The Consumer Confidence Report (CCR) Rule is the federal requirement that every community water system in the United States publish an annual water quality report for its customers. In May 2024, EPA finalized the first substantive revision of that rule since its original 1998 promulgation, with a compliance date of January 1, 2027. What follows is a practitioner-facing walk-through of what actually changes, which utilities are affected, and how to sequence preparation work so the 2027 deadline is a planning anchor rather than a scramble.
What the revised CCR Rule changes
The 1998 CCR Rule, codified at 40 CFR Part 141 Subpart O, required community water systems to mail or directly deliver an annual report once per calendar year and to post that report online once systems crossed a service population of 100,000. Delivery was satisfied by a mailed paper copy, and the technical content — detected contaminants, violations, source-water summary, health-effects language — was tightly templated.
The revision EPA finalized in the Federal Register on May 24, 2024 (docket EPA-HQ-OW-2022-0260, 89 FR 45980) changes four structural things without rewriting the underlying data disclosure. First, it creates a distinct "direct URL" electronic-delivery pathway, clarifying what counts as e-delivery and what does not. Second, it tightens readability and accessibility expectations. Third, it requires large systems to distribute reports twice per year rather than once. Fourth, it establishes translation triggers for non-English-speaking populations. The statutory basis is the 1996 Safe Drinking Water Act Amendments (Public Law 104-182, §114), as reiterated in the America's Water Infrastructure Act of 2018 (P.L. 115-270, §2008), which directed EPA to revise the rule to improve readability and to require biannual distribution for larger systems. The EPA Consumer Confidence Report Rule page is the current landing page for regulatory text, primacy support materials, and implementation guidance.
| Requirement | 1998 CCR Rule | Revised Rule (compliance Jan 1, 2027) |
|---|---|---|
| Electronic delivery | Allowed under 2013 EPA memo; mechanics loose | Formal "direct URL" e-delivery pathway codified at 40 CFR §141.155 |
| Readability | No plain-language requirement | Plain-language summary section required; key terms defined in-report |
| Distribution frequency | Once per calendar year | Twice per year for systems serving more than 10,000 |
| Translation access | No federal translation trigger | Required where primacy-agency language thresholds are met |
| Web posting | Mandatory for systems serving ≥100,000 | Same threshold retained |
| State CMD reporting to EPA | Not required | Primacy agencies submit compliance monitoring data annually (40 CFR §142.15(b)(3)) |
| Delivery certification | Within deadline year | Certify completed delivery within 10 days of deadline |
Beyond these customer-facing changes, the rule also adds a behind-the-scenes requirement: primacy agencies must now submit compliance monitoring data (CMD) they already receive from public water systems to EPA annually, per 40 CFR §142.15(b)(3). Most utilities will not see this directly, but it is a meaningful upgrade to EPA's visibility into system-level compliance data and may feed future rule-making.
What did not change is the core data obligation. Systems still report detected contaminants against maximum contaminant levels (MCLs) and maximum contaminant level goals (MCLGs), still summarize source water, still disclose violations, and still include the standard EPA health-effects language for any violation or exceedance. The revision is a delivery-and-format rule on top of a data-disclosure rule that is now nearly three decades old. For context on what those underlying numbers mean, see our companion post on how to read a CCR and the broader overview of EPA drinking-water standards.
January 1, 2027 compliance timeline
Three dates matter. The rule was published May 24, 2024. States have until June 24, 2026 — the two-year primacy adoption window from the rule's effective date — to submit primacy revision packages. EPA's Revised CCR Rule primacy support documentation, most recently updated in January 2026, lays out the submission process and timeline. The operational compliance date for community water systems, codified at 40 CFR §141.152, is January 1, 2027. The first CCR prepared under the revised rule covers calendar year 2026 data and must reach customers by July 1, 2027. For systems subject to biannual distribution, the second 2027 report must be delivered by the end of the calendar year, with the specific end date set by the primacy agency.
The intermediate milestone operators often miss is the primacy agency's own schedule. State drinking-water programs are not obligated to adopt the federal rule verbatim; they may adopt more stringent requirements, additional delivery methods, or additional language-access triggers. Systems operating across primacy boundaries — a wholesale provider serving retail customers in two states, for example — should confirm each primacy agency's adopted text well before the operational compliance date. The gap between the federal June 24, 2026 primacy deadline and the January 2027 operational deadline is the window during which state rule text becomes final, and it is also the window in which templates, distribution lists, and translator contracts need to be locked.
A practical sequencing pattern: finalize template design by Q2 2026 so that Q3 2026 data can be drafted into the new format as an internal dry run; confirm distribution lists and e-delivery eligibility by Q4 2026; translate header content and health-effects language by Q1 2027; publish the live CCR covering 2026 data by July 1, 2027.
