Comprehensive Model for the Analysis and Assessment of Regulatory Risk: Fundamentals, Mathematical Algorithm and Practical Application

1. Theory of Regulatory Risk Analysis: Algorithm for Assessing Regulatory Risks

Regulatory risk analysis is a systematic process that allows anticipating the impact that regulatory changes may have on the viability of products, processes or business strategies. To structure this analysis in a coherent manner, an algorithm based on nine sequential steps is proposed, which address the identification, classification, evaluation and management of potential regulatory risks (Aven & Zio, 2014; Fischoff, 1995; Renn & Kilinke, 2004; Renn et al., 2011; Slovic, 1987; Zio, 2018).

The first step is to identify the regulatory event. At this stage, it must be determined if there is an official announcement, a measure already in process or a legislative change that may affect the business. The correct classification of the type of event is crucial, since not all advertisements have the same legal force or the same degree of imminence. The event must be categorized into one of the following classes: political announcement, formal action by a regulatory agency, enactment of a new regulation or revocation of existing authorizations, or change in non-binding guidelines or policies. Each of these events has different levels of probability of materialization and impact.

The second step is to classify the type of action that is intended to be implemented. Regulatory action can take different forms, each with different implications for the company. Among the main actions are: the elimination or prohibition of products, the reduction of maximum permitted levels for certain compounds, the imposition of new labelling requirements, the establishment of regulatory incentives to encourage the use of safer or more natural alternatives, and the imposition of additional obligations, such as the need to reformulate products or comply with stricter technical requirements.

In the third step, it is necessary to evaluate the implementation status of the measure. The priority of risk depends directly on whether the regulation is already in force or whether it is still in the public consultation phase, in draft or simply planned for the future. At this stage, it is important to clearly identify the planned timeline, including key dates for entry into force, transition periods, and deadlines for adaptation or public comment.

The fourth step focuses on impact analysis. Here we analyze the degree of impact that the measure would have on the company's products or activities. The impact can be classified as high (when it involves a total ban or revocation of authorisations), medium (when it establishes partial restrictions or new labelling requirements), or low (when it comes to voluntary recommendations or incentives that do not require an immediate change). In addition, it must be assessed which groups of products are affected: whether the measure applies to all products, or only to specific categories, which modulates the priority of action.

The fifth step is to evaluate international precedents. It should be analysed whether there are similar measures already adopted in other jurisdictions or other relevant markets. If similar actions are identified, it should be assessed whether there is a global trend towards tightening regulatory frameworks. This information allows us to anticipate the likelihood that local measures will also be adopted in other regions, increasing the overall risk for the company.

The sixth step requires planning future measures. Many times, initial regulatory announcements are only the first phase of a series of successive actions. It is essential to investigate whether any new scientific research, impact studies or future regulatory reviews have been announced. It should also be analysed whether regulators have explicitly stated their intention to expand restrictions, ban new substances or impose additional requirements in the short or medium term.

In the seventh step, collateral risks are identified. Beyond the direct regulatory impact, side effects that can aggravate the situation should be considered. These include the increase in litigation or class actions, the intensification of public or media pressure on certain products or brands, the economic costs derived from the need to reformulate or restructure the portfolio, and the reputational risk associated with the public perception of non-compliance or lack of commitment to consumer safety.

Once the above steps have been completed, a risk level must be assigned in the eighth step. Based on all the information collected, risk is categorized into one of the following levels: critical risk, when there is an existential threat to the continuity of the product's commercialization; high risk, when urgent adaptation is required, either by reformulation, strategy changes or ingredient substitution; moderate risk, when the expected changes are possible but not urgent; and low risk, when the event requires only follow-up and monitoring, without immediate action.

Finally, in the ninth step, recommendations for action must be defined. Based on the level of risk assigned, an adapted response plan is drawn up. Strategies may include reformulating the product to fit new requirements, switching suppliers to access compliant ingredients, adapting labels and business communications, developing or adopting safer or more natural alternatives, communicating in advance with customers and stakeholders to manage expectations, and preparing legal contingency plans in case of sanctions, lawsuits or product recalls.

Table 1. Phases of the regulatory risk analysis and management process.

