This isn't a warning about what might happen. It's a description of what is already happening.
The EPA's first maximum contaminant levels (MCLs) for PFAS in drinking water — finalized in April 2024 — triggered a compliance clock that is now ticking loudly. Public water systems have until 2027 to meet the new limits, but industrial facilities that discharge into those systems are already under elevated scrutiny. EPA enforcement actions tied to PFAS-contaminated effluent have been escalating since late 2024, following the finalization of CERCLA hazardous substance designations, with agency initiatives and 2026 reporting requirements making clear that proactive disclosure and monitoring of PFAS in wastewater and products is now essential to compliance.
For many facility managers, the shock isn't the rule itself. It's the upstream liability question. If your facility has historically used aqueous film-forming foam (AFFF), certain industrial lubricants, or textile treatments — even if you stopped years ago — you may still be sitting on a contamination legacy that today's enforcement environment will eventually surface.
Meanwhile, the Clean Water Act is operating in a state of post-Sackett uncertainty. The 2023 Supreme Court ruling significantly narrowed the definition of 'waters of the United States,' removing federal jurisdiction over many wetlands and tributaries. But states are responding unevenly. Some have moved to fill the gap with expanded state-level protections; others have not. The result is a patchwork of jurisdiction that is genuinely difficult to map — and that is creating both compliance gaps and unexpected exposure, depending on where your operations sit.
Western water curtailments have been making headlines for years, but 2026 is the first year we're seeing drought designations systematically trigger permit reviews for industrial users across multiple basins. In California, Colorado, and parts of the Southwest, state water boards are revisiting discharge permits, water rights allocations, and cooling water agreements for facilities that haven't changed their operations at all — but now find themselves operating in a fundamentally different hydrological reality.
What's particularly dangerous for compliance teams is the speed of this process. A drought designation can move from declared to operationally significant in weeks, not quarters. Facilities that have not already inventoried their water-related permits against current drought maps are operating with a lag that could become costly.
The US Drought Monitor reported that by early 2026, approximately 50% of the continental United States remained in at least moderate drought conditions — a figure that covers more industrial water users than most people assume.
First, audit every active water-related permit against current drought status maps and recent state guidance. The US Drought Monitor and your state's environmental agency will have updated data. If your permits have conditions tied to water availability, those conditions may already be technically in play.
Second, run a PFAS exposure inventory. This doesn't require a full site assessment immediately — start with operational history. What chemicals were used, when, and where did they drain? The EPA's 2026 enforcement guidance places significant weight on whether companies can demonstrate good-faith self-assessment. Companies that have done the work will be in a fundamentally different position from those who haven't.
Third, update your risk register. Water risk in 2026 belongs in the same tier as air permitting and hazardous waste management. If it's not in your annual compliance calendar with specific review dates and responsible owners, it's not being managed — it's being hoped for.
The compliance teams that come out ahead this year will be the ones who stopped treating water as a background issue and started treating it as a foreground risk. That reframing isn't pessimistic — it's strategic. The facilities that have already built water risk into their permit review cycles and contamination assessments are discovering something useful: the risk is usually manageable when you find it on your own terms. The ones who wait tend to find it on someone else's terms.
Water risk isn't a wildcard because it's unpredictable. It's a wildcard because too many teams still haven't decided who owns it.