The four new requirements
Direct-URL electronic delivery
The original rule allowed e-delivery under 2013 EPA guidance but left the mechanics loose. The 2024 revision formalizes a "direct URL" method: the utility must provide each customer with a hyperlink that opens the CCR directly, not a homepage link requiring the customer to navigate. A generic link to utility.gov/annual-report is not compliant if the customer lands on a marketing page; the URL must resolve directly to the current report. The revision also clarifies that posting the CCR to a social-media account does not, on its own, satisfy direct-delivery obligations.
E-delivery by email is permissible, but the utility bears the burden of confirming valid customer email addresses and must provide a paper copy on request at no charge. Billing-insert delivery still counts, but utilities that want the cost savings of e-delivery need to invest in customer email capture, bounce-tracking, and an opt-in or opt-out mechanism per primacy agency rules. The revised rule also requires systems to certify that delivery was completed within 10 days of the delivery deadline, which makes e-delivery tracking (bounce rates, open confirmation) operationally relevant rather than nice-to-have.
Readability
The rule tightens the expectation that CCRs be readable by a typical customer. This is less prescriptive than a target grade level — EPA did not adopt a specific Flesch-Kincaid threshold — but it does require that the report use plain-language summaries of detected contaminants, that key terminology (MCL, MCLG, action level, treatment technique) be defined within the document, and that any violation discussion be placed prominently rather than buried in a data table. The revised rule also requires a short, standardized summary section at the front of the report describing overall compliance status in plain English.
This is the requirement that will force the most template work. Most utilities inherited their CCR template from a state association or a primacy agency, often with a design that optimizes for regulatory compliance rather than customer readability. Expect 20 to 40 hours of template rework for a single water system, and more for multi-system consolidated reports.
Biannual distribution for systems serving >10,000
Community water systems serving a population of more than 10,000 people must deliver the CCR twice per calendar year rather than once. The first delivery continues to be due by July 1, covering the prior calendar year. The second delivery's deadline is set by the primacy agency within the remaining calendar year. The content of the second report may be abbreviated — EPA's supporting documentation contemplates a mid-year update focused on any violations, changes in source water, or updates to ongoing public-health advisories — but it is a distinct delivery event, not a reissue of the July copy.
The 10,000-person threshold is a service-population count, not a connection count. For utilities sitting near the boundary — a system serving 9,200 year-round residents plus a seasonal summer population — the primacy agency determines how seasonal population is counted. Systems that have been growing through annexation or subdivision build-out should confirm their current classification well before January 2027 so they have time to budget for a second annual distribution.
Translation access
The revised rule requires utilities to assess the language composition of their service area and to provide translated CCR content — or a translated notice with instructions for obtaining the full translated report — when a non-English-speaking population meets primacy-agency-defined thresholds. The federal rule leans on Census-based methodology, but primacy agencies adopt specific thresholds (commonly 5% of the service area or 1,000 persons, whichever is less).
The practical lift: identify language groups from Census ACS data, contract with a translation provider (or verify a state-offered resource), and build a workflow that regenerates translations when the source report is updated. EPA publishes approved translations of the standardized health-effects language in Spanish and several other languages; system-specific narrative is where fresh translation cost appears.
Who is affected (system size thresholds)
Every community water system — a public water system serving at least 15 service connections used by year-round residents, or regularly serving at least 25 year-round residents — is subject to the CCR Rule, revised or otherwise. Non-transient non-community systems (schools, workplaces with their own wells) and transient non-community systems (campgrounds, highway rest stops) are not subject to the CCR Rule. EPA's Safe Drinking Water Information System (SDWIS) inventory lists approximately 49,000 community water systems nationwide serving roughly 300 million people.
Within that universe, the size thresholds that matter for the 2027 revision are:
- Systems serving ≤500 people: annual distribution only; paper delivery or, with primacy agency approval, direct-URL e-delivery. Translation obligations depend on service-area demographics. Many very small systems qualify for state-provided template assistance and may not bear the template-rework cost directly.
- Systems serving 501 to 10,000 people: annual distribution, with direct-URL e-delivery now formally supported. Readability and translation requirements apply. This is the category where the template-rework cost is most concentrated relative to ratepayer base.
- Systems serving >10,000 people: biannual distribution, direct-URL e-delivery formally supported, full readability and translation expectations, and — for systems serving more than 100,000 — continued mandatory posting to a publicly accessible website. This is the category that requires the largest operational change.
Any system handling lead or copper monitoring at the 90th-percentile trigger, or operating under a PFAS compliance schedule under the 2024 NPDWR, should expect the readability and health-effects language requirements of the revised CCR to interact with ongoing public-notification obligations. For a worked example of what appears in the health-effects narrative, see our contaminant-specific page on lead.
How to prepare: practical steps for utilities
Treat the interval between now and December 31, 2026 as three sequential phases: governance, template, operations.
