How to Write a Consumer Confidence Report: 10-Step 2027-Ready Workflow

Every community water system in the United States has to produce a Consumer Confidence Report (CCR) once a year. Starting with the report that covers calendar year 2026 — the one you will actually draft and deliver in spring 2027 — the rules have changed. The EPA's Revised CCR Rule (final rule at 89 FR 45980, published May 24, 2024, docket EPA-HQ-OW-2022-0260) tightens the content, readability, and delivery requirements, and most systems now have to distribute twice a year if they serve 10,000 or more people. Getting the workflow right the first time is cheaper than issuing a corrected report under a primacy-agency directive.

This playbook walks a drafter — operator, compliance manager, or outsourced consultant — through the ten sequential steps of producing a compliant CCR. Every step cites the relevant section of 40 CFR 141 Subpart O so you can defend each decision if your state asks. If you need the full regulatory background before you start, read the CCR requirements for 2027 and the Revised CCR Rule summary first.

By Andy Zhang. Last reviewed 2026-04-18.

What each step produces

Step	Input	Output artifact
1. Pull monitoring data	SDWIS export + lab PDFs	Validated 2026 sample dataset
2. Build contaminant table	Step 1 dataset	§141.153(d) contaminant table
3. Violations + health effects	State violation log + Appendix A	Violations section (or "met or exceeded" statement)
4. Source-water description	State source-water assessment	§141.153(b) source paragraph(s)
5. Required 2027 disclosures	Steps 1–3 + rule list	Lead, vulnerable-populations, PFAS, nitrate blocks
6. Translation	Finalized English CCR + ACS data	Translated CCR(s)
7. Delivery mechanism choice	Population + customer mix	Delivery plan (mechanisms + counts)
8. Direct-URL host	Step 7 plan	Persistent CCR URL + 3-year hosting commitment
9. Customer notification	Steps 7–8 artifacts	Notice artifact (insert, email, postcard) + delivery log
10. Archive + certify	Everything above	Certification filing + 5-year archive

What you need before you start

Pull these inputs together before you open a template. The drafting itself moves fast when the raw material is on your desk; it stalls for days if you start writing and then discover a missing lab report.

• Water-quality monitoring data for the full calendar year being reported (2026 data for the 2027 report), including every regulated contaminant under 40 CFR 141 and any unregulated contaminants you chose to monitor voluntarily. Pull the original lab PDFs, not just a summary spreadsheet — you need the sample dates, method numbers, and detection limits.
• Violation and enforcement history for the reporting year: any Tier 1, Tier 2, or Tier 3 public-notification events, any monitoring-and-reporting (M&R) violations, any exceedances of a treatment technique.
• Source-water information: the source name(s), the source-water assessment summary from your state, any known contaminants of concern.
• Your primacy agency contact — the person at the state drinking-water program who reviews CCRs. Get their email and the submission portal URL.
• A translator or translation vendor if more than 10 percent of the service population speaks a language other than English, per §141.153(h)(3).
• Your URL host — the public web address where the report will live for at least three years (§141.155(b)). A static page on your utility website is the cleanest option.
• Prior-year CCRs for reference. You cannot copy them verbatim, but they show your voice and the source-water narrative you have already vetted.

If you are a small system and not sure how much of this applies, the small-utility compliance notes cover the §141.155 variations for populations under 10,000.

Steps

Step 1: Pull your 2026 water-quality monitoring data

Every detected contaminant regulated under the National Primary Drinking Water Regulations must appear in the report. Start by exporting your SDWIS sample results for calendar year 2026 and cross-checking them against the original lab reports. You are looking for: contaminant name, the highest detected level, the range of detections, the Maximum Contaminant Level (MCL), the MCL Goal (MCLG), the sample date, and the likely source of the contaminant.

Per §141.153(d)(3), if your most recent sample for a contaminant was taken in a prior calendar year (because your monitoring frequency allows it), you may still use that result, as long as it is no more than five years old for most contaminants and no more than nine years old for lead, copper, asbestos, and a handful of others listed in the rule. Note the sample year explicitly in the table.

If you had any contaminants detected above the MCL, flag them now — they drive the violation-reporting language in Step 3 and may trigger Tier 2 public notification requirements that run in parallel with the CCR.

Step 2: Build the detected-contaminants table (per-customer under §141.153(d))

The contaminant table is the regulatory heart of the CCR. §141.153(d) specifies that for each detected regulated contaminant you must show, at minimum: the MCL, the MCLG, the level detected (highest single sample or running annual average, as required by the contaminant's monitoring rule), the range of detections, the date of the most recent sample, whether the detection violated the MCL, and the likely source.

