After the 2024 election, a rule’s legal form predicted its survival better than its topic

The week

Elections do not rewrite regulations overnight. But they change who holds the pen, and in November 2024 executives in banks, health systems and public agencies woke up to a very different set of odds.

On November 5, 2024, Donald Trump won the U.S. presidential election, and over the following days it became clear that Republicans would control both chambers of Congress. The result meant a change of administration on January 20, 2025, with new leadership at the financial regulators, at HHS and at the offices that set federal IT and AI policy. The people who decide what rules say, how they are enforced and which ones get rewritten were all about to change.

The timing mattered because agencies were still finishing work. The CFPB had finalized its personal financial data rights rule, known as the open banking rule, on October 22. Bank industry plaintiffs, led by the Bank Policy Institute, sued to block it in federal court in Kentucky the same day. The Defense Department had published its final rule for the Cybersecurity Maturity Model Certification program on October 15, effective December 16.

More was on the way. Over the next two months the CFPB finalized a rule bringing large digital payment apps under its supervision. It also finalized a rule on overdraft fees at very large institutions and proposed a rule on data brokers. The IRS finalized broker reporting rules for decentralized finance. HHS proposed an overhaul of the HIPAA Security Rule. Each of these landed in a period that made it vulnerable.

The reason was the Congressional Review Act. The Act lets Congress disapprove a regulation by passing a joint resolution that the president signs. It reaches only recent rules, and it works only when both chambers and the White House agree, which after this election they were likely to do.

The Act had been on the books since 1996 but had rarely been usable. Before 2017 it had succeeded only once, against a Labor Department ergonomics rule in 2001. It came alive when a new president and a Congress of the same party took office together. In 2017 Congress used it against more than a dozen late Obama-era rules, and in 2021 against three late Trump-era rules. November 2024 created that alignment again.

Two features make the Act unusually potent. In the Senate, a disapproval resolution moves under expedited procedures and needs only a simple majority, so the filibuster does not apply. And once a rule is disapproved, the agency may not reissue it, or issue a new rule substantially the same, unless a later law specifically authorizes it.

The Act also has a lookback provision. Rules submitted to Congress near the end of a session can be reviewed by the next Congress, as though they had arrived on the fifteenth session day of the new session. Because of that provision, rules submitted from roughly early August 2024 onward would be open to review by the new Congress. Several significant rules affecting banks, health systems and agencies fell in that window, and any rule finalized between election day and the inauguration would land in it automatically.

One more piece of background made the picture sharper. Months earlier, in June 2024, the Supreme Court’s Loper Bright decision had ended judicial deference to agency interpretations of ambiguous statutes. Until then, when a law was unclear, courts generally accepted an agency’s reasonable reading of it. After Loper Bright, judges would decide for themselves what the law meant, which made rules built on broad readings of an agency’s authority easier to challenge.

Loper Bright was one of three rulings from the end of that term that bore on regulated organizations. In SEC v. Jarkesy, decided the day before, the Court held that when the SEC seeks civil penalties for securities fraud, the defendant is entitled to a jury trial in federal court. In Corner Post, decided days later, it held that the six-year period to challenge a rule under the Administrative Procedure Act starts when a plaintiff is injured, not when the rule is issued. Together they meant that older rules could be challenged by newly affected parties, and that some enforcement would move out of agency proceedings and into the courts.

So the useful question for compliance leaders that week was less “what will the new administration want?” than “which of our obligations can actually be changed, by whom, and how quickly?”

On the morning after an election, compliance leaders get the same question from every direction. The chief executive wants to know what will change. The board wants to know whether the budget for a pending rule is wasted. Business heads want permission to slow down on anything that looks politically doomed. And the honest answer, in that first week, is that nobody knows what the new leaders will choose to do. What can be known, however, is what they are able to do, and how quickly.

Election weeks produce predictions about policy topics: AI, crypto, consumer finance, health data. For compliance planning, topic is a weak guide. Two rules on the same subject can have very different survival odds because of how they were made. The better predictor is the legal instrument behind each obligation.

