The difference between laws and policies comes down to who makes them and what happens when you break them. A law is a binding rule enacted by a legislature (Congress, a state legislature, or a city council) and enforced through courts, police, and regulatory agencies. A policy is a guideline adopted by an organization to steer its own operations, enforced internally through discipline like warnings or termination. The consequences of violating each are on different scales, and in some situations a policy can cross the line into something a court will treat as legally enforceable.
What Makes Something a Law
A law is created by an elected legislative body through a formal process of drafting, debate, committee review, and voting. The U.S. Constitution vests all federal legislative power in Congress, making it the only branch of the federal government that can create or change federal laws.1whitehouse.gov. The Legislative Branch State legislatures do the same work at the state level, and city councils and county boards do it locally.
Once a law is enacted, it binds everyone within the jurisdiction. You don’t opt out because you disagree, and ignorance is almost never a defense. Enforcement runs through the machinery of government: police investigate, prosecutors charge, courts adjudicate, agencies monitor compliance. Penalties scale with the offense, from a few hundred dollars for a traffic ticket to years in prison for a felony.
Laws are also public. Federal statutes sit in the United States Code, state statutes in each state’s code, and local rules in municipal codes. That transparency is intentional. People need to be able to find and read the rules that apply to them.
What Makes Something a Policy
A policy is a guideline an organization adopts to direct its own operations and the behavior of people inside it. Policies come from all kinds of entities: corporations, government agencies, school districts, nonprofits, homeowners’ associations. They typically cover internal matters like employee conduct, data handling, dress codes, or operational procedures.
The defining feature is that a policy, on its own, generally lacks the force of law. Violate your employer’s social media policy and you may face a written warning, suspension, or termination. You won’t face criminal charges or a government lawsuit for the violation itself. Consequences stay within the relationship between you and the organization that wrote the policy. A hospital’s intake protocol, a university’s academic honesty rules, a government agency’s internal procedural guidelines: all policies, even when they feel mandatory to the people subject to them.
Policies are also more flexible. An organization can rewrite one by internal decision, sometimes overnight. Changing a law means going back through the legislative process, which can take months or years.
The Practical Differences at a Glance
Four things really separate the two:
- Who creates them. Laws come from elected legislative bodies through a formal public process. Policies come from organizations, agencies, or executives, often without public input.
- Who they bind. Laws apply to everyone within a jurisdiction, whether or not they’ve read them. Policies bind only the people who fall under the authority of the entity that issued them, usually through employment, membership, or a similar relationship.
- How they’re enforced. Laws are enforced by government institutions. Policies are enforced by the organization itself, through supervisors, HR, or compliance teams.
- What violation costs you. Breaking a law can mean fines, civil liability, or imprisonment. Breaking a policy typically means internal discipline like a reprimand, loss of privileges, or termination.
There’s a transparency gap too. Laws are codified in publicly available statutes. Policies range from formal written manuals distributed to every employee to unwritten norms that shift with whoever’s in charge.
Where Policies Sit in the Legal Hierarchy
Understanding why policies can’t override laws requires seeing the full stack of legal authority. The U.S. Constitution sits at the top. Article VI establishes that the Constitution and federal laws made under it are “the supreme Law of the Land,” overriding anything at the state or local level that conflicts with them.2Library of Congress. U.S. Constitution – Article VI
Below the Constitution, the layers run roughly like this:
- Federal statutes passed by Congress and signed by the President, compiled in the United States Code.
- Federal regulations issued by executive agencies under authority Congress granted them, compiled in the Code of Federal Regulations. These carry the force of law within their scope.
- State constitutions and statutes, which govern within each state unless they conflict with federal law.
- Local ordinances enacted by city councils, county boards, and similar bodies.
- Organizational policies, which sit at the bottom because they can’t override any layer above them.
This matters in practice. A company policy that conflicts with a federal statute is unenforceable. An employer can’t adopt a policy requiring employees to waive their rights under federal anti-discrimination laws, because the statute outranks the policy. When conflicts arise, the higher authority wins.
Regulations and Executive Orders: The Confusing Middle
Two categories confuse people because they sit between clear-cut laws and clear-cut policies.
