PFAS Compliance Orchestration SaaS for Small Community Water Systems
The EPA finalized enforceable limits on six PFAS compounds in drinking water. Every community water system in the country must now test for chemicals that didn't have regulatory limits two years ago, using analytical methods that measure contamination at four parts per trillion — roughly equivalent to detecting four drops of ink in an Olympic swimming pool. Of the 66,000 systems subject to the rule, 97% serve fewer than 10,000 people, most employ three or fewer full-time staff, and virtually none have ever managed an LC-MS/MS laboratory relationship. The compliance layer for this entirely new contaminant class is wide open.
The Problem
In April 2024, the EPA signed the first-ever National Primary Drinking Water Regulation for PFAS, setting maximum contaminant levels (MCLs) of 4 parts per trillion (ppt) for PFOA and PFOS, 10 ppt for PFHxS, PFNA, and HFPO-DA, and a hazard index of 1 for mixtures. In May 2026, the EPA finalized six enforceable regulations and allocated $1 billion in funding for testing and treatment. The compliance deadline is 2029 for initial monitoring, with the Trump administration extending the treatment deadline for PFOA and PFOS to 2031.
That sounds like plenty of time. It isn't.
The United States has 152,002 public water systems, and 97% of them are classified as small — serving 10,000 or fewer people. About 66,000 of those are community water systems subject to the new PFAS rule. The EPA estimates that 6-10% of those systems — between 4,100 and 6,700 — will discover PFAS levels exceeding the new MCLs and need to install treatment. But every single one of the 66,000 must test first, document results, report to their state primacy agency, and notify the public through Consumer Confidence Reports. The monitoring mandate applies regardless of whether the water turns out to be clean.
Here's what that looks like for a small system operator — the kind who runs a water utility for a town of 2,000 in rural Missouri. She manages three wells, two storage tanks, and a chlorination system. Her annual operating budget is $180,000. Her "compliance software" is a filing cabinet and a spreadsheet she inherited from her predecessor. She's never heard of LC-MS/MS. She doesn't know which labs in her state are certified for EPA Method 537.1. She doesn't know what a proper chain-of-custody protocol looks like for analytes measured in parts per trillion, where a contaminated sample bottle or a fingerprint on a cap can produce a false positive. She doesn't know how to interpret a hazard index calculation that combines four PFAS concentrations with different denominators.
She is not unusual. She is the median.
The U.S. Government Accountability Office found that 26% of health-based violations and 84% of monitoring and reporting violations in drinking water systems are inaccurately reported to the EPA. Not because operators are dishonest — because the reporting infrastructure is manual, fragmented, and error-prone. Adding an entirely new class of contaminants measured at detection limits a thousand times lower than coliform bacteria will amplify every existing failure mode in that pipeline.
The Gap in the Market
Water utility compliance software exists. PFAS treatment technology exists. What doesn't exist is a platform purpose-built to orchestrate the end-to-end PFAS compliance workflow for the 60,000+ small systems that constitute the vast majority of the regulated population.
| Company | What They Do | What's Missing |
|---|---|---|
| 120Water | Data management platform for water quality compliance used by 7,000+ utilities across 48 states. Recently launched PFAS sampling and CCR solutions. Backed by Edison Partners. | Built around lead and copper compliance (LCRR/LCRI), with PFAS bolted on. No lab marketplace, no treatment decision support, no PFAS-specific chain-of-custody workflows for ppt-level sampling. Enterprise pricing makes it impractical for a system with a $180K annual budget. |
| Locus Technologies | Cloud-based environmental data management platform. EIM integration, analytics, regulatory reporting. Serves corporations and large utilities. | Enterprise-grade, enterprise-priced. No self-serve onboarding for small systems. No PFAS-specific workflow automation. Requires implementation services that can cost more than a small system's entire annual budget. |
| Xylem (MitiGATOR) | Mobile PFAS treatment systems — containerized GAC and ion exchange units that can be deployed quickly to meet compliance while permanent infrastructure is built. | Hardware, not software. No compliance tracking, no reporting automation, no lab coordination. They sell treatment technology, not the data layer that determines whether treatment is needed. |
| State primacy agencies | Each state's drinking water program is the regulatory authority. Some have electronic reporting portals, many still accept paper forms or fillable PDFs. | Fragmented across 50 states with different reporting formats, submission schedules, and data standards. No cross-state interoperability. No decision support. Primacy agencies are regulators, not service providers — they tell you what to do, not how to do it. |
The pattern is familiar: enterprise vendors serve large utilities, treatment companies sell hardware, regulators set requirements, and the actual operator in a small town is left to figure out the connective tissue herself. Nobody owns the compliance orchestration layer between "we have a new PFAS rule" and "we've submitted our monitoring data and notified the public."
