Who Regulates Your Drinking Water?

The EPA has drinking-water regulations for more than 90 contaminants — legally enforceable limits and treatment-technique rules that apply to public water systems (EPA, How EPA Regulates Drinking Water Contaminants). But the EPA mostly writes those rules rather than enforcing them house by house: it delegates day-to-day authority to states. As of the CY2023 national report, 49 states, 5 territories, and the Navajo Nation hold "primacy" — the primary authority to enforce the rules — and Wyoming and the District of Columbia are run directly by the EPA (EPA, 2023 National Public Water Systems Compliance Report). That four-layer arrangement is the whole answer in miniature.

Knowing who is responsible matters because "is my water safe?" has different owners depending on which water you mean. The water your city sends to your property line is the EPA's rules, your state's enforcement, and your utility's daily job. Bottled water is a separate world governed by the FDA as a food. A private well is no one's job but the owner's. And the pipes inside your house — the last few feet before your glass — are yours alone, regulated by almost no one.

This guide draws the map so you know which body to call, which to read, and which problems only you can solve. The fastest way to see your own slice is to look up your city and find your utility, its source water, and its most recent report.

You might be wondering whether this is a setup to sell you a filter or to alarm you about your water. It is neither. Most U.S. tap water meets every EPA limit, and the goal here is narrow: show you the five parties involved — federal, state, utility, the FDA, and you — and exactly where each one's responsibility starts and stops.

Who actually writes the rules — and is it the EPA or someone else?

Congress passed the Safe Drinking Water Act (SDWA) in 1974 and amended it in 1986 and 1996 (EPA, Background on Drinking Water Standards). The law authorizes the EPA to set national, health-based standards to protect against both naturally occurring and man-made contaminants (EPA, Overview of the Safe Drinking Water Act). Those standards are the National Primary Drinking Water Regulations (NPDWRs) — legally enforceable limits and treatment techniques that apply to public water systems (EPA, NPDWR).

In practice the EPA has set drinking-water regulations for more than 90 contaminants, written as maximum contaminant levels or treatment-technique rules covering chemical, radiological, and microbial hazards (EPA, How EPA Regulates Drinking Water Contaminants). The count is the EPA's own approximate phrasing and rises over time — the 2024 PFAS rule added new limits. So when a filter ad says "the EPA regulates your water," the accurate version is: the EPA writes the rulebook.

What the EPA generally does not do is test the water itself. Under the Public Water System Supervision (PWSS) program, the sampling is performed by water systems using state-certified laboratories, and enforcement is delegated to states and tribes (EPA, Primacy). If you are picturing a federal inspector at your tap, that picture is wrong almost everywhere in the country. And one boundary the SDWA draws up front: it applies to public water systems and does not regulate private wells that serve fewer than 25 individuals (EPA, Overview of the SDWA) — so the federal rulebook was never written for the roughly one in eight Americans drinking from their own well.

Who enforces those rules where you live — your state or the federal government?

The EPA delegates "primacy" — primary enforcement responsibility — to states and Indian tribes that meet certain requirements (EPA, Primacy, 2025). To qualify, a state must adopt drinking-water regulations no less stringent than the NPDWRs in effect under 40 CFR Part 141, run an enforcement program with a system inventory and sanitary surveys, certify laboratories, and keep records (EPA, 40 CFR 142.10). The same condition appears in the statute itself, SDWA section 1413 (42 U.S.C. 300g-2(a)(1)).

That phrase is the most consequential detail in the whole system. Because primacy requires standards at least as stringent as the EPA's, the federal limit is a floor, not a ceiling — a state may not go below it (EPA, ECHO SDWA FAQs; 40 CFR 142.10(a)). So your local standard is whichever is stricter: the federal rule or your state's.

