Indemnification, Flow-Down, and Cure Periods: The Accessibility Clauses to Read Before You Sign

The Clause That Outlives the Contract

In November 2023, a California judge approved a settlement against Conduent — the company that built the ReserveCalifornia.com platform under a $66 million contract with the California Department of Parks and Recreation. The plaintiff, Bryan Bashin, is blind. He sued under the California False Claims Act's qui tam provision and the Unruh Civil Rights Act, alleging that Conduent's representations to the state about accessibility conformance were not true. The settlement totaled more than $2 million — split between Bashin's relator share, the State of California, plaintiff claims, and attorneys' fees — plus a mandatory third-party accessibility audit and full vendor-funded remediation.

The State of California did not pay. The developer did.

That is the precedent every municipal contractor needs to keep on the desk in 2026. Not because the case is unusual — it is unusual today, but the legal mechanics that produced it are now portable across thirty-three states with qui tam-enabled false claims acts. Not because the dollar figure is shocking — it is, but the structural lesson is bigger than the number. The case matters because it is the first clear public example of a contractor paying a seven-figure settlement on a state government contract where the accessibility representations turned out to be unsupported by the test record.

Your contract is the document that determines whether Bashin v. Conduent reaches your firm.

This is the contract-language follow-up to last week's post on third-party embedded content, which traced how Title II's "provides or makes available" framing pulls inherited failures onto your plate. That post promised this one. Below is the contractor's-eye reading of the four contract sections that determine your downside — indemnification, flow-down, remediation triggers, and warranties — across the six state markets the May 18 state-laws map covered. The DOJ moved the federal deadline on April 20. Almost nothing in this post moved with it.

Why the IFR Did Not Change Your Contract

The DOJ's April 20, 2026 Interim Final Rule (91 FR 20902) pushed the federal Title II WCAG 2.1 AA technical-standard dates to April 26, 2027 and April 26, 2028. That extension shifted what your municipal clients owe the federal government. It did not shift what you owe your municipal clients.

The reason is structural. The accessibility contract clauses now embedded in state and local IT procurement do not reference the federal date. They reference WCAG 2.1 AA as a technical standard, the underlying Title II obligation as a continuing duty, and the applicable state statute as a separate procurement gate. Colorado HB 25-1152 went live August 6, 2025 — over a year before the federal date that just moved — and deems an accessibility indemnification included in every state agency contract by operation of law, struck-through or not. Virginia VITA's revised Mandatory Core Contractual Terms went into effect April 24, 2026, four days after the IFR, and Virginia procurement officers were directed to update in-progress RFPs to incorporate them. Massachusetts EOTSS published its Vendor Digital Accessibility Contract Language under Executive Order 614 in 2023 and has been requiring it since.

If you signed a municipal contract in 2025, the accessibility clauses inside it are still binding in 2026, still binding in 2027, and likely still binding through the warranty survival period — typically one to three years past contract termination. The federal extension is a date change at the top of the regulatory stack. Everything below it is unchanged. That is the posture this post is written into.

The Four Sections That Determine Your Downside

Every municipal IT contract that addresses accessibility does it through some combination of four clauses. Reading them as a set — and understanding how they interact — is how you decide what to push back on, what to insure against, and what to flow down to your own subs before you sign.

1. Indemnification: Read It Twice, Read It Separately

The DOJ's January 2025 Resource Document for state and local governments tells public entities three things to put in their vendor contracts: require a warranty of compliance with WCAG and applicable state laws, prohibit vendors from disclaiming that warranty, and require indemnification for any breach. State procurement offices have taken that guidance and run with it. The accessibility indemnification you are being asked to sign in 2026 is no longer buried inside a generic "vendor shall indemnify the entity from all claims" paragraph. It is its own clause, sometimes its own section, with its own triggers and survival terms.

Colorado HB 25-1152 is the most aggressive version. The statute requires every contract between a state agency or public entity and a contractor to contain — and if it does not, deems the contract to contain — an accessibility indemnification covering costs, expenses, claims, damages, court awards, attorney fees, and any other amounts incurred by the agency in relation to the contractor's noncompliance. There is no cap. There is no professional-services carve-out. The Office of the State Controller's August 2025 implementation policy makes clear that if a contractor refuses to agree, the agency escalates to the State Controller, who consults the Attorney General. You cannot strike it; if you do, the statute deems it included anyway.

