It’s with everyone involved.
Both clubs should be of the understanding well before the game that everything is risk assessed and safe for fans and, if not, they should be checking and then demanding that things are before the game takes place… maybe doing their own RAs to make sure. Knowing how bad an organisation UEFA are and how badly finals have been run in the past, we should really have been proactive with that as a club and absolutely should be in the future. No club should just assume UEFA will run something properly because they’ve shown they cannot.
I’ll bet both clubs only bothered to check how their boardrooms and teams were being looked after to a high enough standard.
The stadium operators and local government district/city council and Police/fire service should be well in control of all safety aspects and logistics of facilities so that everything runs smoothly and safely in and around the stadium and with transport.
UEFA are answerable as they are the promoters and governing body of the event - and they’re a fucking shit show of an organisation, as we’ve known for over a decade - but there are many other entities who should have input and responsibility.