CCR Enforcement and Penalties: What Happens if You Miss the 2027 Deadline
Last reviewed: April 18, 2026
The Consumer Confidence Report (CCR) Rule has been in force since 1998, and a measurable share of community water systems have missed at least one CCR deadline in that span. Most of those misses never produced a dollar of fine — they produced a letter, a phone call, and a corrective submission. That pattern will change for the 2027 cycle, and the reasons are structural rather than rhetorical. The revised CCR Rule — finalized by EPA in the May 24, 2024 Federal Register at 89 FR 45980 under docket EPA-HQ-OW-2022-0260, codified at 40 CFR Part 141 Subpart O — increased the number of discrete compliance obligations, tightened verification pathways through direct-URL delivery and primacy-agency portal submission, and prompted several state primacy agencies to update their enforcement frameworks. The composite effect is that a 2027 CCR miss is more visible, more documentable, and more likely to produce formal enforcement than a 2022 CCR miss.
This guide explains who enforces the CCR Rule, how violations are categorized and escalated, what penalties utilities actually face under the current 40 CFR §19.4 inflation-adjusted ceilings, and how to cure a missed or defective CCR before it turns into a fine or consent decree. It is written for the operator, utility manager, or regulatory-compliance attorney preparing for the 2027 cycle and wanting a clear-eyed view of downside risk.
Who enforces the CCR Rule
The CCR Rule is a federal rule codified at 40 CFR 141 Subpart O and enforced through a two-tier federal-state structure. State primacy agencies — the state health department or environmental agency delegated primary enforcement authority under the Safe Drinking Water Act — are the day-to-day enforcer for every state except Wyoming and the District of Columbia (where EPA is the direct primacy agency). Your state primacy agency is the entity that reviews your CCR submission, issues the certification-of-delivery acceptance or rejection, and takes first-line enforcement action on violations.
EPA is the backstop. The Agency retains concurrent enforcement authority under Section 1414 of the Safe Drinking Water Act, which it uses when a primacy agency is unwilling or unable to bring an action, when a violation crosses state lines (for example, a regional wholesale system), or when a pattern of non-compliance rises above the primacy agency's typical enforcement capacity. EPA's regional offices — Regions 1 through 10, each covering several states — coordinate with state primacy agencies and bring direct enforcement where appropriate. For the revised rule specifically, EPA's Office of Ground Water and Drinking Water publishes the national compliance framework, which state primacy agencies adopt and adapt.
Three practical consequences follow from this structure. First, the first phone call about a missed CCR almost always comes from the state primacy agency, not EPA. Second, the penalty schedule that applies to your utility is the state adopted schedule, which tracks but does not always match EPA's maximum civil-penalty ceiling. Third, when enforcement escalates, the escalation is typically within the primacy agency rather than a handoff to EPA. The handoff occurs only in uncommon cases where the state cannot or will not act.
Types of CCR violations
The CCR Rule generates three functionally distinct violation types in the Safe Drinking Water Information System (SDWIS), the federal compliance-tracking database.
Monitoring and reporting (M/R) violations. Failure to submit the CCR to the primacy agency, failure to deliver the CCR to customers, or failure to submit the primacy-agency certification-of-delivery form by the state-specified deadline. M/R violations are the most common CCR violation category; they are procedural in nature and typically cured quickly.
Public notification (PN) violations. Failure to provide any required notification of a water-quality problem, including failure to include violation disclosures inside the CCR when required. A PN violation can arise from content gaps inside the CCR (a health-effects event that occurred during the reporting year and was not disclosed) or from separate public-notification failures outside the CCR that the revised rule ties back to CCR content obligations.
Treatment technique (TT) violations are not directly generated by CCR content in the usual sense, but the CCR is often where a TT violation first becomes publicly visible to customers. The 2024 revisions emphasize the CCR's role in communicating TT events that occurred during the prior reporting year.
The revised rule adds several new discrete sub-violations that fall under the M/R umbrella but are tracked separately by most primacy agencies. Failure to provide the direct URL required under the new electronic delivery framework is one. Failure to meet the translation threshold when the service population speaks a non-English language at home above the state-defined threshold is another. Failure to meet the biannual distribution requirement for systems serving more than 10,000, addressed in our twice-yearly distribution guide, is a third. Each of these is a distinct recordable violation, which means the 2027 cycle has more enforcement surfaces than any prior cycle.
