Earlier quoted context omitted.
It's more complicated than that. Largely, it just seems that way because most people never bother to understand the rules past a cursory Google whereas big companies have teams of very experienced regulatory professionals from the agencies themselves who are all about it and therefore know every way to tweak inputs so that they trigger certain regulations rather than others. I was working on a regulatory compliance p…
I think the fact that it took an entire month to understand how to reach compliance speaks to the "pay to win" nature of regulatory barriers-to-entry.
1. There was no one place that held all the data one was expected to know. Regs were strewn over legislative artifacts, departmental implementatikn documents, best practice documents, and international standards. Also, more than one class of regulations potentially covered efforts in the space. There was also no one site listing the locations of everything.
2. The regulations had evolved from an earlier time where an existing regulatory framework was adopted to try to fit new classes of things, and the mapping didn't work perfectly.
3. The regulations were written in a very high level manner to allow freedom of implementation and to make sure that the regulations didn't constrain tech development. Unfortunately, that meant that there were no suggested implementations which made it difficult for new entrants to the space (especially startups who can't afford to hire consultants) to understand how to actually comply simply.
4. There was ambiguity about what systems fit into which regulatory class as systems were advancing quickly and were changing state over time (ie updates) so traditional regulatory class lines were blurring.
That is where we stepped in. We were making a product that was ambiguously regulated and so we pulled the regs to understand them. Once we figured out how time consuming this was, we tried to make a software system to provide suggested basic implementations to be compliant and which helped companies properly bin their products into regulatory classes. Ultimately the entire regulatory system was changed rendering our product irrelevant, but I hope this shows why the system was as complicated as it was and helps demonstrate that the complexity was not a function of large players going for regulatory barriers to entry but rather a result of natural evolution and technical advancement over time which rendered existing regulations poorly suited for the current environment.