EPA Finalizes Revisions to Risk Management Program (RMP) Regulations, with Special Focus on Petroleum and Chemical Manufacturers

RMP remains an enforcement priority for the EPA. The EPA has retained “Chemical Accident Risk Reduction” as one of its six enforcement priorities for fiscal years 2024–2027, with a focus on RMP noncompliance at facilities using anhydrous ammonia or hydrogen fluoride.

We provide below an overview of RMP and then highlight six key elements of the Rule.

RMP Structure and Program Levels

RMP originates from Section 112(r) of the Clean Air Act and addresses chemical accident prevention at facilities that use, store, or otherwise handle one of 140 toxic, flammable, or extremely hazardous substances above threshold quantities. With limited exceptions, RMP applies to any location that has more than a threshold quantity of a regulated substance, including agriculture and food production, chemical and paper manufacturing and distribution, petroleum refineries, utilities, warehousing/storage, and government operations.

RMP divides affected processes¹ into Program 1, Program 2, and Program 3, based on the complexity of the process and the associated risks. The EPA scheme for dividing processes between the programs is convoluted, but Program 3 is the most restrictive, and Program 1 is the least restrictive. Program 3 includes all processes also subject to OSHA Process Safety Management program requirements. Processes at petroleum refineries, certain chemical manufacturing facilities,² and pulp mills are Program 3 unless they meet the requirements for Program 1 status (e.g., no accidental release in the five years prior to submitting a risk management plan and no public receptors within the area affected by the worst-case release scenario for the facility). A process falls under Program 2 if it does not meet the requirements for either Program 1 or 3. The EPA characterizes the requirements for Program 2 as less extensive and more streamlined than Program 3. Generally, Program 2 applies to processes at smaller businesses, such as those that might use ammonia-based refrigeration systems or use chlorine and other chemicals for water treatment.

Unless specified otherwise, the Rule changes discussed below apply only to Program 2 and 3 processes.

Key Elements

1. Safer Technology and Alternatives Analysis (“STAA”)

The STAA requirements in the Rule apply only to processes at refineries and certain types of chemical plants. By definition, processes at facilities fitting in the refinery and certain chemical plant definitions are subject to Program 3.

There are three STAA-related requirements in the Rule:

1. Conduct an STAA for processes at covered refineries and chemical plants;
2. Conduct a practicability assessment for the “inherently safer technologies or designs” (“IST/ISD”) considered; and
3. Implement at least one passive measure or IST/ISD, or a combination of active and procedural measures equivalent to or greater than the risk reduction of a passive measure.

Processes are subject to the second and third requirements above if they:

• are located within one mile of another petroleum or specified chemical manufacturing facility;
• are at petroleum refineries with processes using hydrofluoric acid alkylation; or
• have had a reportable accident within the last five years.

The Rule defines IST/ISD as “risk management measures that minimize the use of regulated substances, substitute less hazardous substances, moderate the use of regulated substances, or simplify covered processes in order to make accidental releases less likely, or the impacts of such releases less severe.” Covered facilities can also adopt a similarly protective active measure (e.g., controls that rely on mechanical input to detect and respond to process deviations) or passive measure (e.g., measures that use design features that reduce either the frequency or consequence of a hazard without human, mechanical, or energy input).

The Rule also requires documentation of the justification for not adopting IST/ISD and reporting to EPA when inherently safer designs or technologies are adopted.

This part of the Rule has drawn considerable criticism, and the EPA’s own analysis projects that these changes will account for roughly two-thirds of the Rule’s nearly $300 million per year compliance cost for industry.

2. Natural and Adjacent Hazards

The Rule requires facilities to address natural hazards — including those caused by climate change — in their hazard evaluations. Industry has argued that the EPA has not justified this new regulatory burden, citing to a Government Accountability Office report finding that a natural hazard was the initiating event in just 2% of RMP-reportable accidental chemical releases in the last five years.³

The EPA asserts that the new language related to climate change does not add new obligations because considering risks to a process from weather and natural events is already a part of industry practice and is required by RMP without this amendment. The EPA claims that the climate change risk evaluation requirements explicitly state what is already implicit under existing regulations. Accordingly, the EPA maintains that a climate risk evaluation does not increase RMP compliance costs because facilities should already be including applicable risks in hazard assessments.

In the Rule preamble, the EPA points to existing guidance related to natural hazard risks including from Center for Chemical Process Safety, the Federal Emergency Management Agency’s (FEMA) National Risk Index, and FEMA’s recent publication Climate Essentials for Emergency Managers.

The EPA considered but decided not to develop and publish a list of sources that the EPA deems to have heightened risk of climate events. Instead, the EPA pointed to existing studies and reports that may provide the regulated community with guidance on natural or climate related hazards to consider.

