Nuclear power accidents repeatedly reveal that the industry has an incomplete understanding of the complex risks involved in its operation. Through analyzing the investigation of a nuclear power incident in Sweden in 2006, I show how the industry’s learning practices shape recurrent normalization of risk regulation after such surprises. Learning is shaped through institutionalized measures of sufficiency and particular “risk objects” (e.g. human factors and safety culture) created through learning from previous events. Subsequent regulatory measures are shaped through improvement scripts associated with these risk objects. These learning practices exclude alternative conceptual perspectives to understand and address safety-critical incidents. Latent risks will therefore produce similar events in the future. The article contributes to the literature on organizational learning, policy making, sensemaking and normalization in complex systems. To improve learning from incidents and regulation in high-hazard industries, social scientists and a wider circle of stakeholders should be included in the regulatory and post-incident examination processes.