The Consumer Confidence Report guide — 40 CFR 141 Subpart O, in plain English

What a Consumer Confidence Report actually is

Every federally-regulated Community Water System (CWS) in the United States must publish an annual Consumer Confidence Report (CCR). The CCR is the document a utility sends to its customers each year explaining where their drinking water comes from, what contaminants were detected in it, and how those contaminants compare to federal limits.

The rule lives at 40 CFR 141 Subpart O (§ 141.151 through § 141.156, plus Appendix A to Subpart O). It was established under the Safe Drinking Water Act amendments of 1996 and has been revised several times — most recently by the 2024 CCR Rule Revisions (89 FR 46012, May 24, 2024), which introduce biannual delivery for systems serving ≥10,000 persons (§ 141.155(j)(2)) and a Limited English Proficiency plan requirement for systems serving ≥100,000 persons (§ 141.155(i)).

Community Water Systems are defined at 40 CFR § 141.2: systems that serve at least 25 year-round residents or have at least 15 service connections used by year-round residents. If your utility fits that definition, you are required to publish a CCR every year — without exception.

The July 1 deadline and what is due to whom

The CCR is due by July 1 each year and covers the previous calendar year's monitoring data. For the 2026 reporting cycle, that means the report is due July 1, 2026, covering calendar year 2025 data.

The deadline is hard. Primacy agencies have authority to fine for late filings and — more importantly — to record a compliance violation against your system. That violation must itself be disclosed in the following year's CCR (§ 141.153(f)), so a late filing doubles down on paperwork.

The CCR must go to three audiences in three different forms:

The public. You must make the CCR available to every bill-paying customer. For most utilities that means mailing it, inserting it into billing envelopes, or posting it on the utility website with an e-notification to customers.
Your state primacy agency. You must submit the CCR plus a completed Certificate of Delivery to your state's drinking water program.
Your records. 40 CFR § 141.155(h) requires you to retain copies of your CCR for no less than three years. Underlying monitoring records retain longer under § 141.33 (bacteriological analyses — 5 years; chemical analyses — 10 years). 1water.ai retains every published CCR, compliance report, and distribution log for 5 years — exceeding the § 141.155(h) minimum.

The nine federally-required sections (§ 141.153)

40 CFR § 141.153 lists the content every CCR must include. We summarize them here; the exact wording for health-effects language and MCLG narratives is reproduced verbatim in Appendix A and must be used without modification.

System information. Utility name, PWSID, population served, contact for more information, and participation rights in local decisions.
Source water description. Where your water comes from (groundwater, surface water, purchased water) and any source water assessment.
Definitions. The verbatim definitions for MCL, MCLG, Action Level, Treatment Technique, MRDL, MRDLG, Variances and Exemptions, Level 1/2 Assessments, ppm, ppb, and related terms. These come straight from Appendix A.
Detected contaminants table. Every contaminant regulated under 40 CFR 141 detected in your water during the reporting period. Columns include MCL/MCLG, level detected, range, sample date, likely source, and a violation flag.
Lead and Copper narrative. Required language for lead health effects, plus the 90th-percentile value, the number of sites exceeding the Action Level, and guidance on minimizing lead exposure. Since LCRI, additional content on service line inventory status and replacement schedule applies.
Unregulated contaminants detected under the Unregulated Contaminant Monitoring Rule (UCMR).
Variances and exemptions if applicable.
Violation disclosures with required verbatim language for health effects, steps taken to correct the violation, and compliance status.
Educational statements — a closing section on water conservation, lead minimization practices, and how consumers can get involved in local water decisions.

Contaminant tables: MCL, MCLG, units, and detection limits

The detected contaminants table is the core of the report — and the most common source of rejections. Four rules you cannot break:

Units must be consistent

Contaminant tables must use the units specified in Appendix A for each contaminant. Most inorganic contaminants report in milligrams per liter (mg/L) or parts per million (ppm); most organic contaminants in micrograms per liter (µg/L) or parts per billion (ppb); disinfection byproducts vary by compound.

