How Do Regulators Decide Which Water Contaminants Actually Matter? Inside the Risk-Assessment Process

In short: No single agency wakes up one day and declares a chemical dangerous. A new drinking water contaminant moves through a slow, layered screening process, EPA’s Contaminant Candidate List, its IRIS toxicology reviews, ATSDR’s exposure profiles, and years of nationwide monitoring, before it ever gets an enforceable limit. That process can take decades. PFAS is the clearest example: the chemistry was patented in 1938, DuPont’s own scientists flagged liver effects in animal studies by 1961, and the first federal drinking water limit didn’t arrive until April 2024. If you’re choosing treatment equipment for a home or facility, understanding this lag matters more than memorizing whatever chemical is trending in the news this month, because the gap between “we found something concerning” and “it’s regulated” is where most of the actual health exposure happens.

Most homeowners and facility managers assume the EPA is watching every chemical in the water supply and will tell them when something’s wrong. That’s not really how it works. Regulation follows evidence, and evidence takes time to build. Here’s what actually happens between the moment a chemical shows up in someone’s tap water and the moment it gets a legal limit.

What Triggers a Contaminant Review in the First Place?

A contaminant usually enters the regulatory pipeline through one of three doors: it turns up in nationwide monitoring data, it’s flagged by academic or industry research, or it’s nominated by the public during EPA’s open comment windows. EPA compiles these leads into what it calls the Contaminant Candidate List, or CCL. The most recent version, CCL 5, finalized in November 2022, includes 66 individually listed chemicals, three chemical groups (cyanotoxins, disinfection byproducts, and PFAS as a class), and 12 microbial contaminants, built from a three-step process of assembling a broad universe of candidates, screening them, and classifying what’s left.

Landing on the CCL doesn’t mean a chemical will ever be regulated. It means EPA has decided the substance is worth a closer look. Most contaminants that make the list sit there for years while agencies gather occurrence data and toxicology evidence, and plenty never advance past this stage at all.

How Do Toxicologists Decide a Chemical Is Actually Dangerous?

They build a dose-response relationship, essentially a curve showing how health effects change as exposure increases, using EPA’s Integrated Risk Information System, or IRIS. Analysts pull together human epidemiology, animal studies, and mechanistic data, then use that evidence to calculate a Reference Dose, the highest daily oral exposure over a lifetime that’s expected to carry no appreciable risk of non-cancer harm. That single number becomes the scientific backbone for whatever regulatory limit follows, so getting it wrong in either direction, too lax or too conservative, has real consequences downstream.

This is where the timeline stretches. A full IRIS assessment for a single chemical routinely takes years of internal and external peer review before it’s finalized. Inorganic arsenic is a useful case study here: a draft toxicological review circulated through interagency science discussion in 2024, with the final report not published until 2025, and arsenic has been a known drinking water hazard for decades already. If a well-understood legacy contaminant takes that long to re-review, a genuinely new one starts from further behind.

What Does ATSDR Add That EPA Doesn’t Already Cover?

The Agency for Toxic Substances and Disease Registry runs a parallel track focused specifically on exposure at contaminated sites, and it often ends up more conservative than EPA. ATSDR develops toxicological profiles that produce Minimal Risk Levels, its version of a safety threshold for a given route and duration of exposure. When ATSDR finalized its PFAS toxicological profile in 2021 after reviewing twelve individual compounds, the resulting Minimal Risk Level for PFOS came out ten times stricter than EPA’s own reference dose at the time, and the PFOA level landed seven times stricter than EPA’s 2016 health advisory. Two federal science bodies, looking at the same chemical family, reached meaningfully different numbers. That’s not a sign the system is broken. It’s a sign the underlying science is genuinely uncertain, and regulators tend to lean cautious when it is.

How Does a Chemical Go From “Candidate” to an Actual Legal Limit?

After toxicology work establishes a health basis, EPA still needs real-world occurrence data before it can regulate anything, which is where the Unregulated Contaminant Monitoring Rule comes in. UCMR 5, the current cycle, requires water systems nationwide to test for 29 PFAS compounds plus lithium between 2023 and 2025, with EPA still compiling and cross-checking the results through 2026. Only once EPA can show a contaminant occurs at meaningful frequency and concentration in actual public water systems, not just in a lab, can it issue a formal regulatory determination and move toward a Maximum Contaminant Level.

For PFAS, that whole arc from formal proposal to final rule took about a year, EPA proposed the National Primary Drinking Water Regulation in March 2023 and finalized it in April 2024, setting individual limits of 4 parts per trillion for PFOA and PFOS and 10 parts per trillion for three related compounds. But utilities aren’t required to fully comply until 2029. Even after a rule is final, there’s a multi-year runway before it’s actually enforced at the tap.

Why Does This Process Take Decades for Some Chemicals?

