My understanding is that most of the cost is driven by outdated and draconian compliance requirements (created by public/government agencies). For example, safety requirements that don't have a threshold but instead require reducing risk "as much as possible" which is equivalent to 0 profit.