Introduction

Per- and polyfluoroalkyl substances, or PFAS, have moved from a niche environmental issue to a broad regulatory priority across the United States. For EHS and compliance teams, the challenge is no longer just identifying whether PFAS are present but determining where they appear in the supply chain, how they are reported, and what obligations apply at the federal and state levels.

This article is written as a practical, expert-level guide for teams that manage chemical safety, product stewardship, environmental compliance, manufacturing risk, or site remediation. It explains the current U.S. regulatory landscape, the major federal rules, the most common state-level patterns, and the operating steps organizations should take to build a defensible PFAS program.

What PFAS Are

PFAS are a large class of human-made chemicals used in many industrial and consumer applications because they resist heat, oil, water, and staining. The FDA describes PFAS as a diverse group of thousands of chemicals used in hundreds of product types and notes that PFAS can enter food through contaminated environments, processing, and cookware.

From a compliance perspective, the difficulty is that PFAS are not governed as a single substance in every context. Regulators often act on individual compounds, groups of compounds, or mixtures or use categories, which means a company can be affected even if it does not think of itself as a “PFAS manufacturer.”

Why PFAS Matter

PFAS matter because they are persistent, can be difficult to remove once released, and have triggered regulations that affect the entire product and environmental life cycle. EPA’s PFAS drinking water rule is designed to reduce exposure for about 100 million people over time, and the agency has paired that with implementation funding and phased compliance expectations.

For EHS teams, PFAS is not just an environmental issue. They can affect worker exposure assessment, wastewater management, stormwater, hazardous waste handling, reporting, procurement, customer disclosures, contract language, and end-of-life liability. That wide footprint is why a mature PFAS program must involve legal, operations, procurement, product stewardship, and environmental engineering together.

Federal Drinking Water Rule

The EPA finalized a National Primary Drinking Water Regulation for six PFAS in April 2024. The rule establishes enforceable Maximum Contaminant Levels, or MCLs, for PFOA and PFOS at 4.0 ppt each and for PFHxS, PFNA, and HFPO-DA at 10 ppt each, while also using a hazard index for mixtures containing two or more of PFHxS, PFNA, HFPO-DA, and PFBS.

EPA’s current PFAS page states that public water systems must complete initial monitoring within three years, by 2027, and then continue compliance monitoring, with public notification beginning in 2027. Systems that exceed the limits have five years, by 2029, to implement solutions to reduce PFAS levels, and systems in violation must take action and notify the public.

For EHS and utility-facing teams, the main operational implication is that PFAS water compliance is measurement-driven. If a company operates its own water system, has onsite treatment, discharges to a public system, or manages private wells for employees or nearby residents, the drinking water rule can become a site-level compliance issue rather than an abstract regulatory development.

Current EPA Direction

EPA announced on May 18, 2026, two proposed drinking-water-related PFAS rules. One proposal would keep the NPDWR for PFOA and PFOS while allowing drinking water systems to request two additional years, until 2031, to comply; the other would rescind drinking water regulations for PFHxS, PFNA, HFPO-DA, and the Hazard Index mixture of those three PFAS plus PFBS.

That matters because PFAS regulation is still changing, even after the 2024 final rule. Compliance teams should therefore track not only final requirements but also proposed changes, litigation risk, and state-level responses that can keep moving even when federal requirements are under review.

TSCA Reporting Duties

EPA finalized PFAS reporting and recordkeeping requirements under TSCA section 8(a)(7), requiring companies that manufactured or imported PFAS for commercial purposes in 2011 or later to report PFAS data to EPA. The rule is important because it reaches historical activity and not just current production, which is unusual for many chemical reporting programs.

In practical terms, TSCA reporting can require companies to identify PFAS uses, production volumes, byproducts, disposal pathways, environmental releases, exposure information, and available health and environmental effect data. This means a company may need to survey business units and suppliers and archive product records even if PFAS are no longer used in current operations.

For EHS teams, TSCA compliance is often the first major PFAS data-inventory exercise. If the company cannot quickly determine what PFAS it has handled since 2011, that is usually a sign that the chemical inventory, product stewardship system, and supplier declarations need serious improvement.

CERCLA Liability

EPA finalized a rule in April 2024 designating PFOA and PFOS as hazardous substances under CERCLA, commonly called Superfund. That designation increases the risk of release reporting, investigation, cleanup obligations, and cost recovery exposure for sites where these PFAS are present.

For compliance teams, the key issue is not just whether PFOA or PFOS was intentionally used but whether they may be present as manufacturing byproducts, in firefighting foam legacy use, in contaminated media, or in disposal streams. Once CERCLA enters the picture, a PFAS issue can quickly become a transaction, remediation, or insurance problem as well as an environmental one.

