The exposure your clients have not priced yet

Public-facing websites are now read by two audiences: the people who depend on inclusive access to use them, and the AI systems that read, summarize, and recommend them on behalf of buyers. The same flaws block both, and the resulting regulatory and commercial exposure sits with the insured, not the IT department.

Treated as a managed risk, with audit, vendor accountability in writing, and ongoing measurement, the website comes under the same governance discipline already applied to every other operational exposure.

The advisors who keep a seat at the client's table are the ones who arrive with a risk the client has not yet recognized. Website accessibility is one of those risks. It has been quietly building inside the IT budget for a decade, treated as a technical line item, and it now sits in plain sight, with regulators tightening, plaintiff firms working against a clear benchmark, and a second category of users, the AI systems acting on behalf of buyers, multiplying the consequence of any failure.

This is no longer a developer problem. It is either a managed risk on the balance sheet or an unmanaged one, and the way it gets managed is the way other operational exposures get managed: independent audit, vendor accountability in writing, and measurement on a defined cycle.

The duty is older than the rule

The Americans with Disabilities Act has, for more than 30 years, required businesses to make reasonable adjustments so that people with disabilities can use their goods, services, and information on equal terms. For a website, that means a person with a disability can find what they came for, complete what they came to do, and receive the same information any other user would receive. The duty has been there from the start. The digital application of it has been catching up.

In April 2024, the US Department of Justice published its first specific technical regulation under Title II of the ADA, naming the international standard WCAG 2.1 Level AA as the technical benchmark used to measure whether the duty has been met online. The original compliance dates were April 24, 2026 for state and local government entities serving 50,000 or more people, and April 26, 2027 for smaller entities. On April 20, 2026, the DOJ extended those dates by a year, to April 26, 2027 and April 26, 2028, while leaving the underlying duty unchanged.

The relevance for private-sector clients is not the deadlines themselves. It is the codification. The federal benchmark for measuring inclusive access online is now defined in regulation, and US courts have been applying that same benchmark to private-sector websites under Title III of the ADA for years. State laws including California's Unruh Civil Rights Act and New York's Human Rights Law have been read by federal and state courts to extend the duty to digital services. The direction of travel is settled, and plaintiff firms are operating against a benchmark the courts treat as authoritative.

Why money has not moved the number

The WebAIM Million is the annual evaluation of the home pages of the top 1,000,000 websites worldwide, run by the non-profit Web Accessibility in Mind. In its February 2026 analysis, 95.9% of those home pages fell short of the technical benchmark used to measure inclusive access, up from 94.8% in 2025, reversing a trend of small improvements logged in each of the previous 6 years. Significant remediation budgets have been deployed against this problem in the US for years, and the aggregate outcome has not moved.

The reason is structural, and brokers will recognize it from other categories of risk. When responsibility for an exposure sits inside the team that produced the asset, accountability is structurally weak. The web team builds the site, the web team is asked to assess the site, and the web team reports back on whether the site is in good shape. That is not how a risk manager treats other operational exposures. A facilities team does not sign off on its own loss-control survey, and a safety officer does not write the EHS audit on the line they manage. The function that produces an asset is not the function that signs off on its risk profile.

The cost of leaving this in place has changed. For most of the past decade, the practical risk of an inaccessible site was a settlement letter, a remediation project, and an internal post-mortem. With the federal benchmark now codified, the cost is increasingly a question of how the courts read that codified standard, with state laws compounding the exposure for clients operating across multiple jurisdictions. The structural problem is the same one brokers have always recognized. What has changed is the price of letting it sit there.

The AI exposure, and the falling-behind risk

Until recently, the readers of a public-facing website that mattered for revenue were people. That is no longer the only audience. AI agents from organizations including OpenAI, Anthropic, and Perplexity already read publicly available websites, and they do so on behalf of users who increasingly use AI to evaluate suppliers, look up information, and complete transactions on the buyer's behalf.

The parts of a site that block a person with a disability are, in large part, the same parts that prevent an AI system from making sense of the page. A site that does not work for a screen reader does not read cleanly for an AI agent either, and a site the AI cannot read is a site that does not appear cleanly in the answers AI generates for buyers. One underlying condition produces both an accessibility failure and a commercial one.

