Three-quarters of the country's water supplies still do not have the required plan that identifies hazards to water sources, but those that do cover most of the population.
Water regulator Taumata Arowai has been checking hundreds of new water safety plans since January. Some have yet to be done despite a November 2022 deadline, and in other cases the agency does not have all the documents that plans refer to.
It was figuring out "whether those documents are critical", it told RNZ.
The regulator was set up, and strict new requirements imposed, after the Havelock North water poisoning in 2016. But the 'deadlines' around the new law and tighter rules are proving fluid.
Almost 2000 water supplies must have a water safety plan. By May, 750 had been submitted. In addition, 1200 of those 2000 need a source water risk management plan (SWRMP), but only 308 - or a quarter - had one.
"This low return rate ... is not unexpected," said Taumata Arowai regulatory head Ray McMillan in a statement.
The legal requirement was relatively new and the authority was giving water suppliers a chance to come up to speed.
The 308 with a separate source water plan covered 86 percent of the population.
"Most of the supplies without SWRMPs are small supplies."
Out of the 1200 that require an SWRMP, about 450 are owned by councils. Of those, 300 had a plan and 158 did not. At stake is staying ahead of the threat of potentially lethal bugs in the water.
"There are no bright lines around how many, or what sort, of hazards and risks need to be covered or how they should be addressed," the agency said.
"We can take rapid action where acute risks are detected," McMillan said.
The law and the regulations clearly state: "Drinking water suppliers must prepare and implement a SWRMP to identify source water hazards, any risks associated with those hazards, and how those risks will be managed, controlled, monitored, or eliminated".
But the regulator is giving suppliers some leeway on timing, and depending on the size and nature of their supply.
"Incomplete compliance following the 15 November, 2022, deadline is not entirely unexpected" given the range of regulatory change and how varied councils' capabilities were, McMillan said.
Water supplies which still did not have a SWRMP were expected to manage the hazards through their primary water safety plan (called a DWSP), McMillan said.
Sometimes these plans were merged together and the agency was combing through the safety plans to see if the source hazards were covered.
"We will be focusing on determining gaps" including where this was not happening, McMillan said.
Some supplies are not registered at all, and have until 2025 to do that, then until 2028 to do a drinking water safety plan or come up with an alternative.
Taumata Arowai said it was ahead in its own "rapid review" of the plans.
Wairoa District Council, hard hit by Cyclone Gabrielle, is a classic example of a small council struggling to get the source hazards plan done, though it has done a water safety plan.
Taumata Arowai said it had not approved the delay at Wairoa, but knew the council had considered the hazards and had an interim plan in place to manage them until a fuller SWRMP was developed.
"Taumata Arowai is comfortable with the approach followed by Wairoa District Council, but our approach may change if the improvement programme is not implemented in a timely manner."
Also, if there were a water supply problem, the lack of an SWRMP would count against the council.