PFAS Regulations: What Manufacturers Need to Know

Most manufacturers I talk to think PFAS is a chemical company's problem. It isn't anymore. If you make cookware, textiles, cosmetics, food packaging, electronics, firefighting foam, or dozens of other product categories, this applies to you. So does simply discharging wastewater from a facility that used PFAS-containing materials at any point since 2011. Either one puts federal reporting obligations, and quite possibly state-level bans, on your compliance calendar — whether you noticed them arrive or not.

That's the thing about PFAS regulation right now: it didn't show up as one law. It showed up as a stack of them, moving on different clocks, from different agencies, with different definitions of the thing they're all trying to control. In my view, the manufacturers getting hurt aren't the ones who used a lot of PFAS. They're the ones who assumed someone would tell them if a rule applied to them. Nobody will. That's your job now.

This guide walks through the federal rules currently in force, the state laws creating the real day-to-day compliance burden, and what a working PFAS program actually looks like inside a manufacturing environmental management system.

What Counts as PFAS, and Why the Definition Keeps Moving

Per- and polyfluoroalkyl substances are a class of thousands of synthetic chemicals built around a carbon-fluorine bond that doesn't break down easily in the environment — which is exactly why they show up in everything from non-stick cookware to waterproof fabric to firefighting foam, and exactly why regulators call them "forever chemicals."

The compliance problem starts with definition. EPA's TSCA reporting rule uses a structural definition that captures roughly 1,400 individual chemical substances. Several states, including Maine and Minnesota, define PFAS even more broadly, as any substance containing at least one fully fluorinated carbon atom. A raw material your supplier certifies as "PFAS-free" under one definition can still trigger reporting under another. I have seen manufacturers get this wrong not because they were careless, but because they checked the wrong definition against the wrong law.

The Federal Rules Manufacturers Can't Ignore

EPA's Drinking Water Rule Sets the National Benchmark

EPA finalized the PFAS National Primary Drinking Water Regulation in April 2024, setting an enforceable maximum contaminant level of 4.0 parts per trillion for both PFOA and PFOS individually, plus a Hazard Index limit for combinations of PFHxS, PFNA, HFPO-DA (GenX), and PFBS. That's no longer the full picture: in May 2025, EPA announced it would keep the PFOA/PFOS limits in place but extend the compliance deadline from 2029 to 2031, while moving to rescind and rework the Hazard Index limit for the other four compounds through a separate rulemaking. Public water systems still must complete initial monitoring by 2027, but confirm the current compliance deadline and the status of the Hazard Index requirement directly with EPA before you plan around either one — both have moved since the rule was first announced. You may not run a public water system, but if your facility discharges to one, expect your local utility to start asking hard questions about your effluent well before its compliance deadline arrives, because they're the ones who answer to EPA first.

PFOA and PFOS Are Now CERCLA Hazardous Substances

This is the one that changes the liability math. As of July 8, 2024, EPA's designation rule made PFOA and PFOS hazardous substances under the Comprehensive Environmental Response, Compensation, and Liability Act — Superfund. That means a release of either compound can trigger federal cleanup liability under CERCLA Section 107. CERCLA liability is strict, joint, and several. It also reaches back to conduct that happened decades before the designation took effect. If your facility has legacy contamination from PFAS-containing materials used in the 1990s, this rule doesn't care that it predates today's regulations. Liability follows the release, not the calendar.

TSCA Section 8(a)(7): Your Paper Trail Back to 2011

EPA's Toxic Substances Control Act reporting rule, codified at 40 CFR Part 705, requires any entity that manufactured or imported PFAS, or PFAS-containing articles, for a commercial purpose at any time since January 1, 2011, to report that use to EPA — including production volume, use categories, and known environmental and health effects. There's no minimum volume threshold and no small-business exemption from the reporting obligation itself, only limited exemptions from certain data elements. The reporting window itself has moved: EPA's original rule set submissions to open in May 2025, then pushed that start date back amid litigation and subsequent rule revisions tracked under docket EPA-HQ-OPPT-2020-0549. Confirm the current open and close dates on EPA's TSCA PFAS reporting page before you build a submission timeline around this section — it's the one date in this rule that hasn't stayed put. This is the rule that catches manufacturers who don't think of themselves as chemical companies at all — the ones who bought a PFAS-treated fabric or a fluoropolymer gasket from a supplier and never asked what was in it.

FDA and Food-Contact PFAS

FDA doesn't regulate PFAS the way EPA does, but it moved on one specific use. In February 2024, FDA confirmed that all manufacturers of PFAS-based grease-proofing substances used in food packaging had completed a voluntary phase-out the agency negotiated in 2020. If you package food and your supplier hasn't confirmed that phase-out in writing, that's a gap worth closing before an auditor closes it for you.

The State Patchwork Is Where Most Manufacturers Get Caught

Federal rules set the floor. States are setting the actual product restrictions, and they are not waiting for EPA or for each other. Maine and Minnesota both moved first with broad product bans; California, Colorado, New York, Vermont, and Washington have followed with category-specific restrictions. The compliance burden here isn't the ban itself — it's tracking which of your SKUs are in scope in which state, on which date.