Every obligation a bank, health system or agency carries rests on one of three kinds of instrument, and they differ sharply in how easily a new administration can change them: statutes and long-standing regulations; rules finalized recently enough to fall inside the Congressional Review Act window; and guidance, proposals and executive orders. Sorting a regulatory inventory into those three groups was the most useful work of that week.

A regulatory inventory, for readers who have not seen one, is simply a list of every legal obligation the organization must meet, with the source of each obligation and the team responsible for it. Most large regulated organizations keep one, often in a compliance system. The insight here is that adding a single column to that list, “what kind of instrument is this?”, tells you more about the next two years than any amount of reading political commentary.

The three groups also run on three different clocks. A statute changes only when Congress passes a new law, which usually takes years and, outside budget reconciliation, sixty votes in the Senate. A regulation changes through a new rulemaking, which takes months at the least and leaves a public record that courts can review. Guidance and executive orders can change in an afternoon. Knowing which clock governs an obligation tells a planner how much warning there will be before it moves.

Foundation, walls and furniture

Obligations come into being in a few main ways, and they behave like the parts of a building: the foundation is laid by Congress, the walls by agencies and the furniture by whoever happens to occupy it.

A statute is a law passed by Congress and signed by the president, or a law passed by a state legislature. It is the foundation. Changing it requires a new law, which is slow and politically hard.

A regulation, or rule, is written by a federal agency under authority a statute gives it. To issue one, the agency usually publishes a proposal, invites public comment and then publishes a final version, a process called notice and comment. Regulations are the walls: sturdy, but they can be rebuilt if an agency goes through the same formal process again. A regulation that has been in place for many years tends to be woven into how an industry works and is rarely torn out.

Guidance is an agency’s explanation of how it reads the law or what it expects to see, for example in a bulletin, a set of frequently asked questions or an examination manual. A proposed rule is a draft regulation that has not been finalized. An executive order is a directive from the president to the executive branch, and a memorandum from the Office of Management and Budget, the White House office that oversees federal agency management, tells agencies how to carry out policy. These are the furniture: useful, often influential, and easy to move.

Two forces can push against the walls. One is the Congressional Review Act, described above, which lets Congress and the president cancel a recent regulation. The other is litigation: a court can strike down a rule if it finds the agency exceeded its authority or skipped required steps. After Loper Bright, courts no longer defer to an agency’s reading of an unclear statute, so a rule that rests on such a reading is more exposed than before.

Why the walls are harder to move than they look

A new agency head who dislikes a final rule faces real constraints. Rescinding or rewriting it is itself a rulemaking, with its own proposal, comment period and final notice. Under long-standing Supreme Court precedent, an agency that changes course must acknowledge the change and give a reasoned explanation for it. A reversal that skips those steps can be struck down as arbitrary and capricious, the same standard used against new rules.

That symmetry cuts both ways after Loper Bright. A rule built on a stretched reading of the statute is easier for challengers to defeat. A rescission built on a stretched reading in the other direction is exposed in the same way. A rule that tracks its statute closely is hard to attack from either side, which is why the fit between rule and statute matters as much as the rule’s age.

Corner Post adds a further wrinkle. Because the limitation period runs from the date a plaintiff is injured, a company formed in 2024 can challenge a rule issued decades earlier. Age no longer shields a rule from a lawsuit. What still protects an older rule is that firms have built systems, contracts and products around it, and few of them want it gone.

Statutes and long-standing regulations: durable, with a shift in who enforces

Most obligations come from statutes and mature regulations: the Bank Secrecy Act, the Gramm-Leach-Bliley Act, HIPAA, the Federal Information Security Modernization Act, and state privacy and breach notification laws. A new administration can change enforcement emphasis. It cannot change these obligations without legislation.

The risk here is drift. Uncertainty about new rules can spill into complacency about old ones. Statutes of limitations, the time limits within which enforcement action can be brought, run for years, so conduct in 2025 can be examined by a later administration. A shortcut taken while enforcement seems relaxed can be judged by a very different set of regulators down the road.

