11,740 Plants, One May 2027 Deadline: RMP Compliance SaaS for the Chemical Accident Prevention Era
In early 2024, EPA finalized the biggest rewrite of chemical accident prevention rules in a generation. About 11,740 facilities that handle dangerous chemicals got three years to analyze safer technologies, submit to third-party audits, and start telling their neighbors what could go wrong. That deadline is May 10, 2027, eight months from now. Then, in 2026, EPA proposed rolling much of the rule back. Facilities must obey the law on the books while planning for a law that might replace it. The software for that job does not exist yet.
The Problem
On February 27, 2024, EPA signed the Safer Communities by Chemical Accident Prevention rule, the most significant revision to the Clean Air Act's Risk Management Program since the program was created in 1996. The final rule, effective May 10, 2024, rewrote 40 CFR part 68 for the roughly 11,740 facilities that have filed risk management plans with the agency: petroleum refineries, chemical manufacturers and distributors, water and wastewater treatment plants, food manufacturers and cold-storage warehouses running ammonia refrigeration, agricultural chemical distributors, and midstream gas plants. EPA puts the regulated universe at about 12,000 facilities.
New obligations, new paperwork, new deadlines: facilities with Program 3 processes in petroleum refining and chemical manufacturing (NAICS codes 324 and 325) must conduct a safer technologies and alternatives analysis (STAA) as part of their process hazard analysis. A high-risk subset must go further: assess the practicability of inherently safer designs and implement at least one passive safeguard measure, or an equivalent combination of active and procedural measures. That subset covers refineries and chemical plants within one mile of another covered refinery or chemical plant, refineries running hydrofluoric acid alkylation units, and any facility with an RMP-reportable accident since its last hazard analysis. Hydrofluoric acid alkylation runs at 27 percent of US refineries, 45 of 163, which is why the STAA practicability analysis lands hardest on the exact units where a release can send a vapor cloud into a neighborhood and the inherently safer alternative has been commercially available for years.
Every facility with a reportable accident faces a third-party compliance audit at its next audit cycle under formal auditor competence and independence criteria, which quietly disqualifies the incumbent consultant who wrote the facility's last hazard analysis and instantly shrinks the available auditor pool in every industrial corridor in the country. Reportable accidents also trigger formal root cause analysis. Non-responding facilities must build procedures for notifying the public about accidental releases, and every facility must make chemical hazard information available on request to anyone living, working, or spending significant time within six miles, in at least the two most common languages of the community. When a hazard review recommends something and the facility declines, the justification now goes into the risk management plan itself, which turns every declined recommendation into a permanent, inspectable record instead of a conversation that used to disappear into a file cabinet. Backup power is required for the monitoring equipment that detects releases, because a gas detector that dies with the grid is decoration, and the rule now treats it as a compliance obligation rather than a best practice. None of it is optional.
EPA's case for all of this is arithmetic. The agency estimates accidental releases from RMP facilities cost society more than $540 million every year. About 131 million Americans live within three miles of an RMP facility, which is the political arithmetic that keeps this rule alive across administrations: the constituency for chemical accident prevention is everyone downwind. The rule's animating example is the 2019 explosion and fire at TPC Group in Port Neches, Texas, which evacuated 50,000 people and caused $153 million in offsite property damage. An advocacy group, the Coalition to Prevent Chemical Disasters, estimates a chemical incident occurs roughly every other day in the United States, with Texas alone logging 49 in 2023. Treat that last figure as an advocacy estimate, not an EPA statistic. Roughly every other day, something leaks.
Here is the part that makes this a software problem instead of a consulting problem: the obligations are enumerable, the deadlines are fixed, and the deliverables are documents, which is a specification a product team can build against rather than a judgment call that requires a consultant's signature. In 2026, EPA proposed to roll much of SCCAP back, and the proposal's own framing, $234.7 to $240.3 million a year in savings, tells you exactly how much compliance cost the 2024 rule created and how seriously industry is lobbying to unwind it. The "Common Sense Approach to Chemical Accident Prevention" proposal would limit STAA to newly built processes, rescind or sharply narrow the third-party audit provisions, eliminate the multilingual facility disclosure obligations in favor of centralized EPA-published data, and drop the declined-recommendation documentation. EPA estimates the revisions would save regulated facilities $234.7 to $240.3 million a year. The industry noticed. The comment period closed May 11, 2026, a final rule is expected in late 2026, and the surviving May 2027 deadlines mean facilities must keep spending on compliance with a rule that might be rewritten before the money is even invoiced. As Holland & Hart's analysis notes, the May 10, 2027 deadline for incident investigation, employee participation, and emergency response provisions would survive even under the proposal.
