The State Laws That Didn't Move: A Contractor's Map of Non-Federal Digital Accessibility Requirements

A Contractor With Six Logos On Her Website

Imagine a small municipal-services firm that built city websites, citizen portals, or back-office digital tools for one city in each of six states: Denver, Richmond, Boston, Minneapolis, Seattle, and Los Angeles. On April 19, 2026, that contractor had one federal deadline to plan around — April 24, 2026 — and six state-law overlays that mostly tracked the federal rule. On April 20, the DOJ pushed the federal date out by a year, and on May 7, HHS did the same for Section 504. The contractor's federal exposure relaxed by twelve months.

Her state exposure did not. In some states it actually got harder, because the federal date moving means the state date is now the earlier one. In one state — Virginia — the state statute's compliance dates are April 24, 2026 and April 26, 2027, the original federal dates, written into Virginia law and not modified by the IFR. A Virginia covered entity that her firm sells into has a state compliance date in twenty-four days. In Colorado, the private right of action at $3,500 per violation has been live since July 1, 2025 and the federal extension does nothing to it. In California, two separate bills moving through the 2025–26 session would impose direct civil liability on contractors who negligently build inaccessible websites for covered entities — and those bills are the subject of active legislative debate this month.

This is the map of the state laws that didn't move. It is built for the solo contractor or small firm working multiple state markets, where the differentials between states are not academic — they determine whether your accessibility scope, your contract language, and your invoicing survive the next twelve months of "do we still need to do this" conversations. The previous post in this series covered the federal IFR and the conversation script for the call your client is making this week. This post is the reference you keep open while you have those calls.

The Federal Pattern Is Extension. The State Pattern Is Not.

In the seventeen days between April 20 and May 7, 2026, two federal agencies extended digital-accessibility compliance dates by a year. DOJ pushed Title II from April 24, 2026 to April 26, 2027 (≥50K population) and April 26, 2027 to April 26, 2028 (smaller entities and special districts). HHS pushed Section 504 from May 11, 2026 to May 11, 2027 (recipients with 15+ employees) and May 10, 2027 to May 10, 2028 (smaller recipients), in an Interim Final Rule published May 7. HHS's stated rationale: align with DOJ's parallel delay. The federal pattern is now unambiguous — extension across the board, with a 60-day comment period on the HHS rule closing July 6, 2026 and a comment period on the DOJ rule closing June 22, 2026.

State legislatures and state IT agencies have not followed that pattern. Not one of the six states surveyed below modified its digital-accessibility statute or its procurement standards in response to the federal extensions. The state-side direction since April 20 has been forward — Virginia VITA published an implementation memo for HB 2541 on April 14, Minnesota continues to add pre-qualified vendors to its accessibility Master Contract Program, and California has two separate bills moving through the 2025–26 session that would expand contractor liability under the Unruh Act. For municipal contractors, this means the binding deadline in any given state is now whichever date is earlier — and in several of these states, that date is earlier than the federal rule's.

Colorado: $3,500 Per Violation, Live for Ten Months

Colorado HB21-1110 is the most aggressive state digital-accessibility statute in the country, and it has been in active enforcement since July 1, 2025.

Codified at C.R.S. § 24-34-802, the statute creates a private right of action in Colorado state court for any individual with a disability who encounters an inaccessible state or local government digital resource. Damages run at $3,500 per valid discrimination claim, plus actual damages and attorney's fees. The grace period under HB24-1454 — which extended the original July 1, 2024 deadline by twelve months — expired on July 1, 2025. The Office of Information Technology amended its implementing rules in May 2025, and OIT now defines "good-faith compliance" by reference to a documented remediation roadmap, a published mechanism for individuals to report accessibility barriers, and ongoing progress documentation.

The technical standard is WCAG 2.1 Level AA, the same standard as the federal Title II rule. What's different is scope: HB21-1110 applies to all state and local government digital content — public-facing, internal-facing, kiosks, third-party tools embedded in government workflows, and documents. There is no carve-out for archived content, preexisting social-media posts, or password-protected individualized documents at the depth the federal rule provides. The DOJ IFR does not affect HB21-1110 at all.

