A rule’s survival odds belong in the compliance plan

The week

On June 30, 2022, the Supreme Court gave leaders a reason to question an assumption most compliance plans rest on: once a regulation is final, it will stay put.

That day, the Court decided West Virginia v. Environmental Protection Agency. By a vote of 6 to 3, it ruled that the EPA lacked clear congressional authority to require the shift in power generation contemplated by the Obama-era Clean Power Plan. In broad terms, that plan would have pushed the power sector to shift generation toward cleaner sources, rather than only requiring individual plants to run more cleanly.

Chief Justice Roberts wrote for the majority. Justice Gorsuch, joined by Justice Alito, added a concurrence setting out the doctrine’s history and purpose at length. Justice Kagan wrote the dissent, joined by Justices Breyer and Sotomayor. It was Justice Breyer’s last day on the bench; Justice Ketanji Brown Jackson was sworn in at noon the same day.

The headline was about energy. The reasoning reached much further. The majority opinion expressly relied on what is called the major questions doctrine. The doctrine holds that when a government agency claims the power to make decisions of vast economic and political significance, it must point to clear authorization from Congress. A general grant of authority, written decades ago for a different purpose, is not enough. It works like a manager told to “keep the office running smoothly” who then uses that instruction to relocate the entire company: a court applying the doctrine would ask where, exactly, the manager was given that power.

The statute and the plan

The legal question turned on a short provision, section 111(d) of the Clean Air Act. It lets the EPA set emission guidelines for existing sources based on the “best system of emission reduction” that has been adequately demonstrated. For decades the agency had read that phrase to mean measures applied at individual plants, such as more efficient equipment or cleaner fuel. The Clean Power Plan, finalized in 2015, read it to include shifting generation from coal to gas and from fossil fuels to renewables across the grid.

The Court found that this reading claimed a power of a different kind. It noted that Congress had considered and declined to adopt similar emissions-trading schemes. It also noted that the agency was finding a broad new power in a rarely used provision of a long-standing statute. Those features, together with the economic stakes, made it a major question. No clear statement of authority was found.

A rule that never took effect

There was an oddity in the case. The rule at issue had never taken effect. The Supreme Court stayed the Clean Power Plan in February 2016, before any compliance obligation began. The next administration repealed it in 2019 and replaced it with a narrower rule. In January 2021, the D.C. Circuit vacated that replacement and the repeal. The new administration then told the courts it did not intend to revive the 2015 plan. The government argued the case was moot as a result. The majority disagreed and decided the merits anyway.

That procedural history is a planning fact in its own right. A rule can be fought over for seven years without ever binding anyone. Yet the reasoning applied to any agency reading older statutes to address new problems. Many laws that agencies administer were written long before today’s technology, markets and risks existed. Agencies often stretch those older words to cover new situations. The decision made that stretch more vulnerable.

The doctrine’s run of cases

The phrase itself was not new. Commentators had used it for years to describe cases such as the Court’s 2000 decision that the Food and Drug Administration could not regulate tobacco under its general drug authority. The pace had quickened just before this case. In August 2021, the Court ended the federal eviction moratorium, finding that the public health statute the Centers for Disease Control and Prevention relied on did not clearly support it. In January 2022, it blocked the Occupational Safety and Health Administration’s vaccine-or-test requirement for large employers. On the same day it allowed a separate vaccine requirement for health care workers at facilities in Medicare and Medicaid to proceed. West Virginia v. EPA was the first time a majority opinion called the doctrine by name.

Timing mattered too. The decision came as the Court’s term ended, while several agencies, including financial regulators, had ambitious rulemakings underway. In March 2022 the Securities and Exchange Commission had proposed rules requiring public companies to disclose climate-related risks and, separately, to report material cybersecurity incidents. Comment periods had closed or were closing. Rulemaking is the formal process by which agencies write binding regulations: they propose a rule, take public comments and then adopt a final version.