So every EHS manager at an RMP facility now lives in a superposition. The 2024 rule is the law and its deadlines are ticking, while the 2026 proposal might delete half the obligations before the deadline arrives, or might stall in interagency review, or might be litigated for years, which is why every compliance decision right now is a bet placed under uncertainty. Bet on the rollback and stop your STAA work, and you face enforcement under the current rule. Ignore the rollback and spend seven figures on practicability studies, and you may have bought compliance with a repealed regulation. Compliance officers are doing this math on spreadsheets today, which is both the proof that the pain is real and the reason spreadsheets will lose: no static workbook can track obligations that change with the rulemaking cycle. That is the opening.
The May 2027 Compliance Cliff: An Original Calculation
EPA priced the 2024 rule at $256.9 million a year in compliance costs at a 3 percent discount rate, annualized over ten years. The line items tell you where the work concentrates: STAA implementation alone is $168.7 million a year, the practicability study is $27.0 million, the initial STAA evaluation is $18.5 million, information availability is $12.8 million, and employee participation plans are $11.5 million. These are EPA's Regulatory Impact Analysis estimates, not observed spending, and annualized figures smooth out a cost curve that is heavily front-loaded toward the deadline.
Un-smooth it. The practicability assessments, the declined-recommendation justifications, the third-party audits, and the community notification procedures all come due May 10, 2027, with field exercise requirements landing even earlier on March 15, 2027, and full RMP resubmissions with new data elements due May 10, 2028. Suppose the practicability-study spend, which EPA annualizes at $27 million over a decade, actually concentrates into the roughly 30 months between the rule's effective date and the deadline. That implies on the order of $100 million in specialist consulting demand landing before May 2027, all of it chasing practitioners who bill by the day and choose their clients. At a $60,000 median engagement for a practicability assessment, a defensible midpoint for boutique process-safety rates, that is roughly 1,700 deep-dive engagements. Demand is lumpy. Supply is fixed.
Now count the people who can do them. Credible STAA and practicability work requires senior process-safety engineers with refinery or chemical plant experience, the kind of people who have stood in front of an alkylation unit and argued about inherently safer design with the operations manager. The US bench is a few hundred practitioners spread across ioMosaic, Trinity Consultants, ABS Group, AECOM, and a scattering of boutiques, and every one of them already has a calendar full of PHA revalidations and OSHA PSM work that was booked before SCCAP existed. Assign 250 senior assessors to 1,700 engagements over 30 months: each assessor carries seven engagements, and each engagement consumes three to six weeks of calendar time with facility visits, document review, and report writing. The math does not close. It does not close even before you add the third-party audits, which must be completed within 12 months of a triggering accident and which require auditors meeting new independence criteria, or the root cause analyses, which must be finished within 12 months of a reportable release.
What happens when mandated demand exceeds specialist supply is well understood: prices spike, the boutiques triage toward their largest clients, and the long tail gets nothing. The long tail here is enormous and underserved: thousands of facilities whose processes are covered by the rule but whose names never appear in an EPA press release, each one facing the same May 2027 calendar as the refineries with a fraction of the staff. Most of the 11,740 RMP facilities are not refineries; they are municipal water treatment plants storing chlorine, food distribution warehouses with ammonia refrigeration, farm-supply distributors, and midstream gas plants, none of which employ a process-safety engineer. Their EHS staff is often one person who also handles OSHA logs and stormwater permits, which means the STAA practicability analysis lands on a desk already full of obligations that have nothing to do with inherently safer design. They cannot hire a $2,000-a-day consultant for a six-week practicability study, and they will not buy a six-figure enterprise EHS suite. They need the methodology productized: the STAA workflow, the justification templates, the deadline engine, and the auditor marketplace, delivered as software at a price a water utility can expense.