When federal enforcement recedes, state regulators and attorneys general often step forward, sometimes under state statutes broader than their federal counterparts. Private litigation continues regardless. For organizations operating in many states, the likely result is more variation, not less.

The practical response is to keep this layer unchanged and strengthen monitoring of state activity. Where a team does reduce effort on a settled obligation, it should record why, in terms a future examiner would accept, because the decision will be judged against the law, not the political climate.

What changes when the obligation does not

A durable obligation can still feel different from one year to the next. Examination cycles, the topics examiners choose to test, the size of penalties and the willingness to bring cases at all are set by agency leadership. Those can shift within months. For a compliance leader, the risk of being caught falls faster than the risk of being wrong.

The gap between those two risks is where trouble starts. A bank that lets its Bank Secrecy Act alert backlog grow because federal attention seems elsewhere has not reduced its legal obligation. It has only changed when, and by whom, the gap will be found. The general federal limitation period for civil penalties is five years, and some statutes set longer ones, so a decision made in early 2025 could be reviewed well into a later administration.

Who else holds the enforcement pen

Several statutes in this layer give enforcement power to more than one actor. Under the Dodd-Frank Act, state attorneys general can bring civil actions under the federal Consumer Financial Protection Act, with some limits for national banks and federal savings associations. The HITECH Act gave state attorneys general the power to enforce HIPAA on behalf of their residents. Those powers do not depend on federal priorities.

Self-regulatory organizations add another layer of continuity. A broker-dealer answers to FINRA as well as the SEC, and FINRA’s rules and examination program run on their own cycle. A broker-dealer that relaxed its supervisory procedures in expectation of lighter federal enforcement would still face FINRA examiners testing them against unchanged rules.

How the layer differs by type of organization

For a federally insured, state-chartered credit union, statutory obligations run through both the NCUA and a state regulator. For a state-chartered community bank, the state banking department examines alongside the FDIC or the Federal Reserve. In both cases a state examiner provides continuity that does not depend on federal politics.

A health system’s durable layer is HIPAA, the HITECH breach rules, state privacy and breach laws, and Medicare conditions of participation. Its enforcement risk after a federal shift comes mostly from state attorneys general and from private litigation over breaches and tracking technologies, both of which run on their own schedules. A county government’s durable layer is mostly state law: public records, breach notification, procurement and retention rules that no federal election touches.

Recent rules in the review window: exposed on three channels

Rules finalized in 2024 faced three distinct threats. The first was Congressional Review Act disapproval, which voids a rule and bars the agency from reissuing one in substantially the same form without new legislation. That second consequence is what makes the Act so powerful: it removes the rule and closes the door behind it.

The second threat was reconsideration by new agency leadership through fresh rulemaking, or delay of effective and compliance dates. A new agency head cannot simply delete a final rule, but can start a new notice-and-comment process to revise or withdraw it, and can often push back the dates by which firms must comply.

The third was litigation, made more potent by Loper Bright. Courts would now decide for themselves what a statute meant, so rules resting on broad readings of agency authority were more vulnerable.

The channels do not overlap neatly, which is why each rule needs its own assessment. The open banking rule, finalized in October, was inside the CRA window and already in court. The CFPB’s larger-participant rule for digital payment apps, finalized later in November, was squarely inside the window. HHS’s April 2024 HIPAA rule on reproductive health privacy fell before the window but was already being challenged in litigation. A rule outside the CRA window was not safe; it had simply lost one of its three exposures.

For each rule in this group, a compliance team could record which channels applied: whether it was submitted within the lookback window, whether it was already being challenged in court and whether it rested on a contested reading of the statute. That produced a simple exposure score and a list of decision points: the CRA calendar in early 2025, agency announcements after January 20, and court rulings.

Spending could then be staged around those dates. Work with standalone value could proceed. Work that existed only because the rule required it could be designed and held until the next decision point.

Counsel should advise on specific rules, because review windows, effective dates and litigation posture are procedural details that change the answer.

