Sending an employee abroad creates a legal and moral obligation that a travel insurance policy alone does not discharge. How duty of care and insurance actually fit together — and where each one stops.
When a company books an employee onto a flight, it takes on something no leisure traveller carries: an employer's duty of care. The obligation to take reasonable steps to protect people while they work — including while they travel for work — does not pause at the departure gate. Many organisations discharge this duty by buying a corporate travel insurance policy and considering the matter closed. That is the misunderstanding this piece is about.
The thesis: insurance is how an organisation finances travel risk; duty of care is how it manages travel risk. A programme needs both, they are not substitutes, and the gap between them is where companies get hurt — legally, financially, and in the currency that matters most, their people's trust.
What duty of care actually demands
Since 2021 there has been an international reference point. ISO 31030, Travel risk management: guidance for organizations, published in September 2021, sets out how organisations of any type — companies, government bodies, NGOs, universities — should manage risks to the organisation and its travellers arising from work travel. It covers policy development, programme design, threat identification, risk assessment and mitigation. It is guidance rather than a certifiable mandate, but it increasingly defines what reasonable steps means when the question is asked after something has gone wrong.
Read as a checklist, the standard's expectations are concrete: know where your travellers are; assess destinations before authorising trips; prepare travellers for the risks of where they are going; have a way to reach them and be reached in an emergency; and have escalation plans that someone has actually rehearsed. None of that is insurance. All of it is management.
What insurance does — and does not — cover
A well-built corporate travel policy finances the sharp end of travel risk: emergency medical treatment and hospitalisation abroad, medical evacuation and repatriation, personal accident benefits, baggage and equipment, trip disruption. Group policies typically cover all employees automatically, which eliminates the per-trip administration and the fatal gap of the employee who travelled before anyone arranged cover.
But notice what a policy does not do. It does not know an employee is in a city where the security situation just deteriorated. It does not decide whether the trip should happen at all. It does not brief the first-time traveller, track the itinerary change made at the airport, or call the family. Insurance answers the question who pays; duty of care answers the questions before and after it — should we, do we know, can we reach them, what do we do now.
A policy reimburses the medical evacuation. Duty of care is knowing the employee needed one.
Where the two meet: assistance
The practical bridge between insurance and duty of care is the assistance service attached to serious corporate travel policies: 24-hour multilingual medical and security assistance lines, hospital networks with payment guarantees, evacuation logistics. For most mid-sized companies, the assistance provider bundled with their insurance is the closest thing they have to a travel risk capability — which makes assistance quality a more important procurement criterion than premium. A cheap policy with a thin assistance network is a false economy that reveals itself at the worst possible moment, in the wrong language, at 3am.
Companies at larger scale, or with exposure to higher-risk destinations, layer dedicated travel risk management on top: pre-trip approval workflows tied to destination ratings, traveller tracking fed by booking data, security intelligence. The insurance