Public docket filings against state and local entities under HB21-1110 remain relatively quiet — accessibility consultancies tracking the statute have not surfaced a high-volume state-court filing pattern through early 2026. But absence of public filings is not absence of demand-letter activity, which is exactly the channel where most accessibility cases resolve before they ever reach a docket. For a contractor working any of Colorado's eighty-six county or municipal markets, the operative risk vector is the demand letter, not the lawsuit. The contract-language move is to make sure your accessibility scope is documented, your audit defense log is current, and your client knows that "we have an extra year on the federal date" does not extend to Colorado.

If your municipal client in Colorado tries to use the DOJ IFR as a reason to descope accessibility work, the direct answer is that the federal extension does not modify state civil-rights law, and the state has been in active enforcement for almost a year already.

Virginia: The State Law That Out-Strict the Federal Rule

Virginia is the sharpest example of why this post exists. Governor Youngkin signed HB 2541 into law on March 24, 2025 as Acts of Assembly Chapter 571. It amended the Virginia Information Technology Access Act (Va. Code §§ 2.2-3500 through 2.2-3505) and codified the dates April 24, 2026 (≥50K population entities, state public bodies, institutions of higher education) and April 26, 2027 (smaller entities and special district governments) directly into Virginia statute. Those dates are the original federal Title II dates. When DOJ extended the federal dates on April 20, the Virginia statute did not change with them.

In practical terms: a Virginia public university, a Virginia city of 50,000 or more, and every Virginia state agency has a state-law digital-accessibility compliance deadline that is now ten months earlier than the federal deadline. A contractor delivering a website or digital service into that market is bidding into a state-statute environment that the federal IFR did not touch.

The procurement-side requirements are where contractors feel HB 2541 most directly. For contracts negotiated or renegotiated on or after July 1, 2025, the covered entity must include vendor-side accessibility language requiring the vendor to certify that the product conforms to WCAG 2.1 Level AA, Section 508 (specifically 36 C.F.R. Part 1194, Appendix A § E202 and § E202.7 after a March 2025 floor amendment), and Section 255. If the vendor cannot certify full conformance, the entity may require a vendor-paid Accessibility Conformance Report in VPAT format completed by a digital accessibility subject matter expert with significant evaluation experience, or by a qualified neutral third party. Self-attested VPATs do not satisfy the statute. The vendor must also produce a Vendor Accessibility Roadmap documenting nonconforming areas and a remediation timeline. Failure to remediate within twelve months of contract award triggers contract credit equal to twelve months of contract cost (capped at $10,000) or contract cancellation with reimbursement of outstanding costs.

VITA's April 14, 2026 implementation memo formalized the operational details. VITA revised its Mandatory Core Contractual Terms to incorporate the HB 2541 accessibility requirements and is including the revised requirements in RFP packages and contract templates for procurements negotiated or renegotiated on or after April 24, 2026. Agency procurement officers were directed to review in-progress RFPs with anticipated award dates on or after April 24, 2026 and to work with their assigned OAG attorney to update Requirements Exhibits accordingly. The implementation guidance also designates each covered entity to optionally appoint a Digital Accessibility Coordinator with public-facing contact information for reporting accessibility barriers.

For a contractor bidding into Virginia, the operative reality is that the federal IFR is largely irrelevant. The state statute is binding, the procurement clauses are mandatory in any contract negotiated since last July, and the third-party-evaluated ACR requirement is a hard procurement gate that self-attestation cannot satisfy. The market premium right now is for contractors who can produce a credible third-party-evaluated ACR — your competitive positioning in Virginia in 2026 is largely a function of whether you can put one in front of procurement on demand.

Massachusetts: No Overlays, ACRs Under Twelve Months, Manual + Automated

Massachusetts operates its digital-accessibility regime through executive order rather than a standalone statute. Executive Order 614 (July 2023) directed the Executive Office of Technology Services and Security (EOTSS) to maintain enterprise-wide IT accessibility standards under the governance of the Commonwealth's Chief Information Accessibility Officer. The current enterprise standards adopt WCAG 2.1 Levels A and AA for web content, desktop applications, multimedia, and electronic documents; ATAG 2.0 A/AA for authoring tools; and PDF/UA-1 (ISO 14289-1:2014) for PDFs.

