A demand letter is built to make you panic. It works, right up until it lands on a team that already has a real audit trail, a documented remediation history, and specific answers instead of a vague promise to "look into it." The letter does not change. The team's options do.
Two companies can receive the exact same letter, citing the exact same code, on the exact same day. One spends the next six weeks in a scramble of emergency vendor calls, defensive emails, and guesswork. The other pulls a folder, forwards three documents to counsel, and gets back to work. The difference was decided months earlier, long before any letter existed.
The Stat: UsableNet's annual ADA web accessibility lawsuit tracking documents a large and continuing volume of federal accessibility lawsuits filed each year in the US, and finds that a meaningful share name sites that were already running an accessibility overlay at the time. (Source: UsableNet)
Why the letter itself is not the real event
The letter is a trigger, not a verdict. What it actually does is force a question that the organization either already has an answer to, or does not: can you show your work?
Teams that panic tend to share one trait - they are being asked, for the first time, to produce something they never built. No audit history. No ticket trail showing what was fixed and when. No record of who tested what, or against which success criteria. When counsel asks "what do we have," the honest answer is nothing, and that nothing is what turns a routine complaint into a crisis.
Teams that stay calm are not necessarily more compliant on paper at the moment the letter arrives. They simply have a paper trail. A documented remediation history changes the entire conversation from "prove you are not liable" to "here is what we found, here is what we fixed, here is what is scheduled next." That is a fundamentally different negotiating position, and it is built months in advance, not during the ten business days most demand letters give you to respond.
The two failure patterns that show up again and again
If you read enough real complaints and audits, the same two issues surface constantly, because they are also among the most common failures found in large-scale site audits generally:
- WCAG 4.1.2 Name, Role, Value - custom buttons, menus, and widgets built with
<div>s and JavaScript instead of semantic HTML or proper ARIA, so a screen reader has no idea what the control is or what state it's in. - Contrast (Minimum), SC 1.4.3 - text and interface elements that fall below the required contrast ratio against their background, often introduced later by a brand refresh or a marketing team that didn't check the numbers.
Neither of these is exotic. Both are catchable in a competent audit, and both are exactly the kind of finding a demand letter will quote directly, because they are easy to demonstrate and hard to argue against.
Why "we installed an overlay" is not the answer it sounds like
A common reflex after a scare - or before one, as prevention - is to bolt on an accessibility overlay widget and consider the box checked. The data does not support that as a defense. A meaningful share of the sites named in tracked lawsuits were already running an overlay at the time they were sued. An overlay sitting on top of broken underlying markup does not fix SC 4.1.2 failures baked into the DOM; it just adds a layer that can itself introduce new problems. We've written in detail about this pattern - read why overlays keep getting sued despite being installed to prevent it - and it is worth understanding before you spend budget on one. The W3C addresses this directly in the W3C's own Overlay Fact Sheet, which is a useful thing to have read before a vendor pitches you a quick fix.
What "calm" actually looks like in practice
Calm is not a personality trait. It's a checklist that was completed before it was needed.
| Element | Panicked team | Prepared team |
|---|---|---|
| Audit history | None, or one-time and years old | Ongoing, dated, versioned |
| Remediation records | Don't exist | Ticketed, tracked, closed with evidence |
| Response to letter | Generic denial or silence | Specific, sourced, itemized reply |
| Vendor relationship | Cold call under deadline pressure | Existing relationship, known scope |
| Internal ownership | Unclear who is responsible | Named owner, known process |
The gap between those two columns is not effort spent during the crisis. It's effort spent before it.
A simple readiness checklist
Before a letter ever arrives, a team that wants to respond calmly should be able to check off:
- A current accessibility audit exists and is less than 12 months old
- Findings are tracked in a system, not a one-off PDF nobody opens again
- Fixes are documented with dates, not just "resolved"
- Someone internally owns accessibility as an ongoing responsibility, not a one-time project
- The team knows the difference between an overlay and an actual remediation
- Legal and engineering both know where the audit trail lives
If most of those boxes are unchecked, that is the actual risk, not the letter that hasn't arrived yet.
The first 48 hours, if a letter does arrive
Even a well-prepared team still has to act when a real letter lands, and the first two days set the tone for everything after. This is the sequence that keeps a prepared team prepared, rather than letting a real letter undo months of groundwork through a panicked, off-script reply.
First, the letter goes to counsel and to whoever owns the accessibility program internally, at the same time, not in sequence. A common mistake is routing it through legal alone for a week before engineering even sees it, which burns exactly the time a prepared team doesn't need to burn.
Second, pull the existing audit trail before drafting any response. If SC 4.1.2 or SC 1.4.3 failures are cited, the team should already know whether those specific issues are open, already fixed, or already scheduled, with dates attached. Guessing here is how a prepared team accidentally sounds unprepared.
Third, resist the urge to respond with a blanket denial or a rushed promise. A specific, itemized reply naming what was found, what has already shipped, and what is scheduled next is both more credible and more defensible than a vague assurance that "we take accessibility seriously." The letter is asking a factual question. Answer it with facts you already have on file, not ones you scramble to produce that week.
None of this requires new tooling or a new vendor relationship built under deadline pressure. It requires the audit trail already existing, and a short, calm process for pulling it when it's needed. That is the entire difference between the two companies described earlier, receiving the same letter on the same day.
Start building the record now
The letter, if it ever comes, is not really the problem. The absence of a documented answer to it is. Building that record isn't a one-week sprint you do under legal pressure - it's the ordinary, unglamorous work of an ongoing accessibility program, done before anyone is asking.
If you want to start that record today rather than during a panic later, get a free audit and start building that documented history now - it's a practical way to know exactly where you stand and to have real, specific answers ready instead of a vague promise to look into it. Prefer to talk it through first? The team at experts@wcag.world is happy to walk through what a real remediation trail should look like for your site.