By Andy Zhang — Last reviewed April 18, 2026
The revised Consumer Confidence Report (CCR) Rule (89 FR 45980, May 24, 2024; docket EPA-HQ-OW-2022-0260) takes effect January 1, 2027, and the first CCR prepared under it — covering calendar year 2026 — must reach your customers by July 1, 2027 per 40 CFR §141.155(j)(1). What used to be a one-page mail-merge exercise is now a sequenced compliance project with template rework, readability review, direct-URL hosting, translation workflows, and, for systems serving 10,000 or more persons, a second distribution by December 31 (§141.155(j)(2)).
This checklist is the operator-facing playbook we wish existed when we started reading the revised CCR rule 2027 summary and the full requirements matrix. It breaks the work into four phases — pre-work, draft, compliance review, delivery — plus a post-delivery phase for the mid-year report. Every item maps to a specific rule section or a primacy-agency expectation, and the interactive version below remembers your progress between sessions so you can pick up where you left off.
| Phase |
Window |
Key rule section |
Primary deliverable |
| Pre-work |
T-180 to T-90 |
§141.153(d), §141.153(b) |
Reconciled 2026 monitoring data + SDWIS population check |
| Draft |
T-90 to T-60 |
§141.153, §141.156 |
Complete first draft with summary, definitions, tables |
| Compliance review |
T-60 to T-30 |
§141.153, §141.154 |
Section-by-section rule check; optional state pre-review |
| Delivery |
T-30 to T-0 |
§141.155(a)–(d) |
Direct-URL hosting + multi-channel distribution + certification |
| Post-delivery (July 1) |
T+10 |
§141.155(c), §141.155(h) |
Certify within 10 days; archive for 3+ years |
| Mid-year (systems ≥10,000) |
by Dec 31, 2027 |
§141.155(j)(2)–(3) |
Second distribution + 6-month update content if triggered |
The interactive checklist that follows stores your progress in your browser's localStorage — no account, no signup, no server round trip. You tick items off as you complete them, the progress bar updates in real time, and when you come back next week it remembers what you finished. If you clear your browser data or switch machines, your progress resets; the checklist is designed to be a planning aid, not a compliance record.
A printable PDF version of this checklist is available by email for utility operators who want to circulate it to a broader team, print it for a planning meeting, or hand it to a board of directors. The CTA below links to our lightweight lead form — work email only, no credit card, and you will get the PDF plus a one-time reminder two weeks before the January 1, 2027 compliance date.
Everything else in the checklist assumes you already have a clean, reconciled set of 2026 monitoring data. The revised rule did not change the underlying data-disclosure obligation — detected contaminants, maximum contaminant level (MCL) exceedances, maximum contaminant level goals (MCLGs), source-water summary (§141.153(b)), and the standard EPA health-effects language in Appendix A are all carried forward from the 1998 rule codified at 40 CFR Part 141 Subpart O. What changed is the summary (§141.156), delivery (§141.155), readability, and frequency layer on top.
Pull your 2026 data early. If you rely on a contract lab, confirm the cutoff date for Q4 2026 samples and whether any seasonal or triggered monitoring extends into January 2027 reporting. If you operate under a PFAS compliance schedule under the 2024 NPDWR, expect those results to interact with your health-effects narrative. If your system had any 2026 violations — monitoring, reporting, MCL, or treatment technique — you will need the state primacy agency's approved violation language, which can take weeks to receive. For a walkthrough of what the underlying numbers mean, see our companion guide on how to find your CCR and the operator-facing overview of how to write a CCR.
One item that trips up small systems: the SDWIS service-population figure that determines whether you fall above or below the 10,000-person biannual-distribution threshold is the figure on record with the primacy agency, not the census-block count your planning staff pulls from ACS. If you have been growing through annexation or seasonal build-out, confirm your SDWIS classification in writing before you finalize your distribution budget. Utilities sitting at 9,200 year-round residents plus a summer peak should consult the small-utility compliance page before assuming annual distribution is sufficient.
The draft phase begins roughly ninety days before your July 1, 2027 delivery deadline — April 1, 2027 for systems targeting the federal floor, earlier for systems whose primacy agency requires a pre-review window. The objective at this stage is a complete first draft that survives an internal compliance review without a full rewrite.