Step	Topic	Objective	Classification or Action
1	Identification of the regulatory event	Detect if there is an official or planned action	Political announcement, agency action, new regulation, change in guidelines
2	Classification of the type of action	Define the nature of regulatory change	Elimination, reduction of levels, new labelling requirements, incentives, additional obligations
3	Implementation Status Assessment	Establish the degree of progress of the measure	Current, public consultation, planned
4	Impact analysis	Measure the level of impact on products	High, medium, low; General products or specific categories
5	Evaluation of international precedents	Determine global regulatory trends	Europe, Canada, other relevant countries
6	Projection of future measures	Anticipate new restrictions or regulatory studies	New investigations, possible extensions of restrictions
7	Identification of collateral risks	Analyze indirect consequences	Litigation, public pressure, reformulation costs, reputational risk
8	Risk Level Assignment	Classify impact severity	Critical, high, moderate, or low risk
9	Recommendations for action	Define response strategies	Reformulation, change of suppliers, adaptation of labels, development of alternatives, advance communication, legal contingency plans

Table 1. Phases of the regulatory risk analysis and management process.

Step	Topic	Objective	Classification or Action
1	Identification of the regulatory event	Detect if there is an official or planned action	Political announcement, agency action, new regulation, change in guidelines
2	Classification of the type of action	Define the nature of regulatory change	Elimination, reduction of levels, new labelling requirements, incentives, additional obligations
3	Implementation Status Assessment	Establish the degree of progress of the measure	Current, public consultation, planned
4	Impact analysis	Measure the level of impact on products	High, medium, low; General products or specific categories
5	Evaluation of international precedents	Determine global regulatory trends	Europe, Canada, other relevant countries
6	Projection of future measures	Anticipate new restrictions or regulatory studies	New investigations, possible extensions of restrictions
7	Identification of collateral risks	Analyze indirect consequences	Litigation, public pressure, reformulation costs, reputational risk
8	Risk Level Assignment	Classify impact severity	Critical, high, moderate, or low risk
9	Recommendations for action	Define response strategies	Reformulation, change of suppliers, adaptation of labels, development of alternatives, advance communication, legal contingency plans

The introduction should briefly place the study in a broad context and highlight why it is important. It should define the purpose of the work and its significance. The current state of the research field should be carefully reviewed and key publications cited. Please highlight controversial and diverging hypotheses when necessary. Finally, briefly mention the main aim of the work and highlight the principal conclusions. As far as possible, please keep the introduction comprehensible to researchers outside your particular field of research. All the references mentioned in the text should be cited in the “Author-Date” format—e.g., (Baranwal and Munteanu [1921] 1955), (Berry and Smith 1999), (Cojocaru et al. 1999) or Driver et al. (2000). See the end of the document for further details on references.

2. Methods

After a review of the literature (Aven, 2010; Cox, 2009; Flage & Aven, 2008; Flage & Aven, 2009; Longman et al., 2017) have developed a scoring matrix that organizes in a structured way the criteria for assigning numerical values to each of the factors included in the regulatory risk assessment algorithm: Intensity (I), Degree of implementation (G), Time to mandatory (T), Proportion of the portfolio affected (P) and Expected litigation (L). This organization allows an objective, homogeneous and transparent evaluation of any regulatory event.

Each row of the table corresponds to a specific score level, ranging from 1 to 5 for the first four variables (I, G, T, and P), and from 0 to 1 on scales of 0.25 for the L variable, which acts as a risk amplification modifier.

For the variable Intensity (I), a value of 1 is assigned to events involving voluntary recommendations with no legal effect, while a value of 5 corresponds to the total prohibition of products or the revocation of existing authorizations.

Similarly, the variable Degree of implementation (G) varies from 1, in the case of a simple political announcement without official action, to 5, which represents a norm already in force.

The Time to Mandatory (T) variable measures the urgency of regulatory action. A value of 1 is assigned when you have more than three years to adapt, while a value of 5 indicates an immediate entry into force or in less than six months.

The variable Proportion of the portfolio affected (P) reflects the commercial impact of the regulatory change. A value of 1 indicates that less than 5% of the product portfolio is affected, and a value of 5 implies that more than 50% of the portfolio will need to be adapted or modified.

In the case of Expected Litigation (L), the approach is different: it is a modifier that increases the base risk. A value of 0 indicates that no risk of litigation is expected, while a value of 1 implies a critical situation in which the probabilities of lawsuits, penalties or reputational damage are very high. Between these extremes, the intermediate values of 0.25, 0.5 and 0.75 allow situations of low, moderate or high litigation to be graded, respectively.

