Duke Energy is finally being ordered to clean up its coal-ash ponds in North Carolina — more than two years after one of them leaked 40,000 tons of toxic muck into the Dan River. But it has eight years to get the job done, and the state Department of Environmental Quality (DEQ) hopes to give the company even more flexibility.

Duke, the nation’s largest electric utility, has 33 sites around the state where it dumps toxic ash waste from its coal-fired power plants, and some of the sites are believed to be leaking hazardous chemicals into nearby water supplies. For a year, hundreds of households near coal ash ponds were told not to drink water from their wells, which was found to have high levels of a known carcinogen. This spring, they were told they could resume drinking the water, even though it hadn’t been cleaned up. (We wrote more about this earlier this week.)

In a proposal released on Wednesday, DEQ said Duke should excavate and close eight of the most dangerous coal ash sites by 2019, and the 25 others by 2025. But DEQ is asking the state legislature to be allowed to reconsider the timeline in 18 months. The agency has been accused of being lenient on Duke; last year, DEQ lowered the utility’s fine for the big 2014 spill from $25 million to $7 million.

Duke CEO Lynn Goode said the cost of the cleanup could be as high as $4 billion — and the company would seek to pass that cost on to the state’s residents. “It’s fair to say that if we have to excavate all of our basins, it would be significantly higher costs for our customers,” Goode said during a conference call with reporters.

Environmentalists say the DEQ’s recommendations don’t go far enough. “DEQ just ducked its responsibility and punted it into the future,” said Peter Harrison, attorney for the Waterkeeper Alliance. “As usual, North Carolina’s so-called leadership has shown it lacks the courage to stand up to powerful polluters, even when people’s health is at stake.”