WCAG 2.2: what changed from 2.1, and what a machine can test

The Web Content Accessibility Guidelines (WCAG) are the W3C's rules for making websites usable by people with disabilities, published by its Web Accessibility Initiative. Version 2.2 became a W3C Recommendation on 5 October 2023. It retains the 2.1 criteria except one and adds nine. Six of the nine sit at the levels most contracts ask for:

• 2.4.11 Focus Not Obscured (Minimum), AA. When a keyboard user moves to a link or button, a sticky header or cookie banner must not hide it completely.
• 2.5.7 Dragging Movements, AA. Dragging actions need a pointer alternative without dragging. Exceptions include essential dragging and unmodified browser controls.
• 2.5.8 Target Size (Minimum), AA. Pointer targets meet the 24-by-24 CSS pixel size or spacing test, with specified exceptions such as inline links.
• 3.2.6 Consistent Help, A. If a site offers help, such as a contact link or a chat, repeated help mechanisms occur in a consistent relative order.
• 3.3.7 Redundant Entry, A. Information already entered in a process is filled in or available to select, subject to specified exceptions.
• 3.3.8 Accessible Authentication (Minimum), AA. Signing in needs support or an alternative for memory and transcription tasks, subject to specified exceptions. Pasting and password managers can provide that support.

The other three new criteria are at AAA, the stricter level. WCAG 2.2 also removes 4.1.1 Parsing, a check on code that browsers now handle themselves.

Many automated accessibility reports, ours included, run on axe, an open-source testing engine. The version in our own checks, axe 4.13, has one rule for these six criteria: target size. It can measure a button. It cannot tell whether a sticky header hides the focus at the moment a person tabs to a link, or whether a form asked for an address it already had.

Our own site has that question. On a phone, its header is fixed to the top of the screen and slides away as the page scrolls. Whether it ever covers the link in focus is for a person with a keyboard to find out.

So a report that says "WCAG 2.2 AA: 0 violations" does not mean the six new criteria were fully tested. Ask who tested the other five, and how.

Our release gate tests this website against WCAG 2.1 AA and Section 508. The rules for 2.2 run in a separate report that does not block a release. This is where the site stands on the six:

• Target size: no findings. The axe rule ran on all 56 pages on 23 October 2026.
• Consistent help: implemented, awaiting full review. The Contact link sits in the header on every page.
• Accessible authentication: implemented, awaiting full review. Protected case studies open from a link we email, with no password.
• Focus not obscured: not yet tested. It needs a person tabbing through the pages.
• Dragging movements: not yet tested. It needs a person using each moving part.
• Redundant entry: not yet tested. It needs a person filling in each form.

The first action in our sample accessibility audit report, filling in every form by keyboard alone, would cover focus and redundant entry. Dragging needs its own pass.

1. Which version does your report test, 2.1 or 2.2? The number on the cover is the first thing to read.
2. Which of the six new criteria did a person test? Ask for the pages and the date.
3. What did you change because of 2.2? A supplier who tested it will name something.
4. Does a failure stop a release? Ask who acts on failures and how they are tracked.

The US rule for state and local government websites names WCAG 2.1 AA, and Section 508 still points to WCAG 2.0, so 2.2 may not be in your contract yet. The six new criteria are still the ones people trip over: a hidden focus, a drag with no other way, a button too small for a thumb.