How the review calendar actually runs

The Act’s timetable is tight. In the Senate, the expedited procedure is available only for a limited period, roughly sixty session days after a rule is received or, for lookback rules, after the new session’s fifteenth session day. Thirty senators can discharge a resolution from committee, and debate is limited. Once that period closes, a disapproval needs ordinary procedure, which usually means sixty votes.

Floor time is the binding constraint. Each disapproval takes votes in both chambers and a signature. Congress cannot disapprove every eligible rule, so it chooses. Large, visible rules with organized opposition and a willing sponsor are the likeliest targets. Technical rules with few opponents tend to survive even when they are eligible.

Delay, the fourth lever

A new administration does not need to repeal a rule to change its effect for a year or more. Incoming administrations customarily issue a regulatory freeze on inauguration day, asking agencies to postpone rules that have not yet taken effect while new leadership reviews them. Agencies can then propose to push back compliance dates through a narrower rulemaking. Courts can also stay a rule while a challenge proceeds, sometimes at the agency’s own request.

For planning, the distinction between an effective date and a compliance date matters. The effective date is when the rule becomes law. The compliance date is when firms must actually meet it, often months or years later and sometimes staggered by size. The open banking rule phased compliance in by size, starting with the largest providers in 2026, and exempted the smallest depository institutions. A rule can survive every challenge and still move its compliance dates, which changes budgets as surely as repeal would.

Who each late rule actually bound

The exposure analysis is useful only once a firm confirms the rule applies to it. The digital payment app rule reached large nonbank providers handling at least 50 million transactions a year; for a community bank it was competitive context, not an obligation. The overdraft rule reached only institutions with more than $10 billion in assets, leaving smaller credit unions and community banks untouched. The open banking rule reached banks, credit unions and card issuers, with tiered dates. A small credit union had little to sort, while a large regional bank had several exposed rules at once.

Health systems faced a similar pattern. The reproductive health privacy rule applied to every HIPAA covered entity and business associate, with a compliance date of December 23, 2024, weeks after the election and inside a live court challenge. A health system had to decide whether to finish policy changes, workforce training and attestation workflows for a rule that might not last. The sensible course was to finish the parts that also served existing HIPAA duties, such as tighter handling of disclosure requests, and to keep the attestation process simple and easy to retire.

Vendor contracts deserve a line in this analysis. A bank that signed an open banking implementation contract in late 2024 could tie milestones and payments to the rule’s compliance dates, so that a delay moved the spending with it. A contract written against fixed calendar dates would leave the bank paying on schedule for work the rule no longer required on that schedule.

Guidance, proposals and executive orders: changeable at will

Proposed rules can be withdrawn. Guidance can be rescinded by notice. Executive orders can be revoked on the first day. None requires notice and comment, so change can be sudden.

This layer matters most for public agencies themselves. Much federal IT, cybersecurity and AI policy is set through executive orders and OMB memoranda, not regulation. Agency programs needed to know which activities rested on statute, such as FISMA, and which on a memorandum that could disappear. Contractors serving agencies faced the same question about solicitation clauses that implemented those memoranda.

For regulated firms, guidance often describes what examiners expect, even when it is not binding. Its rescission changes the formal reference, not necessarily the examiner’s view of sound practice. An examiner who has spent years expecting a particular control will not stop believing it is prudent because a bulletin was withdrawn.

A useful step is to note, for each guidance document the organization relies on, the underlying statute or safety-and-soundness principle it interprets. Safety and soundness is the broad, long-standing standard that bank supervisors use to judge whether an institution is being run prudently. If the guidance goes, that anchor remains, and so does most of the control.

The federal stack, layer by layer

For federal agencies the instrument sort is unusually concrete. FISMA is a statute: it requires each agency to run an information security program, report on it and answer to its inspector general. CISA’s binding operational directives rest on statutory authority that FISMA gives the Department of Homeland Security, so they are more durable than their name suggests. OMB memoranda, such as the 2022 zero trust strategy and the secure software attestation memo, are layered on top and change whenever the White House chooses.

An agency program office can therefore split its cybersecurity work into three lines. Work FISMA requires continues regardless. Work required by a binding directive continues unless the directive is withdrawn, which happens rarely. Work that exists to meet an OMB deadline needs a short note on whether the agency would do it anyway, because the deadline may move or vanish.

