How Many Regulatory Changes Happen Per Year? The Statistics, Sourced

There is no honest single answer to how many regulatory changes happen per year, but there are four defensible numbers. In 2025, US federal agencies published 2,441 final-rule documents (Federal Register API), the EU adopted 2,575 legal acts (EUR-Lex statistics, pulled 30 September 2026) and the UK made 1,120 statutory instruments (legislation.gov.uk). The widest published feed-level count is 61,228 regulatory events across 1,374 regulators in 190 countries, about 234 per working day, tracked by Thomson Reuters Regulatory Intelligence in 2022, the most recent annual figure we could find (Cost of Compliance 2023).

The one-number answers that circulate on this query are unsourced, years stale or both, and 2025 showed the question itself to be incomplete. The most deregulatory US year on record by one think tank's count still handed compliance teams 2,441 final rules to assess, because a repeal is a change: it needs the same applicability call, the same impact assessment and the same evidence that you looked. "How many changes happen" matters far less than "how many did you have to triage."

This page publishes the numbers without a form. Every statistic carries its period, primary source, counting rule and, wherever the source is machine-readable, the query to reproduce it. All figures are as of 30 September 2026. The page belongs to our regulatory intelligence hub.

The dataset holds 41 statistics, each dated and sourced

The caveat column is what separates this table from the listicles. The sections below the tables explain the counting rules and the corrections behind them.

A. Volume of regulatory change by jurisdiction

B. Global monitored-event feeds and surveys

C. Cost of compliance

D. Cost of non-compliance and enforcement

Reproduce the machine-readable numbers yourself

Methodology: what counts as a "regulatory change" depends entirely on who is counting

Nothing here is our estimate. Every value is a primary source's own figure, and the counting rules differ so much that adding rows together produces nonsense. The rules that matter:

• US "final rules" are Federal Register documents of type RULE, including hundreds of minor administrative rules (airworthiness directives, fishing quotas) that no compliance team will ever see. A ceiling on rulemaking activity, not a count of obligations. Counts are by publication date, so 228 of the 2025 total appeared between 1 and 20 January, on or before inauguration day.
• Federal Register pages come in two bases. The official table gives a total (the last page number, skips included) and an actual count (skipped and blank numbers removed). Compare 2024's 106,109 actual with 2025's 60,917 actual, not with 61,584. Pages are mostly notices and proposals, so they are not rules and not obligations.
• EU act totals count by adoption date, exclude corrigenda and ephemeral agricultural acts, and include Council decisions on appointments and foreign policy. Counts also backfill: the 2025 total was 2,567 in a June 2026 capture and 2,575 on 30 September. State the pull date.
• UK SI counts backfill as late instruments are registered, and the Welsh instruments (225 in 2025) sit in a separate facet.
• Feed-level counts measure one vendor's alert output, the broadest and softest definition of "change." Thomson Reuters' "per day" figures match its annual totals divided by about 261 working days, so read them as per working day.
• Partial-year figures (the 2026 year-to-date counts for US rules, Federal Register pages and EU acts) are labeled and never annualized.
• Political self-reporting (the White House's 129 to 1 ratio) is attributed, not adopted, and set beside OMB's own narrower ratio and outside estimates.
• Vendor and commissioned surveys (CUBE, LexisNexis and Forrester, Ponemon) are named as such in the tables, with sample sizes where the publisher gives them, so you can decide how much skepticism to apply.
• Live sources (the GDPR tracker, the QuantGov tracker) change daily, so the table prints the date of the pull.

Three zombie statistics circulate in every compliance listicle: stop citing them

Listicles built from secondary citations keep three corpses walking. As of 30 September 2026:

"Over 4,500 regulatory updates are issued globally each year (Gartner)." We could not locate a Gartner primary for it, and it appears in none of the Thomson Reuters reports we read. Until someone produces the source, treat the number as unsourced.

"Roughly 3,000 to 4,500 regulations are published each year." No source at all. Its lower half resembles the US final-rule count (2,964 to 3,854 a year over 2015 to 2024), which is real and machine-readable and did not need rounding into a rumor, but nothing connects the two figures except our own observation: 3,248 in 2024, 2,441 in 2025.

