A defect with no price never gets fixed

An ordinary accessibility report reads as an inventory: this many images without a description, that many fields without a label. To a developer it is work; to an executive it is noise. The task drifts into the backlog marked secondary and lives there for years, because not one line of such a list answers the only question a director asks: what does this cost us.

The Oracle answers with a number. It adds up the maximum penalties across every vulnerability found and prints one figure of total financial exposure. The article gives a sample of that line: four critical ADA violations and two GDPR ones combine into a potential risk above three hundred and twenty thousand dollars. After a line like that, priority changes without a meeting.

Three price tags taken from statute

The first is ADA Title III: a federal civil penalty from the US Department of Justice of up to seventy-five thousand dollars for a first violation and up to a hundred and fifty thousand for subsequent ones. The source's caveat carries over verbatim, because it changes what the number means: this is the ceiling, not the average bill. The second is the GDPR, calculated from twenty million euros or four per cent of annual turnover. The third is the CCPA: two and a half thousand dollars for an unintentional violation and up to seven and a half for a deliberate one, counted per affected user.

Beside them sits the backdrop that keeps those sums concrete. Law firms specialising in accessibility hunt vulnerable sites with automated parsers and file class actions demanding between fifteen and a hundred and fifty thousand dollars for a single session of violations. A plaintiff need not wait for a living complainant: a machine walking through sites in sequence is enough.

For the sum to be honest, it cannot be assembled out of false positives — and that is exactly where static analysis breaks. A scanner driven by regular expressions and simple selectors checks that an attribute exists, not that it helps. A sales chart described as “image” passes: the attribute is physically present. For a blind reader that description is useless, and it is a blunt breach of WCAG and ADA — yet the report shows nothing.

The mirror error has the same origin: the tool cannot tell a decorative divider, which should be hidden from assistive technology, from a functional image, which must be described. Hence hundreds of false alarms and silent misses — and the impossibility of building a monetary estimate on top of such a report.

The overlay that makes things worse

The second habitual path is a widget layered over the site, promising to close accessibility in one click by switching fonts, contrast and speech synthesis. US court practice shows such widgets do not save anyone from suits and often work the other way, drawing plaintiffs' attention. Worse, overlays break the built-in screen readers blind users rely on, leaving the site less usable than before.

And crucially, a widget does not touch the source. It edits the DOM in the browser, while a law firm's scanner reads the HTML the server hands out and finds everything still in place. The third gap is the missing link between domains: a tool will check text contrast and never notice that the same page ships personal data through a tracking pixel before any consent is given.

The Oracle splits the job into two unlike stages. First the scraping module builds a blueprint of the page from which heavy media and surplus markup are excluded. What remains is metadata — encoding, language, description, viewport settings; interactive elements together with their identifiers and ARIA attributes; the heading hierarchy from the first level to the sixth; images and the content of their descriptions; traces of analytics, pixels and consent banners; and the server's security headers — HSTS, CSP, certificate state.

The blueprint then goes to a language model. The primary one is Grok 4.3, with an automatic switch to Gemini 2.5 Flash when the network lags or limits run out. The model matches the blueprint against a matrix of two thousand checks and judges what a regular expression cannot see: whether “logo” is an adequate description of a logo, whether a button holding a single icon has an accessible name at all.

What goes into a violation card

Every finding is shaped identically: evidence stating precisely why this is a violation; the offending fragment cut out of the page; step-by-step remediation written in the user's language — Russian, English, Spanish or Chinese — and a ready patch to copy. Rules are sorted into seven categories, each with its own risk weight — critical, serious, moderate or advisory — a link to the regulator's document, and the penalty calculation.

An assessment stops being a matter of taste wherever the formula is named. Text-to-background contrast must be at least 4.5 to 1, with 3 to 1 allowed for large text from 18 points or 14 points bold; relative luminance is computed as L = 0.2126 · R + 0.7152 · G + 0.0722 · B, and the ratio itself as (L1 + 0.05) / (L2 + 0.05).

The server side is specified the same way. The forced-HTTPS header must live for no less than a hundred and eighty days — that is 15768000 seconds — and carry includeSubDomains together with preload. The content security policy has to restrict sources and refuse unsafe inline insertions without hashes or one-time tokens. Protection against framing, a ban on content-type guessing and a vulnerability contact file under RFC 9116 in the well-known directory are all checked. Separately, the last update date of the published policies is read: it must not be older than twelve months.

There is also an appendix for Russian and CIS jurisdictions that western scanners tend to skip. GOST R 52872-2019 demands a version for the visually impaired with switchable colour schemes and font scaling to two hundred per cent without horizontal scrolling. Federal Law 152-FZ demands a consent checkbox that is not pre-ticked and that links to the policy itself. Federal Law 38-FZ demands that consent to advertising be a separate box, never merged with consent to data processing.

The comparison table is fair in the part that counts: two thousand-odd complex checks against roughly fifty basic ones in Lighthouse and roughly sixty in the WAVE extension; a sitemap crawl of up to three pages against a single current page in both; and a penalty calculation that none of the listed tools offers at all.

Then come figures whose provenance is stated outright, and that is worth keeping. Scan depth — up to thirty times more parameters, by internal estimate. False positives down by roughly eighty-five per cent — by internal estimate. Remediation time cut by about seventy per cent — by the team's own estimate. These are estimates, not third-party measurements, and the article labels them as such.

The Oracle stands at the mouth of a cold outreach funnel: thirty domains and ninety warmed mailboxes send personalised audits daily, each letter carrying the recipient's actual violations and the size of the possible fine. The offer is single: close the critical vulnerabilities within forty-eight hours using AI agents for five hundred dollars, once. After that the client moves to AIfa Works hosting, where the check repeats monthly in the background.

Payments run through a Solana smart contract with a fixed split: five per cent to the Founder's Fund, five to the burn, fifteen, seven and three per cent to the three ambassador tiers, sixty-five per cent to the treasury for buying AR. Token supply is capped at ten billion. Partner payouts are framed as a network validation fee, and choosing to be paid in tokens raises the rates to eight, four and two per cent, with the platform buying the required volume on the open market.

The roadmap has three phases and none is declared finished. The third quarter of 2026 is set aside for a GitHub Action and a GitLab CI plugin: the audit will run on every commit, and the build will be blocked when the code breaks accessibility or privacy. The fourth quarter is for zero-knowledge proofs: a site will be able to present an on-chain proof of a passed audit scoring two thousand out of two thousand without disclosing its backend, and record it as a compressed NFT on Solana.

The first half of 2027 is planned for widening the matrix to five thousand checks, adding Asian and Middle Eastern standards, and tuning the local model for applications above ten thousand pages. These are plans, and an analysis has no right to file them under done.

That is the whole manoeuvre. The violations on a site exist whether or not the owner knows about them; the law and the courts priced them long before the first scan. The Oracle adds nothing to the risk — it makes the risk visible and converts it into the unit a business already knows how to decide in.