The structure of this matrix allows for a coherent assessment of any regulatory situation, combining the intrinsic severity of the event, its state of progress, the temporal urgency, its commercial impact and the indirect risk of litigation. Thus, it provides a solid basis for applying the risk algorithm, calculating Regulatory Risk (RR) and making informed strategic decisions.

Table 2. Scoring matrix for calculating regulatory risk.

Punctuation	Intensity (I)	Implementation (G)	Time (T)	Ratio (P)	Litigation (L)
0	-	-	-	-	No or irrelevant litigation risk
0,25	-	-	-	-	Low (possible but unlikely)
0,5	-	-	-	-	Moderate (possible and likely in certain scenarios)
0,75	-	-	-	-	High (likely, risk of class action or regulatory action)
1	Voluntary recommendation, without legal effect	Only political announcement, no official action	More than 3 years to implement changes	Less than 5% of the portfolio affected	Critical (litigation or reputational damage will almost certainly occur)
2	New guidance or non-binding policy	Preliminary draft (open public consultation)	Between 2 and 3 years old	Between 5% and 15%	-
3	Mandatory labelling, but no prohibitions	Project published, consultation closed, awaiting decision	Between 1 and 2 years	Between 15% and 30%	-
4	Partial restriction (maximum limits, restrictions on use on certain products)	Final rule approved, in transition phase	Between 6 months and 1 year	Between 30% and 50%	-
5	Total ban or revocation of authorization	Mandatory standard already in force	Less than 6 months or immediate entry	More than 50% of the portfolio affected	-

Table 2. Scoring matrix for calculating regulatory risk.

Punctuation	Intensity (I)	Implementation (G)	Time (T)	Ratio (P)	Litigation (L)
0	-	-	-	-	No or irrelevant litigation risk
0,25	-	-	-	-	Low (possible but unlikely)
0,5	-	-	-	-	Moderate (possible and likely in certain scenarios)
0,75	-	-	-	-	High (likely, risk of class action or regulatory action)
1	Voluntary recommendation, without legal effect	Only political announcement, no official action	More than 3 years to implement changes	Less than 5% of the portfolio affected	Critical (litigation or reputational damage will almost certainly occur)
2	New guidance or non-binding policy	Preliminary draft (open public consultation)	Between 2 and 3 years old	Between 5% and 15%	-
3	Mandatory labelling, but no prohibitions	Project published, consultation closed, awaiting decision	Between 1 and 2 years	Between 15% and 30%	-
4	Partial restriction (maximum limits, restrictions on use on certain products)	Final rule approved, in transition phase	Between 6 months and 1 year	Between 30% and 50%	-
5	Total ban or revocation of authorization	Mandatory standard already in force	Less than 6 months or immediate entry	More than 50% of the portfolio affected	-

2.1. Mathematical Algorithm to Assess Regulatory Risk

Anticipating regulatory risk assessment is a crucial challenge for any company operating in markets subject to frequent regulatory changes, such as the food sector. The ability to detect, measure and prioritize these risks before they directly impact products or business strategy is decisive to ensure long-term sustainability and competitiveness (Neus et al., 1999; Paté-Cornell, 1996; Price, 2015).

To respond to this need, a simple but robust mathematical algorithm is proposed, specifically designed to quantify the regulatory risk associated with any event, regulatory change or legislative trend. The algorithm combines five key factors in a weighted manner, reflecting both the severity of the threat and the urgency and exposure of the company to change.

The proposed general formula is: Regulatory Risk (RR)=(I×G×T×P)×(1+L).

Each variable represents an essential component in the assessment:

• I (Intensity of Measure): measures the severity of regulatory action, from simple recommendations to formal prohibitions.
• G (Degree of implementation): reflects the level of progress of the regulatory process, from a preliminary announcement to an obligation already in force.
• T (Time to compulsory): introduces the urgency factor, crucial for prioritizing preventive actions.
• P (Proportion of the portfolio affected): quantifies the direct commercial impact of the measure.
• L (Expected Litigation): Acts as an amplification factor that captures collateral risks such as lawsuits or reputational damage.