The Gap in the Market
| Company | What They Do | What's Missing |
|---|---|---|
| EPA's RMP*eSubmit | The agency's free filing software. Every RMP facility uses it to submit its risk management plan. It is a form with validation. | It manages the submission, not the program. No STAA workflow, no practicability tracking, no root cause analysis builder, no audit scheduling, no deadline engine, no multilingual community disclosure packets, no declined-recommendation register. The 2024 rule added a dozen new workflows; eSubmit added none of them. |
| Encamp | Indianapolis EHS compliance platform, $47.2M raised including a $30M Series C led by Drive Capital, roughly 200 customers. The largest third-party filer of EPCRA Tier II reports in the country, expanding into TRI, Clean Water Act, and Clean Air Act modules. The closest thing to a modern mid-market EHS suite. | Horizontal by design: Tier II, waste, water, air. No RMP-vertical depth for SCCAP's new obligations, no STAA methodology, no third-party auditor network, no rule-version scenario planning. Their roadmap points at adjacent media, not at 40 CFR 68. |
| VelocityEHS / Benchmark Gensuite / Cority / Intelex | Enterprise EHS suites with incident management, audit, and compliance calendar modules. Six-figure implementations, annual user conferences, Fortune 500 logos. | Built for companies with EHS departments, not for the municipal water plant whose EHS department is one person. Nothing RMP-specific; the SCCAP workflows would be custom configuration work billed by the hour. The 10,000-facility long tail will never clear their procurement bar. |
| ioMosaic | Deep process-safety software: PSMPro for PHA, HAZOP, LOPA, and fault-tree analysis, plus the Process Safety Enterprise lifecycle platform. Consulting-led, genuinely expert. | Sells to the majors doing hazard analysis, not to the facility manager running an RMP program. No compliance deadline engine, no community notification tooling, no auditor marketplace. A scalpel where the long tail needs a checklist. |
| Sphera | Enterprise process safety and operational risk management, PSM modules, large installed base in oil and gas. | Enterprise pricing and enterprise sales cycles. The product assumes a process-safety organization already exists at the customer. |
| Boutique consultants (Trinity, ABS Group, AECOM, independents) | The people who actually perform STAAs, PHAs, and compliance audits today. Deep expertise, trusted relationships, $500-$2,000 day rates. | They are the capacity bottleneck identified above, not a scalable product. Every engagement is bespoke. They have no software to sell and no incentive to productize the methodology that bills by the day. |
The pattern is the familiar one in industrial compliance: the regulator built a free form, the enterprises bought six-figure suites, the consultants bill by the day, and the 10,000 smaller facilities in the middle got nothing built for them. SCCAP widened the gap because its new obligations, STAA practicability studies, third-party audits with independence criteria, multilingual community disclosures, declined-recommendation justifications, are precisely the workflows where a mid-market facility has no in-house expertise and no affordable tooling. The incumbent EHS suites treat RMP as one module among forty. This product treats 40 CFR 68 as the entire company. The middle got nothing.
The Solution
A rule-versioned RMP program management platform: the system of record for everything a facility must do under the Risk Management Program, tracking the 2024 rule and the 2026 proposal side by side so the EHS manager always knows what is required under the law on the books and what changes if the rollback finalizes. One system of record. Two versions of the law.
1. Obligation engine and compliance calendar ($6K-$25K/site/year by program level): Ingest the facility's RMP data: program level by process, NAICS codes, accident history, proximity to other covered facilities. The engine outputs a facility-specific obligation map and a deadline calendar: STAA evaluation, practicability assessment, passive-measure implementation, third-party audit triggers, root cause analysis clocks, field exercise dates, the March 2027 exercise deadline, the May 2027 provision deadline, the May 2028 resubmission. Every obligation carries its citation to the section of 40 CFR 68 and its status under both rule versions, so when an inspector asks why a requirement was marked complete, the answer is a linked regulatory lineage rather than someone's memory of a meeting. When EPA finalizes the rollback, the engine re-computes every customer's obligations overnight, turning the industry's worst planning scenario, a mid-cycle rewrite of the rule, into the product's best demonstration of why rule-versioned software exists. Regulatory volatility becomes a feature instead of a crisis.
2. STAA module ($15K one-time per analysis, $3K/year maintenance): A guided workflow for the safer technologies and alternatives analysis: technology identification, inherently safer design option screening, practicability assessment templates with cost and feasibility scoring, and a declined-recommendation justification generator that produces the documentation the rule requires in the RMP when a recommendation is not adopted. Ships with a passive-measure library drawn from published inherently safer design practice, so a two-person EHS team at a municipal utility can produce in an afternoon the analysis that currently takes a boutique firm six weeks and a five-figure invoice. This is the productized methodology the long tail cannot buy from consultants, because consultants sell hours and this sells the hours' output: a defensible practicability file at a price a municipal utility can put on a purchase order.