For agency leaders and for the banks, health systems, contractors and other organizations they regulate, the question became how likely a new rule was to survive, as well as what it required.

Suppose you are the chief compliance officer of a mid-sized bank in 2022. A regulator has proposed an ambitious new disclosure rule. Your team estimates that complying will mean new data feeds, a new reporting system, outside consultants and months of staff time. The compliance date is eighteen months away. Meanwhile, lawyers are already predicting that the rule will be challenged in court. Do you start building now, or wait?

Most analysis of West Virginia v. EPA concerned energy policy. For agency program directors and the compliance leaders of regulated institutions, the lasting effect was on planning. Courts now had a named test, invoked in a majority opinion, for setting aside rules that rest on broad readings of general statutory language. A rule that might be vacated three years after adoption is a different commitment from one that will stand. That holds for the agency that writes it, the systems built to administer it, and the institutions that must comply. Durability turned into a number to estimate rather than an assumption.

The effect falls on three separate decisions, each owned by different people: how agencies write new rules, how agencies protect programs built on older interpretations, and how regulated organizations sequence the money they spend on compliance.

How regulations are made and unmade

Congress passes laws, called statutes. Many statutes do not spell out every detail. Instead, they give an agency, such as the EPA, the Securities and Exchange Commission or a banking regulator, the authority to write detailed rules. Those rules carry the force of law.

To write a significant rule, an agency typically publishes a proposal, invites public comment, considers the responses and then publishes a final rule with an explanation of its reasoning. Everything the agency relied on, from studies to comment letters to its own analysis, forms the administrative record. If the rule is challenged, a court reviews that record.

Anyone affected by a rule can usually challenge it in federal court. A court can uphold the rule, send it back to the agency to fix, or vacate it, which means striking it down so it has no effect. A court can also issue a stay, which pauses the rule while the case continues. Without a stay, the rule remains in force during litigation, compliance dates and all.

The question at the center of many challenges is whether the agency had the authority to write the rule at all. That depends on the words Congress used. West Virginia v. EPA mattered because it sharpened how courts answer that question when the stakes are large. If an agency is doing something big and new, the decision tells courts to look for clear authority in the statute, rather than a plausible reading of general language.

How a court decides that a question is major

The opinion did not give a checklist, but it pointed to features that recur across the cases. The first is scale: an agency claim that would reshape a national industry, move hundreds of billions of dollars or touch most of the population. The second is novelty: a power the agency had never before found in a statute that had been on the books for decades. The third is location: a broad power discovered in a narrow, technical or rarely used provision. The fourth is history: Congress had debated the policy and declined to enact it, or the agency had earlier said it lacked the power.

None of those features is decisive alone. Together they move the burden. In an ordinary case, an agency wins if its reading of the statute is the better one. In a major questions case, the agency must show that Congress clearly gave it the power. That is a harder standard to meet with statutes drafted before the problem existed.

The doctrine also has limits that planners should keep in view. The Court reserved it for what it called extraordinary cases, and most rules never come near that line. A rule on recordkeeping formats, examination procedures or the timing of a filing is unlikely to be treated as a major question, whatever its cost to a particular firm. The exposure concentrates in rules that are large, new and contested.

Vacatur, remand and the remedy question

When a court finds a rule unlawful, the Administrative Procedure Act tells it to “hold unlawful and set aside” the agency action. In most federal cases that has meant vacatur: the rule is gone for everyone, including parties that never sued. Sometimes a court instead remands without vacatur, leaving the rule in place while the agency repairs its reasoning. That is more common when the flaw is in the explanation rather than the agency’s basic power.

The distinction matters for planning. A rule that falls for want of authority cannot be fixed by a better record; the agency would need new legislation. A rule that falls for a thin explanation can often be readopted after more work, sometimes with similar requirements. Compliance teams that read the grounds of a challenge, as well as noting that one exists, can tell which kind of risk they face.