State and local agencies, and grant conditions

State and local governments are not bound by OMB memoranda directly. Federal policy reaches them mostly through grant conditions, such as the requirements attached to the State and Local Cybersecurity Grant Program created by the 2021 infrastructure law. A grant program created by statute is durable, but the conditions attached to each year’s award can change. A county IT director should track which obligations come from the authorizing law and which from the year’s funding notice.

Guidance can be challenged too

Guidance is exposed to courts as well as to new leadership. In June 2024 a federal court in Texas vacated part of HHS’s guidance on online tracking technologies, the part that treated certain tracking on unauthenticated public web pages as a HIPAA disclosure. Health systems that had rebuilt their websites around the bulletin saw the formal basis for part of that work disappear. The privacy risk, state law exposure and class action risk that motivated the work had not changed, so removing the controls would have been a choice to accept that risk.

For banks the same logic applies to supervisory guidance on third-party risk, model risk and cybersecurity. The 2023 interagency guidance on third-party relationships describes what examiners expect, but its foundation is the safety-and-soundness standard and the Bank Service Company Act. If the guidance were withdrawn, the expectation that a bank manages its vendors prudently would remain.

How the sort works in practice

For any single regulation, the sensible test is to separate work worth doing anyway from work only the rule requires. The instrument sort scales that test to the whole inventory and tells a compliance leader where to apply it first: the second and third groups, where the odds had moved most.

Suppose a regional bank has a compliance inventory of several hundred obligations. In the week after the election, the chief compliance officer asks each obligation owner to tag their items with one of three labels. The great majority come back as statute or mature regulation. The team agrees that these stay exactly as they are, and assigns one analyst to track state attorney general activity more closely.

A short list of items comes back as recent rules. For each, legal records whether it falls inside the review window, whether it is in court and whether it relies on a disputed reading of the statute. Open banking scores high on all three. The bank continues the parts of that program that reduce fraud regardless, and pauses the parts that exist only because the rule demands them, with a review date pinned to the next court ruling.

A further set of items rests on guidance. For each, the team writes one line naming the statute or safety-and-soundness principle underneath. Where that line is strong, the control stays even if the guidance disappears. Where it is weak, the team flags the control for review, not removal, so that any change is deliberate and documented.

The whole exercise takes the bank a few weeks, not months, because it builds on an inventory that already exists. The result is a one-page summary for the board: the share of obligations in each group, the handful of rules with high exposure, the decision dates for each and the spending staged against them. When directors ask what the election means for compliance, the chief compliance officer can answer with specifics rather than speculation.

The same exercise looks different at a state agency or a federal contractor. There, the critical sort is between programs funded and required by statute and those that exist because of an executive order or an OMB memo. A cybersecurity program required by law continues. A program created to implement a memorandum on AI governance needs a contingency plan for the day the memorandum is replaced.

The same exercise at a health system

A multi-hospital health system runs the sort differently because more of its obligations come through payment programs. Medicare conditions of participation, HIPAA and state licensing rules form its durable layer. Its recent-rule layer in late 2024 held the reproductive health privacy rule. The proposed Security Rule overhaul, as a proposal, belonged in the third group. Its guidance layer included OCR bulletins and CMS program guidance.

The useful output for a health system is a list of security and privacy projects tagged by what drives them. A project to inventory assets and map data flows serves the existing Security Rule’s risk analysis requirement and would also serve any revised version. A project built only to meet a specific new deadline in the proposal can be designed and held. That split protects the work most likely to pay off however the proposal ends.

Measures that show the sort is working

A compliance leader can track a few simple measures. Every obligation should carry an instrument tag within weeks. Every exposed rule should have a named owner, a next decision date and a spending status of proceed, design and hold, or watch. Every guidance-based control should have its anchor written down. Reviewing those measures monthly in the first half of 2025, and quarterly after that, would have been enough for most organizations.