3. Third-party auditor marketplace (15% take rate): A credentialed network of auditors screened against the rule's competence and independence criteria, because the independence requirements mean a facility cannot simply rehire the consultant who knows its plant best, which is exactly the constraint that creates the marketplace. Facilities with a triggering accident get matched, scheduled, and managed through the audit; findings flow into the declined-recommendation register automatically, because an audit that produces a PDF nobody reads is a liability, while an audit that produces tracked corrective actions is a defense. Auditors get a steady pipeline of mandated work without business development. Typical third-party process-safety audits run $25,000-$60,000, so the marketplace earns $3,750-$9,000 per engagement while solving the independence problem the rule created.
4. Root cause analysis workflow ($5K per investigation): A formal RCA builder for RMP-reportable accidents and near misses: timeline construction, causal factor charting, corrective-action assignment and tracking, and the five-year retention file the rule demands. Enforcement exposure lives in corrective actions identified but never addressed, and the workflow makes that visible before an inspector does, because the facilities that get hurt in enforcement are rarely the ones that never investigated, they are the ones whose reports listed actions with due dates that came and went.
5. Community notification and information availability ($3K/year): Generates the six-mile disclosure packets in the community's two most common languages, maintains the request log, and provides public notification procedure templates for non-responding facilities. If the rollback centralizes disclosure at EPA, this module pivots to managing the facility's side of the centralized submission, which is the hedge built into the product: whichever version of the disclosure regime survives, the facility still needs software to assemble what gets disclosed.
6. RMP resubmission generator ($2,500 per filing): Assembles the updated risk management plan with the new and revised data elements for the May 2028 resubmission wave, validated against EPA's schema before it touches eSubmit. Sold as a one-time service, it is also the wedge: the cheapest way to acquire a facility is to do its resubmission, then convert it to the platform. Land with a filing. Expand with the deadline.
Revenue Model
| Revenue Stream | Amount | Notes |
|---|---|---|
| Core platform, Program 1 / small facilities | $6,000/year | Obligation engine, deadline calendar, document vault. 90%+ software margin. |
| Core platform, Program 2 | $12,000/year | Adds audit scheduling, RCA workflow, employee participation tracking. |
| Core platform, Program 3 complex | $25,000/year | Adds STAA tracking, practicability workflow, multi-site rollup for fleets. |
| STAA module | $15,000 one-time + $3,000/year | Guided analysis, practicability scoring, justification generator. Highest willingness to pay: it replaces a $40K-$80K consulting engagement. |
| Auditor marketplace | 15% of $25K-$60K audits | $3,750-$9,000 per engagement. Scales with the accident-triggered audit cycle. |
| Root cause analysis add-on | $5,000 per investigation | Event-driven revenue; every reportable accident in the customer base is a trigger. |
| Community information module | $3,000/year | Multilingual disclosure packets, request log, notification templates. |
| RMP resubmission service | $2,500 per filing | Acquisition wedge for the May 2028 wave; converts to platform subscriptions. |
| Auditor certification | $1,500/auditor/year | Credentialing, independence screening, continuing education for the marketplace network. |
Unit economics for a 20-site cold-storage chain (ammonia refrigeration, Program 2/3 processes): Platform at $12,000 per site is $240,000 a year in ARR at roughly 88% gross margin. Per-logo economics like that let a direct sales team hunt a small number of large accounts instead of chasing transactional volume. STAA modules for the six highest-risk sites add $90,000 one-time plus $18,000 a year. Two reportable accidents a year across the fleet at $5,000 RCA fees add $10,000. Year-one revenue from one logo: about $358,000. Customer acquisition through the RMP resubmission wedge and process-safety conferences runs roughly $18,000 per logo, because the entire buyer universe fits in three hotel ballrooms and already knows it has a May 2027 problem. Six-year retention at 90% gross margin gives an LTV near $1.9M against an $18K CAC, which funds a direct sales motion with long cycles: when each logo is worth seven figures over its lifetime, you can afford to wait out a nine-month procurement process. The ratio is over 100x, which mostly tells you the CAC assumption deserves skepticism. Triple the acquisition cost and the math still works.