Governance (now through Q3 2026). Identify a single staff owner for CCR compliance — typically a water quality manager, operations superintendent, or public-information officer. Confirm the primacy agency's adopted rule text. Budget for three line items: template rework, translation services, and customer-email capture (if e-delivery is part of the strategy). For small systems, the Drinking Water State Revolving Fund (DWSRF) offers technical assistance; the 2021 Bipartisan Infrastructure Law expanded DWSRF set-asides for small-system compliance support.
Template (Q3 2026 through Q1 2027). Redesign the CCR template against the readability requirement. Open with a plain-language summary; retain the detected-contaminants data table as the compliance backbone; ensure defined terms (MCL, MCLG, action level, treatment technique, ppm, ppb, non-detect) appear in a glossary or inline. Pilot the new template against the 2024 or 2025 CCR as a dry run and circulate to customer-facing staff for readability feedback. If the primacy agency offers a certified template, consider adopting it directly.
Operations (Q1 through July 1, 2027). Validate the customer distribution list, including residents billed through sub-metered landlord arrangements. For e-delivery utilities, reconcile the email list against billing records and plan for paper-copy requests. Lock in translator contracts. Publish the first revised CCR covering 2026 data no later than July 1, 2027, with any biannual delivery scheduled per primacy agency direction.
Two items are frequently missed. First, customer notification that e-delivery is happening: most primacy agencies require a one-time printed notice informing customers of the switch to direct-URL delivery. Second, the archive: the revised rule continues the 1998 requirement to retain CCRs for ten years, and direct-URL delivery raises a new question about URL persistence. A CCR URL that silently 404s three years after publication is a compliance problem; plan URL structure and archive hosting accordingly.
FAQ
When do I need to comply with the revised CCR Rule?
The operational compliance date is January 1, 2027. The first CCR prepared under the revised rule covers calendar year 2026 and must reach customers by July 1, 2027. Systems serving more than 10,000 people must also deliver a second report before the end of 2027 on a date set by the primacy agency.
Does the revised rule let me stop mailing paper copies?
Not unilaterally. The rule formalizes direct-URL e-delivery as a supported method, but whether a given utility can rely on e-delivery as its primary channel depends on primacy-agency rules, on the utility's ability to validate customer email addresses, and on the utility's willingness to provide paper copies on request. Most utilities will run a hybrid: e-delivery for opted-in customers, paper for the rest.
My utility serves 9,500 people. Do I need to distribute twice a year?
Not under the federal rule's population threshold — biannual distribution applies to systems serving more than 10,000. But service-population counts can shift with annexation, seasonal population, or accelerated subdivision build-out, and primacy agencies determine exactly how seasonal population is counted. Confirm your current SDWIS service population figure with the primacy agency before assuming annual distribution is adequate through 2027 and beyond.
Do I need to translate the entire CCR into every language spoken in my service area?
No. The federal rule, as implemented by primacy agencies, generally requires translation when a non-English-speaking population meets a defined threshold (commonly 5% of the service area or 1,000 persons, whichever is lower). The translation obligation can often be met with a translated notice directing readers to an available translated report rather than wholesale translation of every template section, but primacy agency rules govern the specifics.
Is the readability requirement a specific grade level?
No. EPA declined to adopt a numeric readability threshold in the final rule. The readability expectation is qualitative: plain language, defined terminology, a prominent summary, and a clear statement of compliance status. Utilities that pilot the new template with customer-facing staff before publication tend to meet the expectation; utilities that copy the state template verbatim without review occasionally do not.
What are the penalties for non-compliance?
CCR violations are treated as monitoring and reporting violations under the Safe Drinking Water Act enforcement framework. The primacy agency is the first-line enforcer. Penalties range from informal notices of non-compliance for first-time procedural lapses to formal administrative orders and, in rare cases, civil penalties. The more immediate consequence is public: a missed or late CCR becomes part of the system's compliance record on SDWIS and, for larger systems, on state-level public compliance dashboards.
Sources
- U.S. EPA, "National Primary Drinking Water Regulations: Consumer Confidence Reports," final rule, 89 FR 45980, published May 24, 2024, effective June 24, 2024. Docket EPA-HQ-OW-2022-0260. Accessed 2026-04-18.
- U.S. EPA, "Consumer Confidence Report Rule Revisions", program page including Q&A and comparison fact sheet. Accessed 2026-04-18.
- U.S. EPA, "Consumer Confidence Reports (CCR)", Safe Drinking Water Act program landing page. Accessed 2026-04-18.
- Electronic Code of Federal Regulations, 40 CFR Part 141 Subpart O — Consumer Confidence Reports. Accessed 2026-04-18.
- Safe Drinking Water Act Amendments of 1996, Public Law 104-182, §114 (CCR program origin, codified at SDWA §1414(c)).
- America's Water Infrastructure Act of 2018, Public Law 115-270, §2008 (directive to revise CCR rule).