Massachusetts EOTSS is the model worth quoting back to procurement officers in other states. The Commonwealth's Vendor Digital Accessibility Contract Language contains a dedicated indemnification clause holding the Commonwealth harmless from any claims, damages, costs, and expenses arising from a failure of the deliverables to meet the accessibility requirements. What makes it contractor-survivable is the cap inherited from Section 13 of the Commonwealth Terms and Conditions for IT Contracts: liability is capped at the greater of $100,000 or two times the total contract value. Accessibility indemnification is not carved out of that cap. That is unusually contractor-friendly, and if you ever find yourself negotiating an uncapped clause in another state, the Massachusetts language is the precedent to reference.

Virginia HB 2541 takes a different mechanical path. The statute does not impose a direct private indemnification at the contractor level. Instead, it works through procurement gatekeeping — a vendor-paid Accessibility Conformance Report and a Vendor Accessibility Roadmap — and a liquidated-damages remedy. If the vendor fails to remediate identified accessibility shortfalls within twelve months of contract award, the covered entity may require a contract credit equal to twelve months of contract cost, not to exceed $10,000, or cancel the contract and seek reimbursement of outstanding contracting costs. The $10,000 cap is the friendliest number in this entire post.

Minnesota runs leaner at the state contract-template level, but the University of Minnesota model — widely copied by agencies and local governments — contains an open-ended indemnification covering any claim arising from a failure to comply with the applicable state and federal accessibility statutes. Pair that with the Minnesota Human Rights Act's $500-per-violation statutory penalty and $15,000 aggregate cap under § 363A.42, and you have direct user-side exposure plus contractor-side indemnification, with no overall cap defined.

Washington authorizes agencies to reduce or terminate contracts when vendors fail to respond and remediate on time, or when they misrepresent the current accessibility of their products. The state does not mandate a specific indemnification template; agencies import indemnification from Department of Enterprise Services master contracts.

California has no single mandated accessibility indemnification analogous to Colorado's. What California has instead is the Unruh Act's $4,000-per-violation statutory floor, the AB 434 biennial agency certification regime, and the Bashin precedent. If AB 2190 or the reintroduced AB 1757 pass with their contractor-liability language intact during the 2025–26 session, the state will catch up to Colorado quickly.

The contractor's reading checklist on indemnification:

Read the accessibility indemnity separately from the general one. Two clauses, two analyses. Check whether the contract's overall liability cap actually applies to the accessibility indemnity, because in most state templates it does not unless you draft it that way. Demand a "third-party claims only" qualifier — limiting indemnification to claims brought by users, advocacy organizations, or the DOJ rather than first-party damages claimed directly by your government client. Demand a notice-and-cure precondition; you cannot defend a claim you do not know about. And demand the right to control the defense and settlement of any indemnified claim. Without that last one, the government picks counsel at your expense and settles on terms that may not protect your interests.

2. Flow-Down: The Only Way to Avoid Being the Last Party Holding the Bag

Flow-down clauses come from construction and federal contracting. The principle is simple: whatever the prime promised the owner, the subcontractor promises the prime. The accessibility version of this is now the difference between a solo contractor surviving a Tyler payment widget failure and absorbing the cost personally.

The federal template is Section 508 of the Rehabilitation Act and FAR Subpart 39.2. Federal agencies look only to the prime contractor; the prime must flow accessibility obligations down to subs or absorb subcontractor failures itself. State and local procurement borrows that posture even though Section 508 does not directly apply. None of the six target states (Colorado, Virginia, Massachusetts, Minnesota, Washington, California) has an explicit accessibility flow-down statute. But every one of them reaches embedded vendors through the way the contract defines "deliverable." The Massachusetts EOTSS clause defines deliverable broadly enough to cover any third-party widget you integrate; Colorado's statute reaches any supplies or services with no carve-out; Virginia's ITAA requires the ACR to cover the full ICT being procured, which procurement officers read to mean the entire delivered system, embeds included.

