DSGov home page: 92 for accessibility on Lighthouse. Documentation: 202 level AA non-conformities.

An open audit protocol with governance recommendations for government design systems. I audited the DSGov and Bold documentation with the same procedure and found 277 level AA non-conformities: 202 in DSGov and 75 in Bold. In an isolated fork of the Menu Push example, the correction indicated by the method reduced two structural-rule flags from 22 to zero under the same audit. As of October 8, 2026, the correction had not been incorporated into the official code.

Accessibility by Default

Undergraduate thesis defended at UFSC, grade 10 out of 10, December 2025
Open data
Replicable method

See the evidence Open the dataset

Declared conformance is not verified conformance.

Public digital services are essential civic infrastructure, not a convenience. Brazilian law guarantees the right of access, and millions of people depend on it.

Both systems declare conformance with WCAG and eMAG. The documentation audit found failures in the portal shell and copyable examples; it did not transfer those findings to distributed code.

18.6 million

people with disabilities in Brazil in 2022, 8.9% of the population.

IBGE, PNAD Contínua 2022

The barrier is not only in the published screen. It can live in the source that produces the screen.

Three objects, three limits of inference.

Design systems organize reusable components and examples for building services. When a team reuses an example or component, a barrier in that object may travel with it.

This study distinguishes the documentation portal shell, copyable examples and distributed code. It did not measure propagation in a derived service.

Portal shell
Copyable examples
Distributed code

Three independent blocks with no arrows: portal shell, copyable examples and distributed code.

If a maintainer team adopts a corrected version, the correction may reach services that use that version.

What was audited, and why these two.

Padrão Digital de Governo (DSGov)

The Brazilian federal government's official design standard, published by the Secretariat of Digital Government. It is the reference source for the entire federal government.

Bold Design System

The design system of Laboratório Bridge, at UFSC. An academic comparison case audited with the same procedure.

Fairness note

The procedure was identical for both: same flow, same test suite, same 8 verification categories and same environment. The study also credits what the systems get right: both passed 100% of the visible-focus checks, with no focus trap, across the instrumented components.

Disclosure

The author has an academic affiliation with UFSC. Independent tools, an identical procedure and Bold's higher internal share of critical non-conformities compared with DSGov (40.0% versus 22.3%) are documented mitigations for potential bias.

A protocol in four layers.

The method is the Hybrid Audit and Verification Framework. It integrates four complementary layers, converts abstract standards into auditable metrics, and keeps every finding tied to archived evidence.

The four layers

01
Automated audit
axe-core, Lighthouse and WAVE over the official component documentation.
02
Heuristic inspection
Guided by the WAI-ARIA practices.
03
eMAG 3.1 checklist
The Brazilian standard, item by item.
04
Synthesis matrix
Consolidation and prioritization of the non-conformities found.

Counting pipeline

The count goes through an auditable funnel:

1
Raw
The complete tool results.
2
Deduplication
By rule plus selector plus context.
3
AA filter
Only what violates level AA remains.

Every finding has a 26-field evaluation record, tied to the standard (WCAG, eMAG, WAI-ARIA) and to the evidence.

Reproducible environment

Pinned environment with tool version, browser and viewport recorded. Public scripts under MIT, data under CC BY 4.0 and SHA-256 hashes support rerunning the audit. As of August 3, 2026, its usability with a real team had not been tested.

MIT (scripts)
CC BY 4.0 (data)
SHA-256 (integrity)

Per-Component Verification Checklist

Appendix C of the thesis on one page: the priority checks per component, with WCAG and eMAG criteria and the recommended actions for each system.

Download the checklist (PDF, 1 page, in Portuguese)

Source: Xikota, T. K. C. Acessibilidade Digital em Design Systems Públicos, undergraduate thesis, UFSC, 2025, Appendix C.

What the audit found.

277

unique level AA non-conformities in the official documentation of the two systems.

Bold27% of the total: 75
DSGov73% of the total: 202

Unit of analysis: each non-conformity is unique by rule, selector and context, after deduplication. The per-rule counts cited below (such as the 40 for aria-required-parent) and the 128 contrast non-conformities are parts of these same 277.

Table 5 of the thesis

The illusion of the high score

Meanwhile, the automated accessibility score of the home pages was 98 for Bold and 92 for DSGov. The high score coexists with 75 and 202 verified non-conformities in the documentation.

