Scroll Top

The dynamic risk profile: the new guideline calls for different tools

featured

In February, the Dutch safety regions adopted a new guideline for their regional risk inventory and analysis: phenomenon analysis, resilience, a living document. The risk profile itself, however, remains what it was: a report adopted once every four years. The two do not automatically fit together. How big can the gap get? The same shipment puts 232 people in the affected zone with one wind direction, and none with another. More on that below.


What changed in February

On 27 February 2026, the council of safety region commanders and directors (RCDV) adopted the Regional Risk Inventory and Analysis Guideline, replacing the guidance that had been in place since 2009. All 25 safety regions, the regional emergency management authorities of the Netherlands, were involved in its development; the Netherlands Institute for Public Safety (NIPV) maintains it.

Seventeen years separate the two documents, and it shows. The new guideline shifts the emphasis from risk estimation to phenomenon analysis, adds a resilience analysis, asks for a systemic view of interconnection and interdependence, and calls itself a living document in which new developments are incorporated as they arise. It is the step the sector itself asked for: the Dutch fire service concluded in a 2023 advisory report that a profile remade once every four years no longer suits a changing environment, and recommended working towards a cyclical, learning model.

One thing remains. The method is now learning and dynamic. The profile itself is not.


Why this matters now

Most current risk profiles are approaching the end of their term, and for many regions the next update will be the first made under the new guideline. The preparatory work starts this year. That makes this a governance moment too: the risk profile is adopted by the region’s general board and underpins the policy plan, capacity decisions and risk communication. What a region sets up now determines how the profile works for the coming policy period. Some colleagues are already acting on it: at least one safety region has appointed a Dynamic Risk Profile project lead, and that term comes from the sector itself, not from the market.


Three speeds in one region


The background document accompanying the guideline lays the update frequencies side by side, matter-of-factly. Operational pictures are updated daily or weekly. Fire and care risk profiles roughly once a year. And the regional risk profile roughly once every four years.

Three products, one region, three realities. And the risk profile is precisely the document in which the other two are supposed to come together.

The friction is sharpest in the new multi-criteria analysis. It looks at every risk type through four lenses: factual impact, probability, perception, and fourthly volatility and unfamiliarity. Under that fourth lens, what counts is whether the probability and the impact are expected to change in the coming years: if both increase, the risk scores a 3; if one of the two increases, a 2; with no increase or a decrease, a 0.

Since February, movement has been a criterion. But it is filled in once per cycle, in a table, based on an estimate. You can write down that a risk type is moving. You cannot see it move.
The regional risk profile as it usually is today: a carefully made document, adopted for an entire policy period.

What a dynamic risk profile is

A dynamic risk profile is not a different risk profile. It is the same profile, built as an instrument instead of a document. It replaces nothing in the guideline; it makes the steps executable at any moment rather than filled in once each cycle.

The pattern underneath consists of four layers, identical for every risk type. Only the content differs.

The static framework

What the profile currently contains: the route with its impact zone, the risk contours, the designated areas for fire, explosion and toxic cloud.

Het statische kader

Wat er nu in het profiel staat: de route met het invloedsgebied, de risicocontouren, de aandachtsgebieden voor brand, explosie en gifwolk.

The current situation

What is actually out there right now. Which shipments are moving and what they carry, or what is inside the facility at this hour.

Het statische kader

Wat er nu in het profiel staat: de route met het invloedsgebied, de risicocontouren, de aandachtsgebieden voor brand, explosie en gifwolk.

De actuele situatie

Wat er op dit moment werkelijk is. Welk transport er rijdt en wat erin zit, of wat er op dit uur in de installatie aanwezig is.

The analysis

What that means for the area: the affected zone, the people in it, the buildings and their vulnerability classification.

Het statische kader

Wat er nu in het profiel staat: de route met het invloedsgebied, de risicocontouren, de aandachtsgebieden voor brand, explosie en gifwolk.

