PFAS Compliance Reporting for Small Environmental Consulting Firms: What You Need to Know Before 2027

EPA finalized Maximum Contaminant Levels for six PFAS compounds in 2024: PFOA at 4 ppt (ng/L), PFOS at 4 ppt, and a hazard index approach for PFHxS, PFNA, HFPO-DA (GenX), and PFBS. Initial monitoring must begin by 2027. Full MCL compliance is required by 2031 (extended from the original 2029 deadline).

For large consulting firms with EQuIS deployments and dedicated data management teams, adding PFAS to their compliance workflow is a configuration change. For the small firm that has been doing metals and VOC compliance in Excel for 15 years, PFAS introduces a fundamentally different level of complexity:

- **Parts-per-trillion concentrations.** Your Excel template was built for ug/L (parts per billion). PFAS MCLs are in ng/L (parts per trillion) — a factor of 1,000 lower. Unit conversion errors between ng/L and ug/L are the most common PFAS data mistake in compliance reporting.

- **The hazard index approach.** For PFHxS, PFNA, HFPO-DA, and PFBS, compliance is determined by a hazard index — the sum of individual PFAS concentrations divided by their respective Health-Based Water Concentration (HBWC) values. An HI greater than 1.0 is an exceedance. This is not a simple result-vs-standard comparison. Your VLOOKUP cannot calculate a hazard index.

- **Rapidly evolving state standards.** At least 12 states have adopted PFAS standards independent of EPA, often more stringent: Michigan, New Jersey, New Hampshire, Vermont, Massachusetts, California, and others. Some states regulate PFAS compounds not covered by EPA. Your compliance reporting must track both federal and state PFAS standards — and they change frequently.

- **Multiple analytical methods with different compound coverage.** EPA Method 537.1 covers 18 PFAS. Method 533 covers 25 PFAS (different subset). Method 1633 covers 40+ PFAS. The method your lab uses determines which PFAS are reported, and not all methods detect all regulated compounds. You need to know what your method covers and what it misses.

The 2024 PFAS MCL rule established two types of limits:

**Individual MCLs:** - PFOA: 4.0 ng/L (ppt) - PFOS: 4.0 ng/L (ppt)

These are straightforward single-analyte comparisons, similar to how you compare lead or arsenic against their MCLs. If the detected concentration exceeds 4.0 ppt, it is an exceedance.

**Hazard Index MCL (HI = 1.0) for a mixture of four PFAS:** - PFHxS (Health-Based Water Concentration: 10 ng/L) - PFNA (HBWC: 10 ng/L) - HFPO-DA / GenX (HBWC: 10 ng/L) - PFBS (HBWC: 2,000 ng/L)

The hazard index is calculated as:

HI = (PFHxS concentration / 10) + (PFNA concentration / 10) + (HFPO-DA concentration / 10) + (PFBS concentration / 2,000)

If HI exceeds 1.0, the sample exceeds the MCL. The key insight: a sample can exceed the hazard index MCL even if no individual compound exceeds its HBWC. For example, PFHxS at 5 ppt, PFNA at 4 ppt, and HFPO-DA at 3 ppt each individually below their 10 ppt HBWC, but together: HI = 0.5 + 0.4 + 0.3 = 1.2, which exceeds the MCL.

For compliance reporting, you need to show the HI calculation with each compound's contribution. If there is an exceedance, the report should identify which compound(s) are driving the HI above 1.0.

Many states adopted PFAS standards before EPA finalized the federal MCLs, and some are more stringent:

**New Jersey** was among the first, with individual MCLs for PFOA (14 ppt), PFOS (13 ppt), and PFNA (13 ppt). NJ also has groundwater quality standards for PFAS. Note that the federal MCLs (4 ppt for PFOA and PFOS) are now more stringent than NJ for those compounds, but NJ's PFNA standard remains relevant as an individual MCL.