The score range for each variable has been carefully defined so that for I, G, T, and P, a scale from 1 (low impact or low priority) to 5 (critical impact or high priority) is used, while for L, an additional modifier from 0 to 1 is used, depending on the expected risk of litigation or reputational consequences. Thus, the final result not only reflects the severity of regulatory risk in absolute terms, but also its ability to be amplified due to external factors.

The interpretation of the result is simple.

Table 3. Numerical Interpretation of Regulatory Risk.

Risk (RR)	Level
1-50	Low risk
51-150	Moderate risk
151-300	High risk
>300	Critical risk

Table 3. Numerical Interpretation of Regulatory Risk.

Risk (RR)	Level
1-50	Low risk
51-150	Moderate risk
151-300	High risk
>300	Critical risk

This structure provides an immediate classification of the level of risk, facilitating strategic decision-making such as product reformulations, label adaptation, supplier changes, or preparation of crisis communication plans.

2.2. Methodological Foundations

The design of this algorithm to assess regulatory risk is not arbitrary, but is inspired by internationally accepted standards of risk analysis and is based on widely recognized regulatory and scientific principles and references.

The Codex Alimentarius (Codex Alimentarius Commission, 2007) establishes that risk analysis should be based on the systematic identification of hazards, the evaluation of their severity and exposure, and the adequate management of uncertainties, concepts that underpin the structure of the proposed model.

Within the European legislative framework, Regulation (EC) No 178/2002 of the European Parliament and of the Council defines the general principles of food law and lays the foundations for the creation of the European Food Safety Authority (EFSA), establishing that all risk management must be proportional, non-discriminatory and based on up-to-date scientific evidence (Regulation (EC) 178/2002). In addition, EFSA has developed specific guidelines for terminology in risk assessment, promoting a clear and consistent understanding of key concepts such as severity, probability and uncertainty (EFSA Scientific Committee, 2012).

The European Commission has also issued guidelines to facilitate the implementation of food safety management systems based on the Hazard Analysis and Critical Control Points (HACCP) approach, underlining the need to assess risks in a systematic and flexible manner according to the size and type of company (Commission Notice 2016/C 278/01). Subsequently, Regulation (EU) 2017/625 reinforced the importance of official risk-based controls, extending this logic to the entire agri-food sector and consolidating the obligation for preventive approaches throughout the production chain (Regulation (EU) 2017/625).

From a methodological point of view, EFSA has published specific scientific opinions that reinforce the use of assessment matrices and the explicit treatment of uncertainties. In particular, its work on uncertainty assessment principles (EFSA Scientific Committee, 2018a) and its methodological guide on uncertainty analysis in scientific assessments (EFSA Scientific Committee, 2018b) support the inclusion of modifiers such as the litigation factor (L) in the proposed algorithm.

The ISO 31000:2018 standard on risk management has also directly influenced the construction of the algorithm, establishing that risk should be understood as a combination of the probability of occurrence of an event and its impact, incorporating factors of uncertainty, temporal sensitivity and severity (International Organization for Standardization, 2018).

In the U.S. context, the FDA has developed a similar approach based on food safety risk assessment. Its papers on risk-based preventive control and analysis (FDA, 2016) and on risk and food safety assessments (FDA, 2025) underscore the importance of identifying critical variables, establishing preventive measures based on the level of risk, and considering additional factors such as business responsiveness and public perception.

Finally, the FDA's approach to risk-based decisions, as proposed by the National Research Council (2010), supports the use of prioritization structures such as the scoring matrix proposed in the algorithm, recommending methods that allow proportional assessment of the severity, urgency, and exposure of each potential threat.

Together, these international references consolidate the conceptual and methodological validity of the regulatory risk assessment algorithm, ensuring that its application is coherent, reproducible and defensible to auditors, clients, compliance bodies or regulatory authorities.

2.3. Mathematical and Statistical Explanation of the Regulatory Risk Formula

To mathematically support the proposed Regulatory Risk (RR) calculation model, it is essential to consider academic and practical approaches that support the use of multiplicative models, semi-quantitative analyses, and the inclusion of amplification factors in the assessment of complex risks. The analysis of uncertain and multifactorial systems requires frameworks that adequately capture the interaction between different dimensions of risk, rather than treating them in isolation.

