What is the EPA Process to Regulate a New Drinking Water Contaminant?

Written by Eric G. Roy, PhD


Quick Summary:  

  • Statutory authority (SDWA, 1974): The Safe Drinking Water Act (SDWA) authorizes the US Environmental Protection Agency (EPA) to regulate contaminants in public water systems (PWS) by issuing National Primary Drinking Water Regulations (NPDWRs). 
  • Key Amendment to SDWA in 1996: The 1996 SDWA amendments shifted the EPA away from contaminant quotas and into a risk-based process built around the Contaminant Candidate List (CCL), the Unregulated Contaminant Monitoring Rule (UCMR), formal Regulatory Determinations, Health Risk Reduction and Cost Analyses (HRRCAs), Consumer Confidence Reports (CCRs), and recurring Six-Year Reviews of existing rules. 
  • Collecting Occurrence Data (UCMR): The EPA uses UCMR to generate national occurrence data for selected unregulated contaminants. Occurrence evidence is one of the statutory gates the EPA must clear before it can justify a national drinking water regulation. 
  • Collecting Toxicology Data (IRIS, ATSDR): The EPA’s Integrated Risk Information System (IRIS) and the Agency for Toxic Substances and Disease Registry (ATSDR) contribute toxicity assessments and screening values that shape how EPA frames health risk. The EPA uses toxicology to derive the Maximum Contaminant Level Goal (MCLG), the health-based target that does not account for treatment cost or feasibility. 
  • Rulemaking and interagency review (OMB/OIRA + notice-and-comment): Once the EPA moves from evaluation into an NPDWR proposal, the process expands to include OMB’s Office of Information and Regulatory Affairs (OIRA) review and formal Federal Register notice-and-comment rulemaking. The EPA must address significant technical and legal issues in writing to build a defensible administrative record. 
  • Implementation: A final regulation establishes a national baseline, not an immediate physical fix. Primacy agencies must adopt and implement the rule, and utilities typically need additional time to fund, design, procure, and operate monitoring and treatment. Ongoing obligations commonly include compliance monitoring, public notification of violations, and CCR reporting. 

The Safe Drinking Water Act (SDWA) (1974-Present) 

Federally enforceable water standards trace back to the Safe Drinking Water Act (SDWA), which was originally passed in 1974. The SDWA gave the EPA the authority to set science-based standards (called National Primary Drinking Water Regulations (NPDWRs) that apply to public water systems. 

An NPDWR can take two enforceable forms. For many contaminants, the EPA sets a Maximum Contaminant Level (MCL), which is a numeric concentration limit in drinking water. When SDWA constraints make a numeric limit impractical as the enforceable control point, the EPA can instead require a Treatment Technique (TT).  A TT is an enforceable set of treatment and operational requirements that utilities must implement to reduce health risk, even if compliance is not defined solely by a single concentration number. 

Two high-profile examples illustrate why this distinction matters in practice. The EPA regulates lead primarily through a treatment technique for corrosion control under the Lead and Copper Rule, rather than as a classic entry-point MCL. EPA’s Surface Water Treatment Rules similarly rely on treatment technique requirements, including filtration and disinfection, to control microbial risk. 

Since the SDWA was originally passed, two major Congressional amendments (1986 and 1996) fundamentally reshaped the regulatory process. 

1986 Amendments to the SDWA 

Congress amended the SDWA in 1986 and required the EPA to regulate 83 specific contaminants by 1989 and 25 additional contaminants every three years after that. The amendments also mandated disinfection and treatment requirements, and restricted lead in new plumbing materials. 

While this amendment increased the speed of regulation, which was the intent, it also prioritized volume over scientific rigor.  

1996 Amendments to the SDWA 

The 1996 amendments overhauled the entire water quality regulatory process. Congress replaced the contaminant quotas with a risk-based, prioritized system built around several new requirements that continue to serve as the structure today: 

  • Contaminant Candidate Lists (CCLs): The EPA must publish a list of unregulated contaminants that may need regulation, updated every five years. 
  • Regulatory Determinations: The EPA must evaluate at least five CCL contaminants every five years and decide whether to regulate them. 
  • Unregulated Contaminant Monitoring Rule (UCMR): The EPA can require water systems to monitor unregulated contaminants to build a national occurrence database. 
  • Health Risk Reduction and Cost Analysis (HRRCA): The EPA must publish a Health Risk Reduction and Cost Analysis (HRRCA) and make a formal determination about whether the benefits of the proposed level justify the costs. Where the benefits of a feasible MCL do not justify the costs, the SDWA allows the EPA (in limited circumstances and scope) to set an alternative level that maximizes health risk reduction benefits at a cost justified by the benefits. 
  • Consumer Confidence Reports (CCRs): Community water systems must send annual water quality reports to their customers. 
  • Six-Year Review: The SDWA requires the EPA to review each NPDWR at least once every six years and revise it, as appropriate. Any revision must maintain or strengthen public health protection. 

