Industrial Hygiene and Exposure Risk Management in a Changing Regulatory Environment

Overlapping federal regulations around PFAS, silica, and heat stress require shifting from site-specific sampling projects to defensible, enterprise-wide industrial hygiene programs.

• By Robert G. Costello, Michael Culkin
• Aug 20, 2026

Executive Summary

Industrial Hygiene is facing a period of heightened regulatory complexity driven by overlapping requirements around PFAS, respirable crystalline silica, heat stress, and expanded chemical controls. Regulators, insurers, and courts are increasingly evaluating organizations not just on minimum compliance, but on whether exposure risks are managed consistently and defensibly: a rising "standard of care."

Many organizations struggle with execution at scale, particularly around historical data, hazard communication, and multi-site consistency. The traditional project-based Industrial Hygiene model is insufficient for today's demands. Leading organizations are shifting toward structured, enterprise-level programs that prioritize risk-based resource allocation, continuous monitoring, and auditable documentation to ensure long-term defensibility.

Introduction: Industrial Hygiene Consulting for Emerging Compliance and Exposure Challenges

Industrial Hygiene is entering a period of renewed regulatory intensity across North America. Emerging and evolving requirements related to per- and polyfluoroalkyl substances (PFAS), respirable crystalline silica, heat stress, and expanded chemical controls are increasing both the scope and complexity of exposure management obligations.

At the same time, expectations from regulators, insurers, and courts are shifting. Organizations are no longer evaluated solely on whether they meet minimum compliance thresholds, but on whether they can demonstrate that exposure risks are understood, managed, and defensible over time.

To explore how this environment is evolving, this article draws on expertise across Industrial Hygiene, regulatory compliance, operational risk management, and litigation support to examine what is changing, where organizations are exposed, and how leading companies are adapting.

Industrial Hygiene, Risk, and Readiness

Regulation as Business Risk

What continues to separate organizations that respond effectively from those that fall behind is less about technical capability and more about how organizations choose to respond. Some companies take a wait-and-see approach. They delay action, assume enforcement will be slow, or treat new rules as something to deal with later. Others take the opposite view: they engage early, try to understand the implications, and build a structured response.

The difference comes down to whether regulation is treated as a business risk or simply a compliance obligation. The organizations that consistently perform well are the ones that recognize early that these changes affect operations, not just reporting.

Overlapping Drivers Raise the Bar

The biggest difference in the current wave of regulatory change is that organizations are no longer dealing with isolated requirements. Today’s environment includes multiple overlapping drivers:

• PFAS reporting requirements under the Toxic Substances Control Act (TSCA), which may require more than a decade of retrospective data.
• Lower exposure limits for respirable crystalline silica, with near-term compliance deadlines.
• Emerging heat stress standards, which introduce continuous monitoring expectations.
• Ongoing updates to chemical controls and hazard classifications.

None of these, individually, is unprecedented. But together, they create a situation where industrial hygiene must be continuously managed. Organizations are now expected to manage exposure across multiple sites, multiple hazards, and extended timeframes, often simultaneously.

Where Organizations Underestimate the Challenge

PFAS is a clear example of where organizations most risk underestimating the challenge. Many organizations do not yet fully understand the scope of what is required, particularly when it comes to historical data. It is not just current use; it involves going back years to identify where these substances may have been present. Beyond that, we continue to see recurring gaps in areas that have been regulated for decades:

• Hazard Communication (HazCom) programs breaking down in practice.
• Incomplete or outdated Safety Data Sheets (SDS).
• Inconsistent labeling and training.
• Ongoing issues with asbestos and lead management, especially in renovation and demolition work.

These are not new problems. The issue is that they require continuous attention, and many organizations struggle to maintain that consistency over time. The underlying challenge is not awareness, but execution at scale.

Involving Focuses on Compliance, Best Practice, and Standard of Care

Expectations from regulators and courts are evolving with increasing focus on what is often referred to as the standard of care. For example, there is a well-known gap between Occupational Safety and Health Administration (OSHA) Permissible Exposure Limits (PELs) and the American Conference of Governmental Industrial Hygienists (ACGIH) Threshold Limit Values (TLVs). OSHA limits, in many cases, have not kept pace with scientific understanding.

