Overview
WCAG 2.2 has been a recommendation since October 2023, but most procurement teams are only now updating their RFPs to cite it. If you sell to federal, state, healthcare, or education buyers, the next twelve months are the window where 2.2 conformance shifts from advantage to baseline.
The good news: 2.2 is additive. Everything you did for 2.1 still counts. There are nine new success criteria, three of which carry real architectural implications. The rest are mostly common sense made explicit.
What’s new in 2.2
Nine new success criteria, distributed across the three conformance levels:
- Level A: 3.2.6 Consistent Help · 3.3.7 Redundant Entry
- Level AA: 2.4.11 Focus Not Obscured (Min) · 2.5.7 Dragging Movements · 2.5.8 Target Size (Min) · 3.3.8 Accessible Authentication (Min)
- Level AAA: 2.4.12 Focus Not Obscured (Enhanced) · 2.4.13 Focus Appearance · 3.3.9 Accessible Authentication (Enhanced)
If you only have time to read one paragraph: 2.5.8, 3.3.8, and 2.4.11 are the three that will fail real audits today.
Target size — the big one
SC 2.5.8 (AA) requires interactive targets to be at least 24 × 24 CSS pixels, with carve-outs for inline links in flowing text and for elements that are spaced apart. The enhanced version (2.5.5, AAA, carried over from 2.1) wants 44 × 44.
This is the single most common 2.2 failure we find on existing sites. Icon buttons, close affordances, sort arrows, paginators — most design systems built before 2023 have at least one component that fails 2.5.8.
Twenty-four pixels feels small until you remediate fifty buttons across forty templates. Then it feels like an architecture decision.
Where it shows up
- Toast / banner close buttons (
×icons) - Icon-only sort/filter affordances in tables
- Pagination arrows on mobile
- Inline action menus inside data rows
Accessible authentication
SC 3.3.8 (AA) prohibits cognitive function tests as the only means of authentication, unless an alternative is provided. In plain English: users with cognitive disabilities must be able to log in without solving a puzzle, transcribing a code from another device, or remembering an obscure security question.
Acceptable alternatives include: passkeys, autofill from password managers, copy-and-paste of OTP codes, and biometric auth on capable devices. Unacceptable: CAPTCHA-only flows, “drag the puzzle piece” challenges, and security questions that require recall.
Focus appearance
SC 2.4.11 (AA, “Min”) requires that when a UI component receives keyboard focus, it isn’t entirely hidden by other content (sticky headers, cookie banners, persistent chat widgets). This is a real architectural problem on sites with sticky chrome — the focused element scrolls behind the header instead of into view.
The enhanced version (2.4.12, AAA) requires the focused element to be not obscured at all. Most sites can hit AA by adding scroll-padding-top on the document root. AAA requires getting honest about how much sticky chrome you really need.
Remediation in priority order
If we were handed a brand-new 2.2 audit with twelve weeks to remediate, here’s the order we’d work in:
- Target size (2.5.8) — fix the design system once, ship everywhere.
- Accessible auth (3.3.8) — usually a one-line fix on the login form.
- Focus not obscured (2.4.11) — sticky chrome audit + scroll-padding.
- Dragging movements (2.5.7) — replace drag-only interactions with single-pointer alternatives.
- Consistent help (3.2.6) — pin the support link to the same place site-wide.
- Redundant entry (3.3.7) — autofill or pre-populate fields the user already filled in.
The remaining three (2.4.12, 2.4.13, 3.3.9) are AAA. Worth doing if you’re aiming for AAA conformance on critical flows — defer otherwise.
The verdict
WCAG 2.2 isn’t a rewrite. It’s a maturation. The criteria that matter most reflect lessons from a decade of audits — the things that still trip up real users, on real sites, every day.
If you’re already at 2.1 AA, you’re probably 70% of the way to 2.2 AA. The remaining 30% is mostly your design system’s target sizes and your auth flow. Both are tractable inside a single sprint with the right people in the room.
If you’d like a hand running the audit — or a second opinion on the one you just received — we’re here.