What this means in practice: if you do not flow the obligation down to your subs and to the third-party components you integrate, you absorb the entire exposure yourself. That is the structural mistake the May 25 post on third-party content was designed to prevent. The clause below is the version to add to your subcontracts:

Subcontractor agrees that any software, code, content, widget, or service it provides for incorporation into the Deliverable shall conform to WCAG 2.1 Level AA, or to the higher standard required by the prime contract. Subcontractor shall provide a current Accessibility Conformance Report no more than twelve months old at the time of delivery; provide a Vendor Accessibility Roadmap for any non-conforming success criterion identifying the criterion, severity, target remediation date, and remediation technique; remediate identified violations at no additional cost within the cure period specified in the prime contract; cooperate with prime contractor's and the public entity's accessibility testing at no additional cost; and indemnify, defend, and hold prime contractor harmless from any claim, damage, cost, or expense arising from subcontractor's failure to meet these obligations. These obligations survive termination of the subcontract for three years.

That clause mirrors the structure of the Massachusetts EOTSS language and the Colorado OSC implementation policy, and it gives you the documentary chain — ACR, Roadmap, indemnity — to defend yourself when the prime contract's indemnification is invoked against you.

The hard reality is that Granicus, Tyler, CivicPlus, and Esri rarely accept a contractor's flow-down. Their standard agreements disclaim accessibility warranties and cap their liability at twelve months of fees paid. When the third party will not flow down, your only protection is the boundary-of-responsibility clause in your contract with the city — covered in the template section below.

3. Remediation Triggers and Cure Periods

The remediation clause tells you when the meter starts running. The cure-period clause tells you how long you have to fix the problem before contract remedies activate. These are the two paragraphs contractors most often skim, and skipping them is how a $250,000 project becomes a $160,000 project after the Commonwealth bills back third-party remediation.

Massachusetts is uncompromising. The EOTSS clause requires the vendor to remediate any accessibility violation that becomes known — whether through Commonwealth notice, vendor testing, or third-party audit — promptly and at no additional cost. Two provisions override anything elsewhere in the contract: where any other provision limits defect fixes to a warranty period, the accessibility provision controls; where any other provision requires only "reasonable efforts" to correct defects, the accessibility provision again controls. That language deliberately kills the standard vendor escape hatches. The triggers are broad and the cure obligation is open-ended.

Virginia prescribes a hard remediation window of twelve months from contract award. The trigger is identification of accessibility shortfalls; the cure period is twelve months; the remedy if cure fails is the $10,000 contract credit or cancellation with reimbursement. Build the twelve-month calendar into your project plan from kickoff. If you ship in month one and discover non-conformance in month nine, you have three months. Plan accordingly.

Colorado does not specify a numeric cure period — the standard is "promptly take all necessary actions to come into compliance." The contractor pays for third-party assessment and pays for remediation through a state-approved vendor. There is no liquidated-damages cap, and the agency has unilateral discretion to commission testing at any time. Local governments are layering their own templates on top of the state language; the City of Boulder vendor template requires a thirty-day VPAT turnaround and a three-year post-termination survival on the indemnification, which is a useful indicator of where Colorado local-government practice is heading.

Washington authorizes contract reduction or termination for unresponsive vendors but does not prescribe a numeric cure period. Agencies fill the gap with master contract terms.

Minnesota runs short at the agency template level — the standard MnDOT and MDH contract language is silent on cure periods. Watch for addenda that quietly insert a thirty-day cure window without flagging it.

The phrase "cooperation with testing" is doing real work in these contracts. The Massachusetts version obligates the vendor to provide the Commonwealth or any third-party accessibility service provider with access to test the digital products at no additional cost. That means test accounts at every permission level, source code or staging-environment access where the audit requires it, engineering staff time to answer testers' questions, and either acceptance of findings or written rebuttal. Budget for both the audit cost (Colorado makes you pay for it) and the engineering hours. Both are real.

Liquidated damages and contract credits are where the math gets brutal outside Virginia. Most state templates use "deduct from outstanding payments" mechanics with no cap. The Massachusetts language authorizes the Commonwealth to perform testing or remediation itself and deduct the actual cost from any payment owed to the vendor, or seek reimbursement. If you have a $250,000 SOW and the Commonwealth spends $90,000 on third-party remediation, you net $160,000. That is not hypothetical — it is the way the clause is written.

4. Warranties: The Anti-Disclaimer Move

A warranty is a representation about a state of facts. An indemnification is a promise to pay for someone else's losses. Both appear in the same contract, and the DOJ guidance explicitly directs public entities to require both.

