The third Unregulated Contaminant Monitoring Rule (UCMR 3) collected PFAS (per- and polyfluoroalkyl substances) data in 2013 and 2015, and federal limits for those compounds did not arrive until 2024, eleven years after first monitoring started. The EPA proposed UCMR 6 in July 2026, covering 30 more chemicals. Publicly available data from that program will not exist until after 2031. Your utility's annual compliance report covers last year's water, and it does not include compounds the EPA has not yet regulated, seasonal changes in source water chemistry, or what aging internal plumbing contributes between the distribution main and your taps. Federal water law tells your utility what to remove before water reaches your building, and those obligations end at your service connection.
The Safe Drinking Water Act, the Lead and Copper Rule Improvements, the PFAS national standards, and the Unregulated Contaminant Monitoring Rule each govern different parts of the supply chain, and each leaves defined categories of contamination unaddressed.
How the Safe Drinking Water Act Sets the Rules
Congress passed the Safe Drinking Water Act in 1974, giving the EPA authority to set national standards for public water systems. Those standards take two forms for each regulated contaminant: the Maximum Contaminant Level Goal (MCLG) and the Maximum Contaminant Level (MCL).
The MCLG is the EPA's non-enforceable health target. It represents the concentration below which the agency believes no known or anticipated health risk exists. For lead and several PFAS compounds, the MCLG is zero. The EPA's position is that no safe exposure level has been established for those contaminants.
The MCL is the enforceable limit. The EPA sets it as close to the MCLG as it determines is technically and economically achievable across thousands of water systems of varying size and infrastructure. For many contaminants, the MCL is higher than the MCLG, sometimes by a significant margin. A utility can deliver water that meets every MCL and still deliver water containing contaminants the EPA considers harmful at any detectable level.
The Safe Drinking Water Act applies to public water systems. The regulatory obligation runs between the EPA and your utility. Your building receives that water, and what you do with it on your premises falls outside the scope of federal drinking water law. What's in Your Tap Water and What Businesses Can Do About It covers what those contaminants look like in water coming into US commercial buildings.
What the Lead and Copper Rule Improvements Mean for Your Building
Lead enters drinking water at the tap, not at the treatment plant. Water picks up lead when it sits in contact with lead service lines, lead-containing solder, or brass fixtures. Utilities cannot control lead contamination in private building plumbing, which is why the Lead and Copper Rule has always used a different compliance mechanism than other SDWA standards.
Under the original rule, utilities tested at a sample of homes. If the 90th percentile of those results exceeded the action level of 15 parts per billion, the utility was required to take corrective steps. That action level was not a health limit. The MCLG for lead is zero.
The EPA's Lead and Copper Rule Improvements, finalized on December 30, 2024, changed the standard in two significant ways. The rule reduces the lead action level from 15 parts per billion to 10 parts per billion. It also requires water utilities to complete inventories of all lead service lines in their systems and to replace them within ten years. Full compliance for water systems is required by approximately December 2027.
For commercial property owners and building managers, this creates direct implications. If your building has a utility-owned lead service line connecting it to the main, that line may be included in your utility's replacement program. If your building's internal plumbing contains lead-based solder or lead-containing fixtures installed before 1986, that contamination source is not covered by utility replacement programs. It remains your building's responsibility.
The 90th percentile lead figure in your utility's annual water quality report reflects system-wide averages. It does not reflect what comes out of your specific taps. For any building constructed or renovated before 1986, independent tap testing is the only way to establish your building's actual lead level.
The PFAS Drinking Water Standards: Where They Stand in 2026
In April 2024, the EPA finalized the first national PFAS drinking water standards, setting MCLs for six PFAS compounds: PFOA, PFOS, PFHxS, PFNA, HFPO-DA (commonly known as GenX chemicals), and a hazard index mixture of three of those compounds plus PFBS. For PFOA and PFOS, the MCL was set at 4 parts per trillion. The MCLG for both is zero.
In May 2026, the EPA proposed to rescind four of those six standards. Under the proposed rescission rule, MCLs for PFHxS, PFNA, HFPO-DA, and the related hazard index mixture would be removed. The EPA cited procedural errors in how those four standards were finalized. The public comment period for the rescission closes July 20, 2026.
The PFOA and PFOS standards are retained under the proposal. Utilities will continue to test for those two compounds and treat to the 4 ppt limit. The compliance deadline was extended from 2029 to 2031 under a parallel proposed rule.
The scope of the problem the 2024 rule was responding to: a 2026 analysis of EPA UCMR 5 monitoring data found PFAS in water systems serving more than 176 million Americans. A 2023 USGS tap water study found PFAS in 45% of tap water samples tested across the US, including in markets with no documented industrial contamination history.
The practical picture for facilities managers after May 2026: PFOA and PFOS remain federally regulated in drinking water. The four other PFAS compounds that were regulated will likely lose their MCLs when the rescission is finalized. Those compounds do not disappear from water supplies. They lose their enforceable federal ceiling.
PFAS in Drinking Water: What Every Business Needs to Know covers the full contamination scope and what the regulatory rollback means in practice.
UCMR Monitoring: The Gap Between What Is in Your Water and What Is Regulated
The EPA monitors contaminants that lack federal limits through the Unregulated Contaminant Monitoring Rule. Each UCMR cycle requires public water systems to test for a defined list of compounds. The data informs future regulatory decisions but does not set limits and does not require treatment.