This framework was more defensible than the 1986 approach. However, it came with a tradeoff: Newly proposed contaminants had to clear scientific, legal, and economic hurdles before municipalities were required to comply with the new standard, making the process comparably longer. 

Upstream of SDWA: How Chemicals Enter the Market 

Two federal statutes strongly influence which manmade chemicals and pesticides can reach drinking water sources: TSCA (industrial chemicals) and FIFRA (pesticides). These programs operate upstream of SDWA and do not automatically trigger drinking water standards, but they shape the contamination landscape SDWA must address. 

Toxic Substances Control Act (TSCA) 

The Toxic Substances Control Act (TSCA), originally enacted in 1976 and substantially updated by the Lautenberg Chemical Safety for the 21st Century Act in 2016, governs industrial chemicals in commerce. In theory, the TSCA should prevent harmful chemicals from being manufactured or used in ways that contaminate drinking water sources. 

In practice, the TSCA has operated with limited pre-market testing requirements. The 2016 reforms strengthened the law by requiring the EPA to evaluate existing chemicals against a risk-based safety standard and to review new chemicals before they enter the market. But TSCA regulation does not automatically trigger a drinking water standard. The two regulatory tracks (chemical safety under the TSCA and drinking water standards under the SDWA) operate independently. 

Federal Insecticide, Fungicide, and Rodenticide Act (FIFRA) 

The Federal Insecticide, Fungicide, and Rodenticide Act (FIFRA) governs pesticide registration and use. Several pesticides have SDWA standards (atrazine, glyphosate, and others), but FIFRA registration does not ensure a pesticide won't contaminate drinking water at levels exceeding health-based thresholds. A pesticide can be approved for use under FIFRA while still posing a drinking water contamination risk that the SDWA must address downstream. 

How EPA Evaluates New Contaminants for Potential Regulation In Drinking Water 

The EPA takes several considerations into account when determining whether a contaminant requires regulation. 

The Contaminant Candidate List (CCL) 

The formal path toward a drinking water standard begins with the Contaminant Candidate List (CCL). Under the 1996 amendments to the SDWA, the EPA must publish a list of unregulated contaminants that are known or anticipated to occur in public water systems and are of high enough concern that they may require regulation.  For each CCL, the EPA identifies a list of potential contaminants, screens them using available health and occurrence data, and selects a final list for further evaluation. 

The EPA has published five CCLs to date: 

 CCL   Published   Contaminants Listed
 CCL 1  1998  60
 CCL 2  2005  51
 CCL 3  2009  116
 CCL 4  2016  109
 CCL 5  2022  81

 

Note: Totals include chemicals/chemical groups plus microbial contaminants

Unregulated Contaminant Monitoring Rule (UCMR) 

The Unregulated Contaminant Monitoring Rule (UCMR) is how the EPA determines how widespread a contaminant is found in water supplies. 

Under UCMR 1-4, the EPA selected up to 30 contaminants per cycle and requires large water systems (serving over 10,000 people) to test for them.   

In UCMR 5, all community water systems and non-transient non-community systems serving 3,300 or more people, plus a nationally representative sample of smaller systems, must: 

  • Monitor during a single 12-month timeframe within the three-year national monitoring window (2023–2025).   
  • Generally collect two or four sample events per location over a 12 month period, depending on source type. 

 UCMR  Monitoring Period   Notes/Scope 
 UCMR 1  2001-2005   24 contaminants (baseline monitoring cycle)
 UCMR 2  2008-2010   25 contaminants 
 UCMR 3  2013-2015   30 contaminants 
 UCMR 4  2018-2020   30 chemical contaminants 
 UCMR 5  2023-2025   30 chemical contaminants 

 

UCMR data is the primary national evidence base for regulatory decisions. Without it, the EPA can't demonstrate that a contaminant occurs at levels and frequencies of public health concern, which is one of the three statutory criteria for regulation. 