Market Size
TAM: Start with EPA's count: 11,740 facilities with current RMPs on file. Price the core platform on a blend reflecting the program mix: small Program 1 sites at $6,000, mid-size Program 2 at $12,000, complex Program 3 at $25,000. A blended $11,500 per facility per year is conservative, given that the deepest obligations concentrate in the most expensive tier and the facilities with the simplest obligations are the ones most likely to buy without a procurement fight. That gives $135M a year in core platform revenue. Add the auditor marketplace: if 500 facilities a year trigger third-party audits at a $35,000 median with a 15% take, that is $2.6M a year in take rate, growing as the audit cycle matures. Add STAA one-time modules during the cliff window: 1,500 assessments at $15,000 is $22.5M concentrated in 2026-2027, the kind of front-loaded revenue spike that funds the company before the steady-state renewals take over. Blended across a steady state, total TAM lands near $150M a year in software and marketplace take, before counting the resubmission service wave.
SAM: The obligations are not evenly distributed. STAA, practicability assessments, and the passive-measure implementation mandate concentrate in Program 3 refining and chemical manufacturing plus facilities with reportable accidents; third-party audits and formal RCA concentrate in Program 2 and 3 facilities with accident history. Call the high-obligation subset 4,500 facilities, a directional estimate, at a $14,000 blended ACV reflecting heavier module attach: $63M a year. This is the segment where the May 2027 deadline bites hardest and where consultant triage leaves the biggest vacuum, because the boutiques will staff the refineries first and the 4,500-facility middle gets whatever capacity is left: the entire commercial thesis in one sentence.
SOM (year 3): 120 facilities at a $14,000 blended ACV is $1.7M in ARR, plus roughly $600K in marketplace take, STAA one-times, and resubmission services during the cliff window: $2.3M in year-3 revenue at about 85% blended gross margin. That is 2.7% penetration of the SAM, achievable through the resubmission wedge and a direct sales motion into water utilities, cold-storage chains, and ag distribution cooperatives.
Why Now
The deadline is eight months away and the work has barely started. May 10, 2027 is the compliance date for STAA, root cause analysis provisions, third-party audits, employee participation, public notification, and information availability. Field exercises come due March 15, 2027. Industry conference presentations through 2025 show most mid-market facilities still in the awareness phase, not the execution phase, which is the classic pre-deadline pattern: the majors hired consultants eighteen months out, the middle started reading the rule twelve months out, and the long tail will panic six months out, right when the consultants stop answering the phone. The buying window for compliance software is always the 12-18 months before a deadline, because that is when the budget holder has both the mandate and the fear, and after the deadline the same buyer is either compliant or explaining themselves to an inspector. That window is open right now.
The rollback proposal makes software more necessary, not less, because a facility cannot hold two possible versions of its obligations in its head, and the EHS manager who guesses wrong about which rule survives is the one who gets deposed. A facility cannot comply with two possible versions of a rule on a spreadsheet. The 2026 proposal keeps the May 2027 date for retained provisions while rewriting the rest, which means every EHS manager needs scenario planning: what is required today, what changes if the final rule lands in late 2026, and what the three-year clock on new provisions means. No spreadsheet survives that. A rule-versioned obligation engine is the only product shaped like this problem.
The consultant bench cannot absorb the cliff. The calculation above shows mandated specialist demand outrunning the few hundred senior process-safety practitioners in the country, and unlike a labor shortage you can hire through, this one is bounded by a statutory calendar: the demand does not wait for the supply to catch up. When the boutiques triage toward ExxonMobil and Dow, the water utility in Fresno and the cold-storage chain in Kansas City are on their own. Software that productizes the STAA methodology is not competing with consultants, because consultants are about to spend two years telling mid-market prospects they have no availability, which is the most expensive possible way to create demand for a substitute. It serves the customers consultants are about to abandon.
State programs do not follow EPA rollbacks. New Jersey's Toxic Catastrophe Prevention Act has required inherently safer technology reviews for decades, which means the STAA concept is not a federal experiment: it is a proven state regime that the 2024 rule nationalized and that survives any EPA rollback intact. California's Accidental Release Prevention program and Contra Costa County's Industrial Safety Ordinance impose their own process-safety obligations independent of 40 CFR 68. Even if EPA finalizes the rollback, the strictest states keep the strictest requirements, and facilities operating across jurisdictions need one system that tracks all of them.
