Duty of Care Reaches the Boardroom: Travel Risk as Governance in 2026

The shift is easiest to see in who now asks the questions. A decade ago, traveller safety was owned somewhere in HR, security or travel management, and the board saw it only after an incident. Today, duty of care is increasingly framed as a fiduciary responsibility — part of the board’s obligation to manage material risk to its people and, by extension, to the organisation. Several forces are pushing in the same direction: a more volatile world in which the probability of a serious travel incident is genuinely higher; investors and insurers asking harder questions about how human-capital risk is governed; and a legal environment in which “we had a policy” is no longer an adequate defence. The practical consequence is that boards can no longer treat traveller safety as delegated and invisible. They are expected to set the tone, approve the framework, and be able to demonstrate that it works.

The backdrop to all of this is a risk outlook that leaders themselves describe as unstable. The World Economic Forum’s Global Risks Report 2026 identifies the leading short-term global risks as geoeconomic confrontation, misinformation and disinformation, societal polarisation, extreme weather, and state-based armed conflict — a mix of the geopolitical, the environmental and the informational. Around half of the experts surveyed expect a turbulent or stormy period over the next two years, with an even larger share pessimistic over the decade. For organisations that move people across borders, this is not abstract. Geoeconomic tension translates into sudden visa, sanctions and exit-control changes; conflict and polarisation into unrest and rapid deterioration of once-stable destinations; extreme weather into the disruption we have seen repeatedly this year. A board reading this landscape cannot reasonably conclude that traveller risk is static or low-priority — and that realisation is precisely what is driving duty of care up the agenda.

What turns duty of care from good practice into board-level obligation is that it now carries real legal consequences. In the UK, the Corporate Manslaughter and Corporate Homicide Act 2007 allows organisations to be prosecuted where gross failures in management cause death — including, in principle, the death of an employee sent into harm’s way without adequate assessment or support. In the US, OSHA’s General Duty Clause requires employers to provide a workplace free from recognised hazards, a duty that extends to employees working and travelling abroad. Increasingly, the exposure is framed around two failure modes: sending people into foreseeable danger without proper intelligence and mitigation, and responding inadequately when an incident occurs. Directors are not insulated from this. The combination of potential corporate liability, personal accountability and reputational damage means duty of care is now a risk the board must actively own rather than passively delegate.

The regulatory direction of travel reinforces the point, even where it does not yet bite directly. The EU’s Corporate Sustainability Due Diligence Directive (CSDDD), amended by the “Omnibus I” package (Directive (EU) 2026/470) and in force from 18 March 2026, requires large companies to identify and address human-rights and environmental harms across their own operations, subsidiaries and direct business partners. The amendments narrowed its scope from roughly 13,000 to around 6,000 companies — broadly EU firms with more than 5,000 employees and €1.5bn turnover, and comparable non-EU firms — with transposition due by July 2028 and application from July 2029, and penalties capped at 3% of worldwide turnover. Two honest caveats matter here: CSDDD is about human-rights and environmental due diligence, not travel safety specifically, and it does not apply until 2029. But the direction it signals is unmistakable — boards being made formally accountable for how they manage risk to people across their operations and value chains. Duty of care to travelling employees sits squarely within that widening expectation of board-level responsibility.

If the board is now accountable, it needs a defensible framework to point to — and ISO 31030:2021, the international guidance standard for travel risk management, has become the de facto benchmark. It is a guidance standard rather than a certifiable one, but it gives organisations a structured, auditable way to demonstrate that duty of care is being managed properly. Its approach runs through seven connected components: board-approved governance and policy with clear ownership across HR, security and legal; systematic threat identification; risk assessment built around the interplay of destination, traveller and activity; proportionate risk treatment; communication and pre-trip briefing; 24/7 incident response; and continuous monitoring and improvement. The value for a board is that ISO 31030 converts a vague obligation into a concrete, evidenced management system. When a director is asked “how do you know your people are protected?”, being able to point to a live ISO 31030-aligned programme is a far stronger answer than a policy document in a drawer.

Turning all of this into practice is less about spending more and more about governing better. It starts with putting duty of care on the board agenda as a standing item, with a named owner and a policy the board has actually approved. It means assessing destination, traveller and activity together rather than relying on a country rating alone — a low-risk country can still host a high-risk activity for a vulnerable traveller. It means a genuine 24/7 incident-response capability with clear benchmarks, such as making initial contact within around 30 minutes and being able to locate every affected traveller within roughly two hours. It means capturing complete traveller data from all booking channels, so “bleisure” trips and direct bookings do not leave people invisible to the organisation. And it means documenting the audit trail and treating D&O insurance as a backstop, never a substitute for mitigation. Done well, duty of care stops being a liability to be managed and becomes a mark of a well-governed organisation — one that can move its people through a turbulent world with confidence.