What is a VPAT, and how is it different from an ACR?
Someone has asked you for a VPAT. The words are used loosely enough that the request is genuinely ambiguous, so it is worth separating them before you start.
The three words, separated
WCAG is the standard. It is a list of success criteria, organised into levels A, AA and AAA, describing things that must be true for a web interface to be usable by people using assistive technology. Level AA is what nearly every buyer means.
A VPAT is a blank template, published by the Information Technology Industry Council, for reporting how a product measures up against that standard. It is a form, and by itself it says nothing.
An ACR - an Accessibility Conformance Report - is what you get when that form is filled in for your product. It is the document you actually send.
So what is the buyer asking for?
Almost always an ACR, phrased as "a VPAT". They want a document that tells them, criterion by criterion, what your product supports, what it partially supports, what it does not, and what happens to their users in each case.
It is worth asking two things back before you start writing: which standard they are procuring against, and whether they have a preferred template edition. Both answers change what you produce, and asking costs you nothing but a day.
Who is allowed to write one
You are. A conformance report is normally a self-evaluation written by the vendor. Some buyers ask for a third-party audit instead, and they will say so explicitly.
What separates a report that passes review from one that does not is not who wrote it. It is whether the claims in it are supported by an evaluation you actually carried out, and whether the gaps are visible.