OSHA's PSM standard is being modernized on a separate track that no EPA rollback touches, which means the process-safety obligations keep tightening even if the RMP rule loosens, and a platform that covers both is selling into two regulatory currents at once. The RMP rollback proposal explicitly aims to realign RMP with OSHA process safety management, and OSHA's own PSM modernization continues independently. A platform built around the RMP program can extend into PSM compliance for the same facilities, the same buyers, the same budget line. Regulatory churn is the moat. Every rulemaking makes the version-tracking engine more valuable.
Startup Costs
| Category | Cost | Notes |
|---|---|---|
| EHS regulatory SME + product design (4 months) | $70K | A former refinery EHS manager or process-safety consultant who has filed RMPs and survived audits. Non-negotiable: you are selling compliance, and the domain model is 40 CFR 68, which means the founding team needs someone who has read the rule the way a litigator reads a statute, not the way a product manager reads a competitor's feature list. |
| Engineering (2 full-stack, 8 months) | $240K | Obligation engine, deadline calendar, document vault, multilingual generation, marketplace. Boring stack, SOC 2 from day one: you hold a facility's worst-case scenario data. |
| 40 CFR 68 data model + EPA schema integration | $45K | Modeling program levels, NAICS mappings, accident triggers, and proximity logic; validating resubmission output against EPA's submission schema. |
| Multilingual document pipeline | $25K | Disclosure packet generation in the community's top two languages with human-review workflow. Machine translation alone is a liability here, because a disclosure packet that mistranslates a hazard warning is worse than no packet at all, and the communities the rule is written for are the ones least able to absorb the error. |
| Pilot program (12 facilities) | $35K | Subsidized deployments across a water utility, a cold-storage operator, and an ag distributor. You need reference customers in the long tail, not just refineries, because the refineries will buy from whoever the majors already trust, while the water utility that went live in six weeks is the story that sells the next forty. |
| Conferences and marketing (year 1) | $30K | Mary Kay O'Connor Process Safety Symposium, AIChE Spring Meeting, AFPM events. The buyers are all in the same three hotel ballrooms. |
| Regulatory counsel review | $25K | Outside counsel reviews the obligation engine's rule interpretations. If your software tells a facility it is compliant, a lawyer should have blessed the logic, because the distance between a product bug and a Clean Air Act violation is exactly one enforcement action, and no end-user license agreement survives that conversation. |
| Operating buffer (12 months) | $50K | Hosting, audit-log infrastructure, customer support, insurance. Cyber liability is not optional when you store worst-case release scenarios. |
| Total | $520K |
Break-even lands around month 26: 55 facilities at a $12,000 blended ACV is $660K in ARR at roughly 88% gross margin, covering a $540K annual burn. The ramp assumes 8 pilot conversions by month 12, 25 customers by month 18, and 55 by month 26, driven by the resubmission wedge ahead of the May 2028 wave. The cliff does the marketing.
Limitations
The 11,740 facility count is EPA's figure for facilities with current RMPs on file at the time of the 2024 rulemaking, not a live census. Facilities open, close, deregister, and fall below threshold quantities every year; the operating universe today is close to but not exactly that number. The chemical-incident frequency figures come from an advocacy group, not from EPA's RMP database, and should be read as directional.
The cost figures are EPA's Regulatory Impact Analysis estimates, annualized over ten years at a 3 percent discount rate. They are modeled, not observed, and the industry considers them understated: the American Fuel & Petrochemical Manufacturers and the American Petroleum Institute both argued during the rulemaking that EPA's numbers miss the real cost of STAA implementation, with industry citing figures like $800 million to rebuild a single alkylation unit away from hydrofluoric acid. If industry is right, the compliance spend is larger than modeled and the software opportunity grows with it. If EPA is right, the market is as sized above.
The $60,000 median practicability engagement and the 250-assessor bench are the author's estimates, built from published boutique day rates and industry conference rosters rather than from a survey, which means the honest version of the capacity argument is not a precise shortfall figure but a direction: every verifiable input, EPA's front-loaded cost curve, the 12-month audit clock, the three-to-six-week engagement length, points the same way, toward demand arriving faster than the bench can absorb it. The conclusion, that mandated demand outruns specialist supply before May 2027, is robust to wide variation in those inputs; the exact shortfall is not.
The 2026 rollback proposal's fate is genuinely uncertain. A final rule was expected in late 2026 with provisions taking effect over three years, but rulemakings slip, administrations change priorities, and litigation over the 2024 rule continues in parallel. The scenario-planning value proposition assumes sustained uncertainty; a clean, fast, total repeal would shrink the product's differentiation, though the retained provisions and state programs preserve a core market.