De actuele situatie

Wat er op dit moment werkelijk is. Welk transport er rijdt en wat erin zit, of wat er op dit uur in de installatie aanwezig is.

De analyse

Wat dat betekent voor het gebied: het effectgebied, de mensen die erin zijn, de gebouwen en hun kwetsbaarheidsclassificatie.

The course of action

What follows for the profile and the policy behind it: which measure or advice applies, where capacity is needed, and what it means for planning and risk communication.

Once that pattern is in place, every next risk type is a matter of filling four layers. No redesigning, no renegotiating definitions. And because the picture is compiled once, it is the same picture in the cold, warm and everything-in-between phases of crisis management.


Why a few map layers will not do

The first thought is often: we can handle this with a few extra map layers in the existing viewer. In practice, that falls down on two counts.

The affected zone is not a layer

It does not exist until it has been calculated, from the substance, the leak size, the wind direction and speed, and the stability of the atmosphere. A map layer shows a state someone recorded earlier; here, that state has to be recalculated the moment a parameter changes.

Het effectgebied is geen laag

Het bestaat niet tot het is uitgerekend, uit stof, lekgrootte, windrichting, windsnelheid en atmosfeer. Een kaartlaag toont een vastgelegde toestand; hier moet die toestand opnieuw ontstaan zodra een parameter verandert.

Time is not a layer but an axis

How many people are in an area depends on the hour of the day. A map layer is a single moment. To know which situation is truly decisive, you have to run through the whole day and the whole wind rose: hundreds of geometries, and nobody draws those by hand.


Then there is stewardship: every figure that ends up in a board paper must be traceable to a source and a version, without anyone maintaining it by hand. That is precisely the difference between a viewer and a digital twin: a model of the area in which objects, states and relationships are recorded, and on which you can run calculations.

It is also the argument for scale. Twenty-five regions doing the same homework twenty-five times over is exactly the fragmentation the Dutch Inspectorate of Justice and Security warned about in 2025, when it recommended establishing uniform structures and a shared conceptual framework. At a regional boundary, the same incident should look the same on both sides.

One integrated 3D picture of the area: map layers and object information, from building to risk source, in the same environment.

Assuming is allowed, counting is possible


The background document is matter-of-fact about it: to estimate the size of vulnerable groups, a rough picture is sufficient, an assumption of the average size. That is a sensible rule. It was also the only feasible rule, in an era when counting was expensive.

That era is over. The hectare statistics of Statistics Netherlands (CBS), the national buildings register (BAG) and the public registers of risk sources and transport routes describe the area for each hectare, each building and each route. The background document itself says as much: a safety region hardly needs to measure anything, because the public information is already available.

What is missing is not the data. What is missing is the instrument that brings the data together and turns it into a picture read the same way in every region.

How much difference that makes is shown in the worked example below: one shipment of liquefied toxic gas along a rail section through a built-up area, one leak size, and only the wind direction as a variable.

Counting at hectare level: only the cells actually in the path of the effect are counted, with the profile contour alongside.

Affected zone of a hazardous goods transport with wind from the south-west in a dynamic risk profile, 232 people in the zone
The same affected zone with wind from the west, zero people in the zone
↔
Wind from the south-west · 232 people Wind from the west · 0 people
Drag the slider: same transport, same leak size, only the wind direction differs.
Effectgebied van een transport met gevaarlijke stoffen bij wind uit het zuidwesten in een dynamisch risicoprofiel, 232 mensen in het effectgebied
Hetzelfde effectgebied bij wind uit het westen, nul mensen in het effectgebied
↔ Wind zuidwest · 232 mensen Wind west · 0 mensen
Sleep de schuif: zelfde transport, zelfde lekgrootte, alleen de windrichting verschilt.
The same shipment, the same leak size, an affected zone of 0.9 square kilometres. With wind from the south-west, 232 people and 119 buildings lie within that zone. When the wind turns west, the number drops to zero. That is the difference between alerting and not alerting, and no fixed band around the route can see it.

