The EPR Reporting Crisis: Why Manual Data Collection is Too Risky
State EPR audits don't accept "we're working on it." If your packaging compliance data lives in a spreadsheet, here's what's actually at stake.
It starts with a compliance notice: it’s not an email you can ignore, but a formal notice from a state environmental agency requiring your company to submit packaging material data for every SKU in your portfolio, and you have 30 days.
Your compliance team pulls up the spreadsheet.
There are three versions on three different drives. One was last updated when your contract packaging supplier changed its material formulations six months ago. Another includes SKUs you discontinued in Q2. The third has a formula error in the weight calculations column that nobody caught because nobody was checking.
Six hundred SKUs. Thirty days. One spreadsheet that can't tell you which version is correct.
For food and beverage manufacturers operating in states with active Extended Producer Responsibility (EPR) programs, this scenario is happening right now. And the consequences of getting it wrong include EBITDA-level risks.
What EPR actually requires from your organization
Extended Producer Responsibility shifts the financial and administrative burden of packaging waste management from municipalities to the companies that put packaging into the market. If you manufacture or distribute food and beverage products in covered states, you're a "producer" under these laws. You're responsible for collecting, verifying, and reporting granular packaging data for every product you sell.
As of mid-2026, seven states have enacted packaging EPR laws: California, Colorado, Maine, Maryland, Minnesota, Oregon, and Washington. Several others have introduced similar measures. Several of these states, including California and Oregon, have designated the Circular Action Alliance (CAA) as the Producer Responsibility Organization (PRO), creating a consolidated reporting structure. That centralization doesn't eliminate complexity. It just standardizes where you submit.
Most states exempt producers under $2-5 million in annual revenue, and business-to-business transactions are generally excluded. If you're above those thresholds, you're in scope.
What does reporting require? State programs demand component-level packaging data by SKU, including:
- Material type for every packaging component
- Exact weight of each component
- Recyclability classification
- Packaging format and structure
- Where in the supply chain the packaging becomes waste
- Packaging volumes placed on the market
For a mid-size snack food manufacturer with 600 SKUs across multiple product lines, that's potentially thousands of individual data points, each of which must be traceable, accurate, and defensible to a regulator. The May 31, 2026 CAA reporting deadline covered six states simultaneously, with California's deadline extended one day to June 1. [1]
The financial exposure you need to understand before the next board meeting
The penalties for EPR non-compliance are real, and enforcement is no longer theoretical. Oregon's SB 582 establishes civil penalties for non-compliance, and enforcement is active. [2] California's SB 54 establishes significant daily fines for producers who don't meet compliance requirements, with amounts set in statute and currently being confirmed through CalRecycle enforcement guidance. [3] Producers who fail to meet PRO enrollment deadlines may face market access restrictions under California regulations. [3]
California has the authority to restrict sales of products from non-compliant producers. [3] If your company can't demonstrate EPR compliance and your products get pulled from California shelves, you're talking about lost revenue across the largest state economy in the country.
The math on enforcement exposure is straightforward. Even a moderate daily penalty rate, sustained over a 30-day enforcement window, reaches into six or seven figures fast. And unlike a one-time fine, daily accruing penalties don't stop until you fix the underlying compliance problem.
For CEOs and COOs, this is a material risk disclosure issue. If your company is publicly traded or investor-backed, EPR non-compliance may need to appear in your risk disclosures. Boards are starting to ask about it, and the question will keep getting more specific as enforcement visibility increases. [4]
One angle that doesn't show up in the penalty tables: EPR compliance data overlaps directly with GRI and CDP sustainability reporting frameworks. If your company is already producing an ESG report, your packaging data should be feeding both your EPR submissions and your sustainability disclosures from the same source. Right now, most manufacturers are maintaining separate data sets for each, which doubles the workload and multiplies the error risk.
Why spreadsheets fail EPR compliance
Most food and beverage manufacturers didn't build spreadsheet-based systems for EPR. They built them for internal tracking, supplier conversations, and marketing specs. Then EPR happened, and the spreadsheet became the compliance record by default.
