The key policy question in managing hazardous technologies is often some variant of: “How safe is safe enough?” A typical response of regulatory agencies has been to lay down minimum requirements for how hazardous facilities should be built and operated, without specifying the level of safety that it is hoping to achieve. The U.S. Nuclear Regulatory Commission, charged with regulating safety in nuclear power plants, has recently tackled the safety question directly, by adopting “safety goals” that facilities must meet. The NRC's approach proves to be sophisticated in some respects, incomplete in others. More generally, it points up the inherent difficulties that exist with the concept of “acceptable risk” and with any attempt to build policy instruments around it. Lessons from the NRC case apply to other hazardous technologies, as well as to public policies unrelated to safety.