safety as the bedrock of equitable prosperity
True equitable prosperity cannot exist in a vacuum of vulnerability. A community cannot flourish if its social fabric is eroding, its mental resilience is exhausted, or its critical infrastructure is fragile. Security, proactive care, and systemic resilience are the non-negotiable foundations upon which freedom, trust, and enduring well-being are built.
own responsibility, and its limits
Complete avoidance of all hazards is neither possible nor desirable. Comprehensive surveillance and regulation of every area of life in pursuit of maximum safety is ruled out; the free development of the person and the dynamism of society take precedence.
General risks of life that arise from natural conditions or from one’s own way of living, and that are recognisable and reasonable to bear, remain the responsibility of each person. Safety is a shared task, and everyone carries part of it.
Public responsibility concentrates on hazards that cannot be mastered by individuals because of their complexity, their scale or their systemic character. That is the line, and it is worth drawing explicitly: a model that promises to protect everyone from everything promises nothing.
safety is a capacity, not an absence
Safety is usually defined as the absence of harm, and measured by counting what went wrong. That makes a quiet year look like success and leaves nothing to manage in between. Safety research has a name for this and for its alternative. Erik Hollnagel calls them Safety-I and Safety-II.
Safety-I
Safety is the absence of accidents. Work is assumed to go as planned, so when something goes wrong, something or someone must have failed. The method is to look back at what broke and prevent that specific failure from recurring. It is measured by counting damage events – by counting what is not there.
Safety-II (generative safety)
Safety is the presence of the capacity to succeed under varying conditions. Work almost never goes exactly as planned, and things go right because people and systems adjust to the conditions they actually meet. The method is to strengthen that adjusting capacity, and it is measured by what is there.
Generative Safety
Safety in stewardship governance is the presence of capacity: a system’s active, inherent ability to ensure that as many things as possible go right under fluctuating, real-world conditions.
Generative Safety is not defensive or fear-driven. It does not seek to restrict human agency or fence society in. Instead, it proactively strengthens internal capacities, nurtures social bonds, and builds the structural and psychosocial resilience needed to preempt hazards before they manifest. It is safety cultivated through vitality, empowerment, and connectedness.
The difference is not academic. Under Safety-I an authority with no incidents last year has nothing to do. Under generative safety the same authority asks whether its capacity to cope has grown or shrunk, and usually finds an answer – one fewer volunteer crew, a warning system that now reaches fewer households, a response time that has quietly lengthened. Nothing went wrong, and the ground has still moved.
Stewardship governance follows the second reading. Safety is not a state restored by intervention after an event, but the result of continuous analysis and design. Hazards shall be removed where possible, and where not, addressed as they arise through systemic adjustment. Safety-I is not discarded – learning from damage events remains necessary, and the incident reporting system exists for exactly that. It is simply not enough on its own.
This is also why the baseline works the way it does. A capacity can be fully present, and that full presence is what is owed – not a target to aspire to.
radars without steering wheels
Vulnerabilities are mapped better than ever. Global and national risk reports describe what is coming, and most authorities hold more analysis than they can act on.
global risk landscape
If we want to get sure we are moving to ensure that as many things as possible go right, at first we need to understand what is going wrong including a prognosis of can and will be going wrong.
Our coming years will be characterized by an increase in complex and interconnected hazards
https://www.mercer.com/de-de/about/newsroom/people-risk-report-2024
What follows from it is another matter. Risk tools are advisory: nothing follows from a red field on a matrix. And while response to damage is treated as obligatory, proactive investment is treated as optional rather than a core duty. The result is a radar without a steering wheel.
What turns the radar into steering is a duty of preparedness: an obligation to direct means at documented hazards, and a named consequence where that is persistently not done. Persistent failure to act on a documented, quantified gap after formal warning is a stewardship failure, with the consequences the adopting legal order provides.
a hazard becomes a crisis when it meets something protected
A storm over open water is weather. The same storm over a district is a hazard event. Assessment therefore starts not with the trigger but with what is exposed, and runs through five protected assets.
| protected asset | what it covers |
| life and health | the population, vulnerable groups in particular, emergency personnel, and animals – physical and psychosocial |
| critical infrastructure | energy, water, food, emergency medical services, communications, emergency call and warning systems, waste |
| ecological foundations | soil, groundwater, air, biodiversity, carbon cycles |
| built assets and heritage | housing, production sites, cultural heritage, protective structures |
| societal integrity | institutional trust, transparency, civic space, the ability to take decisions at all |
The last of the five is the one most often left out of safety work. An authority that has lost the trust of its residents cannot evacuate them, and a body that cannot decide cannot prepare. Societal integrity is an operational safety matter, not a political one.