Here's where that breaks down.
Version control is a requirement
State EPR audits will require you to demonstrate that the data you submitted was accurate on the date you submitted it. When your packaging data lives in a shared drive spreadsheet, you can't prove which version was current on a given date. A supplier updates their material formulation, someone overwrites the old data, and your audit trail is gone.
The question an auditor asks: "Which version of this spreadsheet generated your May 31 report?" If your answer involves opening three files and comparing metadata you may not have, you're not audit-ready.
Supplier updates break data integrity at scale
Your packaging suppliers don't notify your compliance team every time they make a change. Formulations shift. Materials get substituted. A packaging converter switches from one resin type to another. In a spreadsheet system, you find out reactively, during a supplier conversation, or when a discrepancy surfaces during a report review. By that point, you may have already submitted data that no longer reflects reality.
This is a manageable problem at 50 SKUs. At 600 SKUs across multiple suppliers, it's statistically inevitable. For more on building resilient supplier data practices, see our supplier quality management guide.
No audit trail means no defense
When a state auditor reviews your EPR submission, they're checking whether your data is traceable, verifiable, and internally consistent. A spreadsheet has no built-in audit trail. You can't show who entered which data point, when it was reviewed, or whether it was changed after initial entry.
If you are aware of FSMA documentation requirements, this should sound familiar. EPR is applying the same logic to packaging data. If you can't prove the chain of custody for your compliance records, the records themselves are insufficient. The standard is the same; the subject matter is different.
What "audit-ready" means for EPR
The term gets used loosely. For EPR, it has a specific meaning that sets a higher bar than most manufacturers currently meet.
Audit-ready EPR documentation requires four things:
Completeness. Every in-scope SKU has packaging data on file. No gaps. No "we're waiting on that supplier." Completeness is binary in an audit.
Traceability. Each data point traces to its source. If you report that a component weighs 4.2 grams, you can show the supplier specification document, the date it was obtained, and who verified it. Traceability is what separates a compliance record from a data entry.
Version control. You can demonstrate which version of your data was current on the reporting date. Historical versions are retained and accessible. Changes are logged.
Supplier attestation. You have documented confirmation from your suppliers that the packaging data they provided is accurate. Not an email chain. A formal, dated attestation that material specifications, weights, and recyclability classifications reflect current reality.
These criteria aren't arbitrary. They reflect what state EPR programs and their administering PROs look for when auditing producer submissions. They also reflect what FSMA has required for supplier verification records for years. If you've built those FSMA workflows already, you're closer than you think. The infrastructure transfers.
The retail pressure you're about to start feeling
Regulators are one pressure point. Retail customers are becoming another, and this one moves faster than any enforcement timeline.
Here's a scenario that's playing out now at large retailers: a sustainability procurement team is reviewing its supplier qualification requirements ahead of its own annual ESG commitments. They add EPR compliance documentation to the supplier questionnaire because they face their own liability exposure when they stock products from non-compliant producers, and because their investors are asking about supply chain sustainability posture.
You get the questionnaire on a Tuesday. They want documentation by Friday. You need to show current, dated supplier attestations for every packaging component across your in-scope SKUs, a version-controlled record of your last EPR submission, and confirmation that your data reflects any material changes made in the past 12 months.
If your compliance data lives in a spreadsheet, you don't have any of those things ready. You have raw data that needs to be reconstructed, source documents that may or may not be current, and no way to produce a point-in-time snapshot of what you submitted.
The manufacturers navigating this best aren't treating EPR as a separate compliance program. They're treating it as another data discipline, the same way they treat food safety records and supplier onboarding documentation. The data is already in their systems; and the packaging compliance report is just another output.
A 5-question EPR readiness check
Run through these honestly before your next reporting deadline:
- Can you pull complete packaging material data for every in-scope SKU in under 24 hours? If the answer requires asking multiple people or searching multiple systems, the answer is no.
- Do you have current, dated supplier attestations on file for every packaging component? "We got the spec sheets when we onboarded the supplier" isn't the same as a current attestation. Material formulations change.
