Compliance Ready PR

Status: ready

Intent

A PR that changes a user task carries its own accessibility evidence, so release and compliance review don't start from zero.

Problem

Accessibility is checked at the end, when the code is merged, the vendor flow is wired in and the release date is two days away.

Solution

Verdict: a PR that touches a critical task names the task, the profiles checked, the evidence, the open risk and, for covered services, a one-line regulatory note.

Why: the developer who changed the screen is the cheapest person to check it, today. At release time the same check costs a cycle.

Which PRs need it: payments, health, banking, account and authentication, support, public services, EU covered services, and any vendor SDK change in those flows.

Regulatory brief

Some PRs change legal risk, not only UI quality.

ADA Title II:  public service flow changed → keep WCAG 2.1 AA mapping and task evidence current
WAD:           EU public sector app flow changed → keep EN 301 549 evidence current
EAA:           covered service flow changed → purchase, payment, auth, support stay accessible

Implementation

PR section:

## Accessibility impact

Task:              recover from a declined payment
Profiles checked:  VoiceOver, Larger Text AX5
Evidence:          screenshot, VoiceOver transcript
WCAG mapping:      3.3.1, 3.3.3, 4.1.2
Regulatory note:   checkout is in EAA scope (e-commerce service)
Open risk:         Switch Control not checked yet
Owner:             payments iOS

Code and what the user hears, side by side:

Button("Pay \(total.formatted(.currency(code: "USD")))") { submitPayment() }
VoiceOver: "Pay $24.90, button"

The code shows the implementation. The output shows the effect.

A vendor change is in the diff review:

Vendor SDK changed:  identity verification
Task:                upload a document and return to the app
Evidence needed:     VoiceOver walkthrough, AX5 screenshot,
                     a way out of the web view, support fallback

Five reviewer questions. Can the user complete the task without:

1. seeing color
2. precise gestures
3. reading small text
4. hearing audio
5. finishing before a timeout

Check

Profile:   PR reviewer
Task:      review a PR that changes checkout
Expected:  the task is named
           evidence exists for the changed path
           open risk is written, with an owner

Pitfalls

  1. The same generic checklist pasted into every PR.
  2. "Checked with VoiceOver" without evidence.
  3. accessibilityIdentifier mistaken for a label.
  4. Vendor screens left out of review.
  5. Dropping the regulatory note because it's uncomfortable.

WCAG mapping

Map only the criteria the change affects. Three accurate lines beat a fake full table.

Changed:   payment error recovery
WCAG:      3.3.1 Error Identification, 3.3.3 Error Suggestion, 4.1.2 Name, Role, Value
Evidence:  after Pay, VoiceOver focus is on the error, the field keeps its value
  1. Compliance Theater
  2. Vendor Blind Spot
  3. Scanner Theater
  4. AI Verification Theater
  1. Regulatory Evidence Map
  2. Testing Evidence Record
  3. Evidence Based Release
  1. Chapter 13
  2. Chapter 16
  3. Chapter 18
  1. Legal context without legal theater
  2. VoiceOver output debugging

Sources

  1. ADA.gov: Guidance on Web Accessibility and the ADA
  2. Your Europe: Accessibility requirements for services and products
  3. Apple Developer: Performing accessibility audits for your app