Choose a web development agency for a 2027 project by testing it against the compliance deadlines that land inside your build window, not by comparing portfolios and hourly rates. The three that matter most are the ADA Title II web deadline of April 26, 2027, the EU Cyber Resilience Act's substantive obligations on December 11, 2027, and Google's Core Web Vitals thresholds, which changed in 2024 and still trip up agencies quoting old metrics. A 2027 project is unusual because it is being built across a regulatory edge. Work scoped in 2026 under current assumptions can ship into a legal environment that changed while it was in development, and the cost of retrofitting accessibility, vulnerability reporting, or payment-page script controls falls on whoever owns the site afterward — which is you, not the agency.
Table of Contents
- The accessibility deadline that reshapes a 2027 contract
- What accessibility evidence should the contract require?
- Does your build touch the EU?
- Performance questions that reveal an agency's currency
- Payment pages carry their own requirements
- Reading a rate card against labor cost
- Frequently Asked Questions
The accessibility deadline that reshapes a 2027 contract
The U.S. Department of Justice's interim final rule, published in the Federal Register on April 20, 2026, moved the ADA Title II compliance date for public entities serving 50,000 or more people from April 24, 2026 to April 26, 2027, and pushed entities under 50,000 people — plus any special district — to April 26, 2028. Critically, the DOJ rule did not change the technical standard. WCAG 2.1 Level AA is still the bar. If your project serves a state or local government, a public university, a school district, a transit authority, or a water district, this is a hard date in your build calendar.
Ask any candidate agency which tier your entity falls into and what their delivery schedule looks like against it. An agency that treats the extension as breathing room rather than a deadline has misread it. There is a cheap way to future-proof the contract language. According to W3C's summary of WCAG 2.2, which became a Recommendation on October 5, 2023 and was republished December 12, 2024, content conforming to 2.2 also conforms to 2.1 and 2.0. WCAG 2.2 adds nine success criteria and removes criterion 4.1.1 Parsing. Specifying 2.2 AA in the contract therefore satisfies the DOJ's 2.1 AA floor automatically, with no second negotiation.
What accessibility evidence should the contract require?
Specifying a standard is not the same as getting one. W3C's Accessibility Maturity Model, a 2024 Draft Note, names specific procurement proof points worth copying directly into a statement of work. The maturity model lists these as evidence of a mature procurement process: That last item is the one agencies resist, and it is the one that protects you.
An independent conformance statement means someone other than the people who wrote the code signs off on it. Ask during the pitch whether the agency has worked under an independent audit before and who performed it. "We test internally with automated tools" is a partial answer: automated scanners catch a fraction of WCAG criteria, which is why the maturity model names manual testing alongside them.
- Warranties and remedies sections in the contract explicitly cover accessibility, so a failure is a breach with a defined fix, not a change order
- The vendor supplies accessibility documentation for the deliverable
- The vendor supplies evidence of automated and/or manual testing performed on the actual deliverable, not on a general practice claim
- The contract provides for an independent statement of conformance
Does your build touch the EU?
Two European regimes affect 2027 projects, and they have different scopes. The European Accessibility Act, Directive (EU) 2019/882, has applied through national law since 28 June 2025 and covers e-commerce services. Article 32(1) of the directive grants a transitional period ending 28 June 2030, but only for services delivered using products already lawfully in use beforehand. A new build in 2027 gets no grace period at all. The EU Cyber Resilience Act, Regulation (EU) 2024/2847, is the one agencies are least likely to raise unprompted.
The European Commission confirms the CRA's substantive provisions begin applying on 11 December 2027, and that its reporting duties reach products already placed on the EU market before that date. Manufacturer reporting of actively exploited vulnerabilities and severe incidents started earlier, on 11 September 2026, through the Commission's Single Reporting Platform. The reporting clock is tight: a 24-hour early warning, a 72-hour notification, and a 14-day final report, per the Commission's CRA reporting guidance. If your 2027 project ships connected software or firmware into the EU, you need an agency that can budget for secure-by-design practice and ongoing vulnerability handling — a standing operational duty, not a launch task. Ask who holds that obligation after handoff, and whether the retainer covers a 24-hour response window or just business hours.