Lighthouse score (home page)

0 / 100

Bold

DSGov

Verified AA non-conformities (documentation)

0 / 220

Bold

DSGov

202

Text equivalent: Bold scores 98 on Lighthouse for its home page and has 75 verified AA non-conformities in its documentation; DSGov scores 92 and has 202 non-conformities. The score and the audit measure different surfaces: the score looks at the home page, the audit looks at the component documentation. The score does not capture the non-conformities.

Tables 5 and 8 of the thesis

A high score is not enough.

The institutional paradox

The government's official reference fails its own standard, on its own site.

Object 01

Documentation portal shell

This is where the audit recorded, in DSGov, 40 aria-required-parent non-conformities and 37 listitem ones, with none in Bold. These are documentation portal failures, with no evidence that consuming services inherit them.

Object 02

Copyable code examples

This is where contrast failures in the reference documentation are concentrated. The isolated Menu Push pilot belongs to this object and has its own scope.

Object 03

Distributed component code

This is distinct from the shell and the examples. The audit does not transfer the structural portal failures to the distributed code.

Table 6 of the thesis

The most frequent barrier

Contrast below 4.5:1 is the most frequent barrier: 128 non-conformities across the two systems combined (21 in Bold and 107 in DSGov), concentrated in the code example blocks of the reference documentation. In DSGov, contrast accounts for 107 of the 202, about 53%.

Section 4.4.5 and Table 6 of the thesis

The measured contrast ratios include 4.02:1 and 3.75:1 in Bold and 3.07:1 and 3.58:1 in DSGov, all below the 4.5:1 minimum.

Re-audit

I re-ran the protocol against the live version of both systems on July 30, 2026, with a pinned environment, and recorded the diffs against the September to November 2025 collection in the open dataset. None of the study's anchor numbers changed.

From abstract standard to design decision.

The POUR synthesis reorganizes the findings by the human capability affected, without reopening the method. In both systems, most of them fall under Perceivable.

Non-conformities by WCAG principle in each system (POUR synthesis)

Perceivable

Bold41 of 75 (54.7%)
DSGov137 of 202 (67.8%)

Operable

Bold19 of 75 (25.3%)
DSGov45 of 202 (22.3%)

Understandable

Bold15 of 75 (20.0%)
DSGov20 of 202 (9.9%)

Robust

Bold0 of 75 (0.0%)
DSGov0 of 202 (0.0%)

The zero under Robust, in both systems, is a classification artifact, not an absence of errors: the ARIA structure errors were coded under another guideline (1.3.1).

Table 9 of the thesis

This view sets priorities by their effect on people, not by the order in which a tool reports findings.

Four proposed governance mechanisms.

01
Accessibility gate in CI/CD
If adopted, it can block regressions detected by the test suite before a release.
02
Per-component accessibility contract
Proposal to include accessibility requirements in the Definition of Done.
03
Single source of truth
Proposal to maintain one canonical place for the component and its accessible behavior.
04
Public conformance dashboard
Proposal to publish the series of non-conformities under a constant scope.

Feasibility note

The mechanisms reuse the pipeline run in this study. The audit layer produced the 277 non-conformities. As of August 3, 2026, no agency had deployed the four governance mechanisms.

Adoption of the protocol by an agency can keep new barriers from entering via the CI/CD gate. It is a recommendation, not a deployment.

Experimental correction in a fork, not incorporated into the official code as of October 8, 2026

Before

22 nodes

21 aria-required-parent + 1 aria-required-children

Intervention

Semantic correction in the isolated Menu Push example fork

After

0 nodes

Under the same pinned fork audit

The correction specified by the protocol was applied to a fork of the sample code of the DSGov menu component (Push variant, developer tab). Under the same pinned audit, the 22 ARIA structure violation nodes (aria-required-parent 21, aria-required-children 1) stopped being flagged. Before, after, diff and hashes are published in the open dataset.

The 21 aria-required-parent nodes in the fork cover one example page, a subset of the 40 non-conformities for that rule recorded in the shell across DSGov pages. The listitem rule did not reproduce in the isolated fork and remains recorded in the portal shell.

On July 31, 2026, I reported the defect and the experimental correction to the maintainer, in a public issue on the official DSGov repository. On September 1, a merge request in the official library referenced the issue and proposed removing the inadequate ARIA roles from the menu. As of October 8, 2026, it was still open and not merged. See the public issue (261)(external link, opens in a new tab)

What can be verified now, and what still depends on adoption.