The single most important detail to look for in the warranty section is whether the contract contains anti-disclaimer language. The Berkeley library model is the cleanest example: the standard software MSA's "All warranties are hereby disclaimed" boilerplate is replaced with "Except as to warranties of accessibility, all warranties are hereby disclaimed." Six extra words preserve the accessibility warranty even when the rest of the warranty section is gutted by negotiation. Procurement officers who know what they are doing insist on that edit. If your contract has the boilerplate disclaimer without the accessibility carve-out, the warranty has been quietly disclaimed away — which weakens the entity's position but does not protect you from the underlying statute or from indemnification obligations elsewhere in the contract.

Warranty survival is the other detail to check. Accessibility warranties typically survive contract termination for one to three years; the City of Boulder template uses three years. Default survival language in many templates is silent, which courts often interpret as indefinite. Limit it explicitly if you can.

The most consequential warranty distinction for a solo contractor is the boundary between platform conformance (which you control) and content conformance (which the client controls). A clean drafting model: contractor warrants that the platform code it develops will conform to WCAG 2.1 Level AA at the time of delivery and during the warranty period, but does not warrant the accessibility of content uploaded by the client or its users, third-party components procured by the client and not subcontracted through contractor, or modifications made by the client to the platform code after delivery. That paragraph is the single most important clause to add to your own MSA. Drawn correctly, it stops a city employee uploading an untagged PDF six months after launch from being your problem.

State-by-State at a Glance

| State | Indemnification posture | Cure period | Cap | |---|---|---|---| | Colorado | Statutory, deemed-included under HB 25-1152 | "Prompt" — undefined | None | | Virginia | Procurement-gate (ACR + Roadmap) plus liquidated damages | 12 months from award | $10,000 contract credit | | Massachusetts | Contractual, no carve-out from general cap | "Prompt" — overrides warranty-period limits | Greater of $100K or 2x contract value | | Minnesota | Open-ended at agency template level + § 363A.42 $500/violation | Agency-specific | None defined | | Washington | Imported from DES master contracts; termination right | Agency-specific | Agency-specific | | California | No mandated template; Unruh $4,000/violation; AB 1757/2190 pending | N/A | None defined |

The pattern is clear. Two states (Colorado and California) leave you exposed to uncapped statutory damages. One state (Virginia) gives you the friendliest cap in the country. One state (Massachusetts) gives you the friendliest cap inside a contractual rather than statutory regime. Two states (Minnesota and Washington) are mostly agency-discretion territory. A solo contractor working all six markets is bidding into the most contractor-protective regime (Virginia) and the most contractor-exposed regime (Colorado) using the same MSA template. That template needs work.

The Three Template Additions That Cover Eighty Percent of the Downside

Most contractor MSAs were written before WCAG 2.1 AA was a binding legal standard. Three additions, in writing, before your next bid:

One — the boundary-of-responsibility clause. Spell out what you warrant and what you do not. Platform code under your control, yes. Client-uploaded content, no. Third-party widgets procured by the client outside your subcontract, no. Modifications made after delivery, no. This is the single highest-leverage paragraph in your template; without it, the warranty is effectively perpetual and unbounded.

Two — the notice-and-cure mechanic. Tie the accessibility warranty to a defined acceptance test at delivery, then convert the warranty post-acceptance to a cure obligation: contractor will remediate any reported accessibility violation within thirty days of written notice identifying the specific WCAG success criterion alleged and the affected page or component. Without that mechanic, every client complaint about accessibility becomes an immediate breach. With it, you have a defined process and a defined timeline.

Three — the flow-down clause to subs and third-party components. Use the language in the flow-down section above. This is the only protection that survives when a Granicus or Tyler integration fails an audit and the prime contract's indemnification is invoked against you.

These three additions are contractor-protective without violating any state's mandatory contract language. They are the template work to do in May, not in October.

The Insurance Gap Nobody Wants to Acknowledge

Read your policy, not your renewal certificate. Standard cyber liability and Errors and Omissions policies almost universally exclude ADA and accessibility claims. The legal theory is that ADA claims are civil-rights actions, not professional negligence — and civil-rights claims are typically excluded from E&O coverage. Cyber policies generally cover only breach and data-loss scenarios. The one policy type with consistent coverage potential is Employment Practices Liability Insurance with Third-Party Wrongful Acts coverage that includes Third-Party Discrimination, and even there defense costs may be covered but remediation costs typically are not.