The Revised CCR Rule's 2027 tightening adds a readability constraint: the table must be legible at the point of delivery. If you are delivering electronically, the HTML or PDF version must render without horizontal scrolling on a mobile device. If you are delivering on paper, the font cannot be smaller than 10 points. The EPA has signaled it will consider non-compliant formatting a §141.155 delivery failure.

For each row, verify the "likely source" column uses the exact language from the EPA's CCR iWriter source-library or your primacy agency's approved language. Invented wording ("runoff from the farm up the road") is a common rejection reason at state pre-review.

Step 3: Identify violations and compile health-effects language

List every violation during the reporting year, whether it was an MCL exceedance, a treatment-technique violation, or a monitoring-and-reporting failure. §141.153(f) requires: a clear description of the violation, the length of the violation, the potential adverse health effects in plain language, the steps the system took to correct it, and the current status.

The health-effects language is not optional prose. EPA provides mandatory health-effects statements for each regulated contaminant in Appendix A to Subpart O of 40 CFR 141. Copy these verbatim — paraphrasing the health-effects language is itself a CCR violation. If you had a lead action-level exceedance, the required lead language in §141.154(d) is particularly prescriptive and has to appear even if you did not exceed — more on that in Step 5.

If you had no violations during the reporting year, include an explicit statement that says so. §141.153(h)(5) requires the CCR to state "we are pleased to report that your drinking water meets or exceeds all federal and state requirements" (or equivalent) when that is true. An empty violations section is ambiguous and gets flagged.

Step 4: Write the water-source description (§141.153(b))

§141.153(b) requires a description of the source(s) of your water — surface water, groundwater, purchased water, or combination — including the name of the water body or aquifer, the general location, and a summary of the source-water assessment. If your state has completed a source-water assessment under the Safe Drinking Water Act, you must include a brief summary of its findings and tell customers how to obtain the full report.

Keep this section factual and short: three to five sentences per source. The common mistake is to turn it into marketing copy ("our pristine mountain reservoir"). The rule asks for a description, not a sales pitch, and primacy reviewers push back on puffery.

If you purchase water from a wholesaler, §141.153(b) lets you reference the wholesaler's source-water assessment rather than duplicating it — but you must name the wholesaler and note whether the wholesaler delivered its own CCR to you.

Step 5: Add required 2027 disclosures

The Revised CCR Rule expanded the mandatory disclosure list. For the 2027 reporting cycle, every CCR must include:

• Lead language under §141.154(d) — the full mandatory lead statement, even if you had no lead action-level exceedance. This was not new in 2024, but the Revised Rule adds a requirement that the statement appear in the first half of the document, not buried at the end.
• Vulnerable-populations language under §141.153(h)(3) — the statement that immunocompromised persons, pregnant individuals, infants, and the elderly may be at higher risk. Use EPA's prescribed wording.
• Cryptosporidium language if your source is surface water or groundwater under the direct influence of surface water, per §141.153(d)(4)(ix). Report whether you monitored for it and any detections.
• PFAS disclosures under the new §141.153(d)(6) added by the Revised Rule — if you are subject to the April 2024 PFAS NPDWR, you must report detections of the six regulated PFAS compounds with the Hazard Index calculation for the mixture.
• Nitrate advisory if your highest detection exceeded 5 mg/L — under §141.153(h)(4), infants under six months must not drink the water, and the advisory text is mandatory.

Miss one of these and the report is non-compliant even if every other element is perfect.

Step 6: Translate the report into required languages

§141.153(h)(3) — as amended by the Revised Rule — requires translation when more than 10 percent of the service population has limited English proficiency in a single non-English language. The practical impact: large systems in California, Texas, New York, New Jersey, Florida, and Illinois routinely trigger the threshold for Spanish, and many also trigger Chinese, Vietnamese, Tagalog, or Arabic.

Work from US Census American Community Survey language-spoken-at-home data at the census-tract level for your service area. If you cross the threshold, produce a fully translated version — not a one-line "summary in Spanish available on request." The Revised Rule makes clear that offering translation on request does not meet the standard when the threshold is triggered.

Budget real time for this step. A certified translator working from a finalized English CCR typically needs seven to ten business days; rush fees apply inside that window. For the translation workflow details, see the forthcoming CCR translation and accessibility guide.

