Polycentric risk governance across safety and security risk logics

The regulatory regime governing the Norwegian petroleum sector changed significantly in response to new geopolitical conditions following the war in Ukraine and the sabotage of the Nord Stream I and II pipelines. New legal security requirements and security risk logics were introduced into a sector whose traditional regulatory regime and risk logic had been intrinsically oriented toward safety. This shift altered the balance between safety and security considerations within the sector. This article explores the implications for regulatory regimes and risk logics when transitioning from safety-oriented to security-oriented regulatory models. Our ambition is primarily conceptual and theoretical, with the Norwegian petroleum industry serving as an illustrative case. The article analyses the emerging interface between safety and security, emphasizing the ontological, epistemological, and procedural divergences that complicate the integration of security concerns − focused on intentional, adversarial threats − into established safety regimes that manage unintentional harm. Anchored in a polycentric governance framework, the article examines how geopolitical developments have created tensions between rule-based and risk-based regulatory models, and the implications for organizational practices, regulatory oversight, and tripartite cooperation. It concludes by proposing a model of enforced self-regulation that reconciles safety and security logics, highlighting the need for adaptive, resilient, and knowledge-driven approaches to risk management in complex and evolving threat landscapes.