The procurement requirements are some of the most specific in the country. Vendor contracts for IT solutions must require, at minimum, that the vendor (a) provide an Accessibility Conformance Report no older than twelve months and based on the latest VPAT version evaluating WCAG 2.1 or 2.2 A/AA, (b) conduct both automated and manual accessibility testing as part of standard quality assurance at no additional cost to the Commonwealth, (c) provide Written Validation of accessibility conformance upon delivery, (d) submit a remediation Roadmap that becomes part of the contract, (e) cooperate with state-conducted or third-party-conducted accessibility testing at no cost, and (f) affirm in writing that no accessibility overlay or widget will be used as a means of compliance.

The no-overlays clause is the part that catches contractors who haven't read the procurement language carefully. The FTC's order against accessiBe in 2025 set the federal precedent that overlay claims constitute deceptive practice when they materially misrepresent conformance, and Massachusetts contract language went further by simply banning the practice for state contracts. If your firm has been delivering work that bundles in an overlay product — even as a "supplementary" tool while remediation continues — you cannot bid that approach into Massachusetts state contracts. The overlay-widgets post earlier in this series covers the broader procurement pattern; Massachusetts is the cleanest legal example of where the trend already went all the way to a written ban.

The federal IFR does not affect any of this. Massachusetts EOTSS maintained its standards through the executive-branch process under Executive Order 614 and has not issued post-IFR guidance modifying its requirements. The ACR-under-twelve-months requirement, the manual-plus-automated testing requirement, and the no-overlays clause are all live procurement gates today.

Minnesota: $500 Per Violation and a Pre-Qualified Vendor List

Minnesota operates two parallel mechanisms — a procurement standard administered by the State CIO, and statutory monetary penalties for inaccessible content under the Minnesota Human Rights Act.

Minnesota Statutes § 16E.03 Subdivision 9 requires the CIO to develop and maintain accessibility standards that incorporate Section 508 and WCAG. The current Digital Accessibility Standard v.4.0 applies to all executive-branch state agencies and to all IT procured, developed in-house, or substantially modified. Procurement language tied to the standard is binding on every state agency contract. Bid disqualification for noncompliance with the accessibility standard is an operational outcome — vendors who cannot demonstrate the required conformance are removed from active consideration, not just penalized at the back end.

Separately, Minnesota Statutes §§ 363A.42 and 363A.43 carry $500 per violation statutory penalties for inaccessible public records and continuing-education materials. These provisions are part of the state Human Rights Act and are enforced through the Minnesota Department of Human Rights. A contractor delivering inaccessible records or training materials to a Minnesota covered entity is exposed not only through procurement (the contract can be terminated) but through statutory damages assessable against the entity that then propagate back through indemnification clauses.

The procurement-ready mechanism that distinguishes Minnesota is the Accessibility MN Master Contract Program administered by the Office of State Procurement. The state pre-qualifies vendors for captioning, document remediation, audio description, sign-language interpretation, and other accessibility-adjacent services. A municipality or state agency can issue a work order against a Master Contract vendor without re-running competitive procurement, which means the pre-qualified list is the procurement market for accessibility services in Minnesota state and local government. Contractors who are not on the list are bidding into a market where their competitors have a procurement-velocity advantage they cannot match through pricing alone.

The DOJ IFR did not modify § 16E.03, did not modify § 363A.42 or § 363A.43, and did not modify the Master Contract Program. The federal extension is not a Minnesota event.

Washington: WCAG 2.2 AA on the Books

Washington State updated its digital-accessibility framework on December 10, 2024, when the State Chief Information Officer and the Technology Services Board approved WaTech Policy USER-01 and its companion technical Standard USER-01-01-S. The new framework is the successor to OCIO Policy 188 and applies to all Washington state agencies. Coverage includes websites, web applications, software, electronic documents, e-learning, multimedia, programmable interfaces, and kiosks, with procurement and contracting activities explicitly required to include accessibility requirements.