The most common rejection cause is mixing ppb with mg/L. A fluoride value reported at 1.2 mg/L is the same as 1,200 ppb — if you report it as "1.2 ppb" you have mis-stated a compliant value by a factor of 1,000 and will fail review. Every sample must flow through a unit normalization step before it hits the contaminant table.

MCL, MCLG, and Action Level must match Appendix A exactly

Appendix A gives the MCL (Maximum Contaminant Level, enforceable) and the MCLG (Maximum Contaminant Level Goal, aspirational). Some contaminants have an Action Level instead (notably lead and copper, which are regulated by the Lead and Copper Rule at § 141.80).

Do not round or paraphrase. 1.0 mg/L nitrate is not 1 mg/L nitrate in regulatory context — the zero matters.

Detections vs non-detects

A contaminant that was sampled for but not detected must still appear in the table if detection occurred anywhere in the system during the current or prior sampling period under the reporting rule. Non-detects are reported as "ND" or "< [detection limit]" — not as 0.

Range matters

The range column must report the minimum and maximum detection levels across all samples, not just an average. If one sample site hit 8.2 ppb and another hit 2.1 ppb, the range is "2.1 – 8.2 ppb" — not "5.1 average."

The Lead and Copper story (§ 141.80 + § 141.153(d)(4))

Lead and Copper get their own treatment because the rule that governs them (the Lead and Copper Rule, expanded into the Lead and Copper Rule Improvements) operates on different sampling cycles than routine contaminant monitoring.

The 90th-percentile calculation

Per 40 CFR § 141.80(c)(3), the 90th-percentile value is calculated from the most recent monitoring period. Sort the samples by value, ascending. Identify the sample at the 90th-percentile position (ceil(0.9 × n)). That sample's value is the 90th-percentile.

A worked example: 10 first-draw lead samples at the tap, values 1.2, 2.3, 3.1, 4.0, 4.5, 5.2, 6.8, 7.4, 12.5, 14.1 ppb. Sorted: same. 90th-percentile position: ceil(0.9 × 10) = 9. The 9th value is 12.5 ppb. That's your 90th-percentile, and since the Action Level for lead is 15 ppb, you are under the Action Level for this period.

This math is deceptively tricky. Several tools we tested use the average of the 90th percentile samples instead of the exact sample value — that's wrong under the rule. 1water.ai ships a pure calc_ninetieth_percentile tool that is unit-tested against § 141.80(c)(3).

Action Level exceedances

If the 90th-percentile exceeds the Action Level, you have an Action Level Exceedance — which triggers a cascade of requirements: public education, corrosion control study, possibly service line replacement. The CCR must disclose the exceedance using specific language from Appendix A.

LCRI additions

Since LCRI, the CCR must also report:

The status of your service line inventory (complete, in progress, or the date by which it will be complete)
The count of known lead service lines, galvanized-requiring-replacement lines, and unknowns
The replacement rate and schedule if you have lead service lines

Mandatory verbatim EPA language

Certain blocks in a CCR are required verbatim — the language must be byte-identical to what appears in Appendix A or in the applicable section of 40 CFR 141. These include:

The definitions of MCL, MCLG, Action Level, Treatment Technique, MRDL, MRDLG, Variances, Exemptions, Level 1 and Level 2 Assessments, ppm, and ppb.
The health-effects narrative for each detected contaminant from Appendix A.
The required language for violations, lead exposure, and special populations (immunocompromised, infants, etc.).

If you (or your consultant, or your LLM) paraphrases these blocks even slightly, that is a compliance failure — not a style difference. We reproduce them byte-exact from the eCFR JSON API at build time, and the agent never edits them. See the current loaded text in the regulatory hub.

Violations: disclose without panicking customers

If your utility had a compliance violation in the reporting period, you must disclose it — even if it was corrected. The disclosure must include:

What the violation was (which contaminant, how much, what period)
The health effects (using Appendix A language)
Steps you've taken or are taking to correct it
Whether the violation is ongoing

Do not minimize, do not omit. But do contextualize — explain the corrective steps, the current compliance status, and reassure customers where the facts support reassurance. This is where operator voice matters: a template can draft the violation disclosure, but you should review it for tone and local context.