Performance questions that reveal an agency's currency
Core Web Vitals are a quick competence test because the metrics changed recently and the old ones are still widely quoted. Google's pass thresholds, measured at the 75th percentile of real user visits, are Largest Contentful Paint at or under 2.5 seconds, Interaction to Next Paint at or under 200 milliseconds, and Cumulative Layout Shift at or under 0.1, as documented by Google's web.dev thresholds page. INP replaced First Input Delay in March 2024. An agency still writing First Input Delay targets into a proposal or a performance SLA is working from obsolete criteria, and the substitution matters: FID measured only the delay before the first interaction was processed, while INP accounts for the full response latency across interactions during a visit.
A site can pass FID and fail INP. Two things follow for your contract. First, performance targets should name the 75th percentile of field data, not a lab score from a single test run — a Lighthouse number on the developer's machine proves nothing about real users. Second, if the SLA quotes FID, treat the whole document as a template the agency has not revisited in two years.
Payment pages carry their own requirements
If the project takes card payments, PCI DSS v4.0 adds two requirements that became mandatory on 31 March 2025 and that directly shape front-end work. Requirement 6.4.3 obliges you to authorize, justify, and integrity-check every script running on a payment page. Requirement 11.6.1 obliges you to detect and alert on unauthorized changes to payment-page scripts and HTTP security headers.
As Imperva's summary of the PCI SSC requirements explains, v4.0.1 clarified the boundary: merchants are responsible for scripts in their own parent page, not for scripts inside a payment processor's iframe. That boundary is worth settling in writing before build, because it decides whether your checkout architecture carries the script-inventory burden or offloads most of it. One limitation: the obligation varies by SAQ (Self-Assessment Questionnaire) type, so confirm your specific scope against current PCI SSC documents before paying an agency to build tooling you may not need. An agency that can tell you which SAQ type your setup falls under is demonstrating real payments experience; one that quotes a flat "PCI compliance" line item is not.
Reading a rate card against labor cost
Rates are easier to judge with a labor benchmark behind them. The U.S. Bureau of Labor Statistics puts the May 2024 median pay for web developers and digital designers at $95,380 a year, or $45.85 an hour, with employment projected to grow 7 percent from 2024 to 2034 and roughly 14,500 openings a year. That figure is a floor for reasoning, not a target rate.
A blended agency rate covers overhead, project management, QA, accessibility testing, and margin on top of wages, so a multiple of the median is normal and expected. What the benchmark does let you ask is a sharper question: at this rate, how much of it is senior specialist time, and who exactly performs the accessibility and performance testing? Use the number to detect both extremes. A rate close to the BLS hourly median leaves nothing for the independent conformance statement, manual accessibility testing, or ongoing vulnerability handling that a 2027 project needs — those costs come back later as change orders. A rate several multiples above it is defensible, but only if the agency can name the specialists and show the testing evidence the W3C maturity model describes.
Frequently Asked Questions
Does the DOJ extension mean we can delay accessibility work?
No. The interim final rule moved the date, not the standard: WCAG 2.1 Level AA still applies, at April 26, 2027 for public entities serving 50,000 or more people and April 26, 2028 for smaller entities and special districts. Development scoped now still has to deliver conformance.
Should the contract specify WCAG 2.1 AA or 2.2 AA?
Specify 2.2 AA. W3C states that content conforming to WCAG 2.2 also conforms to 2.1 and 2.0, so 2.2 AA clears the DOJ rule's 2.1 AA floor and adds nine success criteria without a later renegotiation.
Our 2027 e-commerce build serves EU customers. Does the 2030 transitional period help us?
No. Article 32(1) of Directive (EU) 2019/882 limits the period ending 28 June 2030 to services delivered using products lawfully in use before the directive applied. A new build does not qualify.
Who handles CRA vulnerability reporting after the site launches?
Settle that in the contract. The reporting duties — 24-hour early warning, 72-hour notification, 14-day final report — are continuing obligations, so decide before handoff whether the agency's retainer covers them or your team takes them on.