Across all five, safety is assessed in five dimensions, each of which shall be addressed explicitly. A measure that resolves a physical hazard while destroying the social or psychological quality of a place is not compliant.
The five dimensions — applied to each protected asset.
the hazard catalogue
the hazard catalogue will be integrated very soon
Each hazard is placed in one of three categories for the territory: not relevant here, the responsibility of a higher level, or locally relevant with a need to act. The assignment is justified. A hazard that has not been worked through counts as not assessed, and shall not be treated as irrelevant – the distinction that decides whether a catalogue is an instrument or a formality.
The social and psychosocial hazards are treated differently from the rest. Isolation, exhaustion, information overload and loss of orientation are not damage events in their own right; they are vulnerability factors that make every other hazard harder to handle. They are described in their severity and taken into account when the consequences of the other hazards are assessed.
Assessment covers situations in which several hazards occur at once or in cascades, and it is carried out for three system states: normal operation, major incidents, and interstate or hybrid conflict. For each state it is stated which assumptions change.
what actually protects people
Measures follow a ranking borrowed from occupational safety. A lower level is used only once the higher one has been exhausted or ruled out with reasons.
The hierarchy of measures, applied to the public street.
The ranking is uncomfortable because public debate runs in the opposite direction. Campaigns and protective equipment are visible, cheap and quick; removing the hazard is slow and contested. The ranking does not forbid the lower levels. It requires an authority to say why the higher ones were not available.
capacity in three stages
Capacity is recorded in three separate stages, in this order, and counted once, in the stage where it acts.
- Prevention. Lowers the probability that an event occurs at all.
- Resilience. Lowers the damage an event causes when it does occur.
- Intervention. Limits the consequences after it has occurred.
Intervention capacity shall be recorded as capacity actually available across the hours of the day and the days of the week, not as establishment strength on paper. The difference between the two is where most of the unpleasant surprises live.
Merging the three stages into a single figure before they have been recorded separately is not admissible. A well-equipped fire service cannot compensate for a settlement built in a flood plain, and saying so in one number hides exactly the decision that ought to be visible.
the risk chain
What is left after prevention and resilience is handed to intervention. From there the terms shall be kept apart, and this is the distinction on which the whole field turns.
| term | what it is | what follows |
| intervention risk | the risk deliberately handed to the emergency services once prevention and resilience have been applied – the design basis against which staff, equipment and water supply are dimensioned | recorded as a decision of the elected body, never as a given |
| intervention deficit | the part of that risk which actual capacity does not cover – a difference, not a fate: measurable, attributable, and closable with means | quantified, costed, addressed; acceptable if openly acknowledged |
| residual risk | what would remain even if the deficit were fully closed | named and placed on the record |
A deficit may be accepted. It is often impossible, in staff or in money, to close every gap, and acknowledging that limit is more honest than denying it. What is not admissible is the renaming: a deficit shall not be presented as residual risk.
A deficit counts as openly acknowledged only with a quantified statement of the gap, a costing of its closure, a description of the consequences that may follow, a recorded decision of the competent body, and publication of all three. With that decision, responsibility for damage arising from the gap passes from the head of department to the body that decided.
An acknowledged deficit remains a deficit. It is restated in every subsequent report until it is closed or decided again.
The deficit itself has two parts, and both shall be shown: the declared part, which follows from a protection target deliberately set below full coverage, and the measured part, which is whatever actual capacity fails to deliver beyond that. A plan that names only the declared part states the deficit incompletely.
the residual risk protocol
Every essential process and every spatial plan shall carry a protocol stating which damage events remain possible under extreme or unforeseen conditions, which structures are to bear their consequences, and a public acknowledgement signed by those responsible. A deficit acknowledged as above is shown in it separately from the residual risk.
The purpose is twofold: to prevent the illusion of absolute safety, and to prevent a funding gap from appearing as an unavoidable remainder. A community can prepare for a risk that has been named. It cannot prepare for one that has been reclassified.
intervention
Operational intervention rests with the emergency services. Technical services and the operators of critical infrastructure are drawn into intervention planning – municipal works yards in particular, as a substantial source of equipment and practical staff.
The services take part in prevention as well, through instruction in schools, care homes and hospitals, carried out in the duty hours not taken up by operations, training and maintenance. They give the staff office access to current operational statistics and to the findings of the incident reporting system, so that what is learned on scene reaches those who plan.
In an event, members of the relevant project teams join the incident command as specialist advisers, so that the knowledge and working relationships built in preparation are available when they are needed.
On terminology: the draft act proposes RESCUE Corps as a single designation for the operational units of non-police hazard intervetion, to end the split between civil protection, disaster protection and population protection, fire&rescue and ambulance service what belongs together in practice.