BXUP Track progress & test yourself — free
Frontend & Mobile · Playbook · Core · ~5 min read
FRONTEND & MOBILE · PLAYBOOK · CORE

The Three-Layer Accessibility Audit: Automated, AI-Guided, Manual

Automated scanners catch roughly a third of WCAG issues. AI-guided checks extend into the majority that needs judgment. A keyboard and screen-reader pass catches what no machine sees. This playbook chains all three into one WCAG-mapped audit — and teaches you what each layer is structurally blind to.

Tier: Core · Workflow area: Accessibility

The output is a findings table mapped to WCAG success criteria, a remediation plan ordered by user impact, and an honest account of which layer found what.

When to use

  • A surface is heading to release, a public tender, or a client with accessibility requirements (EAA, Section 508, ADA exposure).
  • A significant amount of the UI was AI-generated and nobody has audited it against WCAG.
  • You inherited a product with zero accessibility history and need a defensible baseline.
  • Legal or procurement asked for a VPAT/ACR and you need the underlying evidence.

Skip the full chain for a single component — run axe plus a two-minute keyboard check instead.

Prerequisites

  • A running build of the surface under audit, with realistic data (empty tables and lorem ipsum hide issues).
  • axe DevTools (or axe-core CLI) and Accessibility Insights for Web installed.
  • A screen reader you can operate at basic level: NVDA on Windows, VoiceOver on macOS/iOS, TalkBack on Android. Basic level is learnable in an hour and non-negotiable.
  • WCAG 2.2 AA as the named target — write it down; "accessible" without a version is unauditable.
  • A findings spreadsheet or issue template with columns: location, description, WCAG criterion, severity, layer-that-found-it, suggested fix.

The workflow

  1. Layer 1 — automated sweep. Run axe on every distinct page state, not just the landing render: open the modal, expand the menu, trigger the error state, then scan again. Export results. Deduplicate by component — one broken Button primitive can produce forty findings that are one fix. Expect this layer to find contrast failures, missing alt/labels, landmark and heading structure, and ARIA misuse.

  2. Layer 2 — AI-guided interrogation of what scanners skip. Feed the page's rendered HTML (or component source) plus screenshots to a multimodal assistant and direct it at the non-automatable criteria:

    Here is the rendered HTML and a screenshot of our checkout step.
    Audit ONLY things automated scanners cannot judge:
    1. Is the accessible name of each control meaningful out of context?
    2. Does the visual reading order match the DOM order?
    3. Are error messages programmatically associated with their fields
       and specific enough to act on? (WCAG 3.3.1, 3.3.3)
    4. Is anything conveyed by color or position alone? (1.4.1, 1.3.3)
    5. Are touch targets plausibly under 24x24 CSS px? (2.5.8)
    For each finding: element, WCAG criterion, why it fails, suggested fix.
    

    Then have it generate a page-specific manual test script: "Tab from the promo field: focus should land on Apply, and the discount announcement should be heard." Every AI finding is a hypothesis — verify each one against the live page before it enters the findings table.

  3. Layer 3 — manual keyboard and screen-reader pass. Unplug the mouse. Traverse the full flow with Tab/Shift-Tab/Arrow/Enter/Escape: can you reach everything, see focus at all times, escape every trap, operate every widget? Then repeat with the screen reader on, screen dimmed if you can bear it: are announcements meaningful, are state changes (loading, errors, async results) actually spoken, does the dialog announce itself? Use Accessibility Insights' guided assessment to structure this pass and record evidence.

  4. Merge into one WCAG-mapped plan. Consolidate all three layers into the findings table, deduplicate, and rank by user impact (blocks task completion > degrades task > annoyance), not by count. Cluster fixes by component so remediation lands where the code is shared.

  5. Fix, then re-run the failing layer. Every remediation is verified by the layer that found the issue — an axe finding by re-scan, a layer-2 finding by re-inspection, a screen-reader finding by re-listening. Close nothing on "the code looks right now."

Key Takeaway:

Each layer has a blindness: automation cannot judge meaning, AI cannot hear your actual screen reader, and humans cannot scan 400 elements for contrast. The audit is only complete when all three have run and every finding carries its WCAG criterion and the layer that caught it.

Tool variants

  • axe DevTools / axe-core CLI: the layer-1 standard; the CLI version becomes your CI gate later (see the constraints playbook).
  • Accessibility Insights for Web: FastPass for quick layer-1, guided assessment as the best scaffolding for layer 3.
  • Claude / Gemini with vision: layer 2 — strongest when given HTML and screenshot together, so it can compare structure against visual presentation.
  • NVDA / VoiceOver / TalkBack: layer 3 is not optional and not simulatable. Test with the platform's real assistive tech.

Verification

  • The findings table covers all three layers, and every finding cites a WCAG 2.2 criterion and a location.
  • Every layer-2 AI finding was reproduced by a human on the live page before entering the table.
  • Layer 3 evidence exists: notes or recordings of the keyboard traversal and screen-reader run.
  • Re-tests after remediation used the originating layer, and closures link to that evidence.

Pitfalls

  • Stopping at layer 1. "Zero axe violations" markets well and means the easy third is clean. Div-buttons with click handlers, wrong reading order, and meaningless announcements all pass axe.
  • Trusting AI findings unverified. Multimodal models both miss real issues and confidently invent violations, including citing wrong WCAG numbers. Layer 2 output is a lead sheet.
  • Auditing only the default state. Most accessibility disasters live in modals, toasts, async updates, and error states. Scan and traverse every state.
  • Severity by count. Forty contrast findings from one token are one fix; a single keyboard trap in checkout is a release blocker.
  • Simulator-only screen-reader testing. Browser extensions that "simulate" screen readers do not reproduce real AT behavior. Use NVDA or VoiceOver themselves.

Restricted-environment variant

For client engagements where screenshots and HTML cannot go to external APIs:

  • All three layers work offline except layer 2. axe, Accessibility Insights, and screen readers are local tools — the audit's spine is unaffected.
  • In-tenant model for layer 2: run the same interrogation prompts against a client-approved endpoint (Azure OpenAI, Bedrock) inside their boundary.
  • Checklist fallback: replace the AI pass with a static non-automatable checklist (name quality, reading order, error association, color-alone, target size) executed by a human. Slower, equally valid.
Warning

"The AI audited it" is not a compliance defense. Legal exposure under EAA, ADA, and Section 508 attaches to the shipped product regardless of what tool wrote or reviewed the code — only the layered evidence trail defends you.

Success criteria

  • A WCAG-mapped findings table and prioritized remediation plan exist and are linked from the release checklist.
  • Layer 3 found at least some issues layers 1–2 missed — if it found nothing, the pass was too shallow; redo it.
  • Critical task flows are completable with keyboard only and with a screen reader, verified after remediation.
  • The next audit of the same surface takes half the time because component-level fixes removed whole finding classes.
This is the free reading view. Open BXUP to track your progress, run the hands-on labs, and prove it with original, exam-pattern assessments.
© Anvi Innovate · BXUP — Be Exponentially Upskilled · BXUP is an independent learning platform, not affiliated with or endorsed by AWS, Microsoft, Google, NVIDIA, IBM, Salesforce, Databricks, Oracle or Anthropic. All trademarks belong to their respective owners. · bxup.in