California’s 2026 water regulatory updates focus on tightening groundwater extraction limits, new non-functional turf irrigation bans prepping for 2027, updated Colorado River management frameworks, and revised state acquisition rules for at-risk water systems.
Groundwater and Local Sustainability
- SGMA Enforcement: Implementation of the Sustainable Groundwater Management Act (SGMA) is intensifying, with local agencies rolling out stricter pumping limits and fees. This has raised economic and operational concerns among small-scale farmers who report high vulnerability to new water caps.
- Data and Measurement: The state has finalized preparations for updated water measurement and data reporting rules under Title 23, setting rigorous requirements for water diverters starting in Water Year 2027.
Turf and Conservation Mandates
- AB 1572 Preparations: Public water agencies are actively updating service rules to comply with Assembly Bill 1572, which bans the use of potable water on non-functional turf (such as ornamental grass in commercial or institutional spaces) starting January 1, 2027.
Colorado River & Supply Operations
- Federal Long-Term Framework: The U.S. Bureau of Reclamation released its updated operational guidelines for the Colorado River through 2036. The framework establishes triggers for future water delivery cuts across California, Arizona, and Nevada if Lake Mead and Lake Powell drop to critical levels.
Utility and Drinking Water Rules
- CPUC Acquisition Decision: The California Public Utilities Commission adopted Decision 26-07-031 to prioritize failing or at-risk water systems for voluntary consolidation, a move immediately challenged by the California Water Association over last-minute procedural changes.
- PFAS & Contaminant Standards: The California State Water Resources Control Board continues to advance new Maximum Contaminant Levels (MCLs) for persistent chemicals like PFAS and updates to the Lead and Copper rules under the Division of Drinking Water.
Recent Attacks on U.S. Water Systems
A wave of cyber intrusions has hit water and wastewater utilities across at least a dozen states, and investigators are now working to determine whether hackers with ties to Iran are responsible. The good news: no drinking water was actually contaminated. Still, the disruption was tangible — several Minnesota communities dealt with weakened water pressure or short-term boil water advisories while utilities worked to regain control of their systems.
What made these attacks possible wasn’t a flaw in the water itself, but in the digital layer that runs it. Hackers gained access to internet-connected operational systems — the software governing pumps, wells, valves, and pressure regulation — rather than the physical supply. Minnesota alone logged over 30 compromised systems, Michigan reported nine, and at least 10 other states confirmed similar incidents. In each case, the pattern looked familiar: unauthorized password changes, altered network settings, and operators finding themselves locked out of their own control panels. What stopped a worse outcome were the redundancies built into these systems — manual controls and safety mechanisms that don’t depend on the compromised software. This isn’t the first time Iranian-linked groups have set their sights on American water systems or other domestic targets.
The bigger takeaway may be scale: with more than 152,000 public water systems operating across the country, incidents like these are a reminder of just how exposed the sector’s operational technology can be — and how much depends on the manual fail-safes that exist precisely for moments like this.