As of the CY2023 national report, 49 states, 5 territories, and the Navajo Nation had primacy, while the EPA had direct implementation authority for the District of Columbia, Wyoming, and the rest of Indian country (EPA, CY2023 Compliance Report). Wyoming is the only U.S. state that has never applied for primacy; there, EPA Region 8 directly implements the SDWA, though a July 2023 state DEQ handout framed primacy as something the legislature was still evaluating (EPA Region 8, 2026; Wyoming DEQ, 2023). The Navajo Nation is the only tribe with primacy; the EPA implements the SDWA on all other tribal lands (EPA, ECHO SDWA FAQs).

So the honest answer to "who enforces the rules where I live?" is: almost certainly your state drinking-water program, not Washington — with Wyoming and DC the two EPA-run exceptions, a CY2023 snapshot that would shift to 50 states only if the EPA ever approves a Wyoming application.

What is your water utility actually responsible for?

There are more than 148,000 public water systems in the United States, classified as community, non-transient non-community, or transient non-community systems (EPA, Information About Public Water Systems). A public water system is formally one that provides water through pipes to at least 15 service connections or an average of at least 25 people for at least 60 days a year (EPA, 40 CFR 141.2). Your city utility is a community water system — one serving at least 15 connections or 25 year-round residents.

Your utility's legal job is to treat the water to meet the NPDWRs, sample for regulated contaminants on federal schedules using state-certified labs, report results in an annual consumer report (required since 1998), and notify the public fast when something goes wrong — within 24 hours for a violation with significant potential for serious short-term health effects, and within 30 days or 1 year for less urgent ones (GAO-09-610, 2009).

What surprises most people is where that job stops. A utility's responsibility runs from the source water through the treatment plant and mains to the service line — the pipe connecting the water main to your building (EPA, LCRI service-line fact sheet, 2024). The line has a publicly owned "system side" and a privately owned "customer side," and everything past it — your interior plumbing, fixtures, and any filter — is unambiguously yours. The one exception that crosses onto your property is lead, significant enough to get its own section below. For everything else, the boundary holds: your utility answers for the water arriving at your property line, not for what your home's pipes do to it in the last few feet.

How is bottled water regulated, and is it different from tap?

Bottled water is regulated by the FDA, not the EPA — as a packaged food under the Federal Food, Drug, and Cosmetic Act, which makes manufacturers responsible for producing safe, wholesome, and truthfully labeled products (FDA, Bottled Water Everywhere). The split is explicit: the EPA regulates public tap water, while the FDA regulates bottled drinking water and bases its standards on the tap-water rules (FDA, FDA Regulates the Safety of Bottled Water Beverages; CDC, 2024).

The two regimes are deliberately linked. Under Section 410 of the FD&C Act, each time the EPA issues a drinking-water regulation for a contaminant, the FDA must either adopt a matching bottled-water standard or formally find one unnecessary, and that standard must be no less stringent than the EPA's limit; if the FDA misses its deadline, the EPA's rule automatically becomes the bottled-water standard (GAO-09-610, 2009). So the headline "bottled water is held to the same chemistry as tap" is broadly fair.

Where it differs is monitoring and enforcement. The SDWA lets the EPA require utilities to use certified labs and report violations on set timelines; the FD&C Act grants the FDA no equivalent authority, so bottlers are not required to use certified laboratories, and there is no public-notification or annual consumer-report mandate the way there is for your tap (GAO-09-610, 2009).

Two footnotes. Bottled water made and sold within a single state generally falls outside FDA jurisdiction, regulated by the state alone (GAO-09-610, 2009). And limits can differ: the FDA caps lead in bottled water at 5 ppb (0.005 mg/L) because lead pipes aren't used in bottling, while the EPA's lead figure for tap is 15 ppb — and that 15 ppb is an action level, a treatment-technique trigger, not a maximum contaminant level (FDA consumer update; 21 CFR 165.110(b)(4)(iii)(A)).

Who is responsible for a private well, and who tests it?

