Part of the cost is -documenting- what you're doing. Ensuring the right stakeholders are involved and signed off on it. Etc. When there's a regulation to do it, suddenly you have to involve legal, and the business stakeholders want to better understand it, whereas before it may have just been the developers.

This is incredibly false. When you change the law, you can't assume that people who are currently in compliance will continue to be.

To use a silly extreme: if a new law came out that said I couldn’t yell profanities at my customers, I’m already compliant.

Counterexample: comedy central now has to work to redact all noncompliant programming.

Best practices are funny because context and history are important. Actual regulation is not so forgiving.

Good point—guess this is not as black and white as I first thought!