PSBAR 2018: Accessibility Rules for Public Sector Suppliers

The Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018 (PSBAR 2018) implement the EU Web Accessibility Directive in UK law. They require public sector bodies to make their websites and mobile applications meet WCAG accessibility standards and publish accessibility statements documenting their compliance position.

While PSBAR 2018 directly binds public sector bodies rather than private companies, understanding the regulations is important for any supplier that builds, maintains, or provides technology to UK public sector clients. Contracts for public sector digital services routinely incorporate PSBAR obligations, and procurement frameworks such as G-Cloud and the Digital Marketplace require suppliers to demonstrate accessibility compliance.

For an overview of accessibility obligations on private sector websites under the Equality Act 2010, see website accessibility under the Equality Act 2010.

Scope: which bodies and which content

PSBAR 2018 applies to public sector bodies as defined in Regulation 2. The definition covers central government departments and agencies, local authorities, NHS trusts and bodies, maintained schools and higher education institutions, and most other bodies exercising a function of a public nature. Bodies governed by private law — private companies, charities, and social enterprises — are not directly bound, even if they receive public funding.

The regulations apply to websites (defined to include web applications accessible via a browser) and mobile applications. Certain content is excluded from scope entirely: pre-recorded audio and video content published before 23 September 2020; live audio and video; online maps where essential navigational information is provided by alternative accessible means; third-party content not under the body's control; and reproductions of items in heritage collections that cannot reasonably be made accessible.

Content can also be exempted on grounds of disproportionate burden, but this exemption requires evidence of a genuine proportionality assessment, not a blanket assertion. GDS has made clear in its monitoring activities that bodies claiming disproportionate burden must be able to demonstrate that they have assessed the cost and impact of compliance against the benefits to disabled users.

The WCAG standard

PSBAR 2018 requires compliance with WCAG 2.1 Level AA. However, as WCAG 2.2 was published by the W3C in October 2023 and supersedes WCAG 2.1, public sector bodies are now generally expected to work towards WCAG 2.2 AA compliance. GDS's accessibility monitoring and its own service standard treat WCAG 2.2 AA as the current benchmark.

WCAG 2.2 introduced nine new success criteria relative to WCAG 2.1, and removed one (4.1.1 Parsing, which is now obsolete in light of modern browser behaviour). The new criteria are primarily focused on cognitive accessibility and input methods:

• 2.4.11 Focus Appearance (Minimum)
• 2.4.12 Focus Appearance (Enhanced)
• 2.4.13 Focus Appearance
• 2.5.7 Dragging Movements
• 2.5.8 Target Size (Minimum)
• 3.2.6 Consistent Help
• 3.3.7 Redundant Entry
• 3.3.8 Accessible Authentication (Minimum)
• 3.3.9 Accessible Authentication (Enhanced)

Public sector suppliers delivering new builds should design to WCAG 2.2 AA from the outset. Existing contracts that specify WCAG 2.1 AA may not automatically require WCAG 2.2 compliance, but responsible procurement bodies will typically seek WCAG 2.2 conformance in contract renewals.

The accessibility statement requirement

PSBAR 2018 requires every in-scope public sector body to publish an accessibility statement for each website and mobile application. The statement must be published in an accessible format (typically HTML, not a PDF), be easy to find from the relevant website or application, and contain a specified set of information.

The required content is set out in the Schedule to the regulations:

A statement of the body's general policy on accessibility and its commitment to accessible websites and mobile applications. The current level of compliance — fully conformant, partially conformant, or non-conformant with WCAG — with known non-accessible content listed and explained. The reasons for any non-compliance or exemption claims. A description of any alternative access mechanisms where content is not fully accessible. Contact details for users to request accessible formats or report accessibility problems. A link to the enforcement procedure, which is the enforcement process run by GDS (or the Equality Commission for Northern Ireland).

GDS provides a generator tool for accessibility statements at www.gov.uk/government/publications/sample-accessibility-statement. For most public sector bodies, the GDS generator output forms the starting point, customised with genuine audit findings.

Monitoring and enforcement

GDS monitors a sample of public sector websites and mobile applications each year and publishes reports on its findings. Monitoring typically involves automated testing using tools such as axe-core supplemented by manual expert review. GDS reports findings to the relevant body and expects remediation within a reasonable timeframe.

Formal enforcement is handled by GDS and ultimately by the ICO, but enforcement action is rare. GDS typically works with non-compliant bodies to agree a remediation plan. Cases that are escalated to the ICO are unusual and have generally involved persistent non-compliance or refusal to engage with GDS monitoring.

Data subjects can bring complaints directly to the body in the first instance, and then to GDS if unresolved. The ICO can receive complaints where a body has failed to act, though the ICO's approach is primarily to direct complainants to GDS.

Implications for private sector suppliers

If your organisation builds websites, applications, or digital services for public sector clients, PSBAR obligations flow through your contract. Most public sector framework agreements (G-Cloud, Crown Commercial Service Digital Outcomes framework) require suppliers to warrant that deliverables meet accessibility standards.

In practice this means:

Procurement stage: tenders and applications often ask for evidence of accessibility compliance — audit reports, VPAT/ACR documents, or WCAG conformance statements. Suppliers who cannot demonstrate experience with accessibility testing are disadvantaged in procurement.

Contract terms: delivery contracts for public sector work typically include acceptance criteria that reference WCAG compliance. Defects that cause non-compliance with the client's PSBAR obligations may be treated as contractual defects requiring rectification.

Accessibility auditing: private sector suppliers providing components or platforms used on public sector websites may be asked to provide accessibility conformance reports (ACRs) or accessibility audit reports. Having a current third-party audit report reduces procurement friction.

Statement support: the public sector body is responsible for publishing the accessibility statement, but where the body relies on a supplier's platform, the supplier may be expected to provide conformance information for that platform.

Relationship with the Equality Act 2010

PSBAR 2018 and the Equality Act 2010 operate in parallel. PSBAR is sector-specific and prescriptive about standard and documentation. The Equality Act 2010 imposes a broader reasonable adjustments duty on all service providers, including public sector bodies, and does not specify a technical standard.

A public sector body that meets PSBAR but still excludes disabled users from accessing specific content may still be in breach of the Equality Act's reasonable adjustments duty. Conversely, a body that fails PSBAR monitoring may not face an Equality Act claim if disabled users can access the service by alternative means. The two regimes are distinct, though both push towards the same outcome: digital services that work for disabled users.

For a practical check of your website's accessibility baseline, run a free scan at /uk/en/scan.