Abstract Background The number of chemical parameters included in monitoring programs of water utilities increased in the last decade. In accordance with the European Drinking Water Directive, utilities aim at a tailored risk-based monitoring (RBM) program. Here, such a RBM program was developed for the largest Dutch water utility, mostly using groundwater as a source. Data from target analyses and high-resolution mass spectrometry-based suspect screening was used to cluster the different source waters. Targets were prioritized based on (preliminary) drinking water guideline values or the threshold of toxicological concern. Suspects were prioritized for further identity confirmation based on semi-quantitative occurrence concentrations combined with in vitro toxicity information. Finally, a RBM program was suggested for each cluster of source waters. Results Out of 731 target chemicals, 153 were detected at least once over a 5-year period. Roughly 10% of the detected non-target screening features matched to suspects. 108 source waters were clustered into 7 clusters. Source waters with low numbers and concentrations of organic chemicals were located in areas with all land-use types, while clusters of source waters with higher numbers of chemicals were related to infiltrated surface water. For perfluorinated chemicals, 25 suspects matched features detected in source waters and 7 features detected in drinking water. For the target chemicals, simple treatment showed the lowest and sorption-based techniques relatively high removal efficiencies. The chemical composition of all drinking waters related to non-contaminated source waters. (Preliminary) guideline values were available for 45 of the retrieved target chemicals, and used for prioritization for monitoring frequencies. These chemicals individually posed no appreciable concern to human health. Suspects were prioritized for further identity confirmation based on semi-quantitative occurrence in produced water, detection frequencies and information on toxic potency. Once confirmed and assessed as relevant, the suspects could be added to target monitoring. Conclusion This approach provided a feasible workflow for RBM of target chemicals for clusters of groundwater sources, connected to a feed of new relevant chemicals based on suspect screening.