Facilities must consider hazards posed by proximate facilities and accidental release risks posed by proximity to the public. These hazards include how the proximity of an accidental release can impact offsite receptors, increase the likelihood of a secondary “knock on” release by compromising a nearby process, and how such releases can impact the surrounding community.

3. Backup Power

The Rule requires facility owners and operators to ensure that monitoring equipment associated with prevention and detection of accidental releases from RMP covered processes has standby or backup power to provide continuous operation. The Rule also requires that as part of a hazard review or analysis, an owner or operator consider whether standby or emergency power systems are necessary. If the owner or operator develops a recommendation as part of that review or assessment that standby or emergency power systems are needed to mitigate identified hazards, then the facility’s risk management plan must explain why those recommendations were declined.

4. Third-Party Audits

The Rule requires that the next required RMP compliance audit be conducted by a third party when a facility has had an accident that resulted in deaths, injuries, or significant property damage onsite, or if the accident resulted in known offsite deaths, injuries, evacuation, sheltering in place, property damage, or environmental damage — or if the EPA or delegated state agency otherwise determines an independent audit is necessary. When preparing an RMP after a third‑party compliance audit has been conducted, a facility must choose from preset categories, similar to those in OSHA’s 1994 Compliance Directive, to explain why the facility declined to adopt any third-party compliance audit recommendations. The EPA indicates in the Rule preamble that it will revise its RMP submission template so that it only accepts the preset categories of reasons for why a recommendation was not accepted.

The Rule requires certifications of compliance by a senior corporate officer and that the owner or operator provide the audit report, response, and schedule for implementation to the audit committee (or comparable committee or individual) of the board of directors for the owner or operator.

The EPA asserts that its RMP accident history data shows that 97 percent of RMP facilities had no RMP reportable accidents from 2016 through 2020. That statistic is unlikely to be representative of larger facilities, such as refineries and chemical plants. The third-party audit threshold may also result in much greater scrutiny of a facility’s decision on classification of an accident as an RMP accident.

5. Root Cause Analysis

The Rule expands the incident investigation requirements to include a root cause investigation, using a recognized root cause investigation method. The EPA indicates in the Rule preamble that at least one member of the investigation team should be knowledgeable in the selection and use of root cause analysis techniques. The EPA notes that some companies already conduct root cause investigations and that there are industry guidance materials for root cause investigations. OSHA strongly encourages root cause investigations under its Process Safety Management program. Nonetheless, the addition of a root cause investigation requirement expands the resource requirements for incident investigations under RMP.

Owners and operators should proceed cautiously when investigating root cause, which the Rule defines as a “fundamental, underlying, system-related reason why an incident occurred that identifies correctable failure(s) in management systems and, if applicable, in process design.”

The Rule requires that an investigation be completed within 12 months of the occurrence of a covered incident.

6. Public Information Requests

The Rule contains new requirements aimed at making information more transparent and accessible. Members of the public residing, working, “or spending significant time within” a six‑mile radius of a facility may now submit an information request to that facility. The information that the facility owner or operator must then provide includes but is not limited to:

1. Five years of accident history information, which includes incidents that resulted in deaths, injuries, or significant property damage onsite, or if the accident resulted in known offsite deaths, injuries, evacuation, sheltering in place, property damage, or environmental damage.
2. Summary information related to the facility’s emergency response program.
3. Process hazard analysis⁴ recommendations the facility declined to adopt and the justification for not adopting the recommendations.
4. Safety data sheets for all regulated substances located at the facility.
5. A list of scheduled emergency response exercises, including dates scheduled within the next year.

Facility owners or operators must also maintain a public webpage with details on what information can be requested and how to request such information. Facilities have 45 days to respond to public information requests.

The Rule preamble implies that facility owners or operators will have an obligation to translate all of the information required to be made available to the public in two major languages spoken in the area of the facility based on census data. However, it is unclear whether the Rule’s regulatory text actually imposes such a requirement.

Outlook

Litigation challenging the Rule is a near certainty. While litigation plays out, RMP will remain an active area of EPA enforcement. Companies subject to RMP should review the Rule promptly to assess impacts on their operations. Regulated sources will have to comply with most of the Rule’s requirements, including the above requirements, by May 10, 2027. Facilities will have until May 10, 2028, to update and resubmit risk management plans to reflect the Rule’s new requirements.

¹ A process is any activity involving a regulated substance.

² The current RMP regulations identify covered chemical manufacturing processes using NAICS codes.

³ U.S. Gov’t Accountability Office, GAO-22-104494, Chemical Accident Prevention: EPA Should Ensure Regulated Facilities Consider Risks from Climate Change 12–13 (2022), https://www.gao.gov/assets/gao-22-104494.pdf.

⁴ A process hazard analysis is a risk study that RMP regulations require facilities to perform before a new covered process is commissioned, at least every five years thereafter, and after major changes to the process.