Step 7: Choose your delivery mechanism(s)

§141.155 now defines three primary delivery mechanisms, and you can combine them:

1. Direct URL delivery — you mail, email, or otherwise deliver a notice containing a direct link to the CCR, hosted on a persistent URL. Permitted for any system, but with conditions (Step 8).
2. Paper mail — a paper copy delivered to every bill-paying customer.
3. Bill insert — the CCR is included with a water bill. Only permitted if the CCR fits within the bill envelope and remains legible.

Systems serving 10,000 or more must also deliver a second, abbreviated summary in the fall — the twice-yearly distribution requirement under the Revised Rule. This second delivery does not replace the full spring CCR.

A common pattern for mid-sized utilities: direct-URL notice in a bill insert for most customers, paper copy on request, and a mailed postcard to non-customer residents (renters in master-metered buildings). Document the mix you chose and why.

Step 8: Set up the direct-URL host (3-year persistence under §141.155)

If you chose direct-URL delivery, §141.155(b) requires the URL to resolve to the CCR for at least three years from the date of delivery. Short-link redirects count only if the underlying destination remains stable. The URL must go directly to the CCR — a link to the utility homepage where the customer has to hunt for the report is not compliant.

Practical setup:

• Use a stable path like /ccr/2026 or /water-quality/2026-report — do not embed year-month or a CMS post ID that will change when the CMS is migrated.
• Serve the CCR as a PDF or a standalone HTML page. If HTML, make sure the page is indexable and the content is in the DOM (not loaded by JavaScript after render — some state primacy agencies' accessibility auditors fail JS-dependent content).
• Keep prior years at permanent URLs as well. A customer receiving a 2026 CCR notice in April 2027 must still be able to access it in April 2030 — so /ccr/2026 must resolve through at least April 2030.
• If you use a third-party CCR hosting vendor, confirm in writing that your contract runs at least three years past the last delivery date, and that data export is in your hands on termination.

See the electronic delivery guide for the full §141.155 walkthrough.

Step 9: Notify your customers

A report on a URL that nobody sees is not delivered. §141.155(a) requires "good-faith" efforts to reach every customer. The notice itself — whether a bill insert, postcard, or email — must include: the direct URL, a statement that the CCR contains important information about drinking water, a phone number to request a paper copy, and the required vulnerable-populations disclosure if it is not already in the notice body.

For community systems serving renters and tenants who do not receive a water bill, the Revised Rule's good-faith list includes posting at the property, delivering to property managers for tenant distribution, and partnering with local publications. Document what you did. Your state primacy certification (Step 10) will ask.

If you send an email notice, do not let the CCR link sit inside an unauthenticated SendGrid tracker that will redirect through a domain that changes — the EPA has specifically flagged link-shortener churn as a delivery failure in guidance.

Step 10: Archive and certify delivery to state primacy agency

The water system must certify delivery to the state primacy agency under §141.155. Federal rule requires the certification within ten days of completing CCR distribution; most primacy states set a specific calendar deadline (commonly October 1 of the reporting year) on top of that. The certification states that the report was delivered in compliance with §141.155 and identifies the delivery mechanism used. Check your state's exact deadline — missing the certification is one of the most common M&R violations (see CCR enforcement and penalties).

Archive the following for at least five years under §141.33 record-retention rules:

• The final English CCR (PDF and any HTML).
• Every translated version.
• The customer-notification artifact (bill-insert image, postcard PDF, email template).
• The distribution list or count-of-customers-reached, and the method used to count.
• The certification submitted to the state.
• Any customer-requested paper copies log.

The specific submission format varies by state — some states have an online portal, some require a signed PDF cover sheet. Check with your primacy contact. Missed certifications are one of the most common CCR violations and are typically issued as M&R (monitoring and reporting) violations that themselves need to be disclosed in next year's CCR.

Common issues during drafting

Four issues produce the majority of corrective orders after state primacy review.

First, invented likely-source language. Operators write a plain-English guess ("runoff from agricultural activity in the north of the county") when the EPA iWriter library has specific approved phrasing for each contaminant. Stick to the library.

Second, wrong reporting window for averaged contaminants. Disinfection byproducts (TTHMs, HAA5) are reported as running annual averages, not single samples, under Stage 2 DBPR. Lead and copper are reported as 90th-percentile values, not highest sample. Mixing these up shows up immediately at primacy review.

Third, missing or stale lead language. §141.154(d) requires the full paragraph, not a paraphrase, every year, whether or not you exceeded. Systems serving lead-service-line inventories must also reference the Revised Lead and Copper Rule's tap-sampling pool.

