Taxpayers are too often being forced to pay to clean up environmental damage while the companies responsible dodge the costs, the European Court of Auditors said on Monday.

The European Union’s executive Commission will propose rules this year to force companies to find and fix risks to human rights and the environment in their supply chains.

But so far, EU regulation has a patchy record on holding polluters responsible for the environmental damage they cause in Europe, and in some cases companies are not required to clean up after themselves, auditors said in a report.

“Polluters need to pay for the environmental damage they cause,” said report author Viorel Stefan. “Up to now, though, European taxpayers have far too often been forced to bear the costs that polluters should have paid.”

The auditors looked at a sample of 42 environmental clean-up projects, backed by 180 million euros ($214 million) of EU funds, to fix issues like industrial pollution and contaminated landfill sites in Italy, Poland and Portugal.

Roughly a third of the money was spent on “orphan pollution,” where contaminated sites were damaged so long ago that polluters cannot be identified or made liable. In other cases, EU taxpayers paid for the clean-up since the company responsible was insolvent.

The auditors said the EU should close gaps in legislation that let companies off the hook. That could include lowering the emissions limits large industrial facilities must comply with to gain a permit to operate.

EU legislation holds companies liable when they cause “significant” environmental damage, but the auditors said the law needs a more specific definition of such damage.

Brussels could also consider legislation to require companies to have insurance, cash reserves or another type of security to ensure that if they cause environmental damage, they are able to pay the costs, the auditors said. ($1 = 0.8430 euros)

(Reporting by Kate Abnett; Editing by Hugh Lawson