Delivered and verifiable today

The evidence is published and can be downloaded now.
277 traced non-conformities, each with a record and archived evidence.
Open dataset, checklist and evaluation records published for reuse.
Open protocol for replication: the steps, scripts and data support rerunning the audit on another design system. As of August 3, 2026, its usability with a real team had not been tested.

Potential

Any system-wide effect remains potential and depends on adoption by a maintainer team.
Adopting the gate can keep new barriers from entering.
Less duplicated rework, longer-lived components and less duplicate auditing can reduce digital and operational waste.

How success is measured

By the number of unique level AA non-conformities under constant scope (same pages, same test suite, pinned environment), broken down by severity. Today: 202 in DSGov and 75 in Bold. Success means that series falls (critical and serious first) without regressing, published on the conformance dashboard. Constant scope keeps the yardstick from being gamed by changing the sample.

Environmental note

As of August 3, 2026, the project had not measured environmental impact. Reusing open evidence, avoiding duplicate audits and reducing rework are efficiency hypotheses, not demonstrated environmental results.

What this study did not do, stated in full.

01
There was no testing with people. The analysis covers documents and code, with automated auditing and heuristic inspection by one auditor. No user testing, no participation of people with disabilities, no screen reader operated by the author, no second evaluator.
02
Automated coverage reaches about one sixth of the WCAG criteria (Fischer, Lundell and Gamalielsson, 2025). The rest depends on manual inspection, which does not scale with a single auditor.
03
It is a snapshot from September to November 2025. Systems change; the number is dated.
04
The propagation of a barrier through consuming services is a structural mechanism of adoption, treated in conditional language. No effect was measured in any derived service.
05
The author's affiliation with UFSC is declared. Mitigations: independent tooling, identical procedure, and Bold's internal share of critical non-conformities being higher than DSGov's (40.0% versus 22.3%).

Every limitation is also the next step. Nothing here is hidden, because nothing here needs to be.

Where the evidence can grow.

01
Run sessions with people with disabilities and screen readers to validate in use the barriers identified by the code audit.
02
Expand manual inspection and add a second evaluator to increase coverage beyond automated checks.
03
Bring the protocol to a maintainer team to test the non-regression gate in real operation.
04
Repeat the audit on new snapshots to turn the current snapshot into a time series.

These are planned steps. This page does not claim any of them has already happened.

Source, data and credits.

Primary source

Data under CC BY 4.0, scripts under MIT.

Academic credit

Author: Thiago Kenji Corrêa Xikota
Advisor: Prof. Raul Sidnei Wazlawick
Committee: Raul Sidnei Wazlawick, Berenice Santos Gonçalves, Fabiane Barreto Vavassori Benitti
Institution: Universidade Federal de Santa Catarina, BSc in Computer Science
Defense: December 10, 2025, grade 10 out of 10

A work derived from the same research was approved on the official list of the BrasilGov Academy Forum 2026 under the title Inclusão por Padrão (academic circuit). Accessibility by Default is the name of the protocol in the design circuit. Same research, two circuits, both declared.

Accessibility of this page.

This page aims for WCAG 2.2 level AA conformance. A page that argues for accessibility has the obligation to be accessible.

Conformance status: Meets the WCAG 2.2 level AA criteria covered by this self-assessment
Assessment date: August 4, 2026
Method: Self-assessment using axe, Lighthouse and a manual checklist by one evaluator. Includes criterion 2.4.11, Focus Not Obscured (Minimum), and criterion 2.5.8, Target Size (Minimum). No user testing and no external evaluator.
Result and evidence: axe: zero violations. Lighthouse accessibility: 100. The score remains attached to the full report so you can verify what it does not show.
Full audit of this page

Found a barrier here? Write to thiagoxikota@gmail.com. The report will be used to review this self-assessment.

The evidence is open to scrutiny

Everything supporting this case is public: the deposited thesis, the DOI record and the dataset with SHA-256 hashes. Inspect the method, reproduce the count and challenge anything the evidence does not support.

If you want to discuss the evidence or the protocol, the contact channel remains open.

Discuss the protocol

The audit used off-the-shelf accessibility testing tools: axe DevTools, Lighthouse and WAVE. They are technical verification instruments, operated in a deterministic and documented way. The rigor is in the protocol that organizes them, not in the tools themselves.

Thiago Xikota, 2026