**Michigan** set MCLs for seven PFAS compounds including PFOA (8 ppt), PFOS (16 ppt), PFHxS (51 ppt), PFNA (6 ppt), HFPO-DA (370 ppt), PFBS (420 ppt), and PFHxA (400,000 ppt).

**New Hampshire** adopted MCLs for PFOA (12 ppt), PFOS (15 ppt), PFHxS (18 ppt), and PFNA (11 ppt).

**Vermont** set a combined PFAS standard: 20 ppt for the sum of five PFAS (PFOA, PFOS, PFHxS, PFNA, PFHpA).

**Massachusetts** has an MCL of 20 ppt for the sum of six PFAS (PFOS, PFOA, PFHxS, PFNA, PFHpA, PFDA).

**California** has notification levels (response levels, not enforceable MCLs) for PFOA (5.1 ppt) and PFOS (6.5 ppt), with enforceable MCLs under development.

For any compliance project, you need to identify whether your state has PFAS standards independent of the federal MCLs, determine which is more stringent for each compound, and screen against both. This is a multi-jurisdiction screening problem — exactly the kind of layered standard comparison that manual Excel workflows handle poorly.

State PFAS regulations are evolving rapidly. Standards adopted in 2024 may be revised in 2025. Your compliance reporting process needs a way to stay current.

Not all PFAS analytical methods detect all regulated PFAS. Understanding method coverage is essential for compliance reporting:

**EPA Method 537.1** (drinking water): Detects 18 PFAS including PFOA, PFOS, PFHxS, PFNA, PFBS, and HFPO-DA. This is the most commonly used method for drinking water compliance. Covers all six federally regulated PFAS.

**EPA Method 533** (drinking water): Detects 25 PFAS, including short-chain PFAS that Method 537.1 does not capture. Covers the same six regulated compounds plus additional PFAS that some states regulate.

**EPA Method 1633** (multi-matrix): Detects 40+ PFAS in drinking water, surface water, groundwater, wastewater, soil, sediment, fish tissue, and biosolids. The broadest method available. Required for non-drinking-water matrices.

For compliance reporting, document which method was used and verify that it covers all regulated compounds relevant to your project. If your lab runs Method 537.1, you have coverage for all six federal MCL compounds. But if your state regulates additional PFAS (like New Jersey's PFNA MCL), verify that your method detects them.

A common mistake: assuming that a single PFAS analytical method covers all PFAS of regulatory concern. If your project spans drinking water and groundwater at a contaminated site, you may need both a drinking water method (537.1 or 533) and a multi-matrix method (1633).

Detection limits for PFAS methods are typically in the low ppt range (1-4 ppt for most compounds). At the 4 ppt MCL for PFOA and PFOS, detection limit adequacy is a real concern — a lab reporting RL of 4 ppt meets the MCL exactly but provides zero margin. Request RLs at 2 ppt or lower for PFOA and PFOS to ensure compliance can be determined from non-detect results.

Whether you use purpose-built compliance software or continue with Excel, your PFAS reporting workflow needs these elements:

**1. Unit standardization.** Establish ng/L (ppt) as your reporting unit for all PFAS results. If your lab reports in ug/L, convert immediately (multiply by 1,000). Do not mix units within a project — this is the #1 source of PFAS reporting errors.

**2. Standard set selection.** For each project, identify the applicable PFAS standards: federal MCLs (PFOA 4 ppt, PFOS 4 ppt, HI = 1.0), state individual MCLs (if applicable), and state aggregate standards (if applicable, like MA's sum-of-six or VT's sum-of-five). Screen against all applicable standards simultaneously.

**3. Hazard index calculation.** Build a calculation (in your tool or spreadsheet) that computes the HI for every sample. The formula is simple but must be applied consistently. For non-detect compounds in the HI calculation, use zero (the compound was not detected, so it does not contribute to the index). Document your non-detect handling approach.

