Conference 23–24 September 2024 📍 Washington D.C., USA

PDF Days North America 2024 — Accessibility Deadlines, AI Extraction, and Healthcare PDFs

PDF Days North America 2024 was held in Washington D.C. on 23–24 September 2024. With the EU European Accessibility Act enforcement deadline less than a year away and the DOJ ADA web rule finalised, the conference focused on actionable compliance — PDF/UA-2 tooling, accessible form design, healthcare document workflows under HIPAA, and AI extraction accuracy on real-world North American document types.

Official event page →

Key takeaways

PDF/UA-2 adoption roadmap for federal agencies: require for new contracts from 2025–2026; maintain PDF/UA-1 as transitional; plan legacy remediation using AI-assisted workflows.
NIST FIPS 203/204/205 finalisation activated OMB M-23-02 post-quantum transition obligations; Federal PKI PQC certificate availability expected 2027–2030.
Long-Term Validation (LTV) signatures were recommended immediately for all high-value signed PDFs, independent of PQC transition timing.
Production AI-assisted remediation data: $0.50–$5 per page vs $10–$30 manual; all deployments maintained human review at QA stage for regulatory accountability.

PDF Days North America 2024 was held in Washington D.C. in October 2024, organised by the PDF Association. The 2024 North American conference arrived in a specific context: PDF/UA-2 (ISO 14289-2:2024) had been published in April 2024, NIST's post-quantum cryptography standards had been finalised in August 2024, and the AI-assisted accessibility tooling evaluated at previous conferences had moved into wider deployment. Federal agency practitioners had concrete questions about what these developments required them to do. The conference brought together federal IT and accessibility professionals, PDF tool vendors, digital signature experts, and document management specialists to address these questions with the specificity that US federal context requires.

PDF/UA-2 compliance planning for federal agencies

For US federal agencies, PDF/UA-2 adoption involved multiple decision layers: Legal mandate mapping — Section 508 of the Rehabilitation Act references WCAG 2.0 Level AA. PDF/UA-2 aligns with WCAG 2.1, not WCAG 2.0. Sessions clarified the legal position: agencies are required to meet Section 508 (which maps to WCAG 2.0 AA) as a minimum; PDF/UA-2 compliance is consistent with this requirement (since PDF/UA-2 meets or exceeds WCAG 2.0 AA) but is not mandated by current Section 508 regulations. Agencies proactively adopting PDF/UA-2 are going beyond current minimum requirements — a risk-managed approach given that Section 508 Refresh to WCAG 2.1 is expected. Validator adoption — Both PAC and veraPDF had stable PDF/UA-2 validation capabilities at the time of the October 2024 conference. Sessions reviewed integration of both validators into federal agency document management and publication workflows. Procurement language updates — Building on lessons from PDF Days North America 2021's procurement recommendations, the 2024 sessions addressed how to update contract language from "PDF/UA-1 conformant" to "PDF/UA-2 conformant" and what validation evidence should be required from vendors. Transition timeline — The pragmatic consensus: agencies should require PDF/UA-2 for new document production contracts starting in 2025–2026, maintain PDF/UA-1 as acceptable for existing systems during a transition period, and document a migration path for legacy document libraries.

Post-quantum signature preparation in federal government

NIST's finalisation of FIPS 203 (CRYSTALS-Kyber), FIPS 204 (CRYSTALS-Dilithium), and FIPS 205 (SPHINCS+) in August 2024 moved post-quantum cryptography from planning to an active implementation requirement for US federal agencies under OMB Memorandum M-23-02, which required agencies to begin their cryptographic inventory and transition planning. PDF signature implications — For agencies that rely on PDF digital signatures for document authenticity and non-repudiation: Certificate authority readiness — US federal agencies use PIV (Personal Identity Verification) cards for qualified electronic signatures, backed by the Federal PKI. FPKI will need to issue PQC certificates. Sessions reviewed the GSA/FPKI transition timeline, which was expected to provide PQC certificate capabilities in the 2027–2030 timeframe. Long-term signed documents — Agencies signing documents with RSA/ECDSA that must remain legally valid for 10–30 years were advised to implement LTV (Long-Term Validation) signatures immediately, regardless of the PQC transition. LTV ensures current signature validity can be verified from embedded data; when PQC is available, documents can be counter-signed with a PQC algorithm to provide dual-algorithm coverage. PDF encryption for sensitive PDFs — PDFs containing classified or CUI (Controlled Unclassified Information) encrypted today with AES (symmetric encryption — quantum-resistant) were not at immediate risk. The threat to symmetric encryption from quantum computers (Grover's algorithm halves the effective key strength) means AES-128 effectively drops to 64-bit security with a quantum computer, while AES-256 drops to 128-bit — still considered secure. The urgent risk is asymmetric key exchange and signature algorithms, not AES encryption.