Organizations with brownfield sites, historical manufacturing footprints, wastewater residuals, or AFFF legacy use should assume that CERCLA review will be part of due diligence. That means sampling strategy, chain of custody, data quality objectives, and legal privilege management become especially important.

Food and FDA Oversight 

The FDA regulates PFAS in the food context through contamination monitoring, market actions, and food-contact material oversight. The FDA says it has tested more than 1,900 food samples and has conducted health assessments for PFAS detected in foods and, in 2025, determined that 35 PFAS-related food-contact notifications for grease-proofing uses in paper and paperboard packaging were no longer effective because those uses were abandoned. 

The FDA also notes that PFAS have been found in some foods, especially seafood, and that it is working on future risk management actions, including possible bottled-water regulation aligned with the EPA's drinking water actions. For companies with food packaging, food processing, or consumer product applications, PFAS compliance can therefore involve both EPA and FDA expectations. 

EHS teams supporting consumer product or packaged food operations should pay close attention to food-contact materials, coatings, fluorinated processing aids, and supplier declarations. If the company sells into food-adjacent markets, "PFAS-free" claims also create substantiation and marketing review obligations. 

State-Level Action 

State PFAS laws are often broader and faster than federal rules. As of 2026, examples include broad bans or restrictions in Maine, Minnesota, Vermont, Colorado, California, and others, covering categories such as textiles, cookware, cosmetics, cleaning products, food packaging, children's products, and personal care products. 

Many state laws focus on "intentionally added" PFAS, while others use thresholds such as total organic fluorine or ppm cutoffs. That means a supplier can be acceptable under one law and noncompliant under another, so national companies need a state-by-state product map rather than a single yes/no PFAS statement. 

Minnesota is a good example of how reporting and phase-out can evolve together. According to 2026 reporting, the state requires manufacturers of products containing intentionally added PFAS to submit an initial report by July 1, 2026, with annual reports following thereafter.

Product Categories at Risk 

The categories most affected by laws include textiles, apparel, carpet, upholstered furniture, cosmetics, cookware, cleaning products, ski wax, food packaging, and juvenile products. Several 2026 state updates also show increasing focus on indoor furnishings, personal care, and "all unnecessary uses" approaches. 

This matters because many companies do not think of themselves as PFAS companies. A textile importer, a contract manufacturer, a packaging converter, a cosmetics brand owner, or a cleaning product formulator may still have compliance obligations if intentionally added PFAS are present in ingredients, coatings, or treatment processes. 

For EHS and product stewardship teams, the lesson is to classify PFAS exposure by end use, not just by company industry. The same corporate group may face drinking water obligations at one site, TSCA reporting legacy imports, and state product restrictions for an entirely different product line. 

Building A PFAS Program 

A strong PFAS program starts with a centralized inventory of materials, products, formulations, and sites. Teams should identify where PFAS may be intentionally added, where they may exist as impurities or byproducts, and where they may enter wastewater, air, sludge, waste, or finished goods. 

Next, cross-functional governance is essential. Procurement, R&D, engineering, EHS, legal, quality, manufacturing, and supply chain teams should share a common PFAS questionnaire, reporting workflow, and document retention structure so the company does not rely on fragmented answers from individual plants or suppliers. 

A useful operating model is to treat PFAS as a lifecycle issue: source, use, release, treat, report, and retire. That approach forces teams to consider not only current formulations but also maintenance of products, legacy equipment, wastewater residuals, legacy firefighting foam, and disposal channels. 

Supplier Management 

Supplier management is one of the most important PFAS controls because many organizations do not manufacture PFAS directly but still use PFAS-containing inputs. Companies should require supplier declarations that address intentionally added PFAS, known impurities, concentration ranges, CAS or functional identifiers where available, and jurisdiction-specific declarations for products sold in regulated states. 

A robust supplier process should also include contractual obligations to notify the company when formulations change. Without change notification, a compliant product can quietly become noncompliant after a raw material substitution, sub-tier reformulation, or geographic sourcing change. 

For high-risk categories, declarations alone are often not enough. Testing, audit rights, product specification controls, and certification language are often needed to support defensible compliance, especially where state thresholds are low or where "PFAS-free" marketing claims are being made. 

Sampling And Testing 

Testing strategies should be built around the regulatory question being answered. Drinking water compliance is not the same as product compliance, waste characterization, or environmental site assessment, so teams need the right analytes, matrices, limits of detection, and chain-of-custody controls for each use case. 