That has three consequences worth raising at the next renewal. The first is lost transactions: a buyer using an AI agent to complete a journey on a poorly readable site ends up with a competitor whose page the AI could read, and the loss is rarely visible because nothing breaks at the client's end. The second is misrepresentation: AI systems summarizing the brand or offering use whatever fragments they could pick up, and the resulting answer can contain statements the company never wrote, attributed to no one and difficult to correct after the fact. The third is the falling-behind risk: over time, an unreadable site drops out of AI-generated comparisons and recommendations, and the longer the gap goes unaddressed, the wider it becomes against competitors whose pages AI systems can read fully.

That last consequence does not arrive in a regulator's letter or a plaintiff's demand. It arrives later, in a sales review, when the question is why pipeline is thinner than it was 12 months ago and nobody can point to a cause. It is the type of exposure brokers are familiar with from other categories: a slow drift where the cause is invisible at the operational level, and the only remedy is to have measured it before the drift began.

A risk-management approach the broker can introduce

The structure that solves this is the structure brokers already apply elsewhere. Audit first, with a current-state assessment of the site against the benchmark the regulators and courts reference, carried out independently of the team that built or maintains it. Vendor accountability in writing, because most US websites are built and maintained under contracts that do not assign explicit responsibility for accessible delivery, leaving the exposure with the insured by default. Continuous measurement, because pages change daily, and an audit on its own is a snapshot the client cannot defend 90 days later.

Each pillar has a clear shape. A useful audit names what is on the site, who is testing it, what the test is measuring against, and what good looks like in the report itself. A useful contract names the standard, the test that confirms it, the responsible party, and the consequence when delivery falls short. A useful measurement cycle names the cadence, the metric, and the route by which a deterioration is reported back to the people who need to act on it. None of this is unfamiliar territory to a broker who has reviewed a vendor risk assessment or a compliance program in any other category. The shift is applying that discipline to the website.

This is the approach AAAtraq and its AiSC assessment apply. AiSC measures the inclusive-access profile and the AI-readability profile of a page from the same source, in the same audit, against the same data, and it is built as a risk-management instrument rather than a developer tool. The output is structured to sit alongside other risk reports a broker would already share with a client, in the language a CFO, GC, or risk manager will recognize.

Where the broker fits

Website accessibility now sits across several lines of cover the broker is already discussing with the same client. ADA Title III claims attach to general liability and to specialty disability-access cover, with defense costs and settlement patterns familiar to any broker who has handled these matters in the last 5 years. Errors and omissions cover for the agency or in-house team that built the site is a related conversation. Cyber, where it includes media liability, picks up parts of the misrepresentation exposure now amplified by AI-generated summaries of the client's pages.

Treated as a single, governed, measured exposure, the website simplifies the renewal conversation rather than complicating it. It also reframes the broker's role from policy intermediary to risk advisor on a category that has been drifting between IT, marketing, and legal for 10 years.

The conversation a broker can open with a client this quarter does not need to be technical. It needs to ask whether the website has been audited independently against the federal benchmark in the last 12 months, whether responsibility for inclusive delivery is written into the contract with whoever built or maintains it with a clear consequence when the standard is not met, and whether there is a measurement cycle that flags deterioration before a regulator or plaintiff does. Three questions, defensible at the next board meeting, and none of them require the broker to know the technical detail.

The clients who handle this well in 2026 and 2027 will not be the ones with the largest IT budgets. They will be the ones whose advisors framed the risk early, separated technical delivery from risk ownership, and put a measurement system in place before a notice arrived on the desk. That is the work of the broker who keeps a seat at the table.

References

• WebAIM Million 2026 reportWebAIM, The WebAIM Million: The 2026 Report on the Accessibility of the Top 1,000,000 Home Pages, February 2026.
• DOJ Title II web rule (April 2024)US Department of Justice, Nondiscrimination on the Basis of Disability; Accessibility of Web Information and Services of State and Local Government Entities, Federal Register, 24 April 2024.
• DOJ compliance date extension (April 2026)US Department of Justice, Extension of Compliance Dates for Nondiscrimination on the Basis of Disability, Federal Register, 20 April 2026.
• ABA Business Law Today, August 2025American Bar Association, Digital Accessibility Under Title III of the ADA: Recent Developments and Risk Mitigation Best Practices.
• ADA.gov fact sheetADA.gov, Fact Sheet: New Rule on the Accessibility of Web Content and Mobile Apps Provided by State and Local Governments, US Department of Justice.