The gap between first monitoring and eventual regulation can span a decade. UCMR 3 collected PFAS data in 2013 and 2015. Federal limits for those compounds did not arrive until 2024, eleven years after first monitoring started.
On July 1, 2026, the EPA proposed UCMR 6, covering 30 chemicals: seven ultrashort-chain PFAS compounds, three pesticide metabolites, 13 semivolatile organic compounds, and seven purgeable organic compounds. Monitoring would run from 2028 through 2030. Data would not be publicly available until after 2031.
The implication for businesses is direct: compounds in UCMR 6 may already be present in water supplies. The monitoring has not started. Waiting for UCMR 6 results before acting on water quality means waiting until at least 2031 for data on contaminants that are in the water now.
Your Utility's Annual Disclosure: The Consumer Confidence Report
Every community water system in the United States is required to publish an annual Consumer Confidence Report (CCR) by July 1 each year, covering the prior calendar year's monitoring data. The report discloses detected contaminant levels, MCL comparisons, violation history, and probable contamination sources.
The CCR is the primary regulatory transparency mechanism between utilities and the customers they serve. It is not a complete picture of what comes out of your building's specific taps. Lead from internal plumbing does not appear in it. Contaminants not yet regulated do not appear. Real-time drought or seasonal conditions affecting source water chemistry do not appear. The data always reflects the prior calendar year.
Find your utility's report using the EPA's CCR search tool at epa.gov/ccr or your utility's own website.
What Federal Regulation Does Not Cover
Understanding the limits of federal law matters for facilities decisions. The SDWA regulates public water systems. For most businesses, that means the rules run from the EPA to the utility. They do not extend to your building's internal systems or your dispensers.
A business operating an on-site water cooler, break room tap, or employee drinking water station is not a public water system. The MCLs your utility must meet are not standards your business must independently verify or certify at the dispenser. The regulatory endpoint is the utility's service connection to your building.
Federal drinking water law also does not govern the condition of your building's internal plumbing, the contaminants that form or accumulate between the distribution main and your taps, or compounds in your water that carry no MCL because the regulatory process has not concluded.
OSHA's general industry standards require employers to provide potable water for employees under 29 CFR 1910.141. Potable water under that standard means water meeting EPA and state drinking water requirements. If your building's water meets those standards at the service connection, OSHA's potable water requirement is satisfied, regardless of what your internal plumbing may contribute before water reaches a dispenser.
What Businesses Can Do Beyond the Regulatory Baseline
Federal regulation establishes what your utility must deliver. It does not determine what your employees consume at the tap. The gap between those two points is where most of the real water quality decisions for businesses live.
Point-of-use purification at the tap addresses the distance between what utility compliance covers and what reaches your workforce. A reverse osmosis system installed on your building's water line reduces PFAS compounds, lead, arsenic, nitrates, trihalomethanes, and disinfection byproducts at the point of consumption. It operates independently of utility compliance timelines, MCL values, and UCMR monitoring cycles.
A bottleless water purification system connects directly to your building's water line and processes water through a multi-stage purification sequence before dispensing. The service includes scheduled maintenance and purification system upkeep under a single agreement. Your facilities team does not manage component schedules or coordinate service calls.
Find out what is in the water where your facility operates.
Frequently Asked Questions
What federal regulations apply to business drinking water?
The Safe Drinking Water Act regulates public water systems, not individual businesses. Your utility must meet EPA Maximum Contaminant Levels for regulated contaminants and report results annually in a Consumer Confidence Report. OSHA separately requires employers to provide potable water under 29 CFR 1910.141, meaning water that meets EPA and state drinking water standards. The federal regulatory endpoint is the utility's service to your building, not your building's dispensers.
What are the current PFAS drinking water standards?
As of July 2026, the EPA retains MCLs for PFOA and PFOS at 4 parts per trillion. The EPA proposed in May 2026 to rescind standards for PFHxS, PFNA, HFPO-DA (GenX), and a related hazard index mixture. The comment period for that rescission closes July 20, 2026. The compliance deadline for PFOA and PFOS was extended to 2031.
What is the Lead and Copper Rule, and does it apply to my building?
The Lead and Copper Rule Improvements, finalized in December 2024, reduce the lead action level to 10 parts per billion and require utilities to replace lead service lines within approximately ten years. The rule applies to utilities, not directly to businesses. If your building's internal plumbing contains lead-based solder or lead-containing fixtures from before 1986, that contamination source is your building's responsibility. Independent tap testing is the only way to know your building's specific lead level at the dispenser.
What is UCMR and why does it matter for my business?
The Unregulated Contaminant Monitoring Rule requires public water systems to test for chemicals that lack federal limits. That data feeds future regulatory decisions. UCMR 6 was proposed in July 2026, covering 30 chemicals with monitoring from 2028 to 2030. Results would not be public until after 2031. Compounds in UCMR 6 may already be present in water supplies today, with no current reporting requirement.
How do I find out what is in my utility's water?
Your utility publishes an annual Consumer Confidence Report by July 1 each year. Find it using the EPA's search tool at epa.gov/ccr or your utility's website. The EPA's drinking water dashboard shows violation history going back years. For the complete guide on reading and applying that report, see our Consumer Confidence Report guide.
Does my business need to test its tap water independently?
Federal law does not require most businesses to conduct independent tap water testing. That said, if your building was constructed before 1986, draws water in a market with documented PFAS contamination, or your utility has a violation history, independent testing provides information the CCR cannot. For PFAS, testing using EPA Method 537.1 through a certified laboratory costs approximately $150 to $300.