The thing to remember as well with IARC is that it does its classifications with a hazard based approach, while most regulatory agencies use a risk based approach.

A hazard is something that can harm potentially harm you. Risk quantifies how likely that will happen.

Edit: wording