# Legal-Standard and Target-Standard Are Two Separate Governance Positions ## Claim An organization should document "what we're legally required to meet" and "what we're tracking toward" as two explicitly separate positions, because collapsing them into one is what produces internal confusion the moment a newer standard ships before regulators adopt it. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds when a field has an actively evolving voluntary or de-facto standard (a W3C Recommendation, an industry best-practice framework) that regulators cite selectively and with a multi-year lag. - The distinction has to live in written policy or procurement language, not in whichever staffer happens to be reviewing a given contract — otherwise it collapses back into confusion under pressure. - Breaks when the standard and the regulation are issued by the same body on the same cadence, leaving no lag to manage — in that case a single tracked position is sufficient. ## Evidence Steenhout traces the pattern through WCAG's own history: Section 508 still cites WCAG 2.0 A/AA, DOJ's Title II rule requires 2.1 AA, and the EU's EN 301 549 is built on 2.1 with only newer standards beginning to reference 2.2 — different regulations already citing different versions *before* WCAG 3.0 even ships. "A W3C Recommendation becomes official when the W3C finishes its process. Regulations change when governments and regulators finish theirs. Those clocks are almost never in sync." Vendors marketing "WCAG 3.0 ready" products compound the risk, since that claim can be accurate about standards alignment while saying nothing about the WCAG 2.x-based obligations a buyer is actually bound by. ## Links - [[3. Resources/Permanent Notes/A Timed Review Window Trades Update Speed for Supply-Chain Safety]] — extends: another case where an organization has to hold two different clocks (safety review speed vs. patch urgency) as separate governance positions rather than one collapsed decision. - [[3. Resources/Permanent Notes/Checksum Verification Closes the Gap Auto-Update Status Leaves Open]] — applies-in: same family of claim — "the system reports X" and "X is actually true" need independent verification, whether the system is a patch pipeline or a vendor's standards-readiness marketing. - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — applies-in: procurement and compliance policy for any standards-adjacent claim (security, accessibility, privacy) benefits from this same two-position structure. - [[3. Resources/MOCs/Accessibility & Disability Inclusion MOC]] — applies-in: Concerns WCAG standards and regulation, which fits accessibility governance. ## Tests / falsifiers - Survey accessibility program leads before and after they adopt a written legal-vs-voluntary standards policy; a measurable drop in internal escalations about compliance status would support the claim. - Audit procurement/contract templates for hard version-pinning language ("must conform to WCAG 2.1 AA") and correlate with reported rework or renegotiation costs during a past standards transition (e.g., 2.1→2.2) as a proxy for the 2.x→3.0 transition. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Readwise/Articles/WCAG 3.0 Will Create a Governance Problem Most Organizations Aren't Ready For]] — Nicolas Steenhout, 2026; the "two-timeline problem" and vendor-claims analysis.