The Solution
A vertical SaaS platform that automates the full PFAS compliance lifecycle for small and mid-size community water systems, from sampling through reporting.
1. Sampling schedule engine: Operators enter their system profile — population served, source type (surface water vs. groundwater), number of entry points, state. The platform generates the required monitoring schedule based on federal and state-specific rules, with calendar reminders for sample collection windows. Initial monitoring requires quarterly samples at each entry point for four consecutive quarters; reduced monitoring is available after demonstrating compliance. A system with three groundwater wells needs 12 samples in year one. The platform tracks every deadline.
2. Certified lab marketplace: This is where the real pain is. PFAS analysis requires LC-MS/MS instrumentation, and labs must be state-certified for EPA Method 533 or 537.1. Testing costs $250-500 per sample, and turnaround times vary from 5 to 21 business days depending on the lab's backlog. The platform aggregates certified labs by state, displays real-time pricing and turnaround estimates, and handles chain-of-custody documentation digitally. Operators select a lab, the platform generates prepaid shipping labels with proper sample preservation instructions (polyethylene bottles, no glass, temperature-controlled shipping), and tracks samples from collection to results.
3. Results interpretation dashboard: Raw lab data arrives as a spreadsheet of analyte concentrations in ng/L. Most operators can compare a number to a threshold. What they can't do is calculate a hazard index — a formula that divides each of four PFAS concentrations by their respective health reference levels and sums the quotients, where the total must not exceed 1.0. The platform ingests lab results electronically (many labs support Electronic Data Deliverables in CSV or XML), performs the hazard index calculation automatically, flags MCL exceedances, and displays results in plain language: "Well #2 PFOA at 2.1 ppt — below 4.0 ppt limit ✓" or "Entry Point 3 hazard index at 1.4 — exceeds 1.0 limit ✗, treatment evaluation required."
4. State regulatory reporting automation: Each state primacy agency has its own reporting format. Some accept data through the EPA's Safe Drinking Water Information System (SDWIS). Others use custom portals. Others still use paper. The platform maps lab results to the appropriate state submission format, pre-fills required fields using stored system profile data, and generates submission-ready documents or files. For states with electronic portals, the platform can submit directly via API integration. For states still using paper, it generates filled PDFs ready for signature and mailing.
5. Consumer Confidence Report (CCR) generator: All community water systems must publish annual CCRs disclosing detected contaminants. The 2027 public notification deadline for PFAS data means most systems will include PFAS results for the first time in their 2027 or 2028 CCR. The platform generates CCR-compliant PFAS disclosure language, including the required health effects descriptions, detection levels, MCL comparisons, and the EPA's standard PFAS informational statements. Operators review and approve; the platform exports print-ready and web-ready versions.
6. Treatment decision support (Phase 2): For the 4,100-6,700 systems that exceed MCLs, the platform provides technology evaluation tools. Based on the system's PFAS profile (which specific compounds, at what concentrations), water chemistry (pH, dissolved organics, competing ions), and flow rates, it generates a comparison of treatment technologies: granular activated carbon (GAC), anion exchange (AIX), high-pressure membranes (nanofiltration/reverse osmosis). Each option includes estimated capital costs, operating costs, waste disposal considerations, and vendor contacts. This layer monetizes through referral partnerships with treatment vendors and engineering firms.