What the sort is worth

The instrument sort turns political uncertainty into something an executive can budget for. On cost, it shows where spending is safe and where it should be staged. On risk, it guards against the slow erosion of controls that are still legally required. On regulators, it gives examiners a documented rationale for every change in effort, which is exactly what they will ask for later. On customers and patients, it keeps protections in place that they continue to expect, whatever happens in Washington. On reputation, it avoids the embarrassment of loudly building to a rule that is then cancelled, or loudly abandoning one that survives.

There is a staff dimension too. Compliance teams that are told to “wait and see” tend to lose momentum on everything, including obligations that have not changed. Teams given a clear sort know which work continues at full pace, which is paused with a date to revisit and which is simply being watched. That clarity keeps good people engaged during a period that otherwise feels like drift.

It also improves board conversations. Instead of asking what the new administration will do, which nobody can answer, directors can see a short table: how many obligations sit in each group, how much spending each represents and the dates when the exposed ones will be decided.

The strongest objections

The first objection is that topic matters more than this argument allows. A rule inside the review window that the incoming administration liked faced little real danger. The Defense Department’s CMMC program rule, published in October 2024, fell squarely inside the window, yet it drew on long-standing bipartisan concern about defense contractors’ security, and few expected Congress to disapprove it. Form measured how exposed a rule was. Political alignment decided whether anyone would use that exposure.

That objection is correct, and it refines the sort rather than defeating it. A better version crosses the two: legal form gives the mechanism and the speed, and an honest read of policy direction gives the probability. A rule that is both exposed and opposed by the new majority goes to the top of the list. A rule that is exposed but favored can be treated almost like a durable one.

The second objection is that the sort invites selective cutting. A team under budget pressure can use an exposure score to justify dropping work it never liked. The defense is the written rationale: each change in effort names the decision point and the standalone value given up, and counsel signs off on the high-exposure items. A sort without that discipline becomes an excuse.

The third objection is cost. Tagging several hundred obligations takes time from people who are already busy. But the tag is one field in a system most regulated firms already maintain, and the expensive part, legal analysis of exposure, applies to a short list. The alternative, reacting rule by rule as news arrives, costs more and leaves worse records.

Keeping the sort current, and where it went wrong

A sort that works has a few marks. Every obligation in the inventory carries an instrument tag. Every recent rule has its three exposures recorded and a decision date attached. Every guidance-based control has a named anchor beneath it. One person owns the calendar of decision points, and counsel reviews the specific rules that matter most.

It is also a living record rather than a one-time exercise. When a rule clears its review window, its tag changes. When a court rules or an agency announces reconsideration, the exposure score is updated and the staged spending is released or held. Each change is dated and explained, so that a year later anyone can see why the organization did what it did.

The errors ran in both directions. Some organizations sorted by topic, assuming that a whole area such as consumer finance or AI would be rolled back, and cut controls that rested on durable statutes. Others ignored the election altogether and kept spending heavily on rules that were plainly exposed. Some forgot the states, and were surprised when state regulators and attorneys general filled the space federal enforcement left. Agencies and contractors sometimes failed to separate statutory programs from memo-based ones, and found whole initiatives orphaned overnight.

The calendar worth watching

A few recurring events drive most updates. The CRA calendar mattered most in the first months of 2025. The semiannual Unified Agenda shows which rules each agency plans to propose, revise or withdraw. Court dockets for the rules that matter, state legislative sessions and new state attorney general actions round out the list. One owner who checks these on a fixed cycle catches most changes before they become surprises.

Agencies and contractors need one more item: new executive orders and OMB memoranda, and the contract clauses that implement them. A contract may keep an old clause for months after the underlying memo changes, or pick up a new one at the next modification. The contractor should know which obligations come from the contract as signed and which follow current policy.

One more error deserves mention: treating the sort as a legal conclusion. The tag says how easily an obligation can change, not whether the organization may stop meeting it today. A rule under review stays binding until it is disapproved, vacated or amended. A firm that stopped work on the day a disapproval resolution was introduced, rather than the day it was signed, would have broken a rule still in force. Many introduced resolutions never reach a vote.

