Skip to main content
Dark green background, "Weak Application Security Can Cost You Millions," 3 slanted images of fingers pointing to digital locks, and a "Learn the Basics" button
Five WCAG 3 Planning Mistakes Compliance Teams Keep MakingWCAG Principles and Conformance
4 min readFor Compliance Officers

Five WCAG 3 Planning Mistakes Compliance Teams Keep Making

WCAG 2.2 is nearing finalization, while WCAG 3 remains in a draft state. The W3C/WAI has indicated that WCAG 3 won't replace WCAG 2 immediately, and WCAG 2 will remain relevant for several years after WCAG 3 is finalized. If WCAG 3 is finalized around 2029, with a five-year transition, you're looking Assistive Technology a decision window extending to around 2035. This is an assumption, not a published schedule, but it highlights the planning horizon you're facing.

Why These Mistakes Keep Happening

Compliance officers often face conflicting pressures. Vendors and speakers may imply that the next standard is imminent, while your legal obligations are tied to current standards. The European Accessibility Act relies on EN 301 549, referencing WCAG 2.1. Section 508, ADA Title III litigation, and the DOJ Final Rule (2024) all depend on the WCAG 2 family.

With a long, uncertain timeline and evolving drafts, teams may panic or neglect their responsibilities. The five mistakes below stem from these reactions.

Mistake 1: Pausing WCAG 2.2 Work to Wait for WCAG 3

Why it happens: WCAG 3 seems like the future, making investment in WCAG 2.2 feel temporary.

The consequence: Ignoring WCAG 2.2 exposes you to legal risks today. The core principles of both standards (perceivable, operable, understandable, robust) remain consistent. A site compliant with WCAG 2 won't become inaccessible when a new standard is published. Pausing leaves users blocked and your organization vulnerable.

The fix: Treat WCAG 2.2 as your conformance baseline. Remediation work done now isn't wasted; addressing issues like missing text alternatives benefits users under any future model. Fully fund the current baseline and monitor WCAG 3 developments.

Mistake 2: Assuming WCAG 3 Replaces WCAG 2 on a Set Date

Why it happens: People expect a clear transition, similar to software updates.

The consequence: Teams may plan for a WCAG 2 sunset that isn't realistic. You'll likely face a period where both standards are relevant. Laws and policies will continue citing WCAG 2 as WCAG 3 evolves, and you'll need to address both with clients and procurement officers.

The fix: Plan for coexistence. Decide which standard your Accessibility Conformance Reports and contracts will cite, and include this in your Accessibility Governance policy. Revisit this decision when a regulator changes their reference, not when the W3C releases a new draft.

Mistake 3: Ignoring the Cost of Auditing Against Two Rulesets

Why it happens: Budget owners may assume the audit program will simply update.

The consequence: Auditors might need to conduct WCAG 2 tests, WCAG 3 tests, or a combination, each with unique requirements. Without planning, you risk inconsistent reports and unexpected costs.

The fix: Standardize your Conformance Testing methodology now. WCAG-EM provides a structured approach to define scope, sample pages, and report findings. Build your procedures around it so adding a second ruleset later is a criteria change, not a process overhaul. Discuss dual-standard engagements with your audit vendors in advance.

Mistake 4: Treating Graded Conformance as a Drop-in Replacement for Pass/Fail

Why it happens: A graded model seems more nuanced and forgiving.

The consequence: Under WCAG 2, missing an alternative text on an image fails SC 1.1.1 Non-Text Content. WCAG 3 drafts suggest the number of affected images might affect outcomes, altering what a "result" means. Legal teams and regulators are used to clear pass/fail outcomes. Graded conformance introduces ambiguity in public claims and potential legal challenges.

The fix: Avoid building scoring dependencies into your risk model. Keep reporting focused on clear, criterion-level findings that can adapt to future models. If you pilot graded approaches, label them as internal metrics, not conformance claims. Larger organizations with established processes can manage this more easily; smaller teams should verify vendor capacity.

Mistake 5: Training the Whole Organization on a Moving Target

Why it happens: Teams want to be early adopters and invest in staff education.

The consequence: You risk retraining staff on guidance that will change. Most websites still fail WCAG 2, with issues like unlabeled form fields and insufficient color contrast. Training on a draft diverts resources from addressing these current failures.

The fix: Train to WCAG 2.2 and its principles. Focus on building skills in recognizing patterns and implementing fixes, as this experience is transferable. Certification programs like those from the International Association of Accessibility Professionals remain anchored in WCAG 2, making them a sound investment.

Prevention Checklist

  • Confirm which WCAG version your applicable law, contract, or regulator currently cites, and document it.
  • Fund WCAG 2.2 conformance as the baseline; don't defer remediation for WCAG 3.
  • Write a coexistence position into your Accessibility Governance policy, naming the standard your Accessibility Conformance Reports cite.
  • Standardize Conformance Testing around WCAG-EM so a second ruleset is a criteria change, not a process change.
  • Ask audit vendors how they'll handle WCAG 2, WCAG 3, and combined engagements.
  • Keep conformance claims criterion-based; label any graded scoring as internal until a regulator recognizes it.
  • Train staff on WCAG 2.2 and the underlying principles, not on draft text.
  • Assign one owner to monitor W3C/WAI publications and brief leadership when a regulator, not a draft, changes your obligations.
  • Include WCAG version language in Accessible Procurement requirements so vendor commitments don't go stale.
  • Review this plan annually, or sooner if a law you answer to adopts a new reference standard.

The sound position for most compliance programs is simple: meet WCAG 2.2 well, stay flexible, and let regulation, not enthusiasm, set your timeline.

Digital advertisement promoting the whitepaper “The State of Application Security in Modern Software,” showing the cover f the whitepaper and text highlighting AppSec risks, AI code threats, API vulnerabilities, and a button to download the whitepaper.

You Might Also Like