Building accessibility
from assumption
to standard

When Graham joined Mimecast, the organisation's maturity around accessibility and usability was low. There was no shared appreciation of why either mattered. Many products had not been revisited after their initial bugs were fixed, which meant maintenance had stalled and problems had accumulated unchecked. No feature or function had a WCAG audit. No product had a credible VPAT. No website met AA compliance.

The prevailing assumption was that this was acceptable. Mimecast served enterprise IT and security professionals. In the words of more than one stakeholder, these were technically sophisticated users who knew how to use complex technology. Accessibility was framed as a consumer concern, not an enterprise one.

The support data told a different story. Ticket volumes, customer escalations, and customer interviews pointed to real struggles with the product that were going unacknowledged. The assumption that enterprise users did not have accessibility needs was not grounded in evidence.

Graham saw accessibility not just as a compliance challenge but as a way to make the organisation more human-centred. The rules-based nature of accessibility standards meant they could be understood clearly across the whole organisation, in black and white, by people who had never engaged with UX thinking before. That made accessibility a practical entry point for raising the overall appreciation of user experience at Mimecast.

The internal barriers were widespread. Teams were busy. Adding accessibility requirements on top of existing delivery commitments did not go down well. People could rationalise why it was important when it was explained to them, but understanding something and creating space for it in a packed schedule are different things.

Graham's position in the organisation mattered here. He was at the same hierarchical level as the product and engineering leaders he was trying to bring along. He could not instruct teams to adopt accessibility standards. What he could do was use influencing skills, barter design resource, and create the conditions for teams to understand the value and choose to embed it into their project processes.

Part of that was very practical. Graham ran the company-wide induction for new starters at Mimecast, using that time to explain in detail why accessibility mattered, why the business was investing in it, and how it would help Mimecast commercially. Bringing it into the induction meant every new joiner encountered the rationale before they had formed habits about how the organisation worked.

Securing the right partner and sponsor

Graham brought in Hassell Inclusion as the specialist partner, working directly with Jonathan Hassell as lead consultant. Jonathan is the author of ISO 30071-1:2019 and had previously served as Head of Accessibility at the BBC, where he worked closely with the RNIB and brought RNIB staff directly into the organisation to work alongside designers and engineers. Graham had worked with Jonathan during that period at BBC Radio 2, and trusted both his expertise and his ability to embed accessibility thinking into teams who had not previously engaged with it. Choosing the author of the standard was a deliberate signal: this was a capability build, not a compliance exercise.

Securing organisational commitment required work at a senior level. Harvey Seale, SVP Governance and Global DPO, became the executive sponsor after Graham framed the programme in terms that mattered to his function: governance credibility, regulatory positioning, and the opportunity to demonstrate leadership ahead of incoming legislation. Harvey gave ownership of the programme to Raeann Cando, Senior Director of Governance and Certification, who led the delivery of the programme from the governance side. The certification team took on project management of the work deliverables.

Andrew Doyle and the audit programme

In June 2022 Graham recruited Andrew Doyle directly from a renowned accessibility consultancy, leading the hire himself. Andrew's arrival was the moment the programme shifted from aspiration to execution. His first major piece of work was commissioning audits for every product sold to customers. From those audits, Andrew identified the most common failure patterns across the portfolio and created documentation showing engineers and designers precisely how to correct each one. He consulted directly with engineering and design teams to ensure those problems did not recur.

In tandem with the design system work, Andrew took this further. By working with the design and platform teams to build corrective patterns into Mimecast Elements, he effectively ended entire categories of accessibility problem through adoption of a new component standard. The issue could not come back because the component that caused it had been replaced. Andrew also created an accessibility framework for Mimecast that gave the organisation a clear structure for understanding what they needed to achieve and how to measure progress.

Programme structure and timeline

Cross-functional ownership

Accessibility at Mimecast was never owned by one team. Creating and maintaining the standard required active involvement from QA, technical programme managers, designers, engineers, marketing, and PR. That breadth was intentional. A standard that lives in one function is fragile. A standard that multiple functions have invested in is far harder to deprioritise when delivery pressure increases.

Key partners and sponsors:

Commercial and regulatory validation

When the EU European Accessibility Act came into force in June 2025, field CTOs contacted Graham directly, worried about whether Mimecast could demonstrate compliance to customers. The programme that had been built over four years gave a straightforward answer: the audits existed, the framework was in place, the design system was carrying accessible components across the portfolio, and progress was documented and measurable. Mimecast was ahead of competitors who were only beginning to engage with the requirements.

Three categories of client validated the commercial importance of the work: