope="row">2</th><td>Run the rate-limited axe script from <code>test-kit/</code> on staging with a pre-authenticated session; return the results file.</td><td>Frontend QA</td><td>S</td></tr>
      <tr><th scope="row">3</th><td>Run the token contrast script on tokens.json; return the output.</td><td>Design System</td><td>XS</td></tr>
      <tr><th scope="row">4</th><td>Provide the React repository, or rendered DOM snapshots per page and state.</td><td>Frontend lead</td><td>XS–S</td></tr>
      <tr><th scope="row">5</th><td>Schedule human screen reader sessions on the five-configuration matrix; payments first.</td><td>QA / external testers</td><td>L</td></tr>
      <tr><th scope="row">6</th><td>Obtain vendor accessibility conformance reports for the chat widget and the 3DS provider.</td><td>Procurement</td><td>S</td></tr>
      <tr><th scope="row">7</th><td>Set up a read-only test account and sandbox payments; hand credentials over through your vault, never in chat or files.</td><td>Security / Payments eng</td><td>S</td></tr>
    </tbody>
  </table>

<p>Planning note, not a finding: severity SLAs are S1 within 5 days and S2 within 15 days, and fixes need a re-test. With launch about a month away, results are needed in roughly the next week.</p>

</section>

<section aria-labelledby="limitations">
  <h2 id="limitations">7. Not tested and limitations</h2>

<p>Everything. Coverage is 0%. The itemized list with reasons is in <code>findings.json</code> under <code>not_tested</code>.</p>

  <ul>

<li>All 12 pages and all global templates and components.</li>
<li>Design token colour pairs.</li>
<li>Static source analysis.</li>
<li>Automated rendered scans on both viewports (the <code>raw/</code> folder is empty by design).</li>
<li>Keyboard traversal and visual or perceptual checks.</li>
<li>NVDA, JAWS, VoiceOver (macOS), VoiceOver (iOS), TalkBack.</li>
<li>Third-party chat widget and 3DS redirect.</li>

  </ul>

<p>Environment limitation: this sandbox's shell network is allowlist-limited, so live rendered scanning here may be refused even for a resolvable public URL. Real screen reader testing needs a human tester on real software and devices in any case.</p>

</section>

<section aria-labelledby="recommendations">
  <h2 id="recommendations">8. Recommendations</h2>
  <ul>

<li>Run the test kit in your own network or CI against staging and return the output.</li>
<li>Commission real assistive-technology sessions, ideally including screen reader users; start with payments.</li>
<li>Never run payment submission steps against production with real instruments; use staging or provider test mode.</li>
<li>After results exist, add axe-core as a merge gate and contrast checks in the token pipeline.</li>

  </ul>
</section>

</main>

<footer>

<p>Related files: <code>scope.md</code>, <code>findings.json</code>, <code>accessibility-audit-report.md</code>, <code>remediation-plan.md</code>, <code>vpat-draft.md</code>, <code>test-kit/</code>.</p>

</footer>
</body>
</html>

Remediation Plan — AcmePay EU Customer Portal

Audit ID: A11Y-2026-10-08-001

Status

No findings exist. Nothing was tested. This plan therefore contains no code remediation and no risk scores; inventing them would be fabrication.

A. Actions to unblock the audit (not findings)

Ordered by what gates the most work first. Owners are suggestions; effort uses the audit scale (XS ≤1h, S ≤1d, M ≤3d).

B. Test priority once unblocked

Based on the stakes you described (sensitive flows escalate one severity tier per the audit model):

1. Payments: /payments/new → 3DS → /payments/:id/receipt
2. Authentication/onboarding: /login, /signup, /settings/security
3. Global header/footer and design-system overlays (modals, toasts, menus); reach multiplier is highest here
4. /invoices (virtualized table), /dashboard (charts)
5. /settings/profile, /support, /help, /

C. Schedule note

Planning guidance, not a finding: the severity SLAs are S1 ≤5 days and S2 ≤15 days, and fixes need a re-test. If launch is about a month away, results are needed in roughly the next week to fix S1/S2 items and re-verify before launch.

D. Per-finding remediation entries

None. Add them here (ordered by risk_score desc, then effort asc) after real results exist.

Accessibility Conformance Report — DRAFT (VPAT® 2.5 INT format)

DRAFT. NOT FOR DISTRIBUTION OR PUBLICATION. This document contains

no evaluation results. No page of the product was tested (see Blockers). Every criterion is Not Evaluated. Do not submit, publish, or cite this as a conformance claim. It is a pre-filled structure to be completed after real testing.

Product information

Terms

• Supports / Partially Supports / Does Not Support / Not Applicable: not used in this draft.
• Not Evaluated: the criterion has not been evaluated. This is the only value used here.

