Safe Drinking Water Act Violations Are Rising – What It Means for Your Tap Water

In short: In a typical recent year, more than 18,000 U.S. community water systems reported at least one Safe Drinking Water Act violation, and close to 3,000 of those were health-based violations affecting an estimated 22 million people. Cybersecurity compliance is the newest failure point, with EPA reporting that more than 70% of inspected systems since late 2023 failed to meet basic risk-assessment requirements. None of this means the water coming out of your tap is automatically unsafe. It means the system meant to catch problems is straining, and knowing how to check your own utility’s record is worth five minutes of your time.

Most people assume drinking water compliance is a solved problem in the United States. It mostly is, most of the time. But “mostly” is doing a lot of work in that sentence, and the gap between mostly and fully is where the actual risk lives.

What Counts as a Safe Drinking Water Act Violation?

A violation happens any time a public water system fails to meet a federal standard set under the Safe Drinking Water Act, and these break into three broad categories that matter differently.

Health-based violations mean a contaminant, arsenic, lead, nitrate, disinfection byproducts, PFAS, whatever it happens to be, exceeded the legal limit in the water actually delivered to customers. These are the ones people should care about most directly.

Monitoring and reporting violations mean a system failed to test for a contaminant on schedule, or tested but didn’t report the results to the state or the public. This sounds like paperwork. It isn’t. If a system isn’t testing, nobody, including the operator, actually knows what’s in the water.

Public notification violations mean a system found a problem and didn’t tell the people drinking the water. NRDC’s “Threats on Tap” analysis found more than 13,000 violations tied to systems failing to deliver required water quality reports to customers, affecting roughly 8.4 million people, with formal enforcement action taken in only about 10% of those cases. That last number is the uncomfortable part. Getting caught not reporting a problem doesn’t reliably lead to consequences.

How Widespread Are Violations, Really?

EPA’s own enforcement data shows that in a recent fiscal year, 43.2% of the nation’s community water systems had at least one drinking water standard violation, and roughly 22 million Americans were served by systems with a health-based violation specifically. Total SDWA violations tracked from 2001 through 2024 add up to more than 10.2 million violations across over 169,000 water systems nationally, a scale that reflects both the size of the regulated universe and the persistence of the problem.

The trend line isn’t a clean upward slope. Reported violations climbed from 2001 through roughly 2005, then generally declined with plenty of ups and downs since, according to compiled EPA enforcement data reviewed by the Environmental Data and Governance Initiative. But “declining overall since 2005” and “solved” are different claims. Two things are climbing right now that weren’t tracked the same way even five years ago: PFAS contamination and cybersecurity compliance, and both deserve their own answer.

Why Is Cybersecurity Suddenly Part of a Drinking Water Story?

Because a compromised water system’s control software is a public health risk, not just an IT problem, and federal inspectors are finding widespread noncompliance with the basic requirements meant to prevent it.

EPA’s enforcement alert on this, most recently updated in mid-2025, reports that more than 70% of water systems inspected since September 2023 violated Safe Drinking Water Act section 1433 requirements, incomplete risk and resilience assessments, missing or outdated emergency response plans, the foundational paperwork a utility is supposed to have in place before an incident, not after one. This is a newer enforcement priority than lead or arsenic, but it’s arguably a leading indicator. A utility that can’t keep its cybersecurity documentation current is often the same utility struggling with staffing and budget everywhere else, including water quality monitoring.

What About PFAS? Isn’t That the Big One Right Now?

PFAS, the “forever chemicals” used in everything from nonstick coatings to firefighting foam, are the fastest-growing category of drinking water concern, and NRDC’s tracking found PFAS above EPA thresholds in tap water in every state except three. Roughly half the U.S. population is estimated to be drinking PFAS-contaminated water at some detectable level, with as many as 105 million people served by systems that violate the newer, stricter federal standards. PFAS don’t break down in the environment or in the body the way most contaminants do, which is exactly why regulators moved to tighten the rules and why compliance is proving so difficult for systems that never had to test for these chemicals before.

This is also where the regulatory picture is genuinely unsettled. Federal PFAS standards have been the subject of ongoing rulemaking and legal challenges, so a system that’s technically in violation today could be operating under a different compliance timeline next year. That uncertainty is part of why checking your own utility’s current record matters more than relying on last year’s headlines.

Are Small and Rural Water Systems Hit Harder Than Big Cities?

Yes, and it’s mostly a capacity problem rather than a water-quality problem specific to rural areas.

