The first wave of U.S. packaging EPR was about reporting. The second wave is about proving. As PRO validation and state record-retention requirements activate, the deliverable is no longer the report alone — it is the report plus the chain of records that makes it defensible years later.
A producer submits a packaging report. Two years later, someone asks a simple question: how did you calculate this number?
The answer matters more than the number itself.
The first wave of U.S. packaging EPR was about reporting. The second wave is about proving. The shift is not rhetorical. It is encoded in statutes, embedded in producer responsibility organization agreements, and increasingly active in the validation pipelines that PROs and state regulators have already begun to operate.
The report is not the record. The record is what makes the report defensible.
The mental model most producers carry into their first EPR cycle is straightforward: collect the data, calculate the figures, file the report. The deliverable, in this view, is the report itself.
The regulatory architecture is not built on that model. It is built on a longer sequence: data, methodology, documentation, report, validation. The report is the summary. The records that made the report possible — and that allow it to be reproduced, defended, and audited years later — are the evidence.
This distinction is now operative. The G&A Institute, in its 2026 guidance on EPR data preparation, names the implication directly: companies must "establish consistent weight calculations in line with state requirements and ensure all methodologies are tracked, because Producer Responsibility Organizations may conduct report validations." Methodology tracking is not a reporting requirement. It is an evidence requirement that exists separately from the act of submission.
In the first phase of program implementation, this distinction was easy to miss. Most producers were focused on the submission itself. As programs mature and the first validation reviews begin, the distinction becomes the substance of the obligation. What ultimately matters is not the report. What matters is the chain of records that supports it.
The evidence burden under EPR is more demanding than the comparable burden under most other regulatory frameworks because the underlying data is structurally hard to substantiate.
Packaging data is supplier-provided in significant part, and producers have no statutory leverage to compel supplier participation. Oregon's administrative guidance states this plainly: a lack of data visibility from distributors and supply-chain partners does not relieve the producer of any reporting or fee obligation. The producer is fully obligated. The upstream supplier is not.
Packaging data is also often reconstructed. As the prior article in this series argued, much of what producers report in their first cycle is data assembled retroactively — from PLM systems, supplier records, ERP exports, and physical measurement. The more reconstruction is required, the more evidence becomes necessary, because reconstructed data must be supported by methodology documentation, source materials, and assumptions that can be defended on review.
And packaging data is derived from cross-functional records that were never built for regulatory purposes. The Circular Action Alliance, the producer responsibility organization administering most U.S. programs, characterized this directly: "Most companies' internal systems were designed before EPR was top of mind, which means packaging data is often incomplete, inconsistent, or scattered across teams." Data that has to be assembled from sources never intended to serve as compliance evidence carries a higher proof burden than data generated within purpose-built systems.
The result is a category of compliance obligation in which the act of reporting is comparatively straightforward and the act of substantiating the report is genuinely difficult.
California's SB 54 creates the clearest example of how a single reporting submission can become a permanent piece of evidence.
Every California-obligated producer was required to submit a 2023 baseline report — the foundation for measuring source reduction through 2032. Once the resubmission window closed, the baseline numbers became fixed. Each year's source-reduction performance — toward 10% in 2027, 20% in 2030, and 25% in 2032 — is measured against that locked figure. The baseline is not, in practical terms, a historical artifact. It is a regulatory anchor that must remain explainable for nearly a decade.
The certification layer compounds this. All California PRO and producer submissions carry the declaration: "I hereby declare, under penalty of perjury, that the information provided in this document is true and correct, to the best of my knowledge." The certification gives the submitted data legal significance beyond ordinary administrative reporting. A submitted figure that cannot be substantiated by underlying records carries exposure at the certification level, not only at the civil compliance level.
The evidence standard for historical claims is unambiguous. Producers seeking credit for source reductions achieved before the 2023 baseline must provide "clean, verifiable data." Estimates earn zero credit. The regulation does not distinguish between aggressive estimates and conservative ones — it treats unsupported claims as nullities.
The baseline is not simply reported. It must remain defensible.
The most immediate driver of the evidence burden is not state regulatory enforcement. It is producer responsibility organization validation, which runs continuously and independently of formal enforcement actions.
The Circular Action Alliance's Participant Producer Agreement requires each producer to warrant that submitted data is "accurate and complete" and to provide "further reasonable proof thereof (if requested by CAA)." On written request, producers must supply "specific data, calculation methodologies, and/or audit reports." The CAA Oregon Program Plan additionally reserves the right to access business premises during business hours and to require confirmation from a senior officer.