The Math: What Compliance Actually Costs a Small System
Take a community water system serving 3,500 people in western North Carolina, operating on a $220,000 annual budget. Two groundwater wells, two entry points to the distribution system.
Without the platform (current approach):
The operator calls the state drinking water program to ask about PFAS monitoring requirements. Hold time: 45 minutes. She learns she needs to sample each entry point quarterly for a year. She asks which labs can run the analysis. The state gives her a list of eight labs and tells her to call them. She spends two afternoons calling labs, requesting quotes, and asking about sample bottle requirements. Four labs respond. Prices range from $275 to $485 per sample. She picks the cheapest one without understanding why prices vary (spoiler: sample preservation and quality assurance protocols differ). She receives sample bottles with a handwritten chain-of-custody form. She collects samples, ships them via FedEx in a Styrofoam cooler she bought from Walmart. Results arrive three weeks later as a PDF attached to an email. She doesn't understand the hazard index table. She calls the state again. Hold time: 55 minutes.
Annual direct costs: 8 samples × $300 average = $2,400 in lab fees. 4 FedEx shipments at $35 = $140. Unknown hours of operator time calling labs, state regulators, and interpreting results — conservatively 40 hours over the year, at a loaded cost of $28/hour = $1,120. State reporting: another 8 hours = $224. CCR update: 6 hours = $168. Total: ~$4,052, plus the unquantifiable cost of errors from a manual process handling analytes at parts-per-trillion detection limits.
With the platform:
The operator creates an account, enters her system ID and state, and the platform auto-populates her system profile from the EPA's Community Water System Service Area dataset. It generates her monitoring schedule, shows three certified labs in her region with transparent pricing, and lets her order sample kits with prepaid shipping in two clicks. Chain-of-custody is digital. Results are ingested automatically. Hazard index is calculated. State report is pre-filled. CCR language is generated.
Annual costs: 8 samples × $275 (marketplace lab, competitive pricing) = $2,200. Shipping included in kit price. Platform subscription: $150/month × 12 = $1,800. Operator time for sample collection, review, and approval: 12 hours = $336. Total: ~$4,336 — comparable to the manual approach in direct costs, but with dramatically reduced error risk, complete documentation, and roughly 42 hours of operator time freed up for actual water system operations.
The real value proposition isn't cost savings on lab fees. The value is compliance certainty. A missed monitoring deadline, a botched chain-of-custody, or an unreported MCL exceedance triggers state enforcement action. Fines under the Safe Drinking Water Act run up to $65,791 per day per violation as of the 2024 inflation adjustment. One penalty event exceeds a decade of platform subscription fees. For a rural system on a $220,000 budget, a single enforcement action can threaten solvency.
Revenue Model
| Revenue Stream | Amount | Notes |
|---|---|---|
| Monthly SaaS subscription (per system) | $100-250/month | Tiered by population served. Under-3,300 systems: $100. 3,301-10,000: $175. 10,001-50,000: $250. Includes scheduling, reporting, CCR, and dashboard. |
| Lab marketplace transaction fee | 8-12% of sample cost | Negotiated volume discount from labs, markup passed through at market rate. Operator pays market price or below; platform captures margin on aggregated volume. On a $300 sample, platform earns $24-36. |
| Sample kit fulfillment | $25-40 per kit | Pre-packaged sample kits with correct bottles, preservation agents, chain-of-custody documents, and prepaid shipping. 50% gross margin on kits. |
| Treatment referral commissions | $2,000-5,000 per project | Phase 2. Engineering firms and treatment vendors pay referral fees for qualified leads. A GAC system installation for a small utility runs $200K-1M+; a 1-2.5% referral fee is standard in the sector. |
| Grant writing assistance | $500-1,500 per application | Phase 2. Templated grant applications for the EPA's $1B Emerging Contaminants grant program and state SRF loans. Small systems struggle with grant applications; pre-filled templates with system data reduce the barrier. |
Unit economics on a small system ($150/month tier): Annual SaaS revenue: $1,800. Lab marketplace revenue (8 samples/year, $28 average fee): $224. Sample kit revenue (4 shipments/year, $30 × 50% margin): $60. Annual revenue per customer: $2,084. Customer acquisition cost via state association partnerships and conference presence: $800. Gross margin on SaaS: 85%. Blended gross margin including lab marketplace and kits: 72%. LTV at 7-year average retention (water systems are sticky — compliance doesn't end): $14,588. LTV:CAC ratio: 18.2x.