Why older statutes are under pressure

Laws age. A statute written to govern banking, broadcasting or air pollution decades ago could not anticipate cloud computing, cyberattacks on hospitals or climate-related financial risk. When a new problem appears and Congress does not act, agencies often look for authority in the laws they already administer. Sometimes the fit is good. Sometimes it requires reading general phrases, such as authority over “safety and soundness” or “unfair practices,” to cover something their authors never imagined. The major questions doctrine targets exactly that gap. The bigger and newer the agency’s move, the more a court will want to see Congress’s own words authorizing it. For anyone planning around regulation, that means the most ambitious rules addressing the newest problems are also, by design, the most exposed.

How exposure differs across regulators

The exposure is not spread evenly. Some regulators administer statutes that name the subject they regulate in detail. HIPAA, for example, directed the Department of Health and Human Services to issue privacy and security standards for health information. Rules built on that kind of instruction stand on firmer ground than a new program built on general authority.

Other regulators rely more heavily on broad grants. Securities regulators write disclosure rules under statutes that give them wide authority over what registrants must tell investors. Challengers to the 2022 climate proposal argued that it reached beyond investor protection into climate policy. Defenders argued that disclosure of material risk is the core of securities law. The doctrine gave the first argument a ready frame.

Banking regulators add a further layer. Much of what they expect is set through supervisory guidance and examination rather than binding rules. Guidance does not carry the force of law, so it is less exposed to vacatur in court. It is also easier for a later set of agency leaders to withdraw, a point the hindsight below bears out. For a bank’s compliance team, that means two different kinds of durability to estimate: whether a rule will survive litigation, and whether a supervisory expectation will survive a change of leadership.

The January 2022 pair of vaccine cases shows the doctrine is not a rule that agencies always lose. The Court blocked a workplace requirement grounded in occupational safety law, but upheld a requirement for staff at Medicare and Medicaid facilities grounded in the government’s authority to set conditions for program participation. The difference was fit: how closely the measure matched what the statute plainly gave the agency to do. Health systems that already work under detailed conditions of participation saw the practical effect. Requirements tied to program conditions tended to hold. Requirements resting on broader regulatory reach were more contestable.

Writing new rules

For agencies, the decision raised the value of a clear statutory hook. A rule grounded in specific congressional language is harder to challenge than one resting on general authority over a problem Congress never named. An administrative record that shows how the agency’s approach follows from that language strengthens it further. Agency counsel had long reasoned this way. The decision made the stakes explicit and gave challengers a ready argument.

It also raised the value of scope discipline. A narrower rule that clearly fits the statute may achieve less on paper and more in practice, because it survives. Program directors have to weigh ambition against durability and plan for litigation as a normal stage of rulemaking. That means building the record as if a skeptical court will read it, including the agency’s reasons for rejecting narrower alternatives.

Technology plans inside agencies should follow the legal calendar. A new rule often needs a reporting portal, new data collections, case management changes and staff training. A reporting portal is the website where regulated organizations submit required information. Case management systems are the software agency staff use to track filings, reviews and enforcement matters. Building all of it before the rule clears its first legal challenge risks stranding the investment.

Phasing the build, with design and prototyping early and full production after the main legal milestones, limits the loss if the rule falls. A prototype is a working sketch: enough to test the design and gather feedback, without the cost of a finished system. The trade-off is a slower start if the rule survives, which agencies can reduce by keeping designs ready to execute.

What a durable record contains

Agency counsel describe a durable record in fairly consistent terms. It starts with the statute: the specific words the agency relies on, how they have been read before, and why this rule falls inside them. It addresses the major questions argument directly, rather than hoping a court will not raise it. It shows the alternatives considered, including narrower options, and gives reasons for choosing the one adopted.

A durable record also takes comments seriously. Courts read whether the agency engaged with significant objections, including objections about authority. A comment response that dismisses a statutory argument in a sentence is a weakness a challenger will find. The record should also include a realistic assessment of costs, since the scale of a rule’s economic effect is one of the signals that makes a question major.

