PFAS Liability Is Arriving Before Companies Detect the Risk

Per- and polyfluoroalkyl substances have been accumulating in soil, groundwater, manufacturing equipment, and consumer products for decades. The regulatory response is finally arriving at scale, and it is doing so faster than most corporate environmental programs anticipated. For EHS and compliance leaders, the question is no longer whether PFAS represents a liability. It is whether the organization knows where its exposure is before regulators, plaintiffs, or counterparties find it first.

The companies that have already been through PFAS litigation know what that sequence looks like. The ones that haven't are running out of time to get ahead of it.

What the EPA PFAS Regulatory Timeline Means for Industrial Facilities

The EPA finalized maximum contaminant levels for six PFAS compounds in drinking water in April 2024, setting enforceable limits at 4 parts per trillion for PFOA and PFOS individually, levels that are orders of magnitude lower than prior guidance. Public water systems have until 2029 to comply, but the practical effect for industrial facilities operating near water sources or with historical use of PFAS-containing materials is immediate: regulators now have a legally defensible standard against which to measure contamination plumes, and litigation timelines are compressing accordingly.

The pace of regulatory expansion is also accelerating beyond federal rulemaking. More than half of U.S. states have either adopted or proposed their own PFAS limits—many stricter than federal thresholds—while the European Chemicals Agency is advancing a broad restriction proposal that could phase out thousands of PFAS compounds across the European Union. For companies operating across jurisdictions, compliance is no longer tied to a single standard but to a moving and increasingly fragmented regulatory baseline.

EPA's Superfund designation of PFOA and PFOS as hazardous substances under CERCLA is the regulatory development with the most direct corporate liability implications. CERCLA designation means that any party that disposed of, arranged for disposal of, or transported PFAS-containing materials to a site where a release has occurred can be held liable for remediation costs. The universe of potentially responsible parties is large, and it includes manufacturers, industrial users, fire suppression equipment operators, and in some cases downstream commercial facilities that used Aqueous Film Forming Foam (AFFF) or received wastewater containing PFAS from upstream sources.

How PFAS Exposure Is Entering Corporate Supply Chains Without Detection

Most corporate EHS programs were built to track direct emissions, permitted discharges, and on-site contamination from known hazardous materials. PFAS exposure frequently enters the corporate risk profile through pathways that don't trigger standard environmental management systems.

Biosolids application is one of the most common. Facilities that discharge to municipal wastewater systems have historically had no direct control over how those biosolids were managed after treatment. Where biosolids were applied to agricultural land, PFAS contamination has migrated into soil and groundwater at distances that extend well beyond the original application area. Industrial users of food packaging, textile treatments, coatings, and cleaning compounds may have contributed PFAS loads to municipal systems for years without any direct regulatory contact. That indirect exposure is not theoretical. PFAS compounds have been identified across a wide range of commercial inputs, including food packaging, textiles, electronics manufacturing, and industrial cleaning agents. In many cases, these materials entered operations through suppliers rather than direct procurement decisions, creating a risk profile that sits outside traditional environmental tracking systems.

As of August 2025, the Environmental Working Group (EWG) mapping database documents 9,552 confirmed PFAS contamination sites across all 50 states and two territories. This includes contamination in public water systems, military bases, airports, and industrial sites. Additionally, over 40,000 industrial or municipal sites are identified as potential PFAS sources. A meaningful portion of those sites involve industrial or commercial operations that did not consider themselves PFAS users in any primary sense.

What CERCLA Designation Means for Corporate Balance Sheets

CERCLA remediation costs are not small. Costs vary significantly based on complexity, with limited containment or plume management requiring millions, while comprehensive aquifer restoration, especially for persistent compounds like PFAS, often exceeds tens of millions of dollars per site, according to EPA Superfund and cleanup enforcement data. For multi-party sites where PFAS contamination involves multiple historical contributors, cost allocation litigation can extend remediation timelines by years and add legal costs that rival the remediation expense itself. Recent multi-defendant settlements tied to PFAS contamination have reached into the billions of dollars, resetting expectations for long-tail environmental liabilities and signaling that historical disposal practices are now being priced at a scale few balance sheets were built to absorb.

At the same time, insurers are beginning to narrow or exclude PFAS-related coverage, and environmental due diligence processes in M&A transactions increasingly treat PFAS exposure assessments as standard. The absence of that assessment is no longer neutral—it is being interpreted as an unquantified liability.

The accounting implications are material. Under both U.S. GAAP and IFRS standards, environmental liabilities must be recognized on the balance sheet when it is probable that a liability has been incurred and the amount can be reasonably estimated. For organizations with unassessed PFAS exposure, that threshold may already be met at sites they haven't evaluated. Early-stage site assessments and sampling programs typically cost in the tens to hundreds of thousands of dollars, compared to remediation costs that can escalate into the millions once contamination is formally established and subject to regulatory oversight or litigation.

Auditors and insurers are increasingly asking about PFAS exposure assessments as a standard part of environmental due diligence, and the absence of documentation is being treated as a risk indicator rather than a neutral data point.

What EHS and Compliance Leaders Need to Prioritize Now

The organizations managing PFAS risk most effectively in 2026 are doing three things that many others haven't started. The timeline for action is also shorter than many organizations assume. While CERCLA remediation processes can extend over a decade, the trigger for liability—regulatory identification or third-party claims—can occur well before internal assessments are complete.

• Conducted a systematic historical use assessment that maps PFAS-containing materials, processes, and disposal pathways going back at least 20 years.
• Commissioned groundwater and soil sampling at facilities with any historical PFAS use, not waiting for regulatory contact to trigger the investigation.
• Disclosed known PFAS exposure in their environmental liability footnotes and risk factor sections with enough specificity to withstand auditor and investor scrutiny.

Organizations that are still in a "we don't think we have a PFAS issue" posture need to understand that posture is not a legal defense. It is a description of an assessment that hasn't been done. The window between proactive investigation and reactive response is narrowing, and the cost differential between the two is substantial.