Decisions are not always based solely on whether an organization meets the legal minimum. There is growing scrutiny around whether they followed what is considered “best practice.” That changes the conversation. It is no longer enough to say, “We were compliant.” Organizations need to demonstrate that their approach to exposure management was reasonable, informed, and consistent.

Structure and Prioritization

For organizations dealing with limited Environmental, Health, and Safety (EHS) resources and multiple deadlines, the first step is structure. Organizations need a clear understanding of which requirements apply, when they take effect, and what actions are required to comply. Organizations need a clear understanding of:

• Which requirements apply?
• When do they take effect?
• What actions are required to comply?

That sounds simple, but in practice, it is often missing. A regulatory calendar can go a long way in helping teams prioritize and plan.

The second step is prioritization. Not all risks are equal, nor are all deadlines equally exposed. Organizations need to allocate their resources where the potential impact is greatest. The biggest mistake is staying in a reactive mode and addressing each issue as it arises rather than building a system to manage them collectively.

From Projects to Programs

Given these pressures, the traditional Industrial Hygiene model (that is, sampling, analysis, and reporting) was designed for a different environment. It works well when the scope is limited, the hazard is well understood, and the requirement is clearly defined.

However, today’s challenges are broader. Organizations need to:

• Track exposure across multiple facilities and worker populations.
• Maintain historical data that can withstand scrutiny.
• Demonstrate consistency in how decisions are made.

That is difficult to do when work is structured as a series of independent projects. The model itself is not wrong; it is just not designed for the level of continuity and scale that is now required.

Leading organizations are starting to think about programs rather than projects. That means looking at exposure risk across the entire organization, prioritizing effort where it matters most, and maintaining ongoing visibility into conditions rather than relying on point-in-time assessments. There is also greater emphasis on documentation and on ensuring that decisions can be explained and supported later, if needed.

Technology plays a role, but it is not the driver. The goal is not automation for its own sake. It is about enabling consistent, repeatable, and defensible Industrial Hygiene management.

Exposure Risk Management and Industrial Hygiene Program Implications

The current regulatory environment is creating a fundamental shift in how exposure risk must be managed. What was once a largely periodic, site-specific compliance activity is evolving into a continuous, enterprise-level responsibility. Industrial Hygiene is no longer confined to discrete assessments triggered by incidents, inspections, or capital projects. Instead, it is becoming an ongoing discipline that cuts across operations, regulatory compliance, and legal defensibility.

This shift is driven by the nature of the requirements themselves, particularly emerging and expanding obligations related to per- and polyfluoroalkyl substances (PFAS), respirable crystalline silica, heat stress, and chemical controls. They require organizations to manage exposure across multiple facilities over extended time horizons, with increasing expectations for documentation and traceability.

As a result, organizations that continue to approach Industrial Hygiene as a series of disconnected projects are encountering structural challenges. These often include inconsistent execution across sites, gaps in historical data and institutional knowledge (particularly under retrospective reporting requirements), and difficulty demonstrating that decisions were made in a consistent and defensible manner. In environments where regulators, insurers, and courts are placing greater emphasis on “standard of care”, these gaps can become material.

Leading organizations are beginning to respond by introducing more structured approaches to exposure management. Rather than reacting to individual requirements in isolation, they are focusing on building consistency across their programs. This includes improving visibility into exposure conditions across operations, prioritizing resources based on risk, and ensuring that documentation and decision-making processes can withstand scrutiny over time.

Engaging Industrial Hygiene Consultants and Other Experts

The right experts, when combining Industrial Hygiene, toxicology, regulatory compliance, and litigation support, can help organizations move beyond point-in-time assessments toward consistent, enterprise-level management of exposure risk. This includes multi-site exposure assessments, ongoing monitoring, and translating exposure data into defensible health risk insights. A critical differentiator is the ability to convert complex regulatory requirements into repeatable, operational programs. Many organizations understand what is required but struggle to execute consistently across facilities and over time.

In environments where exposure decisions may be scrutinized by regulators, insurers, or courts, consistency in how data is generated, interpreted, and documented is essential. EHS digital solutions experts can support this shift by enabling organizations to integrate data across platforms (e.g., industrial hygiene, safety, and environmental systems), improve visibility into exposure conditions, and maintain auditable, defensible records. The result is a more structured approach to managing exposure risk—one that aligns operational execution with regulatory expectations and long-term defensibility.