Many agencies also write severability provisions into their rules. A severability clause states that if a court strikes one part of the rule, the agency intends the remaining parts to stand. Courts do not treat such clauses as binding, but they are evidence of what the agency would have done. A rule designed as separable modules, each with its own statutory basis, gives a court the option of trimming rather than discarding it.

The trade-off agencies cannot avoid

The strongest objection to scope discipline is that it concedes too much. If Congress is unlikely to legislate on a new problem, a rule narrowed to fit old statutory text may leave most of the problem untouched. Program directors who narrow every rule pre-emptively may never test what the law allows. Some agency lawyers argue that an ambitious rule that falls still clarifies the law for the next attempt.

There is force in that view. The answer is not to avoid ambition but to make the choice explicit. Leadership should know, in writing, which parts of a rule rest on clear text and which rest on contested reach, and what the agency loses if the second set falls. That turns a legal gamble into a policy decision made by the people accountable for it.

Contracts that follow the legal calendar

Federal acquisition rules already offer the tools for phasing. Contracts can be structured with a base period and options that the agency may exercise later, at prices fixed in advance. Work can be divided into modules, each delivering something usable on its own. The design and data-definition work, which is valuable under almost any outcome, goes in the base period. The production build, the integrations and the hosting go in options.

Phasing has costs. Vendors price uncertainty into option periods. Teams that disband between phases lose knowledge. A contract with too many contingencies can be harder to manage than a single build. Agencies can reduce those costs by keeping a small core team in place between phases and by documenting design decisions so that a new team can pick them up.

State agencies face a different legal setting. Federal major questions doctrine does not bind state courts reviewing state rules. Each state has its own administrative law, and some state courts are more deferential to agencies than federal courts, while others apply strict limits on delegation. The planning habit carries over even where the doctrine does not. A state regulator should still ask how its rule would fare under its own courts’ approach, and phase the build to match.

A narrower rule, built in phases

Consider a state financial regulator preparing a new reporting rule on a broad reading of an older statute. Its general counsel flags the authority question early. The program team responds in two ways. First, it narrows the rule to the parts most clearly supported by statutory text, and documents in the record why it rejected broader and narrower options. Second, it splits the technology work. Design, data definitions and a prototype portal proceed immediately. Contracts for the full production system include an option that is exercised only after the first court ruling. When the rule is challenged, the regulator has spent a fraction of the budget. When it survives, the team picks up the ready design and finishes the build within months.

Protecting existing programs

The second decision concerns programs already running. Many agency programs rest on long-standing interpretations of statutes written before today’s technology and markets existed. The doctrine invited challenges to those interpretations where the economic stakes are high.

A portfolio review is the practical response. List the agency’s major programs and rules, record the legal basis for each, and flag those that depend on interpretive reach rather than explicit text. For each flagged item, estimate what a successful challenge would disrupt: payments, enforcement cases, data flows, contracts or the work of other agencies that rely on it.

The review does not mean abandoning programs. It supports contingency planning. If a reporting requirement could be vacated, the agency should know whether it could still collect the data voluntarily or under another authority. If a grant condition could fall, it should know which grantees depend on it. Where the gap is serious, the review gives agency leadership a documented basis for seeking clearer authority from Congress.

This work needs people who can translate legal risk into program and system terms. Few agencies had that role defined in 2022. Pairing general counsel staff with program and technology leads for each flagged program is a simple way to build it.

Running the review

A workable review has a few steps. First, an inventory of significant programs and rules, with the statutory citation each relies on. Second, a classification of that basis into three bands: an explicit mandate, where Congress told the agency to do this; a specific delegation, where Congress gave the agency defined discretion; and general authority, where the agency is reading broad words to reach a new subject. Third, an impact estimate for each program in the third band.