If you draw water from your own well, the regulatory answer is blunt: no one but you. The quality and safety of drinking water from private domestic wells are not regulated by the federal government under the SDWA, nor by most state governments, and government officials do not regulate, treat, or monitor that water (EPA, privatewells; CDC, 2024).

This is not a small population. The EPA estimates more than 23 million households rely on private wells — around 15 percent of the U.S. population, over 43 million people, or about 1 in 8 American residents by the CDC's count (EPA, privatewells; CDC, 2024). The USGS reports the same headcount, of which over 98 percent came from groundwater as of 2015 (USGS, Domestic Private Supply Wells; USGS, 2015).

Because no agency tests it, the well owner has to. The EPA states plainly that private well owners are responsible for delivering safe drinking water to their households, and the USGS notes that homeowners are primarily responsible for any water-quality monitoring (EPA, privatewells; USGS, Domestic Private Supply Wells). The CDC's baseline: test your well at least once each year for total coliform bacteria, nitrates, total dissolved solids, and pH, plus situational tests for local contaminants of concern (CDC, 2024).

So if you are on a well, the test priorities depend on your situation. If you have an infant in the house, nitrate can't wait — the federal MCL is 10 mg/L as nitrogen, set specifically because higher levels can cause "blue baby syndrome" in young infants (EPA, 40 CFR 141.62(b); EPA, Chemical Contaminant Rules). If your home is older or near a known source, add arsenic, lead, and whatever your state health department flags locally.

Who is responsible for lead in the line and the pipes inside your home?

Lead is the one place where the clean "utility to the property line, you past it" boundary blurs — because the lead service line literally crosses it. On October 8, 2024, the EPA finalized the Lead and Copper Rule Improvements (LCRI), requiring water systems to identify and replace lead pipes within 10 years (EPA, 2024; EPA, 89 FR 86824, effective December 30, 2024).

Under the LCRI, all community and non-transient non-community systems must fully replace every lead and galvanized-requiring-replacement service line under their control within 10 years, and the EPA estimates roughly 99 percent of systems must finish in that window (EPA, LCRI service-line fact sheet, 2024; EPA, LCRI Q&A). A line counts as replaced only when its entire length — both customer side and system side — is non-lead, so for the first time the mandate generally reaches onto the privately owned customer side (EPA, LCRI service-line fact sheet, 2024). The EPA estimates up to roughly 9 million homes and businesses remain on legacy lead pipes, with the mandatory replacement period starting November 1, 2027 (EPA, 2024). The rule also lowers the lead action level from 15 µg/L to 10 µg/L — a system-wide treatment trigger, not a safe level for your glass, since there is no safe blood lead level in children (EPA, 2024; CDC, 2024).

Past the service line, the pipes, solder, and fixtures inside your house are entirely yours. The EPA's compliance testing samples only a small, population-scaled pool of targeted high-risk homes — from as few as 5 sites to 100 depending on system size — almost certainly not yours (EPA, 40 CFR 141.86). So if you have an older home or a lead or unknown service line, the only way to know your tap's level is an independent certified-lab test. In the meantime, the EPA advises using only cold water for drinking, cooking, and making baby formula, and flushing your pipes before drinking by running the tap (EPA, Basic Information About Lead in Drinking Water).

The table below pulls the whole map into one place — for each water situation, who writes the rules, who tests it, and who you call.