Cox (2009), in his article "Risk analysis of complex and uncertain systems", highlights precisely the importance of modeling risk systems where multiple interrelated factors simultaneously impact the final result. This perspective supports the use of variable products to more realistically reflect the combination of independent but concurrent threats.

The Federation of European Risk Management Associations (FERMA) provides updated evidence on the evolution of risk analysis methods in business practice in its "FERMA Global Risk Manager Survey Report 2024" (FERMA, 2024), which highlights the growing need for more dynamic and adaptive models in the face of complex and changing risks.

On the other hand, Taylor, Surridge, and Pickering (2020) propose in their study "Regulatory compliance modelling using risk management techniques" the application of risk modelling techniques for regulatory compliance, emphasizing the usefulness of structured models that weigh critical factors and risk amplifiers.

From a deeper theoretical perspective, Kaplan and Garrick (1981) in "On the quantitative definition of risk" establish a formal definition of risk as a function of the probability of occurrence and the magnitude of the consequences. This framework is critical to justify the multiplicative structure of the model, since it captures how less likely but highly severe events may still represent significant risks.

Zio in his various articles provides a detailed introduction to risk and reliability modelling, explaining why, in contexts where uncertainty is high and factors are numerous, multiplicative models offer advantages in terms of sensitivity and representativeness of the combined risk.

Aven (2016), in his review "Risk assessment and risk management: Review of recent advances on their foundation", reaffirms the importance of models that explicitly manage uncertainty and the interdependence of variables in risk assessment and management processes, something that translates directly into the proposed approach to the calculation of Regulatory Risk.

Finally, Modarres (2006) in "Risk analysis in engineering: Techniques, tools, and trends" addresses how risk engineering uses methodologies that integrate several factors in a composite manner, applying multiplicative adjustments and additional modifiers, as has been structured in the formula of the model with the amplification factor (1+L) associated with the expected litigation.

Together, these references provide a solid theoretical foundation to validate the mathematical structure chosen for the Regulatory Risk model, supporting both the choice of the multiplicative approach and the incorporation of proportional amplifying factors.

The formula used to calculate Regulatory Risk (RR) responds to a multiplicative model of combination of factors, where each variable included —Intensity (I), Degree of implementation (G), Time to mandatory (T) and Proportion of the affected portfolio (P)— represents an independent dimension of risk.

In this model, the product (×) is used as the operator instead of the sum, because in a regulatory context the risk is not additive, but combinatorial. The severity of the threat does not depend on the sum of isolated factors, but on how multiple dimensions of risk interact simultaneously, such as the severity of the measure, its imminence, the degree of regulatory progress and the percentage of the business affected.

An essential feature of this approach is that one high-risk variable enhances the effect of the others, rather than simply adding them together. Mathematically, this responds to a composite risk model, where: RR∝i=1∏nxi. Each of the relevant risk factors is ∝i.

Applied to the specific case of regulatory risk, the product is expressed as: RR=I×G×T×P.

Each variable is scaled from 1 to 5, which allows establishing a controlled distribution of possible values, avoiding extreme biases and comparing different scenarios in a homogeneous and reproducible way.

It is important to note that if any of the factors takes a low value (e.g., (I=1), the total risk is significantly reduced. This correctly reflects the natural behavior of combined risks: a single weak dimension can cushion the overall risk, while several high dimensions enhance each other and amplify the danger.

2.3.1. Introduction of the Amplification Factor (1+L)

After calculating the basic product of the main variables, an additional multiplicative factor is introduced: (1+L). Where L represents the expected litigiousness, measured in a continuous range of 0 to 1. From a statistical point of view, this factor acts as a latent risk modifier. It does not directly affect the threat of regulation itself, but it does amplify the associated economic, operational or reputational consequences. Its location outside the main product reflects its nature as an indirect amplifying effect.

The mathematical logic behind (1+L) is analogous to that used in relative risk models in epidemiology or risk engineering, where "1" represents the baseline risk and "L" represents the percentage increase in risk due to an additional factor.

This treatment is consistent with the relative risk theory used to analyze the occurrence of adverse events, where total risk is expressed as: Total risk = Base risk×(1+Amplification factor).

2.3.2. Semi-Quantitative Nature of the Model

Importantly, the algorithm does not intend to calculate an absolute probabilistic risk, as would be the case in traditional statistical prediction models. On the other hand, it is located within semi-quantitative models, where ordinal scales —that is, ordered discrete values— are assigned to qualitative or semi-qualitative variables.

