We identify the origins, and key characteristics, of the current regulatory framework for genetically modified organisms (GMOs) in the European Union (EU). We focus on the approach of the European Food Safety Authority (EFSA) to assessing GMO risks to public and environmental health. An historical account informs our critical appraisal of the current practices of EFSA’s GMO panel, and helps to explain how and why it fails to satisfy the objectives of the EU’s GMO legislation. While those legislative texts set appropriate objectives, their concrete implementation has fallen far short of the legislative goals. EFSA’s prevailing approach to GM crop and food risk assessment starts from what it terms a ‘comparative safety assessment’. Those comparisons require the scrutiny of sets of molecular, chemical and phenotypic data from GM plants and non-GM varieties (many of which may be only remotely related to the GM variety). Those data are, however, inadequate for predicting adverse biological, toxicological and ecological effects. EFSA’s ‘comparative safety assessments’ draw over-optimistic conclusions from too little data from too few studies. When GM products are deemed to have passed a ‘comparative safety assessment’, EFSA has interpreted that as grounds for conducting only very narrowly circumscribed risk assessments, which have not required meaningful data from studies of ecological or eco-toxicological impacts. This is a reductionist approach to risk assessment, when a more inclusive and comprehensive approach, which we outline, is scientifically available, and also more likely to meet the specified legislative aims. Instead, however, the reductionist choice is systematically applied, but never justified nor acknowledged as such. Indeed, it is concealed, by EFSA and by its main policy client the European Commission, as if it were only for specialist expert scientific deliberation. Thus, key questions that sound scientific assessments should ask about potential harm are not even posed, let alone answered—or at least, they are ‘answered’ only by default, given that the implicit burden of proof requires harm to be demonstrated. Furthermore, and a key point of this paper, we show how the problematic features of EFSA’s approach have been premised on a set of evaluative policy judgements, rather than purely scientific considerations. Responsibility for selecting how EFSA frames its scientific approach should however lie with European Commission risk managers, and not with EFSA. These problems might have been and could be avoided if explicit commitments entered into by the EU at the Codex Alimentarius Commission were implemented by the European Commission and EFSA were instructed accordingly.