As of 2026, Vouch is the only carrier explicitly marketing Digital Accessibility coverage as a baseline in its General Liability product, having added it in mid-May 2024 for the startup market. Everyone else — Travelers, Chubb, Hiscox, Beazley, AIG — requires an endorsement, a sublimit, or a specific schedule, and the endorsement sublimits commonly land in the $25,000 to $100,000 range, which is not enough for a serious claim. The FTC's $1 million settlement with accessiBe in early 2025 has tightened underwriting attention; underwriters increasingly ask whether your remediation is source-code-level or widget-based, and disfavor the latter.

Write to your broker this week. Three questions, in writing. Does my current policy cover defense of ADA Title II, Section 504, and state-statutory accessibility claims? Does it cover remediation costs? Does it cover indemnification obligations I assume in government contracts? File the broker's written answers. They are the difference between a settlement that gets paid by the carrier and one that gets paid by you.

Limitation-of-liability clauses are enforceable in business-to-business contracts when the bargaining is between sophisticated parties and the cap is reasonable. They are not enforceable against statutory damages where a statute creates a private right of action that runs to the contractor directly — Colorado's $3,500 per violation under HB 21-1110, Unruh's $4,000 per violation, Minnesota's $500 per violation. Those statutes can reach you post-Bashin even when the user's contract is with the public entity. A cap of "fees paid in the prior twelve months" will not stop a false claims act treble-damages action or a Title II compensatory damages award.

What This Looks Like in Practice

Five exposure scenarios are most likely to land on a solo contractor between now and April 2027.

A demand letter arrives at the city, the city's legal office pulls your vendor contract, finds the indemnification clause, and sends you a tender of defense. You either accept (and pay defense plus settlement) or decline (and litigate the indemnification with the city while the underlying ADA claim accelerates). The demand-letter playbook from March is the response protocol; the contract clauses in this post are the upstream cause.

An audit commissioned by the public entity finds violations your ACR did not disclose. Massachusetts and Colorado both authorize this. You pay for the audit (Colorado), you pay for remediation, and your contract may be terminated.

A qui tam false claims action — the Bashin pattern — where a relator with no contractual relationship to you sues alleging that your accessibility representations to the state were not supported by the test record. Available in thirty-three states and territories with FCA qui tam provisions.

A statutory-damages class action under state law, multiplying per-violation damages across pages, documents, and users. Colorado, California, and Minnesota are the most active jurisdictions.

Procurement disqualification at the front end — failure to produce a current ACR or qualified Roadmap kills your bid before scoring. Virginia ITAA, Massachusetts EOTSS, and Colorado OIT all authorize this, and it is the most common scenario by far. The RFP-reading playbook from January covered how to spot the gate language before you bid; the contract clauses in this post are what you sign after you win.

The audit defense log is what protects you across all five. Dated ACRs, signed Roadmaps, email chains showing remediation work performed within cure periods. The contractor with that record walks out of a settlement negotiation paying a fraction of what the contractor with a single self-attested VPAT and no follow-up testing pays.

What Comes Next

The June 1 post will go deep on the VPAT and Accessibility Conformance Report — the documents referenced inside every contract clause above. Topics on deck: the four ITI editions (508, WCAG, EU, INT) and which one to use for state and local bids; the four conformance ratings (Supports, Partially Supports, Does Not Support, Not Applicable) and how to write defensible Remarks for the partial ones; the third-party evaluation requirement under Virginia HB 2541 and what "qualified neutral third party" actually means; the five most common contractor errors on self-attested VPATs; and what procurement officers look for when reviewing an ACR, drawing on the Massachusetts EOTSS review checklist.

The post after that will close the loop between what your contract obligates you to deliver (this post) and what you actually file as proof of delivery (June 1). Bookmark both if you have a Virginia, Massachusetts, or Colorado bid on the calendar.

The federal date moved on April 20. The contract clauses inside the agreements you are about to sign did not. Bashin v. Conduent is the case that should be on your desk when you read your next municipal MSA. Read the indemnification twice, read the flow-down hard, read the cure period for the trigger language, and read the warranty section for the disclaimer carve-out. Then update your own template. The contractor who does this in May has a defensible posture by the time the demand letter arrives. The contractor who does it in October does not.