This approach is widely accepted in regulatory risk analysis, compliance management, and strategic planning, for several reasons:

• The exact probabilities of occurrence of regulatory events are not always known or accurately predictable.
• The main objective is to be able to compare risk levels between different scenarios and prioritize actions according to the magnitude of the expected impact, not necessarily calculate the exact probability of occurrence.

Thus, semi-quantification allows a structured, objective and easily communicable evaluation, even in contexts of high uncertainty.

2.3.3. Mathematical Properties of the Model

Multiplicativity: A key property of the model is its multiplicative nature. If one of the variables reaches a very high value, the total risk increases exponentially compared to other scenarios of lower severity. This correctly reflects real situations where, for example, an extremely restrictive regulation, of immediate application, which affects a large percentage of the portfolio, generates a huge jump in the level of total risk.

Scalability: The model is scalable, i.e. it can be easily adapted as it allows new factors to be added if additional dimensions relevant to the risk are identified and allows the relative weights to be changed if you want to give greater importance to certain variables. For example, in certain sectors, the Time factor (T) could be prioritized if regulatory urgency is considered to be the main operational risk.

Linearity of the modifier: The application of the modifier (1+L) preserves the proportional linearity of the amplified risk so that the impact of litigation is proportional to the initial compound risk and does not introduce independent or non-linear distortions, thus ensuring mathematical consistency and practical logic in the interpretation of the results.

Conceptual visualization of risk: From a conceptual point of view, the graphical representation of the model can be imagined as a three-dimensional cube in which the axes would be the variables Intensity (I), Implementation (G), and Time (T), with the Portfolio Ratio (P) determining the density of each point in space and each point in this three-dimensional space would represent a composite base risk level. The litigation factor (1+L) can be visualized as a proportional expansion of the volume of the cube, deforming it according to the level of expected litigation risk. The higher the L, the greater the "effective size" of the perceived risk.

Practical applicability in contexts where it is not possible to estimate exact probabilities, but robust comparative assessments can be made: Its structure faithfully reflects the natural behavior of regulatory risks, in which the combined effects of severity, imminence, commercial impact and litigation define the urgency and magnitude of the necessary strategic responses. In this way, the model allows regulatory threats to be anticipated in a structured way, facilitating informed decision-making in environments of high regulatory uncertainty.

In conclusion, the proposed formula for the calculation of Regulatory Risk constitutes a semi-quantitative multiplicative model, mathematically consistent with composite risk models in complex systems analysis and allows the proportional incorporation of external amplification factors, such as litigation.

3. Findings

The added value provided by the regulatory risk assessment algorithm is manifested in several fundamental aspects that make it a strategic tool for preventive and adaptive management in dynamic and demanding regulatory environments.

First of all, it stands out for its operational simplicity. The model allows a quick assessment of any regulatory situation using information that is usually easily accessible within organizations, such as the type of measure announced, its state of progress, the expected deadlines for its entry into force, the expected impact on the product portfolio, and the probability of facing reputational risks or litigation. This ease of use means that risk analysis is not restricted to specialised legal teams, but can be integrated into decision-making processes in various areas of the company, such as marketing, quality, innovation or general management.

Secondly, the algorithm demonstrates high adaptability. Its modular and semi-quantitative structure allows it to be applied to any type of regulatory change, regardless of its nature or sector. It is equally effective in assessing risks associated with food additives, new labelling requirements, health claims on products, restrictions on the use of banned substances, changes in manufacturing standards, or new sustainability or transparency obligations. This versatility makes it a useful tool not only for regulatory compliance, but also for strategic planning and innovation portfolio design.

Another key aspect is its contribution to strategic prioritization. The algorithm helps to clearly define which risks require immediate attention – either through reformulation, adaptation of labels or changes in supply – and which can be monitored in the medium term, without the need for urgent intervention. By providing a concrete numerical value and categorization into risk levels (low, moderate, high, or critical), it makes it easier to prioritize within the limited resources that compliance, quality, or product development teams typically have.