The impact estimate should be concrete. It counts the payments or grants that depend on the program and the enforcement cases that cite it. It lists the data the program collects and the people and systems that use that data. It names the systems that would need to change and how long each change would take. The output is a short memo per flagged program, refreshed when the legal environment shifts, for example when a court of appeals rules on a similar question.

The review also needs triggers. A petition for certiorari in a related case, a split between courts of appeals, or a new lawsuit against a sister agency should prompt a fresh look. Someone in general counsel’s office should own the watch list, and program leads should hear about relevant developments within days rather than months.

Handling the review itself

A documented list of programs with a weak legal basis is a sensitive document. It could be sought in litigation or under public records laws, and it could become a roadmap for challengers. Agencies should decide with counsel how the review is prepared, who holds it and how privilege applies. Keeping the legal analysis in counsel’s hands, and sharing operational contingency plans more widely, is one common approach.

The other risk is internal. A review framed as a list of weaknesses can chill program staff or prompt premature retreat. Framing it as resilience planning, with the same seriousness as disaster recovery, keeps the focus on continuity of service rather than on the odds of losing a case.

The same review helps with a less visible risk. Other agencies, states and contractors often build their own systems around a federal program’s data or definitions. If the program’s legal basis falls, their systems are stranded too. Telling those dependents which programs are flagged, and keeping them informed as litigation develops, is cheaper than a sudden shutdown that breaks processes the agency does not control.

A county that planned its fallback

Take a county that runs a small business assistance program whose eligibility rules borrow definitions from a federal program. Its systems pull data from a federal reporting portal every month. During a portfolio review, the federal agency flags that program as resting on a broad interpretation of an older statute and writes to state and local users to say so. The county’s program manager and county attorney sit down with the IT lead for an afternoon. They identify what would break if the federal data stopped: two eligibility checks and one quarterly report to the county board. They document a manual fallback for the checks and an alternative data source for the report. The plan costs almost nothing and sits in a drawer. If the program is ever struck down, the county keeps serving businesses while others scramble.

The county example generalizes. Grantees, contractors and partner agencies that rely on a federal program’s definitions should know which of those definitions could change suddenly. A hospital that relies on a federal data feed for quality reporting, or a credit union that uses a federal eligibility definition in a lending program, faces the same question at smaller scale: what breaks, and what is the fallback.

Sequencing compliance spending

The third decision belongs to banks, health systems, contractors and other regulated organizations. The doctrine changed how to read a proposed or new rule. The question was no longer only what the rule required and when, but how likely it was to be challenged, on what grounds, and how long the challenge might take.

That did not justify ignoring new rules. It justified sorting their requirements into two kinds.

No-regret work is valuable regardless of the rule’s fate: better data governance, clearer incident processes, stronger documentation, cleaner inventories of systems and vendors. Data governance simply means knowing what data you hold, where it comes from, who owns it and how reliable it is. That work can start early.

Rule-specific work only pays off if the rule survives: new reporting systems for particular data elements, specialized calculations, attestations in a prescribed format. An attestation is a formal statement, often signed by an executive, that something is true or complete. That work can be designed early and built once the legal path is clearer.

Why no-regret work is larger than it looks

The no-regret category tends to grow on inspection, because other regimes often ask for similar things. When the SEC proposed climate disclosure in 2022, European sustainability reporting requirements for large companies were in force and being expanded. California later enacted its own climate disclosure laws for large companies doing business in the state, signed in October 2023. A data inventory of emissions sources and climate risk exposures served all of those regimes, whatever happened to the federal rule.

The same was true of cybersecurity. The SEC’s 2022 proposal on public company incident reporting would require faster, more formal disclosure. But banks already faced a federal requirement, with compliance due from May 2022, to notify their primary regulator of significant computer-security incidents within 36 hours. Health systems faced HIPAA breach notification. Clear incident classification, escalation paths and decision logs paid off under every one of those obligations. Treating the new rule as the trigger for work that was overdue anyway is often the strongest case for starting early.