Violation categories under SDWIS
SDWIS categorizes CCR violations using standardized codes that drive both internal primacy-agency workflow and external federal reporting. The CCR-specific violation codes a utility is most likely to encounter are:
- 71 — CCR Report Failure to Submit. The utility failed to submit the CCR to the primacy agency by the state-specified submission deadline.
- 72 — CCR Failure to Deliver to Customers. The utility failed to deliver the CCR to customers by July 1 (or the state-specified delivery date).
- 73 — CCR Failure to Certify Delivery. The utility failed to submit the primacy-agency certification-of-delivery form by the state-specified deadline (often October 1).
- 75 — CCR Content Violation. The delivered CCR is missing one or more required content elements (detected-contaminants table, health-effects language for a violation, required definitions, utility contact information, etc.).
Most primacy agencies report these codes into SDWIS Federal Reporting on a quarterly basis. The codes flow into EPA's public Safe Drinking Water Information System Federal Reports, which are accessible to the public, to advocacy organizations, and to the press. A violation in SDWIS is, in practical terms, a public record regardless of whether a formal enforcement action follows.
Codes vary somewhat by state. A handful of primacy agencies use supplementary state-specific codes for more granular tracking (for example, a separate code for translation-threshold failures distinct from general content failures). When reviewing your utility's compliance history, request the full code list used by your primacy agency rather than relying on a national summary.
Tier 3 public notification requirement
The CCR Rule itself incorporates a public notification tier structure under 40 CFR 141 Subpart Q. Failing to deliver the CCR — a §141.155 obligation — is itself a Tier 3 public-notification violation. The practical effect is that a utility that misses the CCR delivery deadline has a compounding obligation: it must both cure the CCR delivery and issue a Tier 3 notice informing customers of the CCR-related violation.
Tier 3 notification has a 12-month turnaround from discovery of the violation and can be satisfied through the annual CCR itself — meaning, in the common case, the Tier 3 notice of a prior-year CCR violation appears inside the following year's CCR. This creates a recursive reporting pattern that primacy agency inspectors look for: a utility that had a CCR miss in 2024 should include a Tier 3 disclosure in the 2025 CCR. Absence of that disclosure is itself a new violation.
For utilities preparing the 2027 cycle, this recursion means any 2026-year violation — including missed monitoring, missed reports, or treatment-technique events — must be disclosed inside the 2027-delivered CCR. The CCR 2027 cycle is, in effect, the formal public-notification vehicle for the entirety of 2026 compliance events. Our CCR 2027 checklist covers the Tier 3 disclosure block in context.
Civil penalties and fine ranges
The Safe Drinking Water Act authorizes EPA and state primacy agencies to assess civil penalties for violations of the CCR Rule. EPA's maximum statutory civil-penalty ceilings for SDWA violations are updated annually under the Federal Civil Penalties Inflation Adjustment Act and published at 40 CFR §19.4. For the 2026 adjustment, the per-day-per-violation ceilings relevant to CCR enforcement are:
| 42 U.S.C. citation | SDWA provision | 2026 max/day | 2025 max/day |
|---|---|---|---|
| 300g-3(b) | Administrative order / civil action against a public water system (the primary CCR-violation authority) | $71,545 | $69,733 |
| 300g-3(g)(3)(B) | Public notification violations — small systems (≤10,000 served) | $14,308 / $49,848 | $13,946 / $48,586 |
| 300g-3(g)(3)(C) | Public notification violations — large systems (>10,000 served) | $49,848 | $48,586 |
| 300j-4(c) | Recordkeeping/reporting (SDWA §1445) | $71,545 | $69,733 |
These are statutory ceilings — the maximum EPA may assess per day of continued violation. Actual assessed penalties are almost always a small fraction of the ceiling.