Small community water systems often run on a narrow rate base, meaning fewer customers to spread infrastructure costs across, combined with limited technical and managerial staff to keep up with increasingly complex federal rules. The Lead and Copper Rule Improvements finalized in recent years require most systems to replace all lead service lines within a decade and lower the lead action level from 15 to 10 micrograms per liter, a genuinely protective change that’s also, by EPA’s own description, an expensive and technically demanding one for systems that were already stretched thin. In August 2025 alone, EPA issued Notice of Noncompliance letters to 285 systems in Louisiana and New Mexico over Lead and Copper Rule violations, a snapshot of how enforcement is landing hardest in exactly the places with the least capacity to fix it fast.

None of this is an argument that big-city water is automatically safer. It’s an argument that the systems most likely to fall behind on compliance are also the ones with the fewest resources to catch up, which is worth knowing if your household gets water from a smaller municipal or rural system.

How Do I Check My Own Utility’s Compliance Record?

Two free federal tools do this directly, and neither requires technical knowledge to use.

EPA’s ECHO database (echo.epa.gov) lets you search any public water system by name or location and see its actual violation history, health-based and administrative, along with whether enforcement action was taken. This is the closest thing to a public rap sheet for your local utility.

Your Consumer Confidence Report, sometimes called an annual drinking water quality report, is legally required for every community water system and must be delivered to customers by July 1 each year. It lists the contaminants actually detected in your water over the past year, compared against legal limits. If you can’t find yours or it’s been more than a year, EPA’s CCR search tool or a direct call to your local water supplier will get you the current one.

If either shows a health-based violation, the follow-up question isn’t panic, it’s what’s actually in the water and at what level, since many violations are technical or short-term rather than an ongoing exposure risk.

What Can Homeowners Actually Do About This?

For most households, the practical answer sits below the utility level entirely: point-of-use or whole-house treatment that doesn’t depend on waiting for a municipal system to catch up. A residential reverse osmosis system removes a wide range of contaminants at the point of use, including many of the ones showing up in violation reports, lead, nitrates, PFAS compounds, arsenic, regardless of what your utility’s current compliance status happens to be. It’s not a replacement for a functioning public water system, but it is a real, immediate layer of protection that doesn’t require a rate hike or a decade-long infrastructure project to take effect.

For property owners managing multiple units, or for facilities that need documented water quality independent of municipal compliance swings, reverse osmosis systems built for higher-volume, continuous use close that same gap at scale. AMPAC USA designs and manufactures RO systems for exactly this kind of application, engineering built around consistent output and real contaminant removal, not just a filter cartridge and a marketing claim.

The honest takeaway here is that the Safe Drinking Water Act mostly works, most of the time, for most people. But “mostly” still leaves tens of millions of people served by systems with an active violation in any given year, and the newest failure points, cybersecurity gaps and PFAS, are ones most households have never had reason to think about before. Checking your own utility’s record takes less time than reading this article did.

Frequently Asked Questions

How many water systems in the U.S. currently have an active violation?

In a recent fiscal year, EPA data showed over 18,000 community water systems with at least one Safe Drinking Water Act violation, and 43.2% of all community water systems had at least one violation of some kind.

Does a violation mean my tap water is unsafe to drink right now?

Not necessarily. Many violations are monitoring, reporting, or public-notification failures rather than a confirmed contaminant exceeding health limits in the water you’re actually drinking. Checking the specific violation type on EPA’s ECHO database tells you which kind you’re dealing with.

Where can I check my water utility’s actual compliance history?

EPA’s ECHO database at echo.epa.gov lets you search any public water system by name or location and see its full violation and enforcement history. Your annual Consumer Confidence Report, delivered by July 1 each year, lists the specific contaminants detected.

Why are cybersecurity violations part of drinking water compliance now?

Because water system control software is a public health target, not just an IT concern. EPA reports more than 70% of inspected systems since late 2023 failed basic risk-assessment and emergency-planning requirements under Safe Drinking Water Act section 1433.

What can I do if my water utility has a history of violations?

Point-of-use treatment, like a residential reverse osmosis system, removes many of the contaminants tied to common violations regardless of your utility’s current compliance status. It’s a practical layer of protection that doesn’t depend on municipal infrastructure timelines.

Sources: NRDC, “Threats on Tap”; U.S. EPA, National Enforcement and Compliance Initiative: Increasing Compliance with Drinking Water Standards; U.S. EPA ECHO (Enforcement and Compliance History Online); U.S. EPA, Compliance Advisory on Lead and Copper Rule Requirements; Environmental Data and Governance Initiative, “Threats to Drinking Water Call for Stronger Regulation and Enforcement.”