The technical standard in the formal PDF of USER-01-01-S references WCAG 2.2 Level AA — one step ahead of the federal rule's WCAG 2.1 AA. Many Washington state-agency public-facing statements still cite WCAG 2.1 AA, reflecting an in-progress transition; the operative version for any specific procurement should be confirmed with WaTech, but the direction is unambiguous. Washington is the first state in this map to formally adopt 2.2 as its baseline.

Executive Order 24-05 (early 2025) directed state agencies to strengthen accessibility for online systems and applications and reinforced procurement-side requirements. Like Massachusetts, Washington operates its standards through executive-branch governance rather than standalone statute, but the procurement reach is comparable. WaTech's policy explicitly extends to "contracting activities," which means any vendor selling into a Washington state agency is operating under an accessibility procurement gate that is, in the formal technical standard, at WCAG 2.2 AA.

The federal IFR did not modify Policy USER-01 or Standard USER-01-01-S. WaTech has not issued post-IFR guidance softening the requirements. A contractor working in Washington state government should treat WCAG 2.2 AA as the operative compliance target for procurement purposes regardless of what the DOJ technical date says.

California: Two Bills In Active Debate, Both Targeting Contractors

California is the most active legislative environment for digital accessibility in 2026, and the two bills currently moving through the 2025–26 session both extend liability to contractors and developers, not just to the entities that own the websites.

AB 2190 (Wallis) would amend the Unruh Civil Rights Act to add Part 2.54 to the Civil Code (commencing with Section 55.58.1). The bill creates an affirmative defense for businesses that publish a "digital accessibility report" disclosing specific accessibility barriers, along with expected remediation dates, and that remediate listed barriers within a specified period after publication. Beyond the affirmative-defense mechanism, AB 2190 prohibits "resource service providers" — defined to include web developers, vendors, and contractors who construct, license, distribute, or maintain inaccessible online resources — from doing so negligently, recklessly, or knowingly. The bill allows small business plaintiffs, the California Attorney General, and certain other public attorneys to sue contractors directly. Provisions apply to civil actions filed on or after January 1, 2026.

The political fight around AB 2190 is live as of this week. On May 8, 2026, the executive director of California Citizens Against Lawsuit Abuse published an opinion piece in the Times of San Diego opposing the bill, arguing that the 48-hour complaint-response window and the five-business-day review window are unworkable, that the bill's redefinition of intentional discrimination under the Unruh Act lowers the legal threshold for proving intent, and that the affirmative-defense protections are illusory. Whether AB 2190 passes in its current form, gets amended, or stalls is genuinely uncertain. What is certain is that the direction of California legislative effort is to put contractors on the legal hook directly.

AB 1757 — yes, the bill that died in the 2023–24 session — has been reintroduced in the 2025–26 session and is currently in committee. The current version of AB 1757 would require all websites and mobile applications offering goods or services in California to conform to WCAG 2.1 Level AA (some recent analyses suggest the working draft references 2.2 AA), and would expand liability to third-party developers while creating a private right of action for individuals with disabilities. A contractor selling into California is therefore facing a legislative pincer: two bills, both targeting contractor-side liability, neither dead.

California's existing statutory framework — independent of the new bills — already creates contractor exposure. Government Code § 11546.7 requires state agency heads to post a signed certification on the homepage that the agency website complies with Government Code §§ 11135 and 7405 and WCAG 2.0 Level AA "or any later version at Level AA." Most California state agencies have transitioned to WCAG 2.2 AA as the operative standard. AB 434 codifies the certification requirement. The Unruh Civil Rights Act incorporates ADA violations into California state law, with statutory damages of $4,000 per violation under Civil Code § 52.

The DOJ IFR did not touch any of this. The federal Title II extension does not modify Civil Code § 11546.7, does not affect Unruh Act remedies, and has no bearing on AB 2190 or AB 1757. A California-market contractor needs to track the 2026 legislative calendar at least as closely as the federal Federal Register, because the operative changes to contractor liability over the next twelve months are happening at the state level.

What to Add to Your Master Services Agreement This Quarter

Six states, six different exposure profiles. The good news is that the contract-language additions that protect you in one state largely protect you in the others. Below is the operational checklist — what to add to your standard Master Services Agreement and Statement of Work templates before your next bid goes out.

