Europe employs more people in compliance than in R&D

An opinion piece on the OECD's new estimate of what compliance actually costs in labour, and why the burden lands on the smallest companies.

In Europe, 3.9% of all jobs are now spent on regulatory compliance. R&D personnel account for 1.7%. Put differently: for every person in Europe paid to invent something, more than two are paid to prove the rules are being followed.

That comparison is not mine. It comes from an OECD Economics Department working paper published this year, Regulatory compliance costs and productivity: new task-based evidence (Andrews, Turban and Tyros, No. 1856). I build compliance tooling for European SMEs, so I read it closely. It is the most concrete attempt I have seen to put a number on something every founder feels but nobody invoices: the hours that go into being compliant.

How do you measure a workload nobody tracks?

The OECD did not count pages of law. It counted tasks. Every occupation is broken into the tasks it involves, and each task is scored on whether it is about rules, permits, licences, standards or compliance.

A regulatory affairs manager scores 79%: four-fifths of the job is compliance. A compliance officer, 51%. A construction inspector, 38%. A statistician or a robotics technician, zero. Weight those scores by how many people hold each job, and what they earn, and you get the share of a whole economy's labour spent on compliance work.

The method is borrowed from work on automation and green skills. Its strength is that it measures effort, not legislation. A thousand-page law nobody has to act on scores nothing. A two-page rule that makes every firm fill in a register every quarter shows up in the data.

The numbers: high, and rising everywhere

Compliance absorbs between 3% and 4% of all employment in every region the OECD measured, and the share went up over the decade in all three.

In the US, where wage data is detailed enough, compliance takes 4.2% of the total wage bill. That is USD 521 billion a year, or 1.8% of GDP, set against 2.7% of GDP spent on all R&D. It also means 4.5 to 5 million American workers doing compliance full time, in effect.

Some European countries sit at 5% to 6% of employment. And the authors call their own estimates conservative: they leave out the capital spent on compliance (software, equipment, audits), which earlier research puts at another 20% on top.

Why small and young firms pay the most

Compliance is largely a fixed cost, and a fixed cost weighs most on whoever has the smallest revenue to spread it over.

A records of processing register, a data processing agreement, a breach procedure: a company of 8 needs the same documents as a company of 800. The large one has a legal team. The small one has a founder writing policies at 11 pm.

The OECD tested this across US states. Where compliance costs rose by about 3.7% (the median), labour productivity came out 0.5% lower and the share of workers in young firms (under five years old) fell by almost 0.4 percentage points. The median state has 9.8% of its workforce in young firms, so that is a real dent. In the states where compliance costs jumped most, like Louisiana and Alabama (+12%), productivity is estimated almost 2% lower than if costs had stayed at 2012 levels.

The reverse also shows up. Idaho passed two deregulation acts in 2019 and its compliance share dropped visibly after, while the national line kept climbing. New Hampshire cut its index by 13.6% over the decade, and the young-firm share is estimated 1.4 points higher for it.

What the numbers don't say

This is not a case against regulation, and reading it as one would be a mistake.

• It counts costs, not benefits. The Clean Air Act's health gains far exceeded its costs; safety rules have cut injuries with no measurable job loss. Data protection rules buy something too. The paper is explicit that the social value of rules is outside what it measures.
• The productivity link is an association. It comes from US states only, and the shorter-term effects only become statistically clear after four or five years.
• Europe-versus-US levels are approximate. European task descriptions are far less detailed than the US ones, and two methods give different levels. The rising trend holds under both; the exact gap does not.
• It is a working paper. Preliminary results, published to start a discussion, not to settle one.

There is also one bias I suspect runs the other way, at least for small firms. The index finds compliance work inside job descriptions. In a 10-person company, nobody's job title says compliance: the founder, the office manager and the developer absorb it on top of their real work. That effort is probably under-counted.

My take: attack the fixed cost, not the rules

The useful question is not "how much regulation" but "how many hours does it take to comply with it". Those are two different dials, and the second one can be turned without weakening a single protection.

For a Belgian or French SME today, the stack is GDPR, ePrivacy, NIS2 for a growing number of sectors, and the AI Act arriving in stages. Each comes with registers, policies, procedures and evidence. Most of that work is the same work, repeated: describe what data you hold, which vendors touch it, what you do when something breaks. A small company rebuilds it from scratch for each regulation, often from a blank Word document.

Three things would bring the hours down:

1. Do the shared work once. One inventory of systems, vendors and processing activities can feed the GDPR register, the DPAs, the privacy policy and much of the NIS2 evidence. Duplication is where SME hours disappear.
2. Standardise the documents. A lawyer can review one template once; nobody can review ten thousand bespoke policies. Templates reviewed by counsel give small firms the quality large firms pay for.
3. Be honest about what applies. A lot of SME effort goes into obligations that turn out not to apply, driven by fear of fines rather than a clear reading of the law. Knowing what you can safely set aside is worth as much as knowing what to do.

The OECD's own conclusion points the same way: manage the stock of existing rules, and design "smart regulation" that keeps the benefits while cutting needless burden. Policymakers own the first half. The second half, the hours, is something tooling and good practice can shrink now.

That is the problem I am working on with RECOSA. But the bigger point stands regardless of the tool: if Europe wants more young companies, it should count compliance in hours, and treat every hour saved for a 10-person firm as productivity it gets back.

Source: Andrews, D., S. Turban and S. Tyros (2026), Regulatory compliance costs and productivity: new task-based evidence, OECD Economics Department Working Papers, No. 1856, OECD Publishing, Paris. Published under CC BY 4.0. The opinions in this article are the author's own and do not represent the official views of the OECD or its member countries.