Consumer Confidence Reports — What Operators Have to Produce Every Year

If you've ever opened a city water bill and found a "Water Quality Report" tucked inside, you've seen a Consumer Confidence Report. CCRs are one of the most-visible parts of the Safe Drinking Water Act — they're the annual public-facing document every community water system has to produce, telling customers what was in their water last year. They're also one of the most-tested regulatory topics on operator certification exams because every CWS has to do one, and getting any element wrong is a public-notification violation.

This guide covers what a CCR is, what's required in it, the deadlines, the delivery rules, and the operator-side responsibilities that keep your system in compliance.

TL;DR

• A Consumer Confidence Report (CCR) is an annual water quality summary that every community water system (CWS) must produce and deliver to its customers by July 1 for the previous calendar year.
• The CCR requirement comes from the 1996 SDWA amendments. Non-community systems (NTNCWS and TNCWS) do not have to produce CCRs.
• Required content includes source water information, list of detected contaminants with MCL comparisons, any violations and their explanations, lead language, cryptosporidium and radon (where applicable), and contact information.
• Delivery has gotten flexible since 2024 — printed copies, electronic delivery, or web-posting plus URL notification are all acceptable depending on system size and state rules.
• Common operator-side mistakes: missing the July 1 deadline, omitting a required element, using wrong MCL values, mismatching units, and miscategorizing detected contaminants.
• Practice with the regulations practice test and the sampling practice test; related guides include the SDWA overview and the MCL guide.

What a CCR actually is

A CCR is an annual report mailed (or electronically delivered) to every customer of a community water system. Its purpose is to inform customers about:

• Where their water comes from
• What contaminants were detected during the previous calendar year
• How those detections compare to federal MCLs
• Whether there were any violations
• What the system did about those violations
• How to contact the system and the state primacy agency

The underlying philosophy: customers have a right to know what's in the water they drink, even when everything is in compliance. EPA's view is that informed customers create accountability that drives utility performance.

The format is flexible. Most CCRs are 2-4 pages with a simple table of contaminants, source water description, paragraph on lead, and contact info. Larger systems often produce more elaborate reports with graphics, multiple language versions, and detailed treatment descriptions. The information requirements are the same.

What every CCR must include

The mandatory content elements, in roughly the order they typically appear:

1. System identifying information. Name of the system, contact information (phone, address, website, email), name of the certified operator in some states, and the system's PWSID (Public Water System Identification number).

2. Source water description. Where the water comes from: surface water from a specific river or reservoir, groundwater from specific wells, purchased water from another system. The description must identify the source by name and location.

3. Source water assessment summary. Since the 1996 amendments require source water assessments, the CCR must summarize the assessment results and tell customers where to read the full assessment (typically a state agency URL).

4. Definitions of key terms. MCL, MCLG, action level, treatment technique, ppm, ppb, nephelometric turbidity unit, etc. EPA provides a standard glossary the system can copy.

5. List of detected contaminants in a standardized table format that includes for each: - Contaminant name - Date(s) of detection - Highest level detected (and range if multiple samples) - MCL (or action level, or treatment technique) - MCLG - Units - Likely source(s) of contamination - Notation if it exceeded the MCL (any violation must be conspicuously noted)

6. Violation explanations. For every violation during the reporting year, a description of the violation, the dates, the potential health effects, the system's response, and any ongoing remediation.

7. Required lead language. A specific paragraph (EPA provides standardized text) that explains lead exposure risks, the role of plumbing materials, and what customers can do — flush taps, use cold water for cooking, contact the system for testing. Required regardless of whether lead is detected.

8. Cryptosporidium statement (for surface water systems and GUDI sources). Either a statement that crypto was monitored and the results, or a brief explanation if not monitored.

9. Radon statement (where required by state). Some states require radon information; not federally required for all systems.

10. Compliance and corrective action statements. Beyond specific violations, any actions taken to address compliance issues (e.g., installing a new treatment process, expanding monitoring, joining a regional system).

11. Special population warnings. Language about immunocompromised individuals, pregnant women, infants, and elderly being more vulnerable to certain contaminants (especially crypto and lead).

12. Contact information for additional help. State drinking water program, EPA Safe Drinking Water Hotline (1-800-426-4791), and local system contacts.

The contaminant table in section 5 is the heart of the report. Every detected regulated contaminant must appear there, even if the level is well below the MCL. Many CCRs include a separate "additional monitoring" section listing UCMR (unregulated contaminant monitoring) detections so customers know what's being tracked even without regulatory limits.

Timing and delivery deadlines

July 1 is the date by which every CWS must deliver the CCR for the previous calendar year to all customers. The CCR for calendar year 2025 must be in customers' hands by July 1, 2026.

Delivery methods (since 2024 updates, all of these are acceptable for most systems):

1. Direct mail — paper copy mailed to every customer (the original default).
2. Electronic delivery — email with attached PDF, or email with URL link directly to the report.
3. Bill insert — included with the customer's water bill (limited eligibility based on system size).
4. Web-posting plus notification — post the CCR on the system's website and mail/email a notification to every customer with the URL and a phone number to request a paper copy.

For systems with fewer than 10,000 customers, a "good faith effort" delivery process is acceptable — typically posting the CCR at the city hall, water billing office, and other public locations, plus a notice in the local newspaper, instead of individual delivery. Check your state's specific rules.

Certification of distribution must be filed with the state primacy agency by October 1 (3 months after the delivery deadline), confirming that the CCR was distributed to all customers as required. This is a separate filing operators commonly forget.

