After the 2024 election, a rule’s legal form predicted its survival better than its topic

The week

On November 5, 2024, Donald Trump won the U.S. presidential election, and over the following days it became clear that Republicans would control both chambers of Congress. The result meant a change of administration on January 20, 2025, with new leadership at the financial regulators, HHS and the offices that set federal IT and AI policy. It also meant that rules finalized late in the outgoing administration could be overturned under the Congressional Review Act, which lets Congress disapprove a rule by joint resolution signed by the president. Because of the Act’s lookback provision, rules submitted to Congress from roughly early August 2024 onward would be open to review by the new Congress. Several significant rules affecting banks, health systems and agencies fell in that window. Months earlier, in June 2024, the Supreme Court’s Loper Bright decision had ended judicial deference to agency interpretations of ambiguous statutes.

Election weeks produce predictions about policy topics: AI, crypto, consumer finance, health data. For compliance planning, topic is a weak guide. Two rules on the same subject can have very different survival odds because of how they were made. The better predictor is the legal instrument behind each obligation. Every obligation a bank, health system or agency carries rests on one of three kinds of instrument, and they differ sharply in how easily a new administration can change them: statutes and long-standing regulations, rules finalized recently enough to fall inside the Congressional Review Act window, and guidance, proposals and executive orders. Sorting a regulatory inventory into those three groups was the most useful work of that week.

Statutes and long-standing regulations: durable, with a shift in who enforces

Most obligations come from statutes and mature regulations: the Bank Secrecy Act, the Gramm-Leach-Bliley Act, HIPAA, the Federal Information Security Modernization Act, and state privacy and breach notification laws. A new administration can change enforcement emphasis. It cannot change these obligations without legislation.

The risk here is drift. Uncertainty about new rules can spill into complacency about old ones. Statutes of limitations run for years, so conduct in 2025 can be examined by a later administration. When federal enforcement recedes, state regulators and attorneys general often step forward, sometimes under state statutes broader than their federal counterparts. Private litigation continues regardless. For organizations operating in many states, the likely result is more variation. The practical response is to keep this layer unchanged and strengthen monitoring of state activity. Where a team does reduce effort on a settled obligation, it should record why, in terms a future examiner would accept, because the decision will be judged against the law, not the political climate.

Recent rules in the review window: exposed on three channels

Rules finalized in 2024 faced three distinct threats. The first was Congressional Review Act disapproval, which voids a rule and bars the agency from reissuing one in substantially the same form without new legislation. The second was reconsideration by new agency leadership through fresh rulemaking, or delay of effective and compliance dates. The third was litigation, made more potent by Loper Bright. Courts would now decide for themselves what a statute meant, so rules resting on broad readings of agency authority were more vulnerable.

The channels do not overlap neatly, which is why each rule needs its own assessment. The open banking rule, finalized in October, was inside the CRA window and already in court. The CFPB’s larger-participant rule for digital payment apps, finalized later in November, was squarely inside the window. HHS’s April 2024 HIPAA rule on reproductive health privacy fell before the window but was already being challenged in litigation. A rule outside the CRA window was not safe; it had simply lost one of its three exposures.

For each rule in this group, a compliance team could record which channels applied. Was it submitted within the lookback window? Was it already being challenged in court? Did it rest on a contested reading of the statute? That produced a simple exposure score and a list of decision points: the CRA calendar in early 2025, agency announcements after January 20, and court rulings. Spending could then be staged around those dates. Work with standalone value could proceed. Work that existed only because the rule required it could be designed and held until the next decision point.

Counsel should advise on specific rules, because review windows, effective dates and litigation posture are procedural details that change the answer.

Guidance, proposals and executive orders: changeable at will

Proposed rules can be withdrawn. Guidance can be rescinded by notice. Executive orders can be revoked on the first day. None requires notice and comment, so change can be sudden.

This layer matters most for public agencies themselves. Much federal IT, cybersecurity and AI policy is set through executive orders and OMB memoranda, not regulation. Agency programs needed to know which activities rested on statute, such as FISMA, and which on a memorandum that could disappear. Contractors serving agencies faced the same question about solicitation clauses that implemented those memoranda.

For regulated firms, guidance often describes what examiners expect, even when it is not binding. Its rescission changes the formal reference, not necessarily the examiner’s view of sound practice. A useful step is to note, for each guidance document the organization relies on, the underlying statute or safety-and-soundness principle it interprets. If the guidance goes, that anchor remains, and so does most of the control.

An earlier article in this series, on the open banking rule, applied a related test to a single regulation: separate work worth doing anyway from work only a rule requires. The instrument sort scales that test to the whole inventory. It tells a compliance leader where to apply it first, starting with the second and third groups, where the odds had moved most.

With hindsight

The instrument proved a reliable predictor. In 2025 Congress used the Congressional Review Act to overturn several late-2024 rules, including the CFPB’s rules on larger digital payment providers and on overdraft fees, and an IRS rule on brokers in decentralized finance. The 2023 AI executive order was revoked on January 20, 2025, and many OMB memoranda were replaced. Agencies reopened other finalized rules through new rulemaking, as with the CFPB’s open banking rule. Litigation did its share: in June 2025 a federal court in Texas vacated most of the 2024 HIPAA reproductive health privacy rule. Statutes and mature regulations did not move, and state regulators and attorneys general grew more active in several areas, including consumer finance and AI. The CRA window closed in 2025, but the other two exposure channels, reconsideration and litigation after Loper Bright, remained open for rules of any age.