"Compliance teams face 200 regulatory changes a day." It traces to Thomson Reuters' Cost of Compliance 2016, which reported that in 2015 to 2016 an average of 200 international regulatory publications, changes and announcements were captured daily. Later reports gave 216 a day for 2017 (TR said the rise partly reflects more regulators monitored), 246 for 2021 and 234 for 2022, and each matches the annual total divided by about 261 working days. We found no report after 2023 with a newer Thomson Reuters event count, and CUBE, which now publishes the franchise, states no newer annual event total on its report page or in its press release. Its current product page says over 180 regulatory changes land every day, an undated vendor claim.

Numbers like these escape their methodology, lose their dates and compound through content farms. The most-quoted cost figure in compliance gets its own section below.

2025 was the most deregulatory US year on record by AAF's count, and it still produced 2,441 final rules to triage

The American Action Forum (AAF) called 2025 the most deregulatory calendar year recorded in its RegRodeo database: net regulatory cost savings of $129.7 billion and 50.9 million paperwork hours cut (AAF, 9 January 2026). Read AAF's fine print: two rules, the beneficial ownership revision ($84.0 billion) and the long-term-care staffing repeal ($55.1 billion), together exceed the entire net saving. Without them, AAF says, 2025 would have been about $9.4 billion in net costs.

The administration's numbers are larger and built differently. The White House's year-end statement of 19 December 2025 cites OMB's fiscal year 2025 accounting: 646 deregulatory actions against 5 significant regulatory ones (129 to 1) in the first eight months of the administration, and $211.8 billion in savings. The OMB document is more careful than the headline: the $211.8 billion is a present value as of 2024, about $14.8 billion a year by OMB's own annualization method, and counting only the 218 deregulatory actions that delete, modify or refine the CFR gives 43 to 1. AAF, tallying published final rules that reference the executive order, found 40 deregulatory and 3 regulatory rules with about $140 billion in net savings, and wrote that the administration's claim came with little supporting documentation. Treat the 129 to 1 as a political self-report and the AAF figure as the checkable one.

The Federal Register still carried 2,441 final-rule documents in 2025, which the Competitive Enterprise Institute calls the lowest annual count on record (CEI, April 2026), plus 225 executive orders, the most in a calendar year since 1942 by AAF's count. Each deregulatory action was itself a change to notice, scope and documentation: does the repeal apply, which controls does it retire, where is the evidence we assessed it. At your next exam, a rescission without a documented applicability call looks identical to one you never saw. Deregulation changes the direction of the workload, not its existence.

And the trough may be short. Through 30 September 2026 the Federal Register had published 2,238 final-rule documents, against 1,952 in the same nine months of 2025, and its actual page count through 29 September, 60,975, had already passed 2025's full-year 60,917. Those are partial-year figures and we do not annualize them, but they are the opposite of a continuing collapse.

The stock, as opposed to the flow: the RegData 6.0 file from QuantGov (Mercatus) counts 1,126,959 regulatory restrictions in the CFR in 2025, words like "shall" and "must", up from 409,520 in 1970, and one deregulatory year barely dents a stock of that size.

The EU adopted 2,575 legal acts in 2025, and the work lives in the implementing layer

EUR-Lex's own statistics for 2025 (pulled 30 September 2026): 2,575 legal acts adopted, of which only 55 were European Parliament and Council legislative acts, the headline layer, while 1,205 were implementing acts and 167 delegated acts (EUR-Lex legal acts statistics). The rest: 530 Council acts (480 of them decisions, many on appointments and foreign policy) and 618 other instruments.

That composition is the practical point. A CCO who tracks "EU regulation" by watching flagship legislation sees 55 acts a year and misses the 1,372 delegated and implementing acts where technical standards, thresholds and templates change. And the technical layer is growing while the flagship layer shrinks: implementing plus delegated acts ran at 1,242 in 2024, 1,215 in 2023 and 1,266 in 2022, and between 973 and 1,235 in 2015 to 2021, so 2025 is the highest year in the series. Parliament and Council acts fell to 55 from 146 in 2024, the lowest in the series. The 2026 year to date (1,807 acts, 927 of them implementing) is a partial figure that is still backfilling, so we print it and do not annualize it.

The caveats that belong on every citation of the 2,575: it counts by adoption date, excludes corrigenda and ephemeral agricultural acts, includes 106 Council implementing acts, and includes Council decisions with no compliance relevance to most firms. That makes it an upper bound on EU legal output.