Market Size
TAM: 66,000 community water systems subject to the PFAS NPDWR. At a blended average subscription of $150/month ($1,800/year), SaaS TAM alone is $118.8M/year. Adding lab marketplace revenue, sample kits, treatment referrals, and grant assistance: approximately $200M total addressable.
SAM: Small systems serving under 10,000 people account for 97% of the total — roughly 64,000 systems. These are the systems with the greatest need and the fewest resources. However, systems serving fewer than 500 people (approximately 45% of all systems) often lack the budget for any paid software. Realistic SAM focuses on systems serving 500-50,000 people: approximately 40,000 systems. At $1,800/year average subscription: $72M/year in SaaS revenue.
SOM (year 3): 2,000 systems (5% of SAM) at blended $1,800/year SaaS + $400/year ancillary revenue = $4.4M ARR. 5% penetration is achievable through partnerships with state rural water associations, which collectively reach the majority of small systems.
Why Now
The regulatory trigger is live. Before April 2024, PFAS in drinking water were unregulated at the federal level. Now they have enforceable MCLs. Every community water system must begin initial monitoring by 2027. The compliance clock is ticking, and most systems haven't started. A National League of Cities panel in 2026 reported that rural communities are "deadly afraid of PFAS because it really has the potential to bankrupt a community." Fear without a clear action path is the exact condition that creates software demand.
The compliance deadline extension makes things worse, not better. The Trump administration's extension from 2029 to 2031 for PFOA and PFOS sounds like relief. In practice, it introduces ambiguity: which compounds have which deadlines, what's been rescinded versus retained, which state requirements still apply independently of the federal rule. AWWA and AMWA's lawsuit challenging the rule adds another layer of uncertainty. Small system operators need a platform that tracks the regulatory landscape and translates it into specific action items, because they cannot afford outside counsel to parse rulemaking notices.
Federal funding is available but expiring. The Bipartisan Infrastructure Law allocated $1 billion specifically for PFAS testing and treatment, plus $12 billion in general drinking water infrastructure funding. The IIJA's key water infrastructure grant programs expire September 30, 2026. Systems that haven't started testing can't apply for treatment funding because they don't have results demonstrating the need. A platform that accelerates the testing-to-application pipeline captures compliance-motivated customers and grant-motivated customers simultaneously.
Lab capacity is constrained. PFAS analysis requires LC-MS/MS instruments costing $300,000-500,000 each, and labs need state certification for compliance monitoring. As 66,000 systems enter the monitoring queue over the next 18 months, lab backlogs will grow. Systems that organized their sampling early will get results faster. A marketplace that provides real-time visibility into lab capacity and turnaround times has genuine informational value — and a platform aggregating thousands of sample orders has leverage to negotiate priority processing agreements.
State regulatory fragmentation is intensifying. Eleven states — including California, Massachusetts, Michigan, New Jersey, and Vermont — have adopted PFAS drinking water standards stricter than the federal MCLs. New Jersey's MCL for PFOA is 14 ppt (vs. federal 4 ppt), but their PFNA limit of 13 ppt applies to a compound the federal rule regulates at 10 ppt. California requires quarterly monitoring regardless of results. A platform that maintains a current regulatory database across all 50 states and translates it into operator-specific action items eliminates one of the most confusing aspects of PFAS compliance: figuring out which rules apply to you.