Per-facility pricing is modeled from adjacent mid-market EHS SaaS, not from quoted RMP software prices, because no directly comparable RMP-vertical product exists to quote. That is both the opportunity and the pricing risk.
Strongest Counterargument
The 2026 rollback will kill this business before it starts. If EPA finalizes the "Common Sense Approach" proposal in late 2026, STAA for existing processes is gone, third-party audits are rescinded or narrowed to facilities with two accidents in five years, facility-level multilingual disclosures are replaced by centralized EPA publication, and declined-recommendation documentation disappears. EPA's own estimate puts the savings above $230 million a year, which is another way of saying the compliance spend this product monetizes shrinks by nearly the entire $256.9 million annualized cost base. The May 2027 cliff dissolves into a three-year glide path for a much smaller set of obligations. You would have spent $520,000 and two years building for a repealed rule, selling scenario planning for a scenario that resolved.
This is the right objection, and it deserves a straight answer in four parts, because anyone who has watched an EPA rulemaking cycle knows that proposed rollbacks have a habit of arriving loudly and finalizing quietly, partially, or not at all. First, the proposal itself retains the May 10, 2027 deadline for incident investigation, employee participation, and emergency response provisions, and gives new provisions a three-year clock. The deadline engine still sells; it just tracks a smaller obligation set for some customers. Second, the core product was never the STAA module alone. RMP program management, PHA tracking, root cause analysis, audit scheduling, and the May 2028 resubmission wave exist under either version of the rule. Third, the strictest jurisdictions do not track EPA rollbacks: New Jersey, California, and Contra Costa County keep their own inherently-safer-technology and process-safety mandates regardless of what 40 CFR 68 says, and multi-state operators need one system for all of them. Fourth, and most important, the uncertainty is the product. Every EHS manager buying compliance software in 2026-2027 is buying an answer to the question "what do we owe under which version of the law." A vendor whose engine recomputes every customer's obligations the week a final rule drops is selling exactly what the rollback creates: the need to know, instantly, what changed. No repeal can obsolete that.
What You Can Do
If you run EHS at an RMP facility: Build your SCCAP obligation map now, against the 2024 rule as written, and do not bet the facility on a proposed rule, because enforcement runs on the Code of Federal Regulations as published, not on press releases about what EPA might do next year. The May 10, 2027 date for incident investigation, employee participation, and emergency response provisions survives under EPA's own proposal. Identify whether your processes trigger the STAA practicability assessment: NAICS 324 or 325 within a mile of another covered 324/325 process, hydrofluoric acid alkylation, or a reportable accident since your last PHA. If any trigger fires, start the practicability work this quarter. Specialist capacity is the binding constraint, and it is booking up.
If you are a process-safety consultant: Productize your STAA methodology before someone else does. The practicability assessment is about to be performed hundreds of times by facilities that cannot afford your day rate, and the firm that turns its judgment into software collects the margin on every engagement it would otherwise have to staff. A guided workflow that encodes your approach, sold as software with your firm as the implementation partner, captures revenue from the long tail without consuming your senior assessors' calendar. The auditor marketplace needs credentialed independents; get in early.
If you are building this product: Start with the obligation engine and the resubmission generator, not the marketplace, because the engine is the daily-use product that earns the renewal, the resubmission service is the acquisition wedge timed to the May 2028 wave, and the marketplace only works once you have the facility relationships that make you the natural broker. Design rule-versioning into the data model from day one, because the 2026 proposal will not be the last rewrite. Recruit your design partners from the long tail: a municipal water utility, a cold-storage chain, an ag distributor. The refineries already have consultants. Your customers are the 10,000 facilities the consultants are about to triage away.
The Bottom Line
EPA gave 11,740 chemical facilities until May 2027 to do things most of them have never done: analyze safer technologies, submit to third-party audits, investigate root causes formally, and tell their neighbors what is in the tanks. Then EPA proposed deleting half the requirements before the deadline. The facilities cannot comply with a superposition, the consultants cannot absorb the demand spike, and the regulator's free software is a form, not a program. A rule-versioned platform that tracks what each facility owes under each version of the law, productizes the STAA methodology for the long tail, and runs the auditor marketplace the rule's independence criteria created, is a $150M software market with an eight-month forcing function. Regulatory uncertainty is usually a reason not to build. Here it is the reason to build.