Keyboard-Only Testing for Procurement: Five Checks Before You Sign

A team bought a tool after a polished demo, then discovered the keyboard could not reach the save button. The contract had no accessibility clause, the vendor had no remediation timeline, and the tool stayed broken for a year. The demo was not a test. The purchase was the test, and it failed.

Procurement is where accessibility gets bought or lost

Accessibility is usually decided at purchase, not at build. A team buys a chat widget, a checkout add-on, a consent banner, or a review tool, and the tool brings its own keyboard behavior with it. The vendor demo shows a mouse user clicking through a scripted flow. The keyboard failures hide in the parts of the flow nobody demonstrated: the settings panel, the error state, the modal that opens on the third step. By the time the team finds them, the contract is signed and the remediation timeline is whatever the vendor feels like. The VPAT is the document that is supposed to prevent this, and it only works if someone reads it before signing.

The five checks, in order

First, Tab through the core flow with the keyboard only, from start to finish. If you cannot reach a control, the tool fails. Second, watch the focus indicator. If it disappears, or is a faint outline that vanishes against the background, the tool fails WCAG 1.4.11 on non-text contrast. Third, open every modal and menu and press Escape. If focus does not return to the control that opened it, the tool fails. Fourth, trigger an error and check whether it is announced and identified in text. Fifth, try to complete the flow without a mouse at all, including the parts the demo skipped. The fifteen-minute keyboard audit is the same test at smaller scale, and it catches the same failures. Five checks, fifteen minutes, and the demo's polish stops mattering.

What to write into the contract

Name the standard: WCAG 2.1 Level AA, under EN 301 549 where the EAA applies. Name the testing method: manual testing by keyboard and screen reader, not automated scanning alone. Name the remediation timeline: critical failures fixed within thirty days, serious ones within ninety. And name the buyer's right to test independently and to reject the tool if it fails. A clause without a testing method is unenforceable, because the vendor can always claim its own testing passed. A clause with a named method and a named timeline is a commitment, and it is the only one that survives the first dispute.

The check that takes fifteen minutes

Run the five checks on the vendor's trial account before the contract is signed, with your own content and your own workflows. If the tool fails, say so in writing and ask for the remediation date. If the vendor will not give one, the tool is not accessible, whatever the VPAT says. The fifteen minutes you spend before signing saves the year you would spend arguing about it after.

Frequently asked questions

Is the vendor VPAT enough to rely on?

The vendor's VPAT, a Voluntary Product Accessibility Template, is a self-assessment, and its value depends on how it was produced. A VPAT based on automated testing alone is a claim. A VPAT based on manual testing with a methodology note is evidence. Ask for the methodology before you trust the document.

Can I put WCAG conformance in the contract?

Yes, and it should be in every accessibility-related contract. The clause should name the standard, WCAG 2.1 Level AA under EN 301 549, the testing method, the remediation timeline for failures, and the buyer's right to test independently. A clause without a testing method is unenforceable.

Is a vendor demo enough to judge accessibility?

No. A tool can pass a vendor demo and fail on your content, your theme, and your users. Test it with your data and your workflows, not the vendor's scripted walkthrough. The demo is a sales artifact. Your test is the evidence.

What is the minimum testing I should do before buying?

For a large purchase, a keyboard-only test plus a screen reader pass on the core flow, backed by the vendor's VPAT and your contract clause. For a small purchase, the five keyboard checks in this post, run in fifteen minutes, catch the failures that matter most.