Before the next decision date

• Does our regulatory inventory record, for each obligation, whether it comes from a statute, a recent rule or guidance and executive orders?
• Which of our recent rules fall inside the Congressional Review Act window, which are in court and which rest on a disputed reading of the law?
• For each guidance document we rely on, what statute or safety-and-soundness principle sits underneath it?
• Who is watching state regulators and attorneys general in the states where we operate?
• For agencies and contractors: which of our programs rest on statute, and which on an executive order or OMB memorandum that could be revoked?

With hindsight

The instrument proved a reliable predictor, often more reliable than predictions about which topics the new administration cared about.

In 2025 Congress used the Congressional Review Act to overturn several late-2024 rules. The IRS rule on brokers in decentralized finance fell first, in April. The CFPB’s rules on overdraft fees at very large institutions and on larger digital payment providers followed on May 9. These were precisely the rules in the review window, and the Act’s bar on reissuing them in similar form means they are unlikely to return without new legislation.

The new administration also turned the logic of Loper Bright into a tool of its own. An executive order signed on January 31, 2025 required agencies to identify ten existing regulations for elimination for each new one. In February another order directed agencies to find regulations based on anything other than the “best reading” of their statutes, the standard Loper Bright had set, and to de-prioritize enforcing them. The challenge that had threatened rules from outside the agencies now came from inside them as well.

The furniture moved fastest. The 2023 AI executive order was revoked on January 20, 2025, and many OMB memoranda were replaced, including the federal AI governance memo, superseded in April 2025. Agency programs and contractors that had tied their work to those documents had to adjust immediately. Some furniture was rearranged rather than removed: the January 2025 cybersecurity executive order was amended in June, keeping some provisions and striking others.

Proposals and guidance went the same way. In May 2025 the CFPB withdrew dozens of guidance documents issued since 2011, along with its December 2024 proposal on data brokers. In June the SEC withdrew fourteen pending proposals, among them its cybersecurity risk management proposal for investment advisers and funds and its proposal on predictive data analytics. The bank regulators withdrew their crypto-asset guidance that spring, while the OCC said it still expected the same strong risk management for new activities as for traditional ones.

Reconsideration did its share as well. Agencies reopened other finalized rules through new rulemaking, as with the CFPB’s open banking rule. An August 2025 advance notice reopened who may act for a consumer, whether data providers may charge fees, and the rule’s data security and privacy risks. So did litigation: in June 2025 a federal court in Texas vacated most of the 2024 HIPAA reproductive health privacy rule, which had fallen before the review window but had been in court all along.

The objections held up too. Exposure was not destiny. The CMMC program rule, inside the window, took effect in December 2024, and the Defense Department’s companion contract clause rule took effect in November 2025. The Justice Department’s rule restricting bulk transfers of sensitive personal data to countries of concern, published in January 2025, took effect that April. Rules whose aims the new administration shared survived despite their timing.

Statutes also proved less uniform than the sort assumed. The Corporate Transparency Act stayed on the books, but in March 2025 Treasury said it would not enforce beneficial ownership reporting against U.S. companies, and an interim final rule from FinCEN narrowed reporting to foreign entities. A statute that leaves key definitions to an agency is only as durable as those definitions.

Statutes that defined obligations directly did not move. State regulators and attorneys general grew more active in several areas, including consumer finance and AI, just as the sort anticipated. The January 2025 proposal to overhaul the HIPAA Security Rule had not been finalized as of this writing. That left health systems where the sort placed them: meeting the existing rule, and building the parts of the proposal that its risk analysis requirement already justified.

The pattern across all of these outcomes was consistent: the more easily an instrument could be changed, the sooner it changed, provided someone in power wanted it changed. Topic alone would have predicted much less. Rules on the same broad subjects met very different fates depending on how and when they had been made.

The CRA window closed in 2025, but the other two exposure channels, reconsideration and litigation after Loper Bright, remained open for rules of any age. Every change of administration will reset the odds on some obligations. The best first step stays the same: establish what kind of instrument created each one, who has the power to change it, and whether they want to. Organizations that keep that column in their inventory can respond to the next election in days rather than months.