Reference the standard, not the federal date. Replace any clause that references "April 24, 2026" or "April 26, 2027" with language that ties compliance to "WCAG 2.1 Level AA (or the higher level required under applicable state law)" and to the underlying Title II obligation. The substantive obligation does not depend on the federal date and your contract language should not either. This is the single most important change.

Carve out the state-law overlay. Add a sentence to the accessibility recitals stating that the contractor's obligations are governed by the more demanding of (a) WCAG 2.1 AA, (b) the applicable state digital-accessibility standard, and (c) the applicable procurement clause. For a Virginia contract, this resolves to HB 2541. For a Washington contract, it resolves to WCAG 2.2 AA. For a Colorado contract, it resolves to HB21-1110's statutory damages framework. Writing the overlay clause once protects you in every state market.

Specify the ACR cadence. Massachusetts and Virginia both require third-party-evaluated or SME-evaluated ACRs no older than twelve months. Even in states that don't formally require it, building a twelve-month ACR cadence into your contracts gives you a defensible posture and aligns your billing schedule with your remediation cycle. The VPAT and ACR mechanics will be covered in detail in a June post; for now, the contract-language move is to commit to twelve-month re-evaluation in writing.

Add a no-overlays clause to your own work product. Match the Massachusetts contract language and Virginia's third-party-evaluator requirement by writing into your SOW that the deliverable will not rely on accessibility overlays or widgets as a means of conformance. This is both a compliance posture and a marketing posture — the FTC's accessiBe order made overlay claims a deceptive-practice issue under federal law, and the Massachusetts and California contract markets have moved against the practice. Volunteering the no-overlays commitment in your SOW is a low-cost differentiator.

Build a vendor-accessibility-coordinator function into the contract. Virginia HB 2541 contemplates a Digital Accessibility Coordinator on the entity side; offering to coordinate with that role on the vendor side — through a named point of contact in your firm — turns the procurement requirement into a service deliverable. This is the kind of small operational commitment that makes your bid more legible to procurement officers in Virginia, Minnesota, and Washington.

Document the indemnification scope. In states with statutory damages — Colorado at $3,500 per violation, Minnesota at $500 per public-records violation, California at $4,000 per Unruh Act violation — covered entities will push to indemnification you against vendor-caused liability. Read your indemnification clauses carefully. If you are agreeing to indemnify a city against any HB21-1110 claim arising from your work product, you need to know that exposure is real and per-violation. The audit defense log is the document that limits this exposure in practice; the contract language is what limits it in law.

The Twelve-Month View

The federal rule moved by twelve months. None of the state laws above did. By April 26, 2027, every state in this map will still be operating its own framework, and several of them will have moved further forward — Washington toward WCAG 2.2 AA, California through whatever survives of AB 2190 and AB 1757, Virginia through full operational rollout of the HB 2541 procurement language, Colorado through the maturing post-grace-period enforcement environment. The federal NPRM that DOJ signaled in the April 20 IFR may or may not appear in time to materially affect the April 2027 date; if it does, it could weaken the substantive rule, but it will not weaken any state law.

The contractor positioning for the next twelve months is therefore not "wait for the federal date." It is "build to the highest applicable standard across the state markets you serve, and make sure your contracts say so." A contractor working Colorado, Virginia, Massachusetts, Minnesota, Washington, and California in 2026 is effectively bidding against WCAG 2.2 AA with third-party-evaluated ACRs, no overlays, twelve-month re-evaluation cadence, and a documented audit defense log. That is the operational compliance posture the procurement market is converging toward — and it is the posture that protects you across every state in this map regardless of what happens next at the federal level.

The next post in this series, June 1, will go deep on VPATs and Accessibility Conformance Reports — what goes in, what stays out, and how to defend the claims you make. If you are bidding into Virginia, Massachusetts, or any procurement market that demands a third-party-evaluated ACR, that post is the one to bookmark before your next RFP response.

The DOJ moved the deadline on April 20. HHS moved its deadline on May 7. The state legislatures and state IT agencies that govern most of your operational compliance work did not move at all. The contracts you sign and the deliverables you ship over the next twelve months should reflect the map, not the headlines.