IRIS and ATSDR 

While UCMR monitoring answers the question "How widespread is this contaminant?", a different set of scientific assessments answers "How harmful is it?" 

The EPA's Integrated Risk Information System (IRIS) 

The EPA’s Integrated Risk Information System (IRIS) program, housed within the Office of Research and Development, develops human health assessments that the EPA and other agencies use as a key source of toxicity information when building risk assessments, including for drinking water decisions. 

  • Reference Dose (RfD): For contaminants that cause noncancer effects, the RfD is an estimate of the daily oral exposure that is likely to be without appreciable risk of adverse health effects over a lifetime. This is calculated from the best available study data, with uncertainty factors applied to account for the gaps between laboratory studies and real-world human exposure. 

  • Cancer Classification and Slope Factors: For potential carcinogens, IRIS classifies the contaminant using EPA's standardized descriptors ("Carcinogenic to Humans," "Likely to Be Carcinogenic to Humans," etc.) and derives an oral slope factor that quantifies the cancer risk per unit of exposure. 
The IRIS assessment process involves systematic literature review, internal and interagency review, public comment, and external peer review. It is thorough. It is also slow. The program has historically been criticized for a significant backlog, and many CCL contaminants lack completed IRIS assessments, which can delay regulatory action by years. 

The Agency for Toxic Substances and Disease Registry (ATSDR) 

The Agency for Toxic Substances and Disease Registry (ATSDR), part of the Department of Health and Human Services, provides a parallel scientific input through its Toxicological Profiles and Minimal Risk Levels (MRLs). These assessments are developed independently of the EPA and evaluate the same scientific literature, sometimes reaching different conclusions about safe exposure levels. 

It's important to understand that MRLs are screening values, not regulatory standards. The ATSDR has no authority to set or enforce drinking water limits. But their assessments contribute to the weight of scientific evidence that the EPA considers in the decision of whether or not to regulate a contaminant. 

Regulatory Determination 

Before the EPA can propose a new drinking water standard, the SDWA requires the agency to make what’s called a formal regulatory determination. This is the statutory “gate” for new contaminants. The EPA must conclude that: (1) the contaminant may have an adverse effect on human health, (2) it occurs in public water systems (or is likely to occur) at levels of public health concern, and (3) national regulation would present a meaningful opportunity to reduce health risk. 

This step is where nearly all contaminants that have been included on historical CCLs have stopped in the regulatory process. Positive determinations are rare for new contaminants, and even if a positive determination is made, contaminants still need to undergo the rulemaking process before they become an enforceable standard. For example, the EPA made a regulatory determination to regulate perchlorate in 2011, later tried to withdraw that determination in 2020, and it has remained contested for years. 

MCLG Determination 

The Maximum Contaminant Level Goal (MCLG) is the non-enforceable, health-based target for which there is no known or expected risk to health for a given contaminant. The EPA bases MCLGs entirely on toxicology and sensitive-population considerations do not take cost or feasibility into account. 

For non-carcinogens (and carcinogens with a threshold), the EPA typically derives an MCLG using a Reference Dose (RfD), body weight, drinking water intake, and a Relative Source Contribution (RSC) to account for exposure from sources other than drinking water.  

For carcinogens with a linear (no-threshold) dose-response relationship, the EPA may set the MCLG at zero, which means the EPA determined there is no exposure level that can be described as risk-free, so the enforceable MCL becomes a feasibility and implementation question. 

Federal Rulemaking & Implementation 

Developing the Proposed Rule 

Once the EPA decides a contaminant warrants national regulation, the agency must turn the technical work into regulatory text that can survive interagency review, public scrutiny, and judicial review. This stage takes time because the EPA has to publish the proposal, build and defend the administrative record, respond to significant critiques in writing, and then finalize a rule that states and utilities can implement. 
 