For product stewardship, total organic fluorine screening may be useful as a first-pass tool, but it does not identify specific PFAS compounds. If the question is whether a product contains a regulated PFAS, targeted analytical methods may be necessary, and interpretation should be tied to the exact law or customer specification at issue. 

For water and environmental media, the analytical challenge is especially important because many legal thresholds are in the low parts-per-trillion range. That makes laboratory capability, detection limits, blanks, and field contamination control central to defensible compliance. 

Waste And Wastewater 

PFAS in wastewater and waste streams can create significant downstream liability, especially when treatment does not destroy the compounds but instead transfers them into sludge, residuals, or concentrate. Even when a facility is not directly regulated for PFAS in its discharge permit, PFAS may still be relevant to pretreatment, industrial wastewater management, landfill acceptance, or offsite disposal. 

EHS teams should evaluate all pathways where PFAS-containing waste can move offsite, including spent filters, foam concentrates, treatment residuals, wipes, personal protective equipment, and contaminated soil. The key compliance question is whether disposal is creating a release, a reporting obligation, or future CERCLA for cost exposure. 

A strong waste program should include treatment vendor due diligence, manifest review, and language addressing downstream handling of PFAS-bearing materials. Where residuals are concentrated rather than destroyed, the company should treat them as part of the PFAS footprint rather than as ordinary waste. 

Remediation And Sites

Site remediation is one of the most complex PFAS challenges because the compounds can move through soil, groundwater, and surface water and can affect multiple receptors over time. Once PFOA or PFOS are present, CERCLA considerations can influence site investigation, cleanup planning, and allocation of costs among responsible parties.

A good site strategy begins with historical use of reviews. Teams should map former AFFF storage and use, coating operations, plating, textile treatment, landfill adjacency, wastewater discharge, and any former supplier activities that could have introduced PFAS to the site.

Remediation decisions should also account for offsite migration and drinking water impacts. Because EPA’s drinking water rule is already in place and state standards can be stricter, an environmental site that previously seemed low risk can become a priority if nearby wells, public supply systems, or stormwater pathways are affected.

Document Control

Document control is a hidden but critical part of PFAS compliance. Teams should retain supplier declarations, lab reports, internal assessments, reporting submissions, legal interpretations, historical SDSs, product specifications, and correspondence supporting any “PFAS-free” or compliant claims.

Because TSCA reporting reaches back to 2011 and state laws may require reporting on current and past products, record retention should be long enough to reconstruct historical use. If a company cannot trace where PFAS came from or whether a product contained PFAS at a given time, its legal and audit position becomes much weaker.

A practical rule is to maintain a controlled PFAS evidence file for every product family and site. That file should show what was known, how the decision was made, and what action was taken.

Risk Assessment

PFAS risk assessment should combine regulatory, operational, and reputational factors. A site with low direct exposure may still be high risk if it sells into regulated states, has legacy wastewater concerns, or supports customer claims that require proof of PFAS absence.

One useful framework is to score each material, site, and product line against four questions: does it contain PFAS, can it release PFAS, is it sold into a regulated market, and can the company prove its claims? That framework helps prioritize scarce resources toward the highest risk uses first.

Another practical step is to distinguish between compliance risk and transition risk. Compliance risk concerns legal violations; transition risk concerns future reformulation, customer loss, product redesign, and capital spending forced by upcoming restrictions.

Common Gaps

The most common PFAS gap is incomplete material visibility. Many companies can identify primary raw materials but not sub-tier ingredients, processing aids, or legacy products, which leaves blind spots in both reporting and product stewardship.

A second common gap is assuming that one federal rule solves the issue. In reality, federal drinking water, TSCA, and CERCLA rules are only part of the picture, and state product bans often create immediate operational consequences that differ by market.

A third gap is weak claim substantiation. Marketing language such as “PFAS-free” can trigger consumer protection scrutiny if the company cannot show how it defined PFAS, which analytes it tested, what detection limits were used, and whether the claim remains true across the whole supply chain.

Implementation Roadmap

A practical implementation of a roadmap starts with inventory, then validation, then control. First, identify all likely PFAS-containing materials, products, sites, and waste streams; second, verify the highest-risk items with suppliers and testing; third, document decisions and assign owners for remediation, substitution, reporting, or phase-out.

The next step is to build a calendar of obligations. That should include federal reporting dates, state reporting deadlines, product effective dates, water-system compliance milestones, and internal approval gates for reformulation or site remediation.

Finally, align PFAS work with broader EHS management systems. If PFAS controls are embedded in change management, procurement review, audit schedules, management review, and training, the organization is much less likely to miss a regulatory shift or supplier change.