This is not a hypothetical structure. CAA confirmed in April 2025 that it was actively validating producer supply reports following Oregon's first reporting cycle. Validation operates on three levels: desktop review of submitted data against internal consistency expectations; on-site inspection of records when warranted; and methodology capture through the CAA Producer Portal, which records the calculation approach each producer used.
The graduated consequence structure means most producers will encounter validation as a request for documentation, not as an enforcement action. But the request requires a response — and the response requires evidence that already exists, organized in a way that can be produced on demand. A producer that has the data but cannot quickly assemble the methodology, source records, and supplier documentation behind it is operationally exposed in a way that has nothing to do with whether the reported number was correct.
Validation is what turns documentation from a discipline into an operational requirement.
The evidence bar rises sharply for producers seeking fee adjustments through eco-modulation or claiming credit for source-reduction pathways.
Oregon's eco-modulation bonuses require life-cycle assessments conducted under ISO 14040/44, with independent third-party critical review prior to submission. These are not internal documents. They require supply chain data, accredited certifiers, and audit statements that accompany the submission itself.
California's source-reduction framework requires third-party validation for any producer seeking PCR Alternative Compliance credit. Recyclability claims that drive eco-modulation fee reductions must be supported by valid certifications. Where they cannot be, the consequence is not only fee recalculation — the risk profile changes materially.
The pattern across both states is consistent. Where a producer is asking the regulator for something — a fee reduction, source-reduction credit, an eco-modulation adjustment — the proof standard is higher than for routine reporting. The asymmetry matters operationally. Producers building eco-modulation into their compliance strategy are simultaneously building a higher-evidence subset of their packaging data system, with stricter chain-of-custody, certification, and third-party validation requirements.
The structural mechanism that converts the evidence obligation from a current-period requirement into a multi-year institutional responsibility is record retention.
California requires producers to maintain records for three years. Oregon, Colorado, and Maryland require five. The required records include not only the submitted reports but the supporting materials — supplier certifications, methodology documentation, invoices, measurement records, end-market chain of custody, and contracts with material handlers. California's regulations alone specify more than a dozen distinct record categories that must be available for inspection by CalRecycle on written request.
The multi-state asymmetry has a practical implication. A producer operating under a uniform records policy calibrated to California's three-year minimum is non-compliant in Oregon, Colorado, and Maryland at year four. Most multi-state producers will need to standardize on the longest applicable retention period, which means packaging data records — and the methodology and supplier documentation behind them — must survive significantly longer than the operational systems that generated them.
The retention requirement also reframes the records themselves. They are no longer working files maintained for current reporting. They are compliance artifacts that must remain readable, organized, and traceable across personnel changes, system migrations, and packaging redesigns. That is an evidence management problem, not a records storage problem.
An earlier article in this series argued that EPR reporting software does not eliminate the packaging-data work that sits beneath the reporting layer. The evidence burden makes that point sharper.
Reporting platforms — Lorax EPI, Recyda, Specright, Source Intelligence, and others — calculate fees, format submissions, and produce audit trails of activity within the platform. They can structure data that exists. They cannot create the evidence chain that connects a reported number back to its supplier source, its methodology decision, its calculation logic, and the documentation that supports each step.
The vendors themselves have moved toward this language. Recyda describes its platform as enabling producers to "effortlessly trace data sources and review calculations for full audit readiness." Assent describes its EPR solution as supporting "audit-defensible reporting." H2 Compliance frames the deliverable as "a verified dataset that stands up to state-level audits." The recurrence of "audit-ready," "audit-defensible," and "verified dataset" across vendor positioning is itself the market acknowledgment: the deliverable is no longer the report alone, but the report plus the substantiation behind it.
What software can do, given good inputs, is preserve the trail. What it cannot do is generate the trail from systems that were not designed to produce one. Evidence has to be created upstream — in supplier relationships, methodology decisions, change control, and documentation discipline — before software can preserve it.
Orbitlex treats evidence creation and evidence retention as part of compliance operations, not as a post-reporting activity.
The evidence layer has to be built before the validation request arrives.
As packaging EPR programs mature, the competitive advantage is no longer the ability to submit a report. It is the ability to explain it years later. Orbitlex builds and maintains the evidence layer alongside the reporting one.
Get Free EPR Compliance CheckThis article is for informational purposes only and does not constitute legal advice. Regulatory timelines and program requirements are subject to change. Always verify current obligations with state authorities, PROs, and qualified legal counsel directly. Orbitlex is not a law firm.