Legal regulation needs risk focus