gov regs, companies get fines for non-compliance and will default to abiding because there's more pain if they don't comply than if they do.