Water situation	Who sets the rules	Who tests it	Who fixes it / who you call
City / public tap water	EPA (national limits on 90+ contaminants); your state may add stricter ones	Your utility, via state-certified labs, at the plant and system points	Your utility (treatment, mains); escalate violations to your state primacy program
Bottled water	FDA, as a food (standards no less stringent than EPA's)	The bottler self-tests under FDA good-manufacturing-practice rules; no certified-lab mandate	The bottler / FDA (recalls); state alone for intrastate-only brands
Private well	No one federally; not regulated by most states	The owner, at least once a year (CDC baseline panel)	The owner — siting, treatment, and testing are 100% on you
Apartment / landlord plumbing	EPA + state set the limits for the supplying utility; building codes govern interior pipes	Utility tests to the building; interior tap is rarely sampled	Utility for incoming water; landlord for the building's plumbing and fixtures
School / daycare on its own supply	EPA + state, as a non-transient non-community public water system	The school operator, on EPA monitoring schedules	The school operator; oversight by your state primacy program
The lead service line	EPA LCRI (replace within 10 years) + state	Utility, at a small pool of targeted high-risk taps	Utility replaces the full line (system + customer side) under the LCRI
Your home's pipes & fixtures	Almost no one (interior plumbing codes only)	No one — only your own certified-lab test	You (replace lead fixtures; flush; use cold water for formula)
Water during a boil-water advisory	EPA + state (notification rules)	Your utility, which must notify the public	Your utility issues and lifts the advisory; follow its instructions
National summary	EPA writes rules; states enforce (49 + 5 territories + Navajo Nation have primacy)	148,000+ public water systems test their own output; wells and home taps test themselves	Match the party to the water: utility, FDA, or you

Sources: EPA NPDWR and 40 CFR 141.2 (public-system rules and definitions); EPA CY2023 National Public Water Systems Compliance Report (primacy); EPA LCRI service-line fact sheet and 40 CFR 141.86 (lead lines and sampling); FDA 21 CFR 165.110/Part 129 and GAO-09-610 (bottled water); EPA privatewells and CDC (private wells). Federal rules are a floor; states may be stricter. How this table was assembled: our data and methodology.

So who do you call when something is actually wrong?

The dividing line is the boundary that runs through this guide: call the body that owns the water in question, and test independently for the part no one else measures.

Call your utility when the signal is about the water coming to you — discolored, cloudy, or odd-tasting water across the whole house, lost pressure, or any boil-water notice — because those point to treatment or the mains, and the utility must notify you of genuine health risks (GAO-09-610, 2009). If the utility itself is the problem — repeated violations, missing notices, a lead line left unaddressed — escalate to your state primacy program, or to the EPA directly in Wyoming and DC (EPA, Primacy; EPA, ECHO SDWA FAQs). For a problem with a bottled-water brand, the regulator is the FDA — or your state, for a brand made and sold only in-state (GAO-09-610, 2009).

Test your own water through a state-certified lab when the question is about your specific tap, because that is the part no agency samples: lead, if you have an older home or a lead/unknown service line; PFAS, if you want to know your household's exposure; and any private well. Once you know what is at your tap, learn which NSF certification matches each contaminant and how to choose a filter from your own water data — matching a certified filter to the specific contaminant is the only filter decision worth making.

---

Reading this from a different angle?

• Worried about kids specifically? Read who actually protects your child's drinking water → — the same map, framed around infants, formula, and the contaminants that hit children hardest.
• Trying to choose a filter? Read why "EPA approved" on filter marketing means almost nothing → — what the EPA does and doesn't certify, and which NSF mark actually matters.
• Want the upstream picture? See what your water utility is responsible for, what happens at the treatment plant, and where US tap water comes from.

Sources and disclosure

This guide draws on EPA primary sources: the Safe Drinking Water Act pages; the National Primary Drinking Water Regulations; the primacy framework and the CY2023 National Public Water Systems Compliance Report; the EPA Region 8 Wyoming page and the Wyoming DEQ primacy handout; the 2024 Lead and Copper Rule Improvements and its service-line fact sheet; and the lead/copper, nitrate, and public-system definitions in 40 CFR Parts 141 and 142 — alongside the FDA's bottled-water rules (21 CFR 165.110 and Part 129), GAO-09-610 on bottled-water oversight, and the CDC and USGS private-well pages, plus the city Consumer Confidence Reports we aggregate across 18,774 U.S. cities. TapWaterData earns affiliate commission on filters recommended in our Filter Buyer guides. This guide contains no affiliate links, but it links to those guides, which do. More about our data and how we work.