Notice the pattern: "intentionally added" is the operative phrase in most of these laws, which means trace or incidental PFAS from a shared manufacturing line can still fall outside the ban while a deliberately applied stain-resistant coating falls squarely inside it. That distinction is where I'd focus your supplier questionnaires first. Don't ask "does this product contain PFAS." Ask whether PFAS was intentionally added to any component, and get it in writing.

What This Means for Your Compliance Program

A few things, in order of how fast they'll bite:

• Map your PFAS exposure before EPA maps it for you. Pull material safety data sheets, supplier certifications, and formulation records back to 2011 for every product line. If you can't answer whether a specific raw material contains a substance on EPA's TSCA reporting list, you don't have a compliance gap yet — you have a visibility gap, and that's the one to fix first.
• Treat CERCLA designation as a liability issue, not just a regulatory one. Legacy contamination at a current or former facility is now a Superfund exposure. If you've never done a Phase I or Phase II environmental site assessment focused specifically on PFAS, and your operations touch any of the known use categories — metal plating, textile treatment, firefighting foam storage, food packaging — this is the year to do one.
• Build a state-by-state SKU tracker, not a single national standard. The temptation is to pick the strictest state law and apply it everywhere. That works for some manufacturers and badly overcorrects for others, especially if a "PFAS-free" reformulation changes product performance in ways your customers will notice. Track state, category, and deadline separately, because Minnesota's 2025 deadline and Maine's 2026 deadline are not the same compliance event even though they look alike on a spreadsheet.
• Get your supplier contracts to do some of the work. A signed PFAS-free attestation from an upstream supplier doesn't eliminate your reporting obligation under TSCA 8(a)(7), but it does give you the documentation you need to respond to a state ban inquiry or a customer audit without scrambling.

Building PFAS Into Your Environmental Management System

If your facility runs an ISO 14001-based environmental management system, PFAS isn't a separate project — it belongs inside the compliance obligations process you already have. ISO 14001:2015 clause 6.1.3 requires the organization to determine and keep current its compliance obligations related to environmental aspects, and clause 6.1.2 requires you to identify the environmental aspects of your activities, products, and services. PFAS reporting duties and state product bans are compliance obligations in the plainest sense the standard describes. Treating them as a one-time legal review misses the point of the clause, which is that this list has to stay current as new rules land, and new rules are landing every few months right now.

The manufacturers who handle this well aren't the ones with the fewest PFAS uses. They're the ones who already had a working management system that could absorb a new obligation without inventing a new process from scratch. If your EMS can't currently answer "which of our compliance obligations changed in the last twelve months," that's a gap worth closing regardless of PFAS, and PFAS is just the rule that's exposing it right now. We work with manufacturers building or tightening exactly this kind of system through our ISO 14001 consulting services, and for companies in cosmetics specifically, where several of the state bans land hardest, our cosmetics compliance work covers the overlapping ISO 22716 and PFAS-restriction requirements together rather than as separate projects.

Frequently Asked Questions

Does the TSCA Section 8(a)(7) reporting rule apply to small manufacturers? Yes. The rule at 40 CFR Part 705 has no revenue-based exemption from the reporting obligation itself, though EPA provides some relief on the level of detail small manufacturers and article importers must supply. If you manufactured or imported PFAS or PFAS-containing articles for a commercial purpose since January 1, 2011, you're in scope regardless of company size.

Are PFOA and PFOS actually classified as hazardous waste now? Not quite — the CERCLA designation that took effect July 8, 2024 makes PFOA and PFOS CERCLA hazardous substances, which governs cleanup liability and release reporting under Superfund. That's a different legal category from a RCRA hazardous waste listing, though EPA has signaled it's evaluating further PFAS designations under other statutes.

What does "intentionally added" mean in state PFAS bans? Most state statutes, including Minnesota's Amara's Law and Maine's amended PFAS law, define intentionally added PFAS as a substance deliberately incorporated into a product or one of its components to perform a specific function, as distinct from PFAS present as a trace contaminant from shared equipment or the environment. The distinction matters for your supplier documentation, because you need to show intent, not just absence.

Do I need to test my products for PFAS, or is supplier documentation enough? The regulations generally don't mandate third-party lab testing as the only compliance path — documented supplier attestations are commonly accepted. That said, a documentation-only approach is only as reliable as your suppliers' own testing, and several manufacturers have discovered PFAS in materials their suppliers certified as PFAS-free. Where a product category carries a near-term ban deadline, I'd treat supplier attestations as a starting point, not a finish line.

How does ISO 14001 relate to PFAS compliance if it's not a PFAS-specific standard? ISO 14001:2015 doesn't name PFAS anywhere in the standard, but clause 6.1.3 requires your organization to identify and track its compliance obligations, and PFAS reporting and product-ban requirements are compliance obligations. A properly maintained EMS gives you the process for catching new PFAS rules as they're issued rather than discovering them during an audit or a customer inquiry.

If you're trying to work out where your facility actually stands against this stack of federal and state PFAS rules, that's a conversation worth having before an auditor or a customer forces it. You can reach our team through certify.consulting to walk through your specific product lines and exposure.

Last updated: 2026-09-03