Enforcement-tier penalty matrix
In practice, CCR civil penalties cluster in three tiers. The matrix below maps violation type to the most common enforcement tier and the typical state-assessed dollar range.
| Violation type | Typical enforcement tier | Typical cure window | Typical state-assessed penalty |
|---|---|---|---|
| First-occurrence missed CCR delivery, cured within 30 days | Tier A — informal resolution | 30-60 days | $0 (letter / phone call) |
| First-occurrence missed primacy-agency certification (§141.155(c) — 10 days after delivery) | Tier A — informal resolution | 30-60 days | $0 |
| First-occurrence CCR content gap, cured within 30 days | Tier A — informal resolution | 30-60 days | $0 |
| Repeat M/R violation OR uncured first-occurrence violation | Tier B — formal Notice of Violation | 30-60 days after NOV | $500-$5,000 (small systems); $2,500-$15,000 (>10,000 served) |
| Missed biannual second delivery for systems ≥10,000 (§141.155(j)(2), Dec 31) | Tier B — formal NOV | 30-60 days after NOV | $1,000-$10,000 |
| Failure to include Tier 3 PN inside the following year's CCR | Tier B — formal NOV (new discrete violation) | 30 days after NOV | $2,500-$15,000 |
| Persistent non-compliance or content misrepresentation (lead, coliform, DBPs) | Tier C — administrative order / consent decree | 90+ days, negotiated | $25,000-$250,000; >$1M in multi-year misrepresentation cases |
| Failure to retain CCR records for 3 years (§141.155(h)) | Tier B — formal NOV | 30 days | $1,000-$10,000 |
The three tiers in detail:
Tier A: Informal resolution, no monetary penalty. A first-occurrence M/R violation cured within 30 to 60 days of discovery, with no customer harm alleged, typically resolves through an informal letter or phone call. No fine is assessed. This is the outcome for a majority of CCR violations — estimates from aggregate SDWIS data suggest 70 to 80 percent of CCR M/R violations resolve in this tier.
Tier B: Notice of violation with modest civil penalty. A repeat M/R violation, a non-trivial content gap, or a first-occurrence violation not cured within the informal-resolution window triggers a formal Notice of Violation (NOV). NOV-accompanied civil penalties from state primacy agencies typically range from 500 dollars to 5,000 dollars for small systems and from 2,500 dollars to 15,000 dollars for systems serving more than 10,000. The figures vary widely by state. New Jersey and California sit at the high end; Texas, Oklahoma, and many southern and mountain states sit at the low end.
Tier C: Consent decree or administrative order with substantial penalty. A persistent pattern of non-compliance, a content violation that amounts to misrepresentation of water-quality data to customers, or a CCR failure accompanying a treatment-technique or health-based violation escalates to a formal administrative order or, in rare cases, a federal consent decree. Penalties in this tier routinely range from 25,000 dollars to 250,000 dollars, and have exceeded 1,000,000 dollars in cases involving multi-year misrepresentation of lead or coliform results. These cases are rare but not hypothetical; EPA's enforcement docket lists several such outcomes from the 2010-2024 period.
EPA's own civil-penalty policy (the Safe Drinking Water Act Civil Penalty Policy, last substantively updated in 2020) provides the framework state primacy agencies generally follow in sizing penalties. The policy weighs gravity (the seriousness of the violation, including duration and population affected), economic benefit (what the utility saved by non-compliance), and ability-to-pay (a small-system-specific consideration that often reduces assessed penalties for rural utilities). Small-system compliance is covered in more detail in our small utility compliance guide.
How enforcement actually plays out
The escalation sequence from a first-identified CCR violation through to a penalty is highly predictable. Seven of ten CCR enforcement cases follow this path.
Step one: Informal contact. A primacy-agency compliance officer identifies the violation — often during a routine review of the state CCR submission portal — and emails or calls the utility's identified CCR contact. The tone is corrective, not punitive. The request is typically to cure the issue (submit the missing CCR, correct the content gap, file the certification) within 30 days.
Step two: Notice of Violation if uncured. If the utility does not cure within the informal-resolution window, the primacy agency issues a formal NOV. The NOV specifies the rule section violated, the required corrective action, and the cure deadline (typically another 30 to 60 days). The NOV is the trigger point at which the violation enters the primacy agency's formal docket and becomes harder to resolve informally.
Step three: Administrative order or consent decree. If the NOV deadline passes without cure, the primacy agency proceeds to a formal administrative order, which typically includes a specified civil penalty. The utility may negotiate the penalty through a consent decree process, which allows partial mitigation in exchange for documented compliance steps (upgraded software, training, retention of outside counsel). The consent decree is the point at which legal counsel becomes essential for the utility.