Federal regulations aren’t passed by Congress, which makes them look like policies. But they carry the force of law, which makes them function like statutes. The bridge is statutory authorization: Congress must first pass a law granting a specific agency authority to write rules on a specific topic. Without that authorization, an agency’s regulation has no legal backing. The Administrative Procedure Act governs how binding regulations get made. Under 5 U.S.C. ยง 553, agencies must generally publish a proposed rule in the Federal Register, accept public comments for a set period, respond to significant comments, and publish the final rule at least 30 days before it takes effect.3Office of the Law Revision Counsel. 5 USC 553 – Rule Making That process is more rigorous than internal policy adoption but less demanding than passing a statute.
The practical test: if an agency regulation tells you to do something, you face real legal consequences for ignoring it, just as you would with a statute. But if an agency issues guidance or an internal memo without going through formal rulemaking, that document doesn’t carry the same binding force. Knowing which one you’re looking at matters enormously for whether noncompliance can land you in legal trouble.
Executive orders occupy their own awkward category. The President issues them to direct how federal agencies implement and enforce existing laws, but they are not laws themselves. Only Congress can pass or alter federal statutes, and an executive order cannot override a statute or infringe on constitutional rights. A future president can also reverse a predecessor’s executive orders directly, which gives them far less durability than legislation. Think of them as policies with unusual reach: they bind federal agencies and their employees, they can be challenged in court if they exceed presidential authority, and they don’t create new criminal offenses or civil obligations for private citizens on their own. When someone says an executive order “has the force of law,” what they usually mean is that it directs agencies to use their existing legal authority in a particular way.
When a Policy Can Actually Bind You Legally
The clean division between “laws are binding, policies aren’t” breaks down in several situations. These are where people get caught off guard.
Policies Required by Statute
When a law requires an organization to adopt a specific policy, failing to create or follow that policy becomes a legal violation, not just an internal management problem. Workplace safety is the clearest example. OSHA regulations require employers to maintain specific safety standards, and Section 17 of the Occupational Safety and Health Act imposes civil penalties on employers who violate them, including fines for willful violations and potential criminal penalties for knowingly filing false statements in required safety plans.4Occupational Safety and Health Administration. Penalties Organizations covered by HIPAA must maintain privacy policies, and violations can trigger civil penalties reaching into the millions along with criminal penalties for deliberate misuse of protected health information.
In these cases, the policy itself isn’t what creates the legal obligation. The statute does. But the policy is the mechanism through which the organization demonstrates compliance, and gaps in the policy create gaps in legal protection.
Employee Handbooks as Contracts
Courts in many states have held that an employee handbook can create enforceable contractual obligations, even when the employer intended it as a mere policy document. The typical analysis looks at three factors: whether the handbook uses language clear enough that a reasonable employee would believe a promise was being made, whether it was distributed in a way that made the employee aware of its contents, and whether the employee accepted by continuing to work. If a handbook says employees will only be terminated for specific listed reasons, and the employer then fires someone for an unlisted reason, the employee may have a breach-of-contract claim.
Disclaimers change the analysis. Many handbooks include a statement that employment remains at-will and the handbook is not a contract. Courts give these disclaimers weight, but only if they’re clear, prominent, and written in plain language. A disclaimer buried in the middle of a 60-page manual in the same font as everything else may not hold up. Courts have rejected disclaimers containing confusing legal jargon that an ordinary employee wouldn’t understand. And if the employer’s actual behavior contradicts the disclaimer, the inconsistency can undermine it.
Incorporation by Reference
A policy can also become legally enforceable when a contract explicitly incorporates it. Employment agreements, service contracts, and partnership agreements often reference external policy documents and state that compliance with those policies is a condition of the agreement. When a contract clearly identifies the policy and treats it as part of the deal, violating the policy becomes a breach of contract, with all the legal remedies that follow.
How to Tell Which One You’re Looking At
The label on a document matters less than its actual content, how it was communicated, and what authority backs it up. When you need to know whether something you’ve been handed is a law or a policy, work through a short checklist. Who issued it: a legislature, an agency operating under statutory authority, or an organization writing rules for its own people? What process produced it: legislative debate, formal notice-and-comment rulemaking, or an internal decision? Where can you find it: a public statute book, the Federal Register, or an internal handbook? What happens if you ignore it: government enforcement, or an internal discipline process?
The document that walks like a law (public origin, formal process, government enforcement) is one. The document that walks like a policy (internal origin, internal enforcement, an organization’s own consequences) is one. And the document in between (a required workplace policy, a handbook that reads like a contract, an agency guidance that regulated companies feel obligated to follow) is the one worth reading carefully, because the label on the cover may not match what a court would do with it.