Code of Federal Regulations (CFR) Explained

The Code of Federal Regulations (CFR) is the codified body of permanent rules issued by federal executive departments and agencies of the United States government. It translates broad congressional statutes into specific, enforceable operational requirements that govern industries, businesses, and individuals nationwide. Understanding the CFR is essential for anyone navigating administrative law and agencies, interpreting federal compliance obligations, or analyzing the relationship between legislative mandates and agency rulemaking authority.

Definition and scope

The CFR is the official compilation of all general and permanent rules published in the Federal Register by the executive departments and agencies of the federal government. It is organized into 50 numbered titles, each corresponding to a broad subject area of federal regulation. Title 21, for example, covers Food and Drugs and contains the regulations administered by the Food and Drug Administration (FDA). Title 29 covers Labor and includes Occupational Safety and Health Administration (OSHA) rules. Title 40 covers Protection of Environment and houses the Environmental Protection Agency's (EPA) regulatory framework.

The CFR is maintained by the Office of the Federal Register (OFR), a component of the National Archives and Records Administration (NARA). The complete, authoritative text is published annually in print and is freely accessible through the Electronic Code of Federal Regulations (eCFR), which is updated on a rolling basis to reflect recent amendments.

The CFR is distinct from the United States Code, which compiles statutory law enacted by Congress. Where the U.S. Code represents the legislative branch's output, the CFR represents the executive branch's regulatory output — rules that carry the force of law but originate from agency rulemaking rather than direct legislation. This distinction is foundational to understanding sources of US law and the separation of powers framework.

How it works

The CFR is structured in a strict four-level hierarchy: titles, chapters, parts, and sections. Each section carries a standardized numerical citation: for instance, 29 C.F.R. § 1910.1200 refers to Title 29, Part 1910, Section 1200 — OSHA's Hazard Communication Standard. This citation format is universally used in litigation, compliance documentation, and regulatory enforcement.

Rules enter the CFR through a formal process governed by the Administrative Procedure Act (APA), codified at 5 U.S.C. §§ 551–559. The standard rulemaking sequence proceeds in discrete stages:

1. Proposed Rule (NPRM): The agency publishes a Notice of Proposed Rulemaking in the Federal Register, setting out the proposed rule text and inviting public comment for a defined period, typically 30 to 60 days.
2. Public Comment Period: Interested parties — businesses, advocacy groups, state governments, and individuals — may submit written comments. Agencies are obligated to consider all substantive comments.
3. Final Rule: After reviewing comments, the agency publishes a Final Rule in the Federal Register, including a preamble that responds to significant comments and states the effective date.
4. Codification: The final rule is incorporated into the relevant CFR title and part, updating the standing text.

Congress may also authorize expedited or interim rulemaking for emergency or time-sensitive regulatory needs, bypassing the full notice-and-comment cycle in limited circumstances permitted under the APA.

The regulatory agencies in the US legal system responsible for CFR titles hold both rulemaking and enforcement authority within their statutory mandates, subject to judicial review under the APA's arbitrary-and-capricious standard.

Common scenarios

The CFR surfaces in a wide range of legal and compliance contexts:

Workplace safety enforcement: OSHA enforces standards codified in 29 C.F.R. Part 1910 (general industry) and Part 1926 (construction). A workplace fatality investigation, for instance, will reference specific CFR sections to establish which standards were allegedly violated and what penalties apply. OSHA's penalty structure — with maximum penalties for willful violations set at $156,259 per violation as of 2023 (OSHA Penalties) — is itself established through the CFR and annually adjusted.

Environmental permitting: EPA regulations in 40 C.F.R. govern air quality standards, water discharge permits under the Clean Water Act, and hazardous waste management under RCRA. Industrial facilities must demonstrate compliance with specific numerical thresholds and procedural requirements codified in those parts.

Healthcare billing and privacy: HHS regulations at 45 C.F.R. Parts 160 and 164 establish the HIPAA Privacy and Security Rules. Covered entities and business associates are subject to civil monetary penalties that reach up to $1,919,173 per violation category per calendar year as of 2023 (HHS HIPAA Penalty Adjustments).

Financial services: Banking regulations in 12 C.F.R., administered by the Federal Reserve, the Office of the Comptroller of the Currency (OCC), and the Consumer Financial Protection Bureau (CFPB), govern capital requirements, consumer disclosures, and anti-money-laundering obligations.

These scenarios illustrate how the CFR functions as the operative layer of federal law — the point where statutory authorization becomes specific, measurable, enforceable obligation.

Decision boundaries

Several key distinctions govern how the CFR is interpreted and applied.

CFR vs. Federal Register: The Federal Register is the daily journal of federal government activity — it is a sequential, chronological record. The CFR is the codified, organized result of that activity. Regulatory practitioners consult the Federal Register to track changes; they cite the CFR for the operative text.

Binding rules vs. guidance documents: Not all agency publications carry the legal force of CFR rules. Guidance documents, policy statements, and interpretive letters issued by agencies — while potentially influential in enforcement — do not carry the same binding authority as codified CFR sections. Courts applying the APA distinguish sharply between the two.

Preemption and state law: Federal CFR rules can preempt conflicting state regulations in areas where Congress has granted agencies comprehensive regulatory authority. This intersection between CFR obligations and federal vs. state law is frequently litigated in administrative and constitutional contexts.

Judicial review: CFR rules are subject to challenge under the APA. Courts may vacate a rule if it is found arbitrary, capricious, an abuse of discretion, or contrary to the enabling statute. The scope of that review has been shaped by landmark administrative law doctrine, including legal precedent and stare decisis developed in the federal circuit and Supreme Court.

References

• Office of the Federal Register — Code of Federal Regulations
• National Archives and Records Administration — CFR Overview
• Administrative Procedure Act, 5 U.S.C. §§ 551–559 (Cornell LII)
• OSHA Penalties
• HHS — HIPAA Civil Monetary Penalties
• U.S. Government Publishing Office — CFR
• Electronic Code of Federal Regulations (eCFR)