Risk managers frequently grapple with web accessibility concerns. They're not looking for theory; they want practical answers about deadlines, vendor tools, and explaining risks to executives who see accessibility as just an IT issue.
These questions arise in Slack channels, compliance forums, and after demand letters reach legal teams. Here's what risk managers are really asking and what you need to know.
Does the Size of My Company Matter for ADA Title III?
No, company size doesn't matter under ADA Title III. There's no small-business exemption. If your business is open to the public, you're covered.
Demand letters can target businesses with just five employees and no physical storefront. Plaintiffs don't filter by revenue or headcount. They look for accessibility barriers on websites selling goods or services to the public.
For risk managers, this means web accessibility isn't just an enterprise concern. The risk exists as soon as your organization operates a customer-facing digital property. The question isn't whether the law applies, but whether you're managing the risk before someone else identifies it.
What's the Difference Between Title II and Title III Compliance?
Title II applies to state and local governments, while Title III applies to private businesses serving the public. The enforcement mechanisms differ significantly.
Under the DOJ's 2024 Title II rule, state and local governments must conform to WCAG 2.1 Level AA by specific deadlines: April 26, 2027, for entities serving populations of 50,000 or more, and April 26, 2028, for smaller entities and special district governments.
For Title III, there's no federal rule specifying WCAG conformance. However, the DOJ and courts consistently point to WCAG 2.1 Level AA as the compliance benchmark. Title III is enforced mainly through private litigation, not federal rulemaking.
From a risk management perspective, Title II entities face regulatory enforcement and litigation risks. Title III entities face litigation risk without a published standard's clarity. Both need WCAG 2.1 AA conformance, but the enforcement path differs.
If We Get Sued, What's the Timeline for Remediation?
Timelines depend on whether you settle or go to trial, but expect aggressive timelines either way.
Most organizations settle. Consent decrees typically require full WCAG 2.1 Level AA conformance within 12 to 18 months, with interim milestones Assistive Technology 90 or 180 days. You'll also commit to ongoing monitoring, third-party audits, and regular reporting to the plaintiff's counsel.
If you go to trial and lose, the court will impose its own remediation timeline. Orders can require conformance in as little as six months. The court doesn't care about your CMS's accessibility or your vendor's timeline. The order sets the deadline, and you're responsible for meeting it.
Litigation costs pile up fast. Legal fees, audit costs, remediation work, and potential damages add up. The longer you wait to address accessibility, the more expensive and disruptive the remediation becomes when it's court-ordered.
Can We Just Rely on an Automated Scanning Tool?
No, automated tools catch some issues, but they can't evaluate most WCAG success criteria.
The WebAIM Million 2026 report found that 95.9% of home pages had detectable WCAG failures. Automated tools can flag missing alt text, color contrast failures, and some structural issues. They can't evaluate whether your alt text is descriptive, whether your forms work for screen readers, or whether your keyboard navigation is effective.
Relying solely on automated tools creates a false sense of compliance. You're measuring what's easy, not what matters to users or courts. When a plaintiff's expert manually tests your site and documents barriers your tool missed, your automated scan report won't help your defense.
Use automated tools for continuous monitoring and regression testing, but start with a professional manual audit against WCAG 2.1 Level AA. That's the baseline for understanding your actual risk exposure.
What If Our Site Has a "Physical Nexus" Issue?
Some courts have ruled that Title III only applies to websites with a connection to a physical location. Others have held that online-only businesses are covered. The circuit split affects your risk assessment.
If you operate in the Second Circuit (New York, Connecticut, Vermont) or Eleventh Circuit (Florida, Georgia, Alabama), you're in areas where plaintiffs file aggressively and courts are more receptive to web accessibility claims. The "physical nexus" debate doesn't stop lawsuits from being filed; it affects whether they survive a motion to dismiss.
For risk managers, geography influences your litigation risk profile, but it doesn't eliminate it. Even if your circuit requires a physical nexus, you still face risk if you operate brick-and-mortar locations. The trend in case law is toward broader application of Title III to digital properties.
Don't base your risk mitigation strategy on a circuit split that might resolve against you.
How Do We Explain This Risk to Executives Who Think It's Just an IT Issue?
Frame it as enterprise risk, not a technical problem.
ADA Title III lawsuits related to web accessibility jumped 27% year-over-year in 2025, reaching 3,117 cases. New York federal courts saw 1,021 filings. Florida nearly doubled, rising from 470 in 2024 to 961 last year. These numbers don't include state law claims or demand letters that never become public filings.
Executives need to understand three things. First, this is a legal compliance issue with direct financial exposure. Second, it's a reputational risk, lawsuits signal to customers that accessibility wasn't a priority. Third, it's an operational risk because court-ordered remediation disrupts roadmaps, pulls engineering resources, and forces timeline commitments you can't control.
Position web accessibility as a proactive risk mitigation strategy, not a reactive IT project. The question isn't whether to invest in conformance, but whether you'd rather control the timeline and approach, or have a court do it for you.
Where Do We Go From Here?
Start with a professional audit against WCAG 2.1 Level AA. Understand your current state, prioritize barriers based on user impact and litigation risk, and build a remediation roadmap with clear ownership and timelines.
Document your process. If you face a demand letter or lawsuit, showing that you've been actively working toward conformance, with audit reports, remediation plans, and measurable progress, strengthens your position.
Recognize that this isn't a one-time project. Conformance requires ongoing testing, training, and governance. Organizations that manage this risk effectively treat accessibility as a continuous compliance obligation, not a checklist.
