Beyond the Audit Certificate: Why Accessibility Conformance Is Failing Disabled Users

Accessibility has rarely been more prominent on the UK product agenda. Public sector bodies have spent the better part of a decade working to the 2018 accessibility regulations. Financial services firms now fold the subject into Consumer Duty discussions. Most design systems shipped in the past three years carry at least a documented contrast matrix and a set of focus-state tokens. Judged by what organisations report upwards, the direction of travel looks encouraging.

Judged by what disabled users report back, it is more complicated. A widening gap has opened between what an audit certificate attests and what someone using a screen reader, switch access or voice control actually experiences when they try to buy a rail ticket, check a balance or renew a licence. Call it the accessibility paradox: products that pass, services that fail. It is becoming one of the more consequential design problems of 2026.

How conformance became a proxy for quality

WCAG is a specification of technical criteria, not a statement about usability. That distinction matters because conformance is measurable and lived experience is not, and organisations gravitate towards what they can measure. An audit yields a number, a PDF and a review date. An abandoned journey yields nothing at all — no ticket, no complaint, no data point.

The Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018 gave UK teams a legal floor and, in doing so, a template: publish a statement, test against WCAG 2.2 AA, remediate, repeat annually. The template has done genuine good. It has also taught a generation of teams to treat accessibility as an artefact to be produced rather than a property of the product they shipped.

What the scoreboard cannot see

Three classes of failure slip through audit routinely.

The first is the composite journey. Individual screens can each be conformant while the sequence between them is not — a modal that traps focus mid-flow, a session that expires while a user dictates a long reference number, a redirect to a third-party identity check that the design team never specified and never tested.

The second is content. Alt text can be technically present and functionally useless; error messages can meet contrast requirements while telling a user nothing actionable. Widely cited, if contested, estimates suggest automated tooling detects only a minority of real accessibility defects, which places most of the burden on human judgement — and human judgement is what compressed research budgets cut first.

The third is timing and cognition. WCAG's timing criteria are generous on paper and frequently ignored in practice. A banking app that logs a user out after ninety seconds of inactivity is not obviously non-compliant, but for someone navigating with voice control and a motor impairment it is exclusion by default setting.

The public sector laboratory

Central government monitoring returns, published annually, have consistently found that a meaningful proportion of sampled public sector websites and apps fail basic checks — absent accessibility statements, unlabelled form controls, insufficient contrast. These are not exotic failures. They are the fundamentals, recurring years after the regulations took effect.

That persistence is instructive. It suggests the problem is not knowledge scarcity but incentive design. Where accessibility is owned by a delivery manager completing a compliance task rather than by a product team accountable for outcomes, the statement gets published and the journey stays broken.

Fintech's particular blind spot

Financial services present the sharpest version of the paradox, because the consequences of failure are material. Identity verification, biometric prompts rendered inside embedded web views, one-time passcode entry, transaction authentication and vulnerability screening all sit on the critical path. Each involves a third-party component, and third-party components are where accessibility ownership most often evaporates.

Consumer Duty has given UK firms a language for this — foreseeable harm, consumer understanding, outcomes — but the operational response has too often been a documentation exercise layered on top of an unchanged interface. A customer who cannot complete a biometric challenge is not merely inconvenienced; they are excluded from their own money.

Redesigning the research paradigm

The way out is not more audits. It is a different research posture, built on four shifts.

Recruit disabled participants continuously, not episodically. A standing panel of users across a range of impairments and assistive technologies, engaged on a quarterly cadence, turns accessibility from a project into a practice.

Test journeys end to end, in realistic conditions. Bring your own device, your own assistive technology, your own account in a test environment. Composite failures are invisible to scripted single-screen tests.

Instrument for task completion, not just conformance. Where consent and privacy allow, segment analytics by assistive technology usage and watch completion rates rather than page views. A drop-off concentrated in one cohort is a signal no audit will surface.

Treat the audit as a hypothesis. It tells you where to look. It does not tell you what a disabled user will experience when they get there.

From compliance theatre to product accountability

The deeper change is organisational. Accessibility statements should be honest about known gaps rather than aspirational. Procurement should stop accepting vendor conformance documents at face value and start asking for evidence of testing with assistive technology. Component-level accessibility should form part of the definition of done in the design system, so that the default is accessible and the exception requires justification.

Above all, leadership metrics need to change. If the number reported to the board is a conformance percentage, teams will optimise for the percentage. If the number is task completion for disabled customers, they will optimise for the journey.

The paradox is not that UK product teams are careless. Most are not. It is that the apparatus built to protect disabled users has become efficient at producing evidence of care while remaining unreliable at delivering it. Closing that gap is a design problem, a research problem and, above all, a governance problem — and it will not be closed by another audit.