How the calculation differs by type of institution

Who the rule applies to shapes the whole exercise, so the first step is reading the scope precisely. SEC disclosure rules for public companies reach banks and bank holding companies that are SEC registrants. They do not reach most credit unions, which are not public companies and are supervised by the National Credit Union Administration or state regulators. Broker-dealers face SEC and FINRA rules directly as regulated firms, and FINRA rules follow their own approval process. Nonprofit health systems are generally not SEC registrants for their equity, although many issue tax-exempt bonds and have disclosure duties to bondholders.

The institution’s size matters too. A large bank with a standing regulatory change team can afford to run a register, track litigation and phase builds. A community bank or a small credit union often relies on its core processor and a handful of vendors to deliver regulatory changes. For those institutions, the practical lever is the vendor contract: knowing when the vendor plans to deliver changes, what it will charge, and whether it will hold off if the rule is stayed.

Health systems face a mix of program rules, privacy rules and payer requirements, each on a different legal footing. Conditions of participation in Medicare and Medicaid have proved relatively durable. Rules resting on broader readings of general authority, or on contested statutory terms, warrant more caution. The same split between no-regret and rule-specific work applies, with the added complication that state law and payer contracts may impose similar requirements independently.

Option value and the cost of waiting

Underneath the sequencing advice is a familiar idea from finance. Waiting to commit has value when new information is coming. A court ruling expected within a year is new information. Holding off the rule-specific build until then preserves the option to spend nothing if the rule falls.

Waiting also has a price. A build compressed into the months before a compliance date costs more: vendors charge for urgency, internal teams work overtime, and testing gets cut. Late builds also carry operational risk, because hurried systems fail more often. A sensible plan compares the expected waste from building early with the expected premium and risk from building late.

Lawyers are often reluctant to put a probability on a court outcome, and they are right that precise odds are false precision. Bands work better: low, moderate or high likelihood that the rule is stayed or vacated before the compliance date. Combined with the build lead time, a band is enough to decide which work starts now and which waits.

The sequencing has limits. If a compliance date arrives before litigation is resolved, the institution must be ready to comply, because a pending challenge is not a stay. Planning should therefore track three dates for any significant rule: its compliance date, the expected timing of legal rulings, and the lead time needed to build what it requires. When those dates collide, the institution needs a decision, made with counsel, about how much to build in advance.

Compliance teams that tracked litigation alongside rulemaking, and reported both to the board, could make that call with evidence, and with their lawyers’ view of how each pending challenge should affect the timeline.

What examiners and auditors will ask

Supervisors do not penalize an institution for watching litigation. They do expect it to be ready on the compliance date unless a court has paused the rule. An examiner reviewing a deferred build will want to see the decision in writing: who made it, on what legal advice, with what plan for catching up if the rule survives. Internal audit will ask the same questions, and will test whether the catch-up plan is realistic given vendor lead times.

The evidence trail is simple to produce if it is built as the work goes. Dated minutes of the decision, the counsel memo, the vendor’s confirmed delivery window and the quarterly register entries together show a deliberate choice. Without them, a deferred build looks like neglect.

Back to the bank

Return to the compliance officer from the opening. Using this approach, she splits the project. The data inventory, governance improvements and documentation start immediately; the bank will want them whatever happens. The specialized reporting engine is designed, priced and scoped, but the main build contract is timed against the compliance date and the expected court schedule. Each quarter, she gives the board a one-page update: where the rule stands in court, how many months of build time remain before the compliance date, and whether the two have collided. If they do, she and counsel bring a recommendation. The bank is never caught unprepared, and it does not pour money into a system that may never be needed.