Practical EHS Checklist

Here is a concise checklist EHS and compliance teams can use to start or refresh a PFAS program:

Build a PFAS inventory for products, raw materials, sites, and waste streams.

Determine whether the company has a TSCA reporting history back to 2011.

Identify whether any sites operate public water systems, private wells, or onsite treatment that could be affected by EPA drinking water requirements.

Screen products against state laws where they are sold, especially textiles, cosmetics, cookware, cleaning products, and packaging.

Require supplier declarations and change-notification obligations for PFAS-containing or PFAS-impacted materials.

Validate high-risk items with testing, not declarations alone.

Review historical AFFF use, wastewater residuals, and site contamination issues for CERCLA exposure.

Retain documentation supporting all compliance decisions and claims.

Here's a brief overview. 

References

1. U.S. Environmental Protection Agency (EPA). PFAS Explained. https://www.epa.gov/pfas
2. U.S. Environmental Protection Agency (EPA). National Primary Drinking Water Regulation for PFAS. https://www.epa.gov/sdwa/and-polyfluoroalkyl-substances-pfas
3. U.S. Environmental Protection Agency (EPA). TSCA Section 8(a)(7): PFAS Reporting and Recordkeeping Requirements. https://www.epa.gov/assessing-and-managing-chemicals-under-tsca
4. U.S. Environmental Protection Agency (EPA). CERCLA Designation of PFOA and PFOS as Hazardous Substances. https://www.epa.gov/pfas
5. U.S. Food and Drug Administration (FDA). PFAS in Food. https://www.fda.gov/food/chemical-contaminants-food/pfas-food
6. Occupational Safety and Health Administration (OSHA). Hazard Communication Standard (29 CFR 1910.1200). https://www.osha.gov/hazcom
7. Occupational Safety and Health Administration (OSHA). Safety Data Sheets. https://www.osha.gov/safety-data-sheets
8. United Nations Economic Commission for Europe (UNECE). Globally Harmonized System of Classification and Labelling of Chemicals (GHS). https://unece.org/about-ghs

FAQ 

What are PFAS regulations in the U.S.? 

They are a set of federal and state rules that govern PFAS in drinking water, products, manufacturing reporting, waste, and cleanup liability. At the federal level, major examples include EPA's drinking water MCLs, TSCA reporting, and CERCLA designation for PFOA and PFOS. 

Which PFAS are regulated federally? 

EPA's drinking water rule sets enforceable limits for PFOA, PFOS, PFHxS, PFNA, and HFPO-DA, plus a hazard index for mixtures containing at least two of PFHxS, PFNA, HFPO-DA, and PFBS. EPA has also designated PFOA and PFOS as hazardous substances under CERCLA. 

Does TSCA require PFAS reporting even for old activity? 

Yes. EPA's TSCA PFAS rule reaches manufacturers and importers that handled PFAS for commercial purposes in 2011 or later, so companies may need historical records to complete reporting accurately. 

Are state PFAS laws more restrictive than federal law? 

Often, yes. Many states restrict PFAS in products such as textiles, cosmetics, cookware, cleaning products, and food packaging, and some use broader "intentionally added" or total fluorine-based approaches. 

What is the biggest EHS mistake with PFAS? 

The biggest mistake is treating PFAS as one issue owned only by environmental staff. Effective compliance requires procurement, legal, product stewardship, operations, engineering, and quality to work from the same inventory and evidence base. 

Why is CERCLA important for PFAS? 

CERCLA matters because PFOA and PFOS are hazardous substances, which can bring release reporting, site investigation, cleanup, and cost allocation consequences. That can affect active facilities, divested sites, and brownfield transactions. 

How should companies start a PFAS program? 

Start with a complete inventory, then verify high-risk materials with suppliers and testing, then build a compliance calendar and document control system. The best programs treat PFAS as a lifecycle risk across sourcing, manufacturing, waste, and claims. 

Conclusion 

PFAS regulation in the United States is now a multi-agency, multi-state compliance challenge that touches water systems, product design, manufacturing records, waste management, and environmental liability. EHS and compliance teams that rely on isolated actions will likely miss obligations, while teams that build a centralized inventory, strong supplier controls, and documented decision-making can respond more effectively as the rules continue to evolve. 

For most organizations, the right strategy is not to wait for a single final rule but to operationalize PFAS management now. That means knowing where PFAS are used, where they may be released, where products are sold, and which federal or state obligations apply, then updating that picture continuously as EPA, FDA, and state agencies move forward.