I have third-party content on my site that is not compliant with WCAG. I disclosed this in my accessibility statement but the third party does not have a VPAT for me to reference. Am I still responsible?

The level of responsibility remains the same regardless of the presence of a VPAT. Essentially, including the third party's VPAT in your accessibility statement serves to reduce risk while you work on its remediations. It does not absolve you of responsibility. An existing VPAT could also open up a conversation with the third party about changes that need to be made to comply with accessibility standards. However, even if you don't have their VPAT, you can and should still disclose the violations. Making your accessibility plan known is always a great strategy.