Regulatory risk shows up first in the Federal Register, as a proposal with a comment period and an effective date far enough out that nobody in finance feels any urgency about it. Legal reads it, somebody forwards it, and it gets filed under later. Then a year passes, the rule is final, the compliance date is close, and the cost is whatever it is, because the window for changing it closed while everyone was busy.
For the budget, the months that matter are the ones in the middle, while it's still a proposal. This year has produced plenty to practice on:
- In August the FDA proposed making GRAS notification mandatory. Companies that decide an ingredient is generally recognized as safe would have to tell the agency instead of deciding it on their own. Comments are open until December 9, and there's a simpler, time-limited route for ingredients already on the market.
- In July, CMS proposed extending site-neutral payment to imaging without contrast at off-campus hospital outpatient departments starting in 2027. The agency estimates about $260 million in first-year savings. Savings for Medicare, that is. For the hospitals running those departments it's $260 million of revenue.
- Also in July, the EPA proposed changes to the 2027 heavy-duty engine rules, including the useful life and warranty periods, and swapping DEF engine derates for warnings. If you build truck components or run a fleet, what a 2027 truck costs depends on which version wins.
- And in May, the EPA proposed letting water systems ask for two more years on the PFOA and PFOS limits, moving compliance from April 2029 to April 2031 for systems that qualify.
Two of those add cost or take revenue away. The other two ease costs for one group and push revenue out for whoever sells them the fix. Proposed rules move money in both directions, and that's the reason they belong in the budget and not only in the legal department's inbox.
What a proposed rule already tells you
Read one all the way through and most of what finance needs is on the page. Its scope section says whether your business is covered and, if there are thresholds, how close you sit to them. Timing is next: the comment deadline and the proposed compliance date, and between them those tell you which budget year eats the cost. And the shape of the requirement tells you whether you're looking at one-time money, for systems or testing or reformulation, or recurring money, for reporting and audits and the person who ends up owning it.
Larger proposals come with the agency's own cost estimate, usually in a regulatory impact analysis. Use it as a starting point, not an answer. Agencies estimate for an average affected company, and a mid market business with one plant and a two-person compliance function tends to land above that average per unit. Sometimes well above it.
Max De Pree, who ran Herman Miller for years and wrote a short book on leadership that still holds up, said the first responsibility of a leader is to define reality. A provisional number does that for a proposed rule, because until someone puts a figure next to it, the thing is a legal memo that a busy room can nod at and move past, and afterward it's a budget line with a name on it.
How to put a number on regulatory risk
Do it in passes. First, cost the rule as proposed, keeping one-time and recurring pieces separate. Second, cost the version you'd expect once industry comments have landed, which in most cases means a softer rule with a later date. Put a rough probability on each and carry the weighted figure as its own named line in the budget. Don't bury it in contingency, where nobody will remember why it's there by the time it matters.
A worked example with made-up numbers. Say the rule as proposed would cost you $400,000 up front and $120,000 a year starting in 2027. The softer version costs $250,000 up front and $80,000 a year starting in 2028. Call it 40% odds on the first and 60% on the second. That puts roughly $210,000 in the 2027 budget and about $250,000 in 2028, with a note on how you got there. Nobody would call that precise, but it's a lot closer to the truth than zero, and zero is what most budgets carry for a rule that isn't final.
Pin two review dates to the line: the day comments close and the day a final rule is expected. For the annual payment rules that's easy, since CMS finalizes the outpatient rule in the fall every year. One-off rules can take a year or more to finalize, and knowing that is useful in itself when you're deciding how much to reserve and when.
In the briefings we run, and especially for food and healthcare companies, proposed rules come up often, and more often than you'd think the comment window is still open when they do. That's the moment to decide whether this one gets a budget line, the same way you'd want an answer ready before the CEO forwards you the article.
The threshold trap
This is the version that costs the most. A rule has a size threshold. Your business sits just under it. So it gets stamped not applicable and nobody scopes it. Then you grow, or you buy something, or the agency revises the threshold in a later rulemaking, and you're inside with no budget and no lead time. Track how close you are to each threshold that matters to you as its own number, apart from whether you clear it today.
Why the comment period is worth your time
Mid market companies tend to skip comment periods on the theory that the big incumbents run the show. Mostly wrong. Trade associations exist partly to pool the voices of smaller companies, and a specific comment with real numbers on what a rule would cost a business your size is something the agency has to consider and answer in the final rule. You can only file it while the window is open, though. Which brings us back to the problem of finding out late.
If you want to see which proposals are headed toward your cost base, a free briefing on your company flags them against your business with scope and timing attached.
CFOmarketIQ tracks regulatory proposals against your specific business as they're published, and the first briefing is free.
Questions CFOs ask about regulatory risk
How much do regulations cost a business?
It varies too much by industry for a national average to help with a budget. The number that matters is yours: the one-time cost to comply, meaning systems, testing, filings, reformulation and outside counsel, plus the recurring cost of reporting and audits and the staff time behind them, each placed in the year it lands.
What is an example of a compliance cost?
Under the FDA's proposed GRAS rule, an ingredient that's been self-affirmed as safe would need a notification filed with the agency, by the ingredient maker or the food company using it. That means paying for the scientific review and a regulatory consultant, plus your own people's time, and possibly a reformulation if the agency pushes back. It starts as a one-time cost and can turn into a product change.
What is regulatory risk in business?
The chance that a new or changed rule raises your costs, cuts your revenue or forces a change in how you operate. For a CFO the useful version is narrower than that: which proposed rules touch your business, when they'd take effect, and roughly what they'd cost in each budget year.
When does a proposed rule become final?
After the comment period closes, the agency works through the comments and publishes a final rule, which can take months or years. Annual payment rules like Medicare's are predictable and finalize in the fall. One-off rules are far less predictable, so budget with a range of effective dates rather than a single one.
A note on all of this: it is general information, not financial, legal or tax advice. Run anything you plan to act on past your own advisors first.