Start with a template. EPA's CCR iWriter tool remains available and is being updated for the 2027 requirements; many state primacy agencies offer their own certified template with pre-populated health-effects language and state-specific translation triggers already wired in. If your primacy agency offers a certified template, use it — the compliance review phase is dramatically shorter when the structural readability requirements are already satisfied. Operators evaluating alternatives should see our CCR iWriter alternative comparison.
Every CCR must include contaminant tables with detected levels, MCL, MCLG, likely source, and whether the detected level exceeded any regulatory threshold (§141.153(d)). The revised rule requires additional 2027 disclosures: a plain-language summary section at the beginning of the report (§141.156), defined terminology for MCL, MCLG, action level, and treatment technique (§141.153(c)), and a clear statement of compliance status. Systems serving 100,000 or more persons must also develop a written language-assistance plan (§141.155(i)) and file it with the state alongside the first 2027 report. Include the source-water assessment summary (§141.153(b)(2)) — required since 1998, but easy to drop when refactoring a template.
The compliance review phase runs sixty to thirty days before delivery. This is the window in which a second set of eyes — ideally not the person who drafted the report — walks through every required section of 40 CFR §141.153 (content), §141.154 (additional health information), and §141.156 (summary) and confirms that each element is present, accurate, and placed where the rule expects it. The checklist items below map directly to the rule text: detected contaminants, MCLs and MCLGs, likely sources, treatment techniques, violations, health-effects language from Appendix A, source-water information, and the definitions of terms.
Two items often slip through. The first is Spanish translation, or other languages triggered by your primacy agency's non-English-speaking-population threshold (commonly 5% of the service area or 1,000 persons, whichever is lower). EPA publishes approved Spanish translations of the standardized health-effects language; system-specific narrative sections still require fresh translation. The second is the primacy agency pre-review: some states — not all — allow utilities to submit a draft CCR for primacy-agency comment before distribution. Where this option is available, use it. A free review from the regulator catches more problems than any internal check.
The compliance review phase is also where electronic-delivery readiness is confirmed. Under §141.155(a)(1), the revised rule permits four direct-delivery methods: mail/hand-deliver a paper copy; mail a notification with a direct link; email a direct link or electronic version; or another method approved in writing by the primacy agency. Whichever you pick, the link must resolve directly to the current report — not to a homepage, not to a marketing page, not to a social-media post — and §141.155(a)(2) requires you to prominently display instructions for customers to request a paper copy.
The delivery phase runs the final thirty days before July 1, 2027. The core deliverables are hosting, distribution, and certification.
Systems using a publicly available website to deliver the report must maintain public access to the report for no less than 3 years (§141.155(a)(4)). Use a predictable URL pattern — utility.gov/ccr/2027 or similar — and plan the archival pattern before you publish, not after the URL gets shared in customer notifications. A silently-404'd CCR URL three years after publication is a compliance problem, and URL persistence is one of the most-asked questions in primacy-agency implementation Q&As. Systems serving 50,000 or more persons must also post the current year's report on a publicly accessible site under §141.155(f).
Distribution is a layered obligation. E-delivery by direct URL is permissible for customers who have been notified and, depending on primacy agency rules, opted in or opted out. Bill-insert delivery continues to count. Direct mail is still required for customers who do not have a valid email address on file or who request paper copies. Plan all three channels in parallel — email, bill insert, direct mail — with a distribution list reconciled against the billing system. For larger systems, the twice-yearly distribution requirement means this whole operation repeats later in the year.
Certification to the primacy agency is the last step before you mark delivery complete. Under §141.155(c), each community water system must provide the primacy agency a copy of the report and a written certification that the reports were distributed to customers and that the information is correct and consistent with previously submitted compliance monitoring data — no later than 10 days after the distribution deadline. The certification form itself is state-specific; confirm the form and any state-specific attachments with your primacy contact before July 1.
The work is not over on July 1. Archive the delivered CCR — both the public-facing URL copy and an internal copy that includes the full distribution list, certification form, and any customer correspondence about paper-copy requests. Under §141.155(h), systems must retain copies of the CCR for no less than 3 years; §141.155(a)(4) similarly requires 3-year public-website access for systems that deliver the report through a posted-notice model. Some primacy agencies require longer retention — check your state's adopted rule. Most utilities satisfy the federal floor through document-management systems tied to the operational compliance record.