The EPA assembles the full proposed National Primary Drinking Water Regulation (NPDWR) package, typically including: 

  • The proposed MCLG and the enforceable requirement (an MCL or a Treatment Technique, depending on the contaminant and feasibility) 
  • Identification of the Best Available Technology (BAT) for treatment 
  • Approved analytical methods for monitoring 
  • Health Risk Reduction and Cost Analysis (HRRCA) 
  • Regulatory flexibility for small systems 
  • Environmental justice analysis 

OMB/OIRA Review 

Before the EPA can publish the proposed rule, it goes to the Office of Information and Regulatory Affairs (OIRA) within the Office of Management and Budget (OMB) for review. The OIRA circulates the rule to other federal agencies and generally has 90 days to complete review, though extensions are common. Drinking water standards typically qualify as "economically significant" rules (with annual impacts exceeding $100 million), which triggers more intensive review. 

Notice of Proposed Rulemaking 

At this stage, the EPA publishes the proposed rule in the Federal Register, along with the scientific and economic basis for the standard. This triggers a public comment period, typically 60 to 90 days for drinking water rules.  

Public Comment and Revision 

During the public comment period, any member of the public may submit a comment, and the EPA must review and respond to significant comments. The rule may be revised based on public input and additional data. 

Second OIRA Review 

The final rule goes through another round of OIRA review before publication. 

Final Rule Publication 

The final rule is published in the Federal Register. Under the APA, it cannot take effect for at least 30 days. Drinking water rules typically include much longer implementation timelines, commonly three to five years for full compliance. 

Congressional Review 

Under the Congressional Review Act, major rules are submitted to Congress, which has a 60-legislative-day window to pass a resolution of disapproval. 

Judicial Review 

Under the SDWA, any party may challenge a final NPDWR in the US Court of Appeals for the D.C. Circuit. The court evaluates whether EPA's decision was supported by the administrative record and consistent with the statute, applying the "arbitrary and capricious" standard, which means that the court must find that the rule doesn’t lack a rational basis, ignore facts, or disregard legal procedures. 

State Implementation 

The federal standard is the floor, not the ceiling. Under the SDWA, states can apply for “primacy” (i.e., primary enforcement responsibility for their public water systems). Currently, 49 states have primacy (the EPA implements directly in Wyoming, the District of Columbia, and in Indian Country except where a Tribe has primacy). 

Primacy states generally have two years to adopt regulations and submit primacy program revisions to EPA, with extensions possible.

Compliance, Monitoring, and Public Notification 

A finalized drinking water standard is not self-executing. The post-rule phase involves its own complex set of requirements. 

Compliance Monitoring 

Water systems must test for the regulated contaminant at frequencies specified in the rule. Initial monitoring is typically required within three years of the rule's effective date, with ongoing routine monitoring (quarterly, annually, or triennially) thereafter. All samples must be analyzed by certified laboratories using EPA-approved methods. 

Public Notification of Violations Criteria 

The Public Notification Rule establishes a three-tier system based on the severity of the violation: 

  • Tier 1: Within 24 hours for violations posing immediate health risks (e.g., acute contaminant exceedances). Water systems must use methods reasonably calculated to reach all served persons, such as broadcast media, hand delivery, or posting. 

  • Tier 2: Within 30 days for MCL violations and other situations with serious health implications but not requiring immediate notice. Repeated at least every three months as long as the violation persists unless the primacy agency approves a different schedule (not less frequent than once per year). 

  • Tier 3: Within one year for monitoring and reporting violations. Can be included in the annual CCR. 

Annual Consumer Confidence Reports 

Community water systems serving 10,000 or more people must distribute the annual water quality report (also called CCR) twice per year, according to 2024 revisions.  The first distribution must occur on  July 1 when the report is initially published, and the annual summary must be delivered by December 31.  The CCR must include detected contaminant levels compared to MCLs, compliance status, source water information, and educational content about health effects. 

The EPA finalized major CCR rule revisions in 2024.  The EPA issued these revisions under authorities added after 1996, including amendments that directed EPA to modernize and improve consumer right-to-know reporting.  In addition to increasing the frequency of issuing CCRs, the revisions expanded electronic delivery options and required primacy agencies to report compliance monitoring data to the EPA. 

Enforcement 

For violations, the EPA or the primacy state can take enforcement action, including administrative orders, penalties, civil judicial actions, and criminal penalties for willful violations. 

Why EPA Regulatory Timelines Matter 

The long federal regulatory timeline creates a large lag between the time when the scientific community identifies a potentially important contaminant and when the public sees the impact of that discovery in their drinking water.  In practice, this means the state regulatory bodies often move earlier than the federal government when it comes to regulating new contaminants.  

Published: April 22, 2026
Updated: April 22, 2026