In addition, the algorithm offers strong technical defensibility. Its design is based on widely recognized international frameworks in risk management, such as the Codex Alimentarius, ISO 31000, the US FDA guidelines, the European Medicines Agency (EMA) risk management systems and the COSO ERM framework. This methodological foundation provides legitimacy and robustness to the algorithm, which allows its results to be presented and defended before external auditors, internal compliance bodies, strategic partners or even regulatory authorities, increasing confidence in the decisions adopted from its application.

Finally, one of the most strategic contributions of the model is that it provides an early vision. Unlike reactive approaches, where the company responds only after a regulatory change comes into force or a problem materializes, this algorithm allows you to anticipate risks. In this way, it makes it easier to act proactively to avoid sanctions, market withdrawals, reputational crises or economic losses associated with improvised changes. The ability to forecast future regulatory scenarios, identify vulnerabilities, and prepare action plans in advance translates into a real competitive advantage in industries where consumer confidence and regulatory compliance are critical success factors.

Together, simplicity, adaptability, strategic prioritization, technical defensibility, and forward vision make the algorithm a high-value-added tool for any organization that wants to proactively and effectively manage regulatory risks that may affect its products, processes, and business strategies.

In short, the algorithm is not intended to replace legal analysis or comprehensive technical audits, but it is a world-class strategic tool for anticipating, quantifying and smarter managing regulatory risks in dynamic and demanding environments.

4. Case Study

On April 22, 2025, the U.S. Department of Health and Human Services (HHS) and the U.S. Food and Drug Administration (FDA) announced their intent to phase out all synthetic petroleum-based dyes from the national food supply (FDA, 2025), as part of the "Make America Healthy Again" initiative (TWH, 2025). This decision represents one of the most ambitious regulatory changes to food additives in decades.

The announcement contemplates, firstly, the immediate revocation of the authorisation of two colourants (Citrus Red No. 2 and Orange B), and, secondly, the gradual withdrawal of six other colourants (FD&C Green No. 3, FD&C Red No. 40, FD&C Yellow No. 5, FD&C Yellow No. 6, FD&C Blue No. 1 and FD&C Blue No. 2) by the end of 2026. Simultaneously, the FDA will encourage the use of natural alternatives and speed up the approval process for new plant-based colorants.

This type of regulatory action cross-cuts multiple categories of processed products, including snacks, beverages, bakery products, ice cream, and candy, among others.

Due to the magnitude of the measure, it is pertinent to apply the regulatory risk assessment algorithm to measure its potential impact and inform the response strategy.

4.1. Detailed Analysis According to the Algorithm

Step 1. Regulatory Event Classification: The event corresponds to a formal action by a regulatory agency (FDA), based on a regulatory change that involves the removal of current authorizations. This is not a voluntary recommendation or an isolated incentive: the process is supported by revocation procedures and the progressive implementation of mandatory bans.

Step 2. Classification of the type of action: The action consists of:

• Elimination and prohibition of products (specific colorants).
• Progressive restrictions that will culminate in mandatory withdrawal.
• Incentives for substitution by natural alternatives. It is, therefore, a clear case of critical restriction, where non-compliance implies the legal impossibility of continuing to market affected products.

Step 3. Assessment of Implementation Status: Current status is intermediate:

• Two dyes have already been subject to immediate revocation.
• The remaining ones have a defined deadline (end of 2026) for their elimination. Therefore, the process has already officially begun, it is in the phase of final approved regulation with a transition phase, which corresponds to a high degree of implementation.

Step 4. Impact analysis: The impact on products is high:

• Many processed foods in the United States use the above dyes, particularly Red 40, Yellow 5, and Yellow 6.
• It is estimated that at least 30% of the average company's processed product portfolio may be affected, although the actual impact varies depending on each company's product profile.
• In addition, the transition to natural alternatives is not always straightforward: it may involve color changes, sensory modifications, labeling changes, and new technological or cost challenges.

Step 5. Assessing international precedents: Although some European countries have restricted the use of certain synthetic dyes, the U.S. move represents a significant tightening. It is likely that, following this change, other relevant markets (Canada, Latin America) will initiate similar authorisation review processes.

Step 6. Projected future action: The FDA document expressly mentions that the removal of dyes is part of a broader strategy to review all synthetic additives. Therefore, a scenario of progressive regulatory tightening is projected, which could include new ingredients or product categories in the coming years.