For systems serving 10,000 or more persons, §141.155(j)(2) requires a second distribution by December 31 of the same calendar year. §141.155(j)(3) specifies the content of any 6-month update: a short description of the update, applicable §141.153(d)(4) contaminant sections for any MCL/MRDL/treatment-technique violation between January 1 and June 30, §141.153(f) language for other violations, §141.153(d)(4)(vi) and (d)(8) content if the lead action level was exceeded, and §141.153(d)(7) content for UCMR results not included in the July 1 report. Primacy agencies may set earlier deadlines; confirm with your state. See our twice-yearly distribution guide for the full walkthrough. The second delivery is a distinct compliance event, not a reissue of the July copy — budget the staff time accordingly.
A related compliance-date footnote: §141.152(a) sets a second phase-in on November 1, 2027, the date by which community water systems must comply with the rule as codified on July 1, 2025 (i.e., the technical corrections finalized after the original May 2024 publication). Most operators plan around the January 1, 2027 and July 1, 2027 deadlines, but keep the November 1, 2027 date in your compliance calendar.
Finally: capture lessons learned. The first revised-rule CCR cycle is the one where template decisions, e-delivery logistics, translation workflows, and primacy-agency communication patterns get stress-tested. Document what worked and what did not so that the 2028 cycle — which will look structurally identical to 2027 — can be a ninety-day effort instead of a year-long project. For a plain-language operator overview of the whole rule, see our companion post on what changed in the 2027 CCR rule and the full 2027 requirements matrix. New Jersey operators should also review the state-specific NJ implementation notes.
If you want help shortening the cycle, TapWaterData is building operator-facing tooling for CCR 2027 — drafting assistance, direct-URL hosting, e-delivery logistics, and mid-year distribution workflows. See the CCR software guide and the CCR software pricing page for current offerings, or head to the small water system CCR compliance page if you serve fewer than 3,300 people.
No. The checklist is a planning aid, not a regulatory document. The authoritative compliance reference for the revised CCR Rule is 40 CFR Part 141 Subpart O and your state primacy agency's adopted rule text. This checklist captures the federal floor plus the primacy-agency patterns we see most commonly, and it is designed to be used alongside — not instead of — the primacy agency's own guidance.
If you are inside the T-60 window (May 1, 2027 or later for the federal floor) and have not yet started template rework, prioritize the compliance-review checklist items over polish. A CCR that satisfies the required sections and health-effects language but looks like last year's template will pass a primacy-agency review; a visually-redesigned CCR that omits a required section will not. Escalate to the primacy-agency contact if you think you will miss July 1 — early communication almost always converts a missed-deadline enforcement action into an agreed-upon late-delivery schedule.
Yes. A printable PDF version is available through the email form above. We send the PDF immediately, with a one-time reminder two weeks before the January 1, 2027 operational compliance date. We do not sell, share, or sync your email with any third-party marketing systems; the reminder is single-send and the list is operator-only.
At least 3 years, per 40 CFR §141.155(h). Systems that deliver the report via a posted-notice-plus-website model must also maintain public access on the website for no less than 3 years under §141.155(a)(4). Your state primacy agency may set a longer retention period, so confirm the state-adopted rule text before you finalize an archival schedule.
Under §141.155(j)(2), the second distribution must be completed by December 31 of the same calendar year as the July 1 report. If your system had an MCL, MRDL, or treatment-technique violation (or certain UCMR results, or a lead action-level exceedance) between January 1 and June 30, §141.155(j)(3) requires a 6-month update with the content specified in that paragraph. Some primacy agencies impose earlier deadlines; check your state.
The interactive checklist stores your ticked items in your browser's localStorage under the key twd_ccr_checklist_v1. That means progress is remembered on the same browser and machine, but not across devices, and not if you clear your browser data. If you want a durable cross-device version, use the printable PDF and track progress in whichever compliance-calendar system your utility already uses.
- 40 CFR Part 141, Subpart O — Consumer Confidence Reports (eCFR current) — accessed 2026-04-18.
- National Primary Drinking Water Regulations: Consumer Confidence Reports Rule Revisions, 89 FR 45980 (May 24, 2024) — docket EPA-HQ-OW-2022-0260; accessed 2026-04-18.
- EPA Safe Drinking Water Act: Consumer Confidence Reports hub (epa.gov/ccr) — accessed 2026-04-18.
- EPA CCR iWriter tool (sdwis.epa.gov/ccriwriter) — accessed 2026-04-18.
- EPA Consumer Confidence Report Rule Revisions overview — accessed 2026-04-18.