How safe is safe enough, who decides and how? From a zero‐risk paradigm to risk‐based decision making