Fourth, broken direct-URL hosts. The URL works on the day the CCR is delivered and breaks six months later when the utility CMS is rebuilt. Set up URL monitoring that pings the CCR path monthly for three years.

Pre-publication review

Before certifying delivery, route the final report through two reviews.

State primacy pre-review (if your state offers it). Many states — New Jersey, Pennsylvania, California among them — will do an optional pre-publication review of a draft CCR if you submit it 30 to 45 days before the delivery deadline. Use it. The reviewer catches the invented-source-language and missing-disclosure errors that would otherwise produce a corrective order. See the New Jersey-specific notes for one state's workflow.

Internal legal and utility-director review. The CCR is a public document that creates liability surface. Have the utility's legal counsel or general counsel review the violations section and any narrative that describes customer impact. Have the utility director sign off that the source-water description and any non-required narrative reflect the system's voice.

Check the 2027 deadline calendar to make sure the pre-review window fits your state's schedule. The full 2027 checklist gives a one-page gate-review version of everything above.

FAQ

Do I have to follow these 10 steps in order?

In practice, yes — the output of each step is the input to the next. You can overlap Steps 1 and 4 (pulling monitoring data and writing the source description happen from different files and can run in parallel), and you can start Step 8 (URL setup) at any time. But Step 5 disclosures depend on Step 3 violation analysis, and Step 6 translation depends on a finalized English text, so those ordering constraints are hard.

What if my state has additional CCR requirements?

Every primacy state can add to the federal minimum under §141.5, and several do. New Jersey requires a lead-service-line inventory status statement. California requires a specific PFAS disclosure format. Texas requires a statement about the Texas Drinking Water Watch portal. Check your state drinking-water program's CCR guidance document each year — states update these, and the Revised CCR Rule has pushed several states to add new language for 2027. Your state primacy contact (gathered in "What you need before you start") is the authoritative source.

How long should the CCR be?

The rule does not set a page count. Community systems serving small populations with no violations commonly produce a four- to six-page report. Large urban systems with multiple sources, PFAS disclosures, lead-service-line language, and translations routinely run to 16 to 24 pages per language. What matters is that every §141.153 and §141.154 element is present, the contaminant table is legible, and the reader can find the violations section quickly. Shorter is better when the content allows.

Can I reuse last year's narrative?

You can reuse the source-water description, the system background, and the general structure — that is what every utility does. You cannot reuse the contaminant table (it has to reflect the new reporting year's data), the violations section, or any year-specific disclosure. The Revised CCR Rule's 2027 additions mean you also cannot reuse your 2025 CCR's disclosure block verbatim — new PFAS language and expanded lead-language placement rules apply.

What happens if I find a violation while drafting?

If you discover an MCL exceedance or treatment-technique violation during CCR preparation that was not previously reported to the state, stop drafting and report the violation to your primacy agency immediately. Late discovery does not change the public-notification timelines under §141.203: Tier 1 violations still require 24-hour notification, Tier 2 still 30 days. Once the public notification is out, include the violation in the CCR per §141.153(f) and note the date you discovered and reported it. Attempting to bundle a late-discovered violation inside a CCR without prior state notification is itself a reporting violation.

---

Once you have a workflow that runs cleanly for two cycles, the next efficiency step is software. The CCR software guide walks through the commercial tools that automate Steps 1, 2, and 8, and the CCR software pricing breakdown compares costs for systems of different sizes. For broader operator context across our utilities hub, the same ten-step backbone applies whether you are a 500-connection water district or a metropolitan authority.

Sources

1. U.S. EPA, "National Primary Drinking Water Regulations: Consumer Confidence Reports" — Final Rule, 89 FR 45980, Federal Register document 2024-10919, docket EPA-HQ-OW-2022-0260. Published May 24, 2024; effective June 24, 2024; compliance date January 1, 2027. Accessed 2026-04-18.
2. eCFR, 40 CFR Part 141 Subpart O — Consumer Confidence Reports, current codified text (§§141.151–141.156). Accessed 2026-04-18.
3. 40 CFR 141.153 (content of the reports), 141.154 (required additional health information), 141.155 (report delivery and recordkeeping).
4. 40 CFR 141.33 (record maintenance).
5. U.S. EPA, Safe Drinking Water Act: Consumer Confidence Reports program page. Accessed 2026-04-18.
6. Stage 2 Disinfection Byproducts Rule (40 CFR 141 Subpart V) for DBP reporting conventions.
7. Revised Lead and Copper Rule (40 CFR 141 Subpart I, 2024 updates) for lead-service-line inventory references.