The UK made 1,120 statutory instruments in 2025, and sector rulebooks churn beneath the SI count

The official count, read from legislation.gov.uk's data feed on 30 September 2026: 1,120 UK statutory instruments made in 2025 (legislation.gov.uk). Two traps. The site's year-browse mixes in Welsh SIs (225 in 2025), so the 1,345 combined figure is a different count, and SI numbers backfill as late instruments are registered, so a count without a pull date will not reproduce.

And the SI count is only the statutory layer. The faster churn is in regulator rulebooks: the FCA amends its Handbook through numbered legal instruments batched in monthly Handbook Notices. Notice No. 128 is dated March 2025 and No. 144 is dated September 2026, so 17 numbered notices cover those 19 months. We deliberately print no instrument count: the FCA's instrument list is JavaScript-rendered and we could not machine-verify a total, the same standard we hold every stats page to. UK firms face change on two clocks: Parliament's 1,120 SIs and the regulators' monthly rulebook cycle.

The only defensible global number is 61,228 regulatory events in 2022, and it is a feed count, not a law count

Thomson Reuters Regulatory Intelligence tracked 61,228 regulatory events across 1,374 regulators in 190 countries in 2022, an average of 234 daily alerts, the third-highest annual total since 2008 (Cost of Compliance 2023; the franchise now belongs to CUBE, and what that sale means for TRRI customers is its own article). Because 61,228 divided by about 261 working days is 234.6, "234 a day" is a per-working-day figure; spread over every calendar day it is about 168. It remains the widest published count we could find, and it is nearly four years old, one vendor's alert-feed output in which "event" spans everything from a binding rule to a speech. Thomson Reuters' own series shows how much of the growth is coverage: 52,506 alerts from 750+ regulators in 2016, 56,321 from 900+ in 2017, 64,152 in 2021 and 61,228 in 2022.

CUBE's 2025 edition adds recent context from a survey of more than 2,000 senior compliance and risk leaders across 11 markets (CUBE, November 2025). Three numbers matter for a board: 74% of firms take more than a year to implement new regulations, 98% have adopted some automation but few have end-to-end visibility, and only 16% of respondents report potential regulatory change directly to their executive teams or board, per CUBE's press release. Separately, CUBE says it captured and published 157 financial-services regulatory insights on AI-relevant laws and rules between June 2024 and May 2025, almost double the prior year. That is a count of CUBE's own published items, so read it as a trend signal, not a census.

Cost-of-compliance statistics: the most-quoted figure is nine years old

The number atop nearly every "cost of compliance" listicle, $5.47 million average cost of compliance, comes from a Ponemon Institute and Globalscape study published in December 2017 (Globalscape announcement, archived). It was decent research with narrow scope: 53 multinational organizations located in the United States, 237 functional leaders interviewed, measuring the cost of complying with data-protection regulations, not compliance in general. Financial services averaged more than $30.9 million in that study and media $7.7 million. It is nine years old, and some listicles pull figures from the 2011 edition ($3.5 million compliance and $9.4 million non-compliance, 46 organizations) without noticing they are different reports. If you use the Ponemon numbers, date them and name the scope.

What newer, narrower primaries support, as of 30 September 2026:

• Financial-crime compliance alone costs US and Canadian institutions $61 billion a year, with 99% reporting cost increases and 79% citing rising technology costs for compliance and KYC software: Forrester Consulting for LexisNexis Risk Solutions, 1,181 senior decision-makers globally (160 in the US and Canada), fielded May to June 2023, published February 2024. It is a commissioned study, and the $61 billion rests on a small regional subsample.
• 60% of CUBE's respondents expect the cost of regulatory change management to rise over the next 12 months (CUBE, 2025).
• In Thomson Reuters' 2023 survey of more than 350 financial-services practitioners, 45% said they did not monitor the costs of compliance with regulations across their firms, while 37% did (TR Cost of Compliance 2023). Many of the people quoting cost statistics cannot produce their own number.

There is no defensible cross-industry "average cost of compliance" for 2026. Anyone offering one without a date and a sample size is reciting the 2017 study.

