The bipartisan FLOWS Act of 2026 would create EPA-administered grants for small water utilities to deploy sensors, SCADA systems and AI tools while reinforcing cyber defences.
A Federal Lifeline for Under-Resourced Water Providers
U.S. Senators John Boozman (R-AR) and Mark Kelly (D-AZ) have introduced the Futureproofing Local Operations for Water Systems (FLOWS) Act of 2026, a bill that would channel $50 million per year into competitive grants for rural drinking water, wastewater and stormwater operators. The programme, to be administered by the U.S. Environmental Protection Agency (EPA), targets utilities serving communities with fewer than 3,300 residents, a segment that encompasses thousands of the country’s roughly 152,000 public water systems.
The legislation stands out for two structural design choices. First, it eliminates the local funding match typically required by federal infrastructure programmes, a condition that has historically locked the smallest ratepayer-funded systems out of grant competitions. Second, eligible spending extends beyond hardware procurement to cover ongoing software maintenance, an acknowledgement that digital tools lose value without sustained operational support.
What the Bill Would Pay For
The FLOWS Act defines four technology categories eligible for grant funding. Remote sensing and real-time monitoring platforms, including acoustic leak-detection tools and flow and pressure sensors, represent the first tier. The bill also covers industrial control systems such as supervisory control and data acquisition (SCADA) platforms, which are the operational backbone of most modern water and wastewater treatment facilities.
Artificial intelligence and optimisation technologies form a third category, aimed at helping small operators improve system performance and asset management without expanding headcount. The fourth encompasses digital engineering tools, including hydraulic modelling software and construction management platforms used for network planning and design.
Beyond equipment, the bill allocates funding for cybersecurity training and technical assistance, recognising that deploying connected infrastructure without adequate protection can introduce new vulnerabilities.
Cyber Threats Lend Urgency to Digital Investment
The timing of the legislation reflects growing alarm over the security posture of the U.S. water sector. A 2024 EPA review found that more than 70 percent of inspected water systems failed to meet basic cybersecurity requirements, from unchanged default passwords to unpatched software. That same year, American Water, the largest regulated water utility in the country, disclosed a cyberattack that forced the disconnection of its customer portal and a temporary halt to billing operations.
State-sponsored actors have also targeted the sector. Russian-linked hackers breached a water facility in Muleshoe, Texas, in January 2024, causing a tank overflow, while U.S. intelligence agencies have warned that Chinese groups, notably the campaign tracked as Volt Typhoon, have pre-positioned malware inside water system networks as preparation for potential future conflict.
A November 2024 report from the EPA’s Office of Inspector General identified critical or high-risk vulnerabilities in nearly 100 drinking water systems serving approximately 27 million people. For many rural operators running one- or two-person teams, the notion of maintaining a cybersecurity programme alongside daily operations remains aspirational. The FLOWS Act attempts to bridge that gap by treating cybersecurity readiness as a core component of digital modernisation rather than a separate mandate.
Where Rural Utilities Stand in the Infrastructure Debate
The American Society of Civil Engineers (ASCE) released its 2025 Report Card for America’s Infrastructure in March 2025, assigning the nation’s overall infrastructure a grade of C, its highest mark since the assessment began in 1998. However, the grades for drinking water (C-), wastewater (D+) and stormwater (D) remained unchanged from 2021, signalling persistent underinvestment in water systems even as other sectors improved.
The EPA’s 2023 Drinking Water Infrastructure Needs Survey estimated that $625 billion in investment is required over the next 20 years to maintain safe water supply nationwide. Federal investments through the 2021 Infrastructure Investment and Jobs Act (IIJA) have begun to address some of this backlog, directing $30 billion toward lead pipe removal and capital improvement projects. But the IIJA’s authorisation is set to expire in 2026, raising questions about whether sustained funding will continue at comparable levels.
The challenges are especially acute for small and rural systems. While community water systems serving fewer than 10,000 people represent roughly 90 percent of the nation’s total systems, they account for only a fraction of the population served, making it difficult for them to generate the revenue needed for technology investment. The FLOWS Act is positioned as a complement to broader infrastructure funding, specifically designed to reach providers that IIJA-scale programmes have struggled to serve.
The affordability dimension explored in this legislation mirrors challenges seen internationally. In Spain, for instance, EU-funded programmes such as the PERTE Digitalización del Ciclo del Agua have channelled NextGenerationEU funds to digitalise rural water networks, as seen in projects like Soria Province’s deployment of over 400 real-time water sensors across more than 100 municipalities. Such parallels suggest a broader global recognition that small, rural utilities require dedicated funding mechanisms to participate in the digital transformation of water infrastructure.
Industry and Institutional Support
The bill has secured backing from a broad coalition of trade groups, engineering bodies and technology vendors. The National Rural Water Association (NRWA), which represents more than 31,000 small and rural utility members, and the National Association of Clean Water Agencies (NACWA) have both endorsed the legislation. The American Society of Civil Engineers praised the bill as a practical measure to help local utilities adopt digital tools that improve operational efficiency.
On the vendor side, Bentley Systems, Autodesk, Grundfos and Xylem have expressed support, alongside the Arkansas Rural Water Association and the Business Software Alliance. The participation of engineering software companies such as Bentley and Autodesk alongside infrastructure hardware providers like Grundfos and Xylem reflects the bill’s dual emphasis on both physical equipment and digital planning tools.
Legislative Outlook and Competing Proposals
The FLOWS Act enters a legislative environment where water cybersecurity has attracted bipartisan attention but limited concrete federal action. In 2025, Senators Catherine Cortez Masto (D-NV) and Cindy Hyde-Smith (R-MS) reintroduced the Cybersecurity for Rural Water Systems Act, which would expand the existing Circuit Rider Program to include dedicated cybersecurity specialists serving small utilities. The EPA also launched a $9.5 million cybersecurity grant programme in August 2025, though analysts noted it excluded community water systems serving fewer than 10,000 people, leaving out the vast majority of the country’s most vulnerable providers.
At the state level, New York announced in March 2026 a $2.5 million grant programme and new cybersecurity regulations for water and wastewater facilities, requiring measures such as multi-factor authentication and the prohibition of default credentials. These parallel efforts at the federal and state level suggest growing consensus that water utility cybersecurity can no longer be treated as an optional upgrade.
Whether the FLOWS Act advances through committee during the current congressional session remains uncertain. But the coalition behind it, spanning rural utility operators, engineering firms and digital infrastructure vendors, signals that the case for federally funded digital modernisation of small water systems has moved beyond advocacy into active legislative effort.