Startup Costs
| Category | Cost | Notes |
|---|---|---|
| Software platform (MVP: scheduling, dashboard, lab integration, basic reporting — 6 months) | $220K | 2 backend engineers + 1 frontend engineer. Cloud infrastructure (AWS/GCP). Ingestion pipeline for lab EDDs. State reporting templates for top 10 states by system count. |
| Regulatory database (federal + 50 states) | $60K | 1 regulatory analyst (contract, 4 months) to compile monitoring schedules, reporting requirements, and MCLs by state. Ongoing maintenance: ~$15K/year. |
| Lab partnership development | $30K | Travel to lab conferences (NEMC, AOAC), contract negotiations with 15-20 certified labs across regions. Legal review of marketplace terms. |
| Sample kit supply chain | $25K | Initial inventory of HDPE sample bottles, ice packs, chain-of-custody forms, prepaid shipping supplies. 500-kit initial run. |
| Pilot program (25 systems in 2 states) | $20K | Subsidized subscriptions for first 25 systems in exchange for feedback and case studies. Travel for on-site onboarding visits. |
| State rural water association partnerships | $15K | Conference booth fees (NRWA, state-level conferences), sponsorship of PFAS training workshops. This is the primary distribution channel. |
| Legal and compliance | $20K | Terms of service, data privacy (water system data is sensitive), state-specific data handling requirements. |
| Operating buffer (12 months) | $35K | Cloud hosting, cellular, support, insurance. |
| Total | $425K |
Limitations
The 66,000-system figure represents community water systems subject to the NPDWR. Not all will need paid compliance software. Systems that test clean with no detections on initial monitoring may conclude — reasonably — that a spreadsheet is adequate for tracking a quarterly "not detected" result. The platform's highest value is for the 4,100-6,700 systems that exceed MCLs and must navigate treatment decisions, and for the subset of clean systems in states with ongoing monitoring requirements or complex hazard index calculations. If 70% of tested systems show no detections, the addressable market for ongoing subscriptions shrinks significantly.
The EPA's cost estimate for the PFAS rule was revised from $771.8 million to $1.5 billion annually, but the GAO noted that even the revised estimate may undercount costs because it excludes treatment for some regulated compounds and doesn't account for hazardous waste disposal costs if PFAS-laden filter media are classified as hazardous under RCRA. Actual compliance costs for individual systems will vary enormously based on contamination levels, source water chemistry, and local disposal options. The startup costs and revenue model presented here are based on the compliance workflow layer, not the treatment capital expenditure layer, which is orders of magnitude larger but also orders of magnitude more competitive.
Lab marketplace revenue assumes the platform can negotiate volume discounts from labs while charging operators market rates. In practice, lab pricing is competitive and relatively transparent — the margin available on aggregated volume may be thinner than projected if labs view the marketplace as a commodity channel rather than a premium one. The sample kit fulfillment margin depends on efficient logistics, which are harder to maintain across 50 states than in a single region.
Regulatory database maintenance across 50 states is nontrivial. State drinking water programs update rules on different schedules, sometimes mid-year, and change reporting formats without advance notice. A regulatory database that falls out of date even briefly undermines the platform's core value proposition. This ongoing maintenance cost scales linearly with coverage and can consume a disproportionate share of engineering resources if not automated early.
Strongest Counterargument
120Water already has 7,000 utility customers across 48 states, a relationship with the California Rural Water Association, and the engineering team to build PFAS-specific features on top of their existing lead compliance platform. They've already launched PFAS sampling and CCR solutions. Their distribution advantage through state association partnerships — the exact channel this startup would need to build from scratch — gives them a 3-5 year head start on trust-building with the target customer base. If PFAS compliance becomes a significant revenue driver, 120Water can allocate product resources to close every feature gap described above within 12-18 months, and do it with better brand recognition and lower customer acquisition costs than any new entrant.