- Can you demonstrate which version of your packaging data was current on your last reporting date? If you can't produce a point-in-time snapshot of your packaging records, you can't prove your submission was accurate.
- Is there a documented process for capturing supplier-initiated packaging changes before they affect your compliance records? Ad hoc notification isn't a process. If suppliers update material specs without a structured intake workflow, your data is perpetually at risk of being stale.
- Can you produce a complete audit trail for your last EPR submission? If your data lives in a shared spreadsheet, the answer is no.
If you answered "no" to any of these, your current process carries material compliance risk. Not future risk. Risk that lives in your next report.
What changes when you have the right system in place
Here's the honest version of what this looks like in practice. When a compliance notice arrives, your team doesn't open a spreadsheet; instead they open a system where every in-scope SKU already has component-level data attached, every supplier has submitted a current attestation through a structured intake process (not an email thread), and every change to a packaging specification is logged with a timestamp and a name.
When the auditor asks which version of your data was current on May 31, you pull a dated record. Not a file with metadata you hope is accurate. A record.
Multi-supplier documentation at EPR scale breaks spreadsheet-based systems, not because of edge cases, but because of normal operations. When documentation requirements change fast, and with EPR they do, manufacturers with centralized systems adapt. Those running on spreadsheets scramble. A $3 billion food service company that built centralized supplier compliance workflows learned this during COVID-19, when supplier documentation requirements changed week to week. The difference was that their system could keep up.
Your compliance team gets a structured process where suppliers submit current spec sheets on your schedule with a timestamp and a trail. When your sustainability team needs the same packaging data for a GRI or CDP disclosure, it comes from the same source. One dataset. Multiple uses.
If you're already using SafetyChain for FSMA supplier verification, you don't need a second system for EPR. The same supplier documentation workflows, structured intake, version-controlled records, detailed change logging, extend directly to packaging compliance data. Manufacturers using SafetyChain's supplier compliance capabilities have cut supplier documentation collection time from weeks to days, which is the difference between scrambling and being ready when a notice arrives.
The question for a COO evaluating this isn't "what does the software do?" It's "what does my team stop doing?" The answer: chasing suppliers for current spec sheets, reconciling three versions of the same spreadsheet, and explaining to an auditor why the data can't be traced to a source.
For more on building audit-ready documentation programs, see our guides on internal auditing and food safety compliance.
The cost of waiting
EPR programs aren't slowing down. The seven states with active programs are generating compliance frameworks that additional states are studying and emulating. Reporting deadlines recur annually. Fee structures increase as programs mature.
The manufacturers struggling most right now aren't those who started early and made mistakes. They're the ones who assumed they had more time.
If your packaging data is in a spreadsheet today, the question is how many more reporting cycles you're willing to run on something that can't pass an audit.
Take the next step
The 30-day scenario at the opening of this post isn't a worst-case projection. Manufacturers are experiencing it right now in states with active EPR enforcement.
The difference between a company that navigates it successfully and one that doesn't isn't budget or headcount. It's whether the data is already there, already organized, already traceable, before the notice arrives.
See a field-by-field example of what a California-compliant EPR submission looks like, including the supplier attestation records, version history, and data traceability that auditors look for, and where spreadsheet-based submissions typically fall short.
References
[1] Alston & Bird. "Packaging EPR Reports Due May 31." June 22, 2026. https://www.alston.com/en/insights/publications/2026/05/packaging-epr-reports-due-may-31
[2] Oregon DEQ. Oregon Plastic Pollution and Recycling Modernization Act (SB 582). https://www.oregon.gov/deq/recycling/pages/sor.aspx
[3] CalRecycle. SB 54 Producer Responsibility for Packaging. https://calrecycle.ca.gov/packaging/
[4] Holland & Knight. "What You Need to Know Now About State EPR Laws." January 22, 2026. https://www.hklaw.com/en/insights/publications/2026/01/what-you-need-to-know-now-about-state-epr-laws