Cost-of-non-compliance statistics: use enforcement primaries and read the footnotes

Same discipline on the other side of the ledger. The circulating figure, non-compliance costing $14.82 million on average, 2.71 times the cost of compliance, is the same December 2017 Ponemon and Globalscape study of 53 US-based organizations, with a range from $2.2 million to $39.22 million. Cite the multiple, carry the date and the data-protection scope. The current, checkable basis for "what does missing a change cost" is enforcement primaries, read carefully:

• SEC, fiscal 2025: 456 enforcement actions (303 standalone, 69 follow-on and 84 delinquent filings) with a headline $17.9 billion in monetary orders (SEC press release 2026-34, 7 April 2026). Three exclusions sit behind the net figure. The SEC's addendum attributes $14.9 billion of the headline to a single case, SEC v. Stanford International Bank, and separately excludes amounts that a parallel criminal restitution or forfeiture order deemed satisfied, plus $71 million in off-channel communications penalties ordered early in the fiscal year. After those, the release puts the total at about $2.7 billion: $1.4 billion in disgorgement and interest and $1.3 billion in civil penalties. And resist trend claims from the action count: fiscal 2024 had 583 total and 431 standalone actions, and the SEC describes 2025 as a refocus on fraud and individual defendants. A record 53,753 tips still came in.
• GDPR: CMS's seventh Enforcement Tracker Report, with a cutoff of 1 March 2026, counts about 6.11 billion euros across 2,685 fines, up 487.6 million euros on the previous edition. The live tracker moved on: on 29 September 2026 it showed 7.16 billion euros across 3,275 cases, after the Dutch data protection authority fined a ride-hailing platform 824,990,000 euros on 21 August 2026 for fully automated driver deactivations, a fine the platform is contesting. Annual totals swing: about 2.09 billion euros in 2023, 1.24 billion in 2024 and 1.12 billion in 2025, with 1.08 billion in 2026 to date. Cite the tracker date, not the larger drifting totals on vendor blogs, and do not read "accelerating" into a series that peaked in 2023.
• The buyer's-eye view: in ACC's 2026 survey of 1,049 chief legal officers in 43 countries, 24% name AI regulation and 30% trade and tariffs among the fastest-growing regulatory concerns, while 35% cite budget and resource constraints as the top barrier to success (ACC, January 2026).

"How many changes happen" is the wrong question; "how many must we triage" is the one your program answers for

Every number above is a denominator; none is your workload. Between "61,228 global events" and what your team must act on sit three filters: which sources are authoritative for you, which items match your business, and which survive de-duplication and triage. That filtered number is the only one worth budgeting against, and with 45% of surveyed practitioners not monitoring their cost of compliance, almost nobody measures triage load either.

A team monitoring a dozen jurisdictions processes the findings its scope catches rather than 61,228 events or 2,441 rules, and it needs a recorded reason for every accept and every dismissal. In RegWatch terms, and with the disclosure that RegWatch is my company: a Watchlist defines scope, scheduled runs (daily to monthly) yield Findings with the source URL, dates and a verbatim excerpt, triage records an accept, reject or defer decision with a written "Why this matters," dismissing an inbox item requires a reason, and an accepted alert converts into an obligation with an owner, a deadline and evidence. "We assessed it and it does not apply" is only evidence if it is written down. We do not publish platform-wide volume figures here, for the same reason we label partial-year counts: a young platform's totals measure activity, not relevance.

If you are building that filter manually, start with how compliance teams track regulatory changes and the free regulatory change tracker spreadsheet. Whether the volume above has outgrown a spreadsheet is a question for a scored diagnostic.

Cite dated denominators to the board and measure your own triage numerator

Three uses, in order of value. First, board decks: cite denominators with dates. "The EU adopted 1,205 implementing acts in 2025; our scope caught N; we dispositioned all N with recorded rationale" is a regulatory change management story an examiner respects, where "firms face 200 changes a day" is wallpaper. Second, measure your own numerator: the changes your team actually triaged last quarter, not any statistic here, set your staffing case and feed your obligations register. Third, audit the statistics you cite against the caveat column: a number with no date and no sample size is probably the 2017 Ponemon study or the phantom Gartner figure.

Where regulatory intelligence reports sit behind a registration wall, the numbers on this page carry their dates, sources and, where the source allows, the queries to check them.

---

This article is general information, not legal advice.