Rule for completion: every value other than Supports must cite findings by ID (e.g. F-012) from findings.json.

Table 1: WCAG 2.2 Report — Level A

Table 2: WCAG 2.2 Report — Level AA

Table 3: WCAG 2.2 Report — Level AAA

Out of the stated conformance target (AA). All Level AAA criteria are Not Evaluated: 1.2.6–1.2.9, 1.3.6, 1.4.6–1.4.9, 2.1.3, 2.2.3–2.2.6, 2.3.2–2.3.3, 2.4.8–2.4.10, 2.4.12–2.4.13, 2.5.5–2.5.6, 3.1.3–3.1.6, 3.2.5, 3.3.5–3.3.6, 3.3.9.

Table 4: EN 301 549 v3.2.1 — Clause 9 (Web)

Clause 9 criteria map one-to-one to WCAG 2.1 Level A and AA success criteria, numbered 9. + the SC number (for example SC 1.1.1 is 9.1.1.1; SC 4.1.2 is 9.4.1.2). Results for each follow Tables 1 and 2 above, so all are Not Evaluated, with these specifics:

Table 5: EN 301 549 v3.2.1 — Other clauses

Legal notes (not legal advice)

• Legal should confirm which instrument(s) apply to AcmePay's EU services and how EN 301 549 conformance is to be evidenced.
• A public accessibility statement or ACR must only be issued from real evaluation results.

Completion checklist

• Real evaluation run (see test-kit/).
• Every non-Supports value cites finding IDs.
• Third-party components (chat widget, 3DS) reported separately with vendor ACRs.
• Legal review before any external use.

Audit Scope — AcmePay EU Customer Portal

Audit ID: A11Y-2026-10-08-001
Status: BLOCKED — UNREACHABLE (plus AUTH_REQUIRED, AT_UNAVAILABLE, SOURCE_NOT_PROVIDED; see Blockers)
Date opened: 2026-10-08
Target: https://portal.acmepay-eu.example.com
Conformance target: WCAG 2.2 Level AA
Jurisdiction overlay: EU-EN301549 (v3.2.1), stated as legally binding (payment provider)
Time-box: 4 hours (started 2026-10-08 11:01 IST). Budget not exhausted; work stopped because nothing could be tested.
Mode: Read-only on target. Writes only to ./a11y-audit-eu-launch/
Rate limit: concurrency 2 max, >=500 ms delay between requests (requests made: 6 fetches total, see log)
Verdict: NOT TESTED
Coverage: 0%

In-scope pages (12)

1. / marketing landing
2. /login email + password + SSO
3. /signup multi-step: identity, KYC, T&C
4. /dashboard SPA, heavy charts
5. /invoices data table, 200+ rows, virtualized
6. /invoices/:id detail + PDF download
7. /payments/new card entry, 3DS redirect
8. /payments/:id/receipt
9. /settings/profile form-heavy
10. /settings/security 2FA setup, QR code, backup codes
11. /support embedded third-party chat widget
12. /help docs, searchable

Global templates / components

Header, footer (global); ~40 design-system components (internal). Not inspected.

Third-party (OUT OF DIRECT CONTROL)

• Chat widget on /support (vendor). Blocker impact unassessed; vendor follow-up required.
• 3DS redirect on /payments/new (issuer/ACS page, not controlled by AcmePay).

Requested assistive-tech matrix (none executed)

• NVDA 2024.4 + Chrome 131 / Windows 11 (P0)
• JAWS 2025 + Chrome 131 / Windows 11 (P0)
• VoiceOver + Safari 18 / macOS 14 (P0)
• VoiceOver + Safari 18 / iOS 17, iPhone 15 (P1)
• TalkBack + Chrome / Android 14, Pixel 8 (P1)

Known context (as stated by the requester; not verified by this audit)

• React 18 SPA, client-side routing.
• Screen reader users report problems in the payments flow; never formally tested.
• Design tokens: https://design.acmepay-eu.example.com/tokens.json (colour-pair pre-check requested).
• Credentials: held in 1Password vault "A11Y-Audit-2025". NOT provided to this session. Never persisted. Do not paste them into chat.

Blockers

Note: this sandbox's shell network is allowlist-limited (package registries, GitHub). Even with a resolvable public URL, rendered scanning here may be refused. The practical route is running test-kit/ inside your own network/CI and returning the output (see test-kit/README.md).

Out of scope

• Anything requiring writes/modification of production (including submitting real payments).
• Load/fuzz/intrusive testing.

Status Log

• 2026-10-08 11:01 IST: Scaffold written.
• 2026-10-08: Reachability check, attempts 1–3 on portal and tokens.json: all failed (see Blockers). Status set to BLOCKED / UNREACHABLE.
• 2026-10-08: No scans, no AT sessions, no findings. Unblock options and a ready-to-run test kit written to test-kit/.