Step 7. Identifying collateral risks: Change doesn't just mean regulatory compliance:

• An increase in media pressure on brands that take time to reformulate is anticipated.
• A moderate risk of litigation is estimated, in particular class actions related to lack of adaptation, perceived damages or allegations of misleading advertising.
• A high reputational risk is expected if the company is perceived as reluctant to protect public health.

4.2. Assigning Values in the Algorithm

Applying the previously defined scoring structure.

Table 4. Applying the model to the FDA news.

			Application to the case
Variable	Meaning	Proposed range	Justification	Assigned value
I	Intensity of the measure (prohibition, restriction, etc.)	1 (low) to 5 (critical)	Complete ban on various additives.	5
G	Degree of implementation (draft, in force, required)	1 (distant proposal) to 5 (in force)	Final rule published; in the phase of progressive elimination.	4
T	Time to Compulsory (Urgency)	1 (long-term >3 years) to 5 (immediate <1 year)	Removal required within 1-2 years.	5
P	Proportion of portfolio affected (impact on products)	1 (lower 5%) to 5 (higher 50%)	Estimate of 30% affected.	3
L	Expected litigation (likelihood of public or private lawsuits)	0 (none) to 1 (high)	Moderate risk of lawsuits and reputational damage.	0,5

Notes: 1. I, G, T and P multiply. 2. L acts as an extra amplification factor: if there is a risk of litigation, the risk grows.

Table 4. Applying the model to the FDA news.

			Application to the case
Variable	Meaning	Proposed range	Justification	Assigned value
I	Intensity of the measure (prohibition, restriction, etc.)	1 (low) to 5 (critical)	Complete ban on various additives.	5
G	Degree of implementation (draft, in force, required)	1 (distant proposal) to 5 (in force)	Final rule published; in the phase of progressive elimination.	4
T	Time to Compulsory (Urgency)	1 (long-term >3 years) to 5 (immediate <1 year)	Removal required within 1-2 years.	5
P	Proportion of portfolio affected (impact on products)	1 (lower 5%) to 5 (higher 50%)	Estimate of 30% affected.	3
L	Expected litigation (likelihood of public or private lawsuits)	0 (none) to 1 (high)	Moderate risk of lawsuits and reputational damage.	0,5

Notes: 1. I, G, T and P multiply. 2. L acts as an extra amplification factor: if there is a risk of litigation, the risk grows.

4.3. Calculation of Regulatory Risk

To calculate the Regulatory Risk (RR) associated with the event analyzed, the previously established general formula is used: RR=(I×G×T×P)×(1+L). In this expression, I represents the intensity of the measure, G the degree of implementation, T the time to compulsory, P the proportion of the portfolio affected and L the expected litigation.

Substituting the values assigned to the specific case yields a total calculated Regulatory Risk value of 450. This result, according to the defined interpretative scale, classifies the event as a critical risk for any company operating in the U.S. market and using petroleum-derived synthetic dyes, i.e., a scenario that requires immediate strategic adaptation measures by the affected companies to minimize economic, operational, and reputational impacts.

5. Conclusions.

In the face of a critical level of regulatory risk, companies must act immediately and in a structured manner. Key strategic options include:

• Accelerated reformulation of affected products using natural alternatives already approved or in the process of rapid approval by the FDA.
• Review of the ingredient portfolio to identify other additives of petrochemical origin that could be subject to future regulatory actions.
• Adaptation of labels and marketing communications, prioritizing messages of naturalness, health and safety.
• Negotiation and coordination with suppliers to ensure the supply of new natural colorants in sufficient quantities.
• Crisis communication plan to manage possible public or media criticism during the transition.
• Preparation of legal strategies to reduce the risk of litigation, through proactive compliance and transparency.
• Active monitoring of regulatory developments in the United States and other international markets to anticipate new restrictions.

In conclusion, the news about the elimination of synthetic dyes in the United States demonstrates the practical usefulness of the regulatory risk assessment algorithm. Thanks to its clear mathematical structure and semi-quantitative approach, it allows the level of threat to be assessed quickly and in a well-founded manner, facilitating immediate strategic decision-making.

Applied correctly, this algorithm not only helps prevent economic losses or regulatory sanctions, but also provides a competitive advantage by allowing companies to act before their competitors, reinforcing their public image and ensuring the sustainable continuity of their operations.