The counterpoint: 120Water's architecture is built around lead service line inventory and the Lead and Copper Rule. That's a physical asset management problem — tracking pipes in the ground, managing replacement schedules, coordinating contractors. PFAS compliance is a different animal: it's an analytical chemistry problem involving sample chain-of-custody at parts-per-trillion detection limits, hazard index calculations across multiple compounds, and treatment technology evaluation that depends on specific water chemistry parameters. Bolting PFAS workflows onto a lead compliance platform is like adding tax preparation features to a payroll product because both involve the IRS. The data models, user workflows, and domain expertise are sufficiently different that a purpose-built competitor has room to deliver a meaningfully better product. Additionally, 120Water's pricing structure — designed for mid-size and large utilities — leaves the 50,000+ systems serving under 10,000 people underserved. A competitor that prices for and designs for the smallest systems occupies a segment 120Water has historically ignored. Water utility software markets tend to support multiple vendors because systems distrust single-vendor dependence for regulatory compliance.
What You Can Do
If you operate a small community water system: Don't wait for the monitoring deadline. Start identifying certified labs in your state now — the EPA maintains a list through the PFAS analytical methods page, and your state drinking water program can provide certified lab directories. Collect initial samples at each entry point during different seasons (PFAS concentrations can fluctuate with groundwater levels and surface water conditions). Understanding your baseline before the regulatory clock starts gives you time to plan if levels are elevated. Budget $2,500-5,000 for initial testing, and check whether your state's Drinking Water State Revolving Fund covers PFAS sampling costs — many now do under the IIJA allocation.
If you're an engineer or product builder: The MVP is narrower than it looks. Start with three features: sampling schedule generation from EPA system profile data, digital chain-of-custody management, and results ingestion from lab EDDs with automated MCL comparison. Skip treatment decision support, grant writing, and the lab marketplace for v1. Partner with one certified lab per region and pre-negotiate sample kit logistics. The National Rural Water Association's annual conference (WaterPro, typically held in late September) is your launch venue — 3,000+ small system operators in one building, all facing the same compliance deadline. Pilot with 10 systems in a single state to prove the workflow before expanding regulatory database coverage.
If you're an investor evaluating water compliance: The PFAS compliance software market doesn't exist yet as a category. 120Water is adjacent, but their PFAS offering is a feature within a lead compliance product, not a standalone platform. The regulatory forcing function is real, the deadline is imminent, and the customer base is enormous but individually small. This is a classic bottom-of-market wedge play: win the smallest systems that incumbents ignore, build density in specific states, then expand upmarket as product maturity increases. The exit landscape includes 120Water, Xylem ($28B market cap, already in PFAS treatment), Veolia ($22B, selling PFAS treatment systems), and the infrastructure software acquirers (Trimble, Bentley Systems) building water utility platforms. Water utility compliance companies that achieve >5,000 system customers have historically been acquired at 6-10x revenue multiples.
The Bottom Line
The federal government just created a new compliance obligation for 66,000 water systems, most of which are run by a few people serving a few thousand residents, using a filing cabinet and a prayer. The contaminant class being regulated — PFAS, the "forever chemicals" — requires analytical methods that cost $250-500 per sample, detection limits measured in parts per trillion, and calculations that combine multiple compounds into hazard indices most operators have never encountered. The treatment technologies for systems that exceed limits cost hundreds of thousands of dollars, and the federal funding to pay for them has an expiration date. Every piece of this pipeline is more complex than the lead and copper compliance these operators already struggle with. Somebody needs to build the Turbotax for PFAS compliance: a platform that takes the raw regulatory requirements, translates them into specific actions for a specific water system, coordinates the lab work, interprets the results, generates the reports, and tells the operator whether she needs treatment or just needs to keep monitoring. The regulatory mandate is signed. The $1 billion in funding is allocated. The 66,000 customers exist. The question is who builds the workflow layer between the EPA and the operator's phone.