Because the chemical universe is enormous and the review capacity isn’t. The EPA’s TSCA inventory currently lists more than 86,000 chemical substances manufactured, processed, or imported in the United States, and only a small fraction of those have ever been formally evaluated for drinking water toxicity. Monitoring infrastructure was largely built around a fixed list of legacy contaminants and hasn’t scaled to match how many new compounds enter commerce every year. PFAS is the extreme version of this lag: patented in 1938, flagged internally by DuPont researchers for liver effects by 1961, detected in factory workers’ blood by the 1970s, and still without a federal drinking water limit until 2024. That’s not a hypothetical worst case. It’s the actual timeline for one of the most consequential contaminant classes in modern water treatment.

What Does This Mean If You’re Choosing Water Treatment Today?

It means waiting for a chemical to show up on an enforceable list is a strategy that puts you years, sometimes decades, behind the actual exposure. The contaminants sitting on CCL 5 right now, the disinfection byproducts, the additional PFAS compounds beyond the six already regulated, the emerging cyanotoxins, are following the same slow path PFAS just finished. Some of them will eventually get MCLs. Most homeowners and facility operators won’t want to wait around to find out which ones.

This is the practical argument for treatment technology that doesn’t depend on a specific regulatory trigger. Reverse osmosis removes a broad spectrum of dissolved contaminants by physically forcing water through a semi-permeable membrane, rather than by targeting one named chemical the way a single-purpose filter might. That’s a meaningfully different posture than compliance-driven filtration, because it doesn’t require an agency to finish a decade-long toxicology review before it starts doing its job. AMPAC USA builds residential reverse osmosis systems sized for household use and commercial reverse osmosis systems for facilities that need higher volume and consistent output, both designed around the same principle: reduce the range of what’s getting through, not just the one contaminant that happens to have a number attached to it this year.

Should You Wait for a Contaminant to Be Officially Regulated Before Treating for It?

No, not if the goal is actually reducing exposure rather than just meeting a compliance deadline. Regulation confirms a hazard is real and sets an enforceable floor, but it’s a lagging indicator by design, built to be certain rather than fast. Toxicology review, exposure monitoring, and rulemaking all have to happen in sequence, and each step is intentionally conservative because getting a national drinking water standard wrong in either direction carries real cost. That caution is appropriate for regulators. It’s less useful as a personal or facility-level strategy, since the interval between “credible evidence of harm” and “legally required to fix it” has run anywhere from one year to nearly a century, depending on the chemical.

Frequently Asked Questions

What is the EPA Contaminant Candidate List and how often is it updated?

The Contaminant Candidate List, or CCL, is EPA’s screening list of chemicals and microbes being evaluated for potential future drinking water regulation. It’s updated roughly every five years; CCL 5, the current version, was finalized in November 2022 and includes 66 individual chemicals, three chemical groups, and 12 microbial contaminants.

What’s the difference between an EPA Reference Dose and an ATSDR Minimal Risk Level?

Both are safety thresholds built from toxicology data, but they come from different agencies with different mandates. EPA’s Reference Dose (RfD), developed through its IRIS program, generally informs national drinking water standards. ATSDR’s Minimal Risk Level (MRL) is built specifically around exposure at contaminated sites and has, in cases like PFOS and PFOA, come out significantly more conservative than EPA’s corresponding number.

How long does it typically take for a new contaminant to get a federal drinking water limit?

It varies enormously. Once EPA formally proposes a rule, finalization can happen in about a year, PFAS took roughly thirteen months from proposal to final rule in 2023-2024. But getting to that proposal stage, including toxicology review and nationwide occurrence monitoring, can take a decade or more, and for PFAS specifically the gap between the chemical’s invention and its first federal drinking water limit was closer to 86 years.

Does reverse osmosis remove contaminants that aren’t yet regulated?

Reverse osmosis works by filtering water through a semi-permeable membrane that blocks a broad range of dissolved solids, salts, and organic compounds based on molecular size and charge, not by targeting a specific named chemical. That mechanism means it can reduce many contaminants regardless of their current regulatory status, though performance still varies by contaminant and system design, so it’s worth reviewing a system’s actual test data for the specific substances you’re concerned about.

Is UCMR5 monitoring the same thing as regulation?

No. UCMR5 is data collection, it requires public water systems to test for a defined list of unregulated substances, currently 29 PFAS compounds and lithium, so EPA can see how often and at what concentration they actually occur nationwide. That occurrence data feeds into a future regulatory determination, but monitoring itself creates no enforceable limit.

Sources: U.S. EPA (Contaminant Candidate List 5, IRIS Program, UCMR 5, PFAS National Primary Drinking Water Regulation); Agency for Toxic Substances and Disease Registry (ATSDR Toxicological Profile for PFAS, 2021); Federal Register; Manufacturing Dive.