Distribution: Good Faith Effort and the Certificate of Delivery

The CCR must reach your consumers by July 1. The rule specifies delivery methods based on system size:

Systems serving under 10,000 people can use mail, bill inserts, electronic delivery (with consent), or door-to-door distribution.
Systems serving 10,000 or more must use direct delivery — mail or electronic delivery to each bill-paying customer.

For electronic delivery to count, you need consent from each customer and a direct URL to the CCR (not just a link to your website's homepage).

The Certificate of Delivery is a signed statement to your primacy agency certifying:

How the CCR was distributed
The date distribution was completed
The number of customers reached
Any customers for whom Good Faith Effort was needed (unreachable addresses, returned mail, etc.)

We auto-generate the Certificate of Delivery and file it on your behalf on the Full Service tier.

CCR retention (§ 141.155(h))

40 CFR § 141.155(h) requires every community water system to retain copies of its Consumer Confidence Report for no less than three years.

Related retention obligations to be aware of:

§ 141.155(a)(4) — If the CCR is posted on a publicly available website, that web copy must remain publicly accessible for no less than three years.
§ 141.33 — Underlying monitoring records have longer retention: bacteriological analyses five years (§ 141.33(a)); chemical analyses ten years (§ 141.33(b)); action records three years (§ 141.33(c)); sanitary survey records ten years (§ 141.33(d)).

Primacy agency auditors routinely request multi-year histories during sanitary surveys. A CWS that keeps only the three-year regulatory minimum will be unable to answer questions about the prior decade of chemical analyses.

1water.ai archives every published CCR, Certificate of Delivery, compliance report, and distribution log for five years — exceeding the § 141.155(h) minimum. The signed CCR PDF, machine-readable CCR JSON, and every tool invocation that produced a calculated value are preserved with provenance. Export your full archive anytime.

State primacy agency overlays

Federal 40 CFR 141 is the baseline. Every state primacy agency adds state-specific requirements on top — some minor (additional footer language), some substantial (extra regulated contaminants, different sampling frequencies, state-specific public education).

The regulatory hub catalogs the federal text plus every state overlay we cover. At launch we ship eight state overlays (California, Texas, New York, Florida, Illinois, Ohio, Pennsylvania, North Carolina). The remaining 42 states are on the roadmap; the federal baseline runs everywhere.

Common rejection causes

A primacy agency can reject your CCR and require you to re-file. Based on advisor input and public state-agency feedback, the top rejection causes are:

Unit inconsistencies (ppb reported where mg/L required, or vice versa). Single biggest cause.
Missing MCL values or incorrect MCL/MCLG pairings for a contaminant.
Lead and Copper calculation errors — wrong 90th-percentile math, or omitting the percentile entirely.
Paraphrased verbatim blocks — the LLM "cleaned up" the health effects language.
Missing violation disclosures — the CCR doesn't disclose a reportable violation from the reporting period.
Late filing — submitted after July 1 without approved extension.
Missing service line inventory — since LCRI, required for most utilities with lead service lines.

How 1water.ai automates each step

Every step above is a tool in our agent. The orchestrator decides which tools to run on your inputs; the tools execute deterministically, with full provenance and audit logs.

Ingest tools read your lab PDFs and SDWIS violations with cell-level provenance.
normalize_samples resolves unit inconsistencies before any comparison.
calc_ninetieth_percentile computes the Lead and Copper 90th-percentile exactly per § 141.80(c)(3).
Compliance validator runs every check in § 141.151 through § 141.156 + your state overlay.
Publish gate blocks unless every required check passes.

When you're ready to start — start free. The 60-day trial is the product: upload last year's CCR, draft every section, review the compliance chips, and preview the output. Upgrade only when you publish.

Products

For developers

By organization

By size

Guides

Media

Company

The Consumer Confidence Report guide.