accordingly, the manufacturer must apply all the control option and may not stop his endeavours if the first or the second control option has reduced the risk to an acceptable level (unless the additional control option(s) do(es) not improve the safety.