The process often starts with companies and consultants. It involves federal, state, and local regulators too.