**4. Method coverage documentation.** For every sampling event, record which analytical method was used and list the compounds it covers. Include a method coverage matrix in your report showing which regulated compounds are and are not covered by the analytical program.

**5. Detection limit adequacy for PFAS.** At 4 ppt MCLs, detection limit adequacy is critical. Check every non-detect PFAS result: is the RL below 4 ppt? If not, flag it. For HI compounds, check the RL against the HBWC (10 ppt for PFHxS, PFNA, HFPO-DA; 2,000 ppt for PFBS — the PFBS HBWC is so high that detection limit adequacy is rarely an issue for that compound).

**6. State standard tracking.** Subscribe to your state environmental agency's regulatory update notifications. PFAS standards are changing faster than any other contaminant class. A standard adopted in January may be revised by June. Your screening must use the standard in effect on the date of your compliance determination.

Based on the compliance challenges small firms encounter with PFAS:

**Mixing ng/L and ug/L.** A PFOA result of 0.004 ug/L is the same as 4 ng/L (ppt) — right at the MCL. If your spreadsheet has the result in ug/L and the MCL in ng/L (or vice versa), you will either miss a critical exceedance or report a false one. Standardize units before any comparison.

**Forgetting the hazard index.** Reporting individual PFAS results without calculating the HI is an incomplete compliance evaluation. A sample can pass all individual compound checks and still exceed the hazard index MCL.

**Using outdated state standards.** State PFAS standards change frequently. If you are screening a 2026 sampling event against 2024 state standards, you may be using superseded values. Verify the effective date of every standard you apply.

**Not documenting method limitations.** If your analytical method does not cover a regulated compound, the compliance report must say so. Silence on method coverage gaps is a finding waiting to happen during regulatory review.

**Applying drinking water MCLs to groundwater at contaminated sites.** Federal PFAS MCLs are drinking water standards under SDWA. Groundwater at a contaminated site may be subject to different standards — state groundwater quality standards, RSLs, or site-specific cleanup levels. Know which regulatory program applies to your project.

**Reporting total PFAS without specifying which compounds.** 'Total PFAS' has different meanings in different contexts. Some states define it as the sum of specific listed compounds. Others mean the sum of all detected PFAS. Your report must specify exactly which compounds are included in any sum.

The federal PFAS compliance timeline has two key milestones:

**By 2027: Initial monitoring.** Public water systems must begin monitoring for the six regulated PFAS. Environmental consulting firms supporting PWSs need PFAS compliance reporting capabilities in place before monitoring begins. The monitoring data needs to be screened against MCLs and reported to state primacy agencies.

**By 2031: Full MCL compliance.** Systems exceeding MCLs must install treatment or take other corrective action. Consultants will be supporting compliance assessments, remediation planning, and ongoing monitoring through this period.

For small firms, preparation means:

- **Build or acquire PFAS screening capability now.** Whether you upgrade your Excel workflow, adopt compliance software, or outsource PFAS data management, do not wait until 2027 when every firm will be competing for the same resources.

- **Understand the analytical methods.** Know what EPA 537.1, 533, and 1633 cover. Know what your preferred lab can achieve for detection limits. Build relationships with labs that can deliver PFAS results at adequate detection limits.

- **Track state PFAS regulations actively.** Set up alerts for your state environmental agency's PFAS rulemaking. States are moving faster than EPA on some fronts.

- **Train staff on PFAS compliance reporting.** The hazard index calculation, unit handling, and multi-standard screening are new skills for staff scientists who have been doing traditional compliance work. Invest in training now.

- **Evaluate your professional liability exposure.** PFAS compliance errors carry the same E&O risk as any compliance reporting error — arguably higher given the regulatory attention and public concern around PFAS. Ensure your workflow is defensible.

The firms that build PFAS compliance capability early will be positioned to handle the surge of PFAS work coming through 2027-2031. The firms that wait until they are forced to will be scrambling.