What a board update can look like

Boards do not need legal briefs. They need a short, consistent view they can compare quarter to quarter. A useful format is a single table with one row per significant rule and a handful of columns: what the rule requires in a sentence, its compliance date, its litigation status, the expected timing of the next ruling, the build lead time, money spent so far on no-regret work, money committed to rule-specific work, and a simple flag for whether the dates are on a collision course. A short note beneath highlights any decision the board needs to make. The format keeps legal, technology and finance on the same page, literally, and makes the trade-offs visible to people who must approve the spending.

Sunk costs, gambles and a missing variable

• Money. Systems built for a rule that is later vacated are sunk costs. Phasing spending against legal milestones limits that waste.
• Risk. Ignoring a rule because it might be struck down is a gamble. A pending challenge does not pause the compliance date unless a court says so.
• Public service continuity. For agencies, a vacated rule can halt payments, data flows or enforcement overnight. Contingency plans keep services running.
• Governance. Boards and agency leaders need to see legal durability alongside cost and schedule, or they are approving plans with a missing variable.
• Talent. The people who can translate legal risk into program and system terms are scarce. Pairing lawyers with program and technology leads builds that capability.

Those consequences fall on different budgets. Sunk costs land on the technology and compliance budgets. A missed compliance date lands on the institution’s regulatory standing, which can affect examination ratings and, for banks, approvals for mergers or new activities. A broken public program lands on residents and on the agency’s relationship with its legislature. That spread is the reason legal durability has to be reported to the people who own the whole picture, rather than handled inside legal or technology alone.

The case against planning for vacatur

There is a serious argument that all of this is overcautious. Most rules are never challenged. Of those that are, many survive or are remanded without vacatur. Building a litigation tracker and a no-regret split for every rule adds overhead to compliance teams that are already stretched. And a habit of waiting can drift into a culture of doing the minimum.

The argument holds for routine rules, and the approach should be reserved for significant ones: large, new, contested, and resting on general authority. For those, the overhead is small compared with the build. The split between no-regret and rule-specific work is also useful even if every rule survived, because it forces a team to identify which spending improves the institution and which only satisfies a format. The method costs a few hours per rule and protects budgets measured in months of staff time.

Registers, splits and phased contracts

Signs of a mature approach

• A register of significant rules that tracks compliance dates, litigation status and build lead times side by side.
• A clear split between no-regret and rule-specific work for each rule, with different start triggers.
• For agencies, a portfolio review that flags programs resting on interpretive reach, with contingency plans and notice to dependents.
• Technology contracts with options or phases tied to legal milestones.
• Regular board or leadership reporting that includes legal durability.

Who owns the register

The register works best with one owner and several contributors. The chief compliance officer or regulatory change lead owns it. The general counsel’s office supplies litigation status and the likelihood band. The technology organization supplies build lead times and vendor commitments. Finance tracks spend against the no-regret and rule-specific categories. Each contributor updates its columns before the quarterly report, and the owner reconciles them.

For agencies, the equivalent owner is often the regulatory policy office or the chief of staff, with general counsel, the program office and the chief information officer contributing. The format matters less than the habit of reviewing all three dates together.

Where planning goes wrong

• Building everything immediately. Full systems built for a rule that falls are money lost.
• Waiting for certainty. Litigation can outlast compliance dates. Doing nothing until courts rule can leave an institution in breach.
• Treating legal and technology plans separately. When lawyers and system builders do not share a calendar, collisions arrive as surprises.
• Forgetting dependents. Agencies whose data or definitions feed other systems can break those systems without warning.
• Confusing a challenge with a stay. Only a court order pauses a rule.

A further error is subtler: treating a vacated rule as the end of the underlying expectation. When a specific rule falls, the supervisory interest behind it usually remains. Examiners can still ask how a bank manages a risk under general safety-and-soundness standards, and state law may impose similar duties. Institutions that dismantle no-regret work the day a rule is vacated often find themselves rebuilding it.

Litigation risk belongs in the compliance plan

The questions below are meant for a quarterly leadership discussion rather than a one-time review. They work for an agency deciding how to write and defend its rules, and for an institution deciding how to spend on compliance. Each should have a named owner and a dated answer.