What triggers a CCR violation

Three categories of CCR violation:

1. Failure to produce or distribute on time — missing the July 1 deadline. Tier 3 public notification required (just noting the failure in next year's CCR is one common form of notification).

2. Failure to include required content — leaving out a required element. Same Tier 3 violation. Common omissions: the standard lead language, source water assessment URL, or one of the violation explanations.

3. Failure to certify distribution to the state — not filing the certification by October 1. Tier 3 violation.

Practical consequence: the state regulator will note the violation, the system must include it in next year's CCR, and there's typically no fine for a first offense. Repeat or egregious offenses can trigger formal enforcement.

The exam doesn't usually drill into CCR violation procedures, but it does test:

• The July 1 deadline (consistently asked)
• That CCRs apply only to community water systems
• That the report covers the previous calendar year
• That the violation explanations must be in the CCR
• The required lead language

CCR for a system with a violation last year

This is the case operators most often have to handle correctly. If your system had a TTHM exceedance in Q3 of last year, your CCR for that year must:

1. List the violation prominently — typically in a separate "Health Effects Notice" or "Violation" section, not buried in the contaminant table.
2. Explain what happened: date(s), location(s), specific contaminant, the actual level vs. the MCL.
3. Describe the health effects in plain language (using EPA's required wording for the specific contaminant).
4. Describe what the system did: short-term corrective action (e.g., switched to alternative source, increased flushing), long-term action (e.g., installed enhanced coagulation), and current status.
5. State whether the violation is ongoing or has been resolved.
6. Note any public notification that was issued at the time, beyond the CCR.

The exam-style question pattern: "A community water system had an arsenic MCL violation in October. Which of the following must be included in next year's CCR?" Correct answer: a description of the violation, its health effects, dates, and the corrective action taken.

Special elements for specific system types

Surface water systems — include cryptosporidium monitoring data if applicable under LT2ESWTR.

Systems with lead service lines — beyond the standard lead language, include service line inventory status (under LCRR), a notice of any lead exceedances at sampled sites, and the system's lead replacement plan.

Systems serving schools or childcare facilities — under LCRR, must include language about school sampling requirements and results.

Multilingual communities — if a significant portion of the population speaks a language other than English, EPA recommends (and some states require) a translated version of the CCR, or at least a translation of key sections.

Systems with PFAS detections — once PFAS MCLs are fully in force (2027 for most systems), CCR reporting of PFAS detections becomes mandatory along with required health-effects language.

Operator responsibilities for CCRs

Most utilities have an operator (or a clerk/manager) who owns CCR production. The operator's typical role:

1. Compile the year's monitoring data — pulling sample results from LIMS, regulatory submissions, and operating logs.
2. Verify the contaminant table — every regulated contaminant detected during the year, with correct MCL values, correct units, correct sample dates.
3. Confirm violation status — list any MCL exceedances, treatment technique violations, monitoring violations, or reporting violations from the year.
4. Draft or update the report text — most systems use a template that gets updated annually with new data.
5. Submit for state pre-review (some states require this; others don't).
6. Distribute by July 1 — coordinate with billing department for mailing/insert, IT for electronic delivery, or webmaster for posting.
7. File certification with state by October 1 — confirm distribution method and date.

The most common operator-side error is unit confusion — reporting arsenic as 10 instead of 0.010 (mg/L vs. µg/L), nitrate as N vs. NO3 (10 mg/L vs. 44 mg/L), or fluoride as the SMCL (2.0) instead of the primary MCL (4.0). Double-checking units against the rule each year prevents this.

Common exam pitfalls

Thinking all PWSs produce CCRs. Only community water systems do. Non-community systems (schools, gas stations, campgrounds) do not.

Mixing up the deadline. July 1 of the year FOLLOWING the reporting year. The CCR for 2025 is due July 1, 2026.

Forgetting the certification deadline. October 1 — three months after delivery — is the deadline to certify to the state that distribution was completed.

Treating violations as confidential. Every violation during the reporting year must be in the CCR, prominently. Hiding it is itself a violation.

Forgetting required content. Required lead language, source water assessment URL, special-population warnings, and contact info are NOT optional even if your system has no issues.

Mismatching units in the table. Each contaminant has a standard unit (ppm/mg/L, ppb/µg/L, NTU, pCi/L). Reporting in the wrong unit makes the data wrong.

Quick reference

• Required for: community water systems only (not NTNCWS or TNCWS)
• Reporting period: previous calendar year (Jan 1 – Dec 31)
• Delivery deadline: July 1 of the following year
• State certification deadline: October 1
• Required content: source description, contaminant table with detections, violations + explanations, lead language, contact info, definitions
• Delivery methods: paper mail, electronic, bill insert, or web-posting + notification
• Health effect language: EPA-prescribed wording for each specific contaminant violated

Practice and next steps

• Free regulations practice test — 50 questions on CCR requirements, MCLs, and rule compliance.
• Free sampling practice test — the monitoring data that ends up in your CCR.
• Safe Drinking Water Act overview — the law that requires CCRs.
• MCLs, MCLGs, and SMCLs explained — the limits your CCR table compares against.
• Lead and Copper Rule guide — the LCRR lead-related CCR additions.
• Disinfection byproducts explained — DBP results that appear in every CWS's CCR.

CCRs are the closest a water system gets to public-facing communication. Getting them right shows the system takes accountability seriously. Getting them wrong is a published, archived violation that anyone in your service area can read.