AI-assisted accessibility at scale: production lessons

By October 2024, several federal agencies and their contractors had moved AI-assisted PDF accessibility workflows from pilot to production. Sessions provided the first large-scale production data from these deployments: Cost and throughput metrics — Agencies that had deployed AI-assisted remediation workflows (AI-generated tags + human review + automated validation) reported processing costs of $0.50–$5 per page depending on document complexity, compared to $10–$30 per page for fully manual expert remediation. For high-volume agencies (Department of Veterans Affairs, Social Security Administration) with millions of legacy documents, the cost difference was a primary adoption driver. Quality assurance approaches — The most successful deployments combined: (1) AI-generated initial structure tags; (2) Automated validation with veraPDF/PAC to catch structural errors before human review; (3) Stratified human review (100% review for complex documents, sampled review for simple documents); (4) Automated regression testing on sample documents after tool updates. Multimodal AI for alt text — Production experience confirmed that multimodal AI models (GPT-4V, Claude, and similar) produced acceptable initial alt text for photographs and simple diagrams, requiring less than 5 minutes of human review per image on average. Complex technical diagrams, maps, and domain-specific figures still required substantial human input. Human-in-the-loop requirements — No agency had deployed fully automated PDF accessibility production without human review. The consensus was that regulatory risk (Section 508 compliance is a legal obligation with potential litigation exposure) required human accountability at the quality assurance stage, regardless of AI capability improvements. AI was deployed as a cost reducer and throughput accelerator within a human-accountable workflow, not as a replacement for it.

Frequently asked questions

What is OMB Memorandum M-23-02 and what does it require for PDF signatures?

OMB (Office of Management and Budget) Memorandum M-23-02 (November 2022) — "Migrating to Post-Quantum Cryptography" — directs US federal agencies to inventory their cryptographic systems and develop migration plans for transition to post-quantum cryptographic algorithms. For PDF digital signatures, this means: identifying all systems that create, verify, or rely on PDF signatures using RSA, DSA, or ECDSA; prioritising high-value and long-lived signed documents for early transition; and planning for adoption of NIST PQC standards (FIPS 203/204/205) in signature infrastructure. The memo sets a framework and timeline (initial inventory by 2024, ongoing migration through the 2030s) rather than mandating immediate PDF format changes — PDF signature algorithm updates depend on upstream PKI infrastructure (certificate authority and HSM support) that has its own transition timeline.

What is PIV and how does it relate to PDF signatures in federal government?

PIV (Personal Identity Verification) is the US federal government's standard (FIPS 201) for employee and contractor identity credentials, implemented as smart cards. PIV cards carry PKI certificates (identity, encryption, card authentication) issued by agency CAs that chain to the Federal Bridge Certification Authority (FBCA). Federal employees can sign PDFs using their PIV card credentials — the signing certificate chain from PIV issuer to FBCA is used to validate the signature. Adobe Acrobat and other PDF signing tools support PIV card signing via PKCS#11 middleware. Signed PDFs from federal PIV signatories are trusted by organisations that trust the FBCA. The post-quantum transition for PIV-based signatures requires the FPKI to begin issuing PQC certificates, which GSA and NIST were planning for the 2027–2030 timeframe as of the 2024 conference.

What is the Federal CIO Council's guidance on accessible PDF?

The Federal CIO Council is an interagency body coordinating federal IT policy. Its Section 508 working group has published the IT Accessibility / 508 requirements and guidance documents that supplement the Access Board's regulatory standards. The most directly relevant publications for PDF are: the IT Accessibility Testing Baseline for PDFs, which defines the testing methodology and pass/fail criteria that Section 508 compliance assessments must use; and the Trusted Tester certification programme, which trains and certifies testers to apply the testing baseline consistently. The testing baseline aligns with WCAG 2.1 Level AA for PDF (despite the 508 Refresh formally referencing WCAG 2.0) and incorporates the PDF-specific techniques from the W3C PDF Techniques series. Agencies seeking to self-certify Section 508 compliance for PDFs should use the Testing Baseline methodology.

Try it in your browser

The PDF tools and standards discussed at this event are available free — no account needed.

Sign PDF Edit PDF Protect PDF Open editor