1. Which significant rules are we preparing for, and which of them are being challenged in court or are likely to be?
2. For each, what is the compliance date, when do we expect key rulings, and how long will the build take? Do any of those dates collide?
3. Which parts of our compliance work are valuable no matter what happens to the rule, and have we started them?
4. Which parts only pay off if the rule survives, and when exactly will we commit money to them?
5. For agencies: if a program resting on a broad reading of an older statute were struck down, what payments, data flows, cases or partner systems would stop?

With hindsight

The doctrine turned out to be one step in a larger shift in how courts treat agencies, and each later step reinforced the planning case made in 2022.

A year to the day after West Virginia v. EPA, in Biden v. Nebraska, the Court applied the major questions doctrine to strike down the administration’s student loan forgiveness program. The government had relied on a 2003 statute allowing the Education Secretary to waive or modify loan provisions in connection with a national emergency. Justice Barrett wrote separately to describe the doctrine as a way of reading statutes in context, rather than a special rule against agencies. The case showed that the doctrine reached spending and benefit programs as well as regulation.

In June 2024, in Loper Bright Enterprises v. Raimondo, the Court overruled the Chevron doctrine, ending judicial deference to reasonable agency interpretations of ambiguous statutes. Chevron had told courts to defer to an agency’s sensible reading when a law was unclear. Its end meant that courts would decide for themselves what ambiguous statutes mean, making agency interpretations more open to challenge across the board. The major questions doctrine now applies to the largest cases; Loper Bright reaches the ordinary ones.

Days later, Corner Post v. Board of Governors allowed parties newly affected by older rules to challenge them. In practice, that meant even long-standing rules could face fresh lawsuits from organizations that had only recently come under them. A few days earlier, in SEC v. Jarkesy, the Court held that the SEC must bring certain fraud claims seeking civil penalties before a jury, rather than in its in-house proceedings. That changed how financial regulators enforce rules as well as how they write them.

Lower courts applied the new tools. In June 2024, the Fifth Circuit vacated the SEC’s private fund adviser rules in full, months before the first compliance dates, finding that the Commission had exceeded its statutory authority. In January 2025, the Sixth Circuit struck down the FCC’s 2024 net neutrality rules, relying on Loper Bright to decide the statutory question for itself. A federal court in Texas set aside the FTC’s ban on most employee noncompete agreements in August 2024. In September 2025, the Commission voted to drop its appeals and accept the vacatur.

The SEC’s climate disclosure rule, adopted in March 2024 in narrower form than the 2022 proposal, was stayed pending litigation. In March 2025 the Commission voted to stop defending it. That rule is a clear example of the risk the 2022 decision highlighted: an ambitious requirement, years in the making, that never took full effect. Companies that had built emissions inventories still needed them for California and European requirements; companies that had bought rule-specific reporting tools had less to show.

Changes of administration added a second source of instability, as agencies reconsidered rules adopted by their predecessors. In February 2025, an executive order directed agencies to identify regulations based on anything other than the best reading of their statutes, and rules on significant matters lacking clear statutory authority. Those categories track Loper Bright and the major questions doctrine. Supervisory guidance proved changeable too: the federal banking agencies’ 2023 climate risk principles for the largest banks were rescinded in October 2025, without any court involvement.

The shift had limits. In June 2025, in FCC v. Consumers’ Research, the Court upheld the Universal Service Fund against a challenge that Congress had delegated too much power. Durability did not collapse everywhere; it became something to assess case by case.

By 2026, agencies and regulated organizations both treat legal and political durability as standard planning inputs. Institutions that separated no-regret work from rule-specific builds have spent less on systems for rules that never took effect. The practical habit is to keep asking two questions about every major compliance program: what would we still want if this rule disappeared, and what are we building only because the rule exists? The answers tell you where to move fast and where to wait.