No safe threshold, unlike almost everything else EPA regulates
Most contaminants EPA regulates have a maximum level below which exposure is considered acceptable. Lead does not - the EPA and CDC treat any detectable lead exposure as a risk, especially for children, which is why DrinkingWaterCheck ranks a lead & copper flag as the single most urgent concern category, above even acute microbial risks.
It usually isn't the utility's water that's the problem
Lead contamination typically comes from lead service lines or lead solder in a building's own plumbing, corroding after the water has already left the treatment plant - which is why a system can carry a lead & copper flag while its source water tests clean. CHICAGO, IL and CLEVELAND PUBLIC WATER SYSTEM, OH are both large systems with a lead & copper flag on record, from cities with substantial lead service line inventories.
What EPA's Lead and Copper Rule actually requires
Utilities must sample water at high-risk taps (older homes with lead service lines) and take corrosion-control action if too many samples exceed the action level. A violation means that action level was exceeded or the required corrosion-control step wasn't taken, not that every tap in the system carries lead. SEATTLE PUBLIC UTILITIES, WA shows how this reads on one system's own page, alongside the NSF/ANSI 53 filter class it points to.
Where to go next
Real systems this plays out on: CHICAGO, IL, CLEVELAND PUBLIC WATER SYSTEM, OH, SEATTLE PUBLIC UTILITIES, WA.
What EPA's Water Data Doesn't Cover · How to Read a "No Violations" Record