Step four: Federal referral if state action is insufficient. In the small number of cases where the state primacy agency cannot or does not proceed, EPA Region staff may pick up the case. EPA federal referral is rare for CCR-only violations; it is more common when CCR violations accompany broader SDWA non-compliance.
The majority of utility CCR incidents never proceed past step one. Discipline in responding to the informal contact — cure within 30 days, document the cure, and communicate the documentation to the primacy agency — is the single most effective practical defense against enforcement escalation. For cycle-management help, see our how to write a CCR guide and the CCR 2027 deadline calendar.
State-by-state enforcement patterns
State primacy agencies vary considerably in how aggressively they enforce the CCR Rule. Four representative patterns illustrate the range.
New Jersey: active, documentary, publicized. NJDEP maintains one of the most aggressive CCR enforcement postures in the country. First-occurrence M/R violations are documented in writing and added to the utility's public compliance history. Repeat violations draw NOVs with assessed penalties at the upper end of the state range (15,000 to 25,000 dollars for mid-sized systems is within the typical band). NJDEP's 2027-cycle implementation layers additional submission and format requirements on top of the federal rule; see our New Jersey CCR rule guide for the specifics. A utility operating in New Jersey should assume higher enforcement intensity than the national median.
California: publicized, press-facing. California's State Water Resources Control Board Division of Drinking Water takes a documentary approach similar to New Jersey's but layers on routine publication of violation data to state press and advocacy channels. California CCR violations reliably produce news coverage in regional outlets. The reputational cost of a California CCR miss often exceeds the direct civil penalty.
Texas: lighter initial, federal backstop in extreme cases. Texas Commission on Environmental Quality runs a more informal enforcement posture for first-occurrence CCR M/R violations. NOVs and civil penalties are issued, but at the lower end of the national range and typically only for repeat or content violations. Texas has one of the largest populations of small community water systems in the country, and TCEQ's enforcement capacity is stretched correspondingly. EPA Region 6 occasionally intervenes in cases where TCEQ enforcement is insufficient, but federal backstop is rare for CCR-only matters.
Federal direct enforcement (Wyoming, DC, tribal lands). In jurisdictions without state primacy, EPA Regional offices act as the primacy agency directly. Federal direct enforcement is generally characterized by slower turnaround from violation to action, narrower civil-penalty ranges (closer to EPA's guidance policy), and heavier documentation. Utilities in these jurisdictions should expect longer resolution timelines but generally lower enforcement-intensity variance than state-primacy jurisdictions.
Utilities with multi-state operations — regional wholesalers, investor-owned utilities operating across state lines — should map each state primacy agency's enforcement pattern separately rather than assume a uniform national posture.
How to cure a missed CCR
A utility that discovers a missed or defective CCR has a narrow window to cure before escalation. The practical playbook is six steps.
Step one. Document the discovery. Record the date, the person who identified the gap, and the scope (missed delivery, missed submission, missed certification, content gap). The primacy agency's eventual view of the incident will depend materially on whether the utility self-identified or was notified.
Step two. Notify the primacy agency proactively. A self-disclosure within seven days of discovery produces materially better outcomes than a notification received from the primacy agency. Most primacy-agency compliance staff confirm, informally, that self-disclosure is the single strongest mitigating factor in penalty assessment.
Step three. Produce the cure. Deliver the missed CCR, correct the content gap, or file the certification. The cure must be documented — retain the delivery records, the corrected content, and the certification submission confirmation.
Step four. Issue the Tier 3 public notification inside the following year's CCR. This is a rule obligation, not an optional step. A utility that cured a 2026 miss but did not disclose it inside the 2027 CCR has a new 2027 violation.
Step five. Document root cause and remediation. The primacy agency will often ask, either formally or informally, what the utility is doing to prevent recurrence. A written root-cause-and-remediation summary — which includes staffing changes, software procurement, or process documentation — is the appropriate response. This is the input that determines whether the next review cycle is heightened or routine.
Step six. Close the loop. Confirm in writing with the primacy agency that the incident is closed. Retain that confirmation in your compliance archive for the rule's retention period — three years under 40 CFR §141.155(h), often longer under state rules.
For small systems managing cures without in-house counsel, the state primacy agency's small-systems technical-assistance staff are the right first contact; they are non-adversarial and their assistance does not prejudice enforcement decisions.