And that is only the wind. A business park at three in the morning is a different area from the same park at three in the afternoon, with a different population, different self-reliance and a different course of action.


The conversation with the data owner has changed


For the current-situation layer, a region depends on others: what is actually running, sailing or present is known to the infrastructure operator, the harbour master or the licensing authority. That conversation has recently changed. Since 15 August 2026, around five hundred designated critical entities have been required under the Critical Entities Resilience Act to make and maintain their own risk assessments. Safety regions are exempt from the act, but the obligation lands with precisely the parties regions have been asking for data for years; the guideline now also lists the CER inventory as a source of information. The request is no longer a favour, it is a shared interest. And a working picture that shows in thirty seconds what becomes visible with their data is more convincing than a letter.

Objects know each other: cascading effects on critical entities, calculated on a live power outage scenario.

Starting small is an option


A common caveat is that the live data is not there yet. That is true, and it need not be a reason to wait.

Maturity grows in three steps, with the same structure underneath each. First, models and assumptions: reproducible, testable, and built entirely from public registers. Then historical series: patterns instead of moments, which is where the volatility of a risk first gets a foundation instead of an estimate. And finally the live picture. Anyone who starts at step one never has to redo anything later, and sees which data source adds the most value before anyone builds a connection.

In practice, it starts small: record the four-layer pattern in a document of a few pages, hold the first conversations with data owners with a working picture on the table, and fill a second risk type to prove the pattern holds.

The pattern and the data definitions should, in our view, be public knowledge: we build and supply the platform it runs on, but the method belongs to the sector. The guideline has brought the method up to date. Now it is the tools’ turn.

The affected zone only exists once it has been calculated: here computed live from the current train position and the current weather.

See where your region stands

Argaleo Digitwin is the digital twin platform that dozens of Dutch municipalities, safety regions and provinces work with every day. If you would like to see what your own region looks like in a dynamic risk profile, built from public registers and showing your own risk types, you can do so in a single one-hour session. No implementation project up front, no data delivery required.


Frequently asked questions

What is a dynamic risk profile?
A dynamic risk profile is a regional risk profile built as an instrument rather than a document. It combines the static framework from the adopted profile with the current situation, calculates the effects and consequences, and attaches a course of action. It does not replace the adopted profile; it makes it usable at any moment.
What changed in the 2026 Regional Risk Inventory and Analysis Guideline?
The guideline, adopted by the council of safety region commanders and directors (RCDV) on 27 February 2026 and maintained by the Netherlands Institute for Public Safety (NIPV), replaces the 2009 regional risk profile guidance. It shifts the emphasis from risk estimation to phenomenon analysis, adds a resilience analysis, and now also weighs risks on volatility and unfamiliarity.
What is a phenomenon analysis?
According to the background document accompanying the guideline, it is an analysis that looks at a risk in an integrated, systemic way and describes it in depth, beyond the boundaries of one or a few scenarios. It is a qualitative analysis of interconnection, interdependence and differing perceptions.
Could this not be done with a few extra map layers in our existing viewer?
Not the part that matters. A map layer shows a recorded state; an affected zone has to be calculated from the substance, leak size and weather conditions, and recalculated whenever one of those parameters changes. Counting the people and buildings inside it requires a spatial join between registers with different geometries, which happens on the underlying objects rather than on the map images. That is what a digital twin is for.
What data does a dynamic risk profile require?
The first layer can be built entirely from public sources: risk sources and designated areas, transport routes with their impact zones, buildings with their vulnerability classification, and population data for each hectare. The second layer, the current situation, comes from data owners such as infrastructure operators, ports and licensing authorities. Starting with the first layer alone is perfectly feasible.
What does it cost to get started?
Considerably less than an implementation project, because the first layer comes from public registers and no data pipeline is needed up front. The practical starting point is a single session in which your region is mapped out, followed by a decision on whether to adopt the pattern for the next profile cycle.

more news

Subscribe to our newsletter and stay up to date with our digital twin innovations!