Skip to content
Manager guide

The CCR duty: getting the water quality report out

What the Consumer Confidence Report has to say, where the numbers come from, and how to get it out and certified before July 1.

July 2026
Business & Governance
All
7
The short answer

A Consumer Confidence Report (CCR) is the annual water quality report every community water system must deliver to customers by July 1, covering the prior calendar year. It requires no new testing, only monitoring data you already collect, organized into eight required sections: system contact info, source description, definitions, the detected-contaminant table, extra Cryptosporidium/radon detail if found, any rule violations, variances, and required educational language. Certify distribution to your state roughly three months after delivery, and keep the report and certification on file at least three years.

What you will be able to do

You know the summer scramble already. Every July, the Consumer Confidence Report needs to go out, and somehow it still catches you off guard. The CCR is the annual water quality report every community water system owes its customers, and it pulls a full year of monitoring data into something a resident can actually read.

The report itself isn't hard science. The hard part is knowing exactly what belongs in it, in what units, and getting it delivered and certified before the deadline passes. Skip a required item, round a number the wrong way, or miss July 1, and you're the one explaining it to your board or your customers.

The CCR comes down to four things: what it has to say, where the numbers come from, a working timeline so the deadline doesn't land on you as a surprise, and how to make the report something people actually open.

What is the CCR, and who has to send one?

A CCR is a short annual water quality report that every community water system (CWS) must deliver to its customers, a requirement that goes back to the 1996 Safe Drinking Water Act amendments. A CWS is a system with at least 15 service connections or that serves at least 25 people year-round: cities, towns, homeowners associations, manufactured housing communities, and similar setups.

Each report covers the prior calendar year. A report due by July 1 covers January through December of the year before. A brand-new system sends its first CCR by July 1 of the year after its first full calendar year in operation, then every year after that. Non-community systems, like a school or factory running its own well for its own people, don't produce a CCR at all.

If you buy your water wholesale from another system, you're what the rule calls a consecutive system. You still owe your own customers a report. The wholesaler owes you the source and compliance data you need to build it, early enough for you to hit your deadline, but the wholesaler doesn't build your report for you.

A lab or consultant can help assemble the numbers, but the system is always the one responsible for the content and for getting it out the door.

What has to be in the report?

Every CCR covers eight required pieces, and missing one is usually what turns a routine report into a compliance problem.

  • Contact information for someone who can answer questions, plus how customers can weigh in on decisions about their water, such as board meeting times.
  • Where your water comes from, plus a plain-language summary of how vulnerable that source is, if a source water assessment has been completed.
  • Definitions for the technical terms the report uses, including the difference between a legal limit and a health goal.
  • The detected-contaminant table, the core of the report, covered in its own section below.
  • Extra detail on Cryptosporidium, radon, or anything else you monitored and found, beyond what a standard table entry requires.
  • Any violation of other drinking water rules during the year, what it meant for health, and the corrective steps you took.
  • Any variance or exemption your system operated under during the report year.
  • Required educational language, including a lead statement every system includes whether or not lead was detected that year.

Where does the data come from?

Nothing in the CCR requires new testing. The whole report is built from monitoring you already do and already report to your state.

The detected-contaminant table lists only contaminants found at or above the method detection limit, with the highest level found and the range if you sampled more than once. How you show that level depends on how often you monitor. An annual sample shows the highest result and its range.

Contaminants tested more often show the running annual average. Disinfection byproducts, total trihalomethanes and haloacetic acids, show the highest average across your monitoring locations and the range of individual results. Lead and copper show the 90th percentile result from your tap sampling and how many sites came in above the action level.

Every number has to appear in units where the legal limit reads as more than 1. A limit that's naturally written as a tiny decimal gets converted so it shows as a whole number, like parts per billion instead of parts per million. Round your result first, then convert; converting before rounding can shift which side of a limit a value lands on.

For each contaminant you detected, name the likely source to the best of your knowledge. Clearly flag anything that violated a limit, with a plain explanation of what it meant for health and what you did about it.

What's the timeline, working backward from July 1?

Every CCR runs against the same fixed date, and working backward from it keeps the report from turning into a scramble.

  • January: the calendar year of data closes. Start pulling together the monitoring results and lab reports already sitting in your files.
  • If you're a consecutive system buying water wholesale, your wholesaler owes you source and compliance data by April 1, timed to leave you enough runway for July 1. Confirm it actually arrived instead of assuming it did.
  • Late winter into spring: draft the report, convert your units, flag anything that violated a limit, and write the required plain-language explanations.
  • Before July 1: have a finished report ready to mail or deliver, and decide how you'll reach customers who don't get billed directly, like renters.
  • July 1: deliver the CCR to every customer, and send a copy to your state drinking water program at the same time.
  • Roughly three months later: send your state the certification confirming delivery, and confirming the figures line up with what they already have on file for your system. States set their own exact certification date, so confirm yours rather than assuming the federal three-month window.
  • After that: file your copy. Keep both the CCR and the certification on hand for at least three years.

How do you deliver it, and how do you certify it?

Delivery has specific rules about who has to actually receive a copy, not just whether one was printed.

Mail or hand-deliver a copy to each customer. Make a genuine effort to reach people who drink your water but don't get the bill, like renters or employees at a business account. Folding the CCR into a water bill works if that reaches people; a separate mailer sometimes works better because it reaches renters directly instead of a property owner.

Very large systems, those serving 100,000 people or more, must post the CCR online. Smaller systems get relief instead: where a state has waived mailing for systems under 10,000 people, publishing in a local newspaper can substitute, and systems serving 500 or fewer people can sometimes meet the requirement with just an annual notice that the report is available on request. These waivers come from your state, not automatically, so confirm which option, if any, applies to your system before you rely on one.

Certification comes after delivery: tell your state you distributed the report and that the numbers match what you already reported to them for compliance. Keep a copy of both the certification and the CCR itself on file for at least three years, in case anyone asks to see it later.

How do you make it something people actually read?

A technically correct CCR that nobody opens still misses the point of the report.

Keep sentences and paragraphs short, and don't shrink the type just to fit more on a page. Before you send it, hand a draft to someone outside the water business and ask if it makes sense to them. Skip acronyms and jargon where you can, and only add graphics that support the message rather than distract from it.

Be careful with the word "safe." Customers want to know whether their water meets standards, and telling them plainly helps. But water that's fine for most people isn't automatically fine for an infant or someone undergoing chemotherapy, so pair any reassurance with the required warnings for vulnerable groups.

Use the report to say what you're doing well, too. A CCR that's only a column of numbers reads like a compliance chore. One that also explains why the water tasted different in spring, or what you just fixed, reads like something worth opening.

Once the report itself is under control, the next question is usually how long to keep it and everything behind it. See records retention for clerks for the filing side of this job.

Further reading

EPA's guidance for water suppliers on preparing the Consumer Confidence Report, the source for the content requirements and worked reporting examples in this guide. State primacy agencies publish their own CCR preparation guides with state-specific delivery, certification, and waiver details, since state rules can be stricter than the federal floor.

Looking for your state? Find your state for certification rules, renewal, and who to call, one page per state.
A free resource from Ziptility. We make software for small water systems.