FAQ
What is the fine for missing a CCR deadline?
There is no single national fine schedule. State primacy agencies set their own penalty schedules, generally within the EPA statutory ceiling. Under the 2026 inflation-adjusted 40 CFR §19.4 table, SDWA §1414 administrative penalties against public water systems top out at $71,545 per day per violation, and SDWA §1414(g)(3) public-notification civil penalties top out at $49,848 per day for large systems and $14,308-$49,848 per day for small systems. In practice, a first-occurrence missed-delivery violation cured within 30 days typically resolves without a monetary fine. A repeat or uncured violation produces an NOV with an assessed penalty, most often in the 500-to-15,000-dollar range for state enforcement. Persistent non-compliance or content misrepresentation can escalate to penalties in the tens or hundreds of thousands of dollars. Exact penalty ranges depend on the state; see the state-by-state section above.
Who notifies customers if I miss a CCR?
The utility does. A missed CCR generates a Tier 3 public-notification obligation that the utility itself must satisfy, typically through the following year's CCR. The primacy agency does not notify customers directly; its role is to compel and verify that the utility issues the required notification. Failure to issue the Tier 3 notification is itself a separate violation on top of the original missed CCR.
Can EPA fine a utility directly?
Yes, in any state, through concurrent federal enforcement under Safe Drinking Water Act Section 1414. In practice, EPA direct enforcement of CCR-only violations is rare when a state primacy agency is acting; it is more common when CCR violations accompany broader SDWA non-compliance or when the state primacy agency cannot or will not act. Utilities in Wyoming, the District of Columbia, and on tribal lands face EPA direct enforcement by default because EPA is their primacy agency.
What counts as a "content violation"?
A CCR that omits any rule-required element is a content violation. The most common content violations are (1) omitting health-effects language for a violation that occurred during the reporting year, (2) omitting the required definitions of regulatory terms like MCL and MCLG, (3) omitting utility contact information, (4) omitting the detected-contaminants table entirely, and (5) misstating a detected value (which in severe cases becomes misrepresentation rather than simple content violation). Under the revised rule, failure to provide a direct URL when using electronic delivery, failure to provide translation when the service population triggers the language-access threshold, and failure to meet the readability-level target are also discrete content violations.
If I cure quickly, will the violation still show in SDWIS?
Yes, typically. SDWIS is a compliance-tracking database; a violation is recorded when it occurs, not when it is cured. The record shows the original violation and the subsequent cure. The visible record does not go away even after a complete cure and formal primacy-agency closure. The record's existence is one reason self-disclosure and rapid cure matter: the compliance history reviewed in future enforcement decisions shows a cured-quickly pattern, which is materially better than a pattern of uncured or slowly-cured violations. Small systems specifically should treat compliance-history cleanliness as a long-term asset; see the small utility compliance guide for the budget-conscious version of that strategy. The full CCR 2027 requirements reference sets the baseline obligations you are being measured against.
Sources
- 40 CFR Part 141 Subpart O — Consumer Confidence Reports (§§141.151-141.155) — accessed 2026-04-18.
- 40 CFR Part 141 Subpart Q — Public Notification of Drinking Water Violations — accessed 2026-04-18.
- 40 CFR §19.4 — Statutory civil monetary penalties, as adjusted for inflation, and tables (2026 adjustment: SDWA 42 U.S.C. 300g-3(b) ceiling = $71,545/day; 300g-3(g)(3)(C) = $49,848/day) — accessed 2026-04-18.
- Federal Register, May 24, 2024 — National Primary Drinking Water Regulations: Consumer Confidence Reports, 89 FR 45980, docket EPA-HQ-OW-2022-0260 — accessed 2026-04-18.
- EPA — Safe Drinking Water Act Civil Penalty Policy — accessed 2026-04-18.
- EPA — Safe Drinking Water Act (SDWA) Enforcement — accessed 2026-04-18.
- EPA — Safe Drinking Water Information System (SDWIS) Federal Reports — accessed 2026-04-18.
- EPA — Consumer Confidence Report Rule Revisions — accessed 2026-04-18.
- Safe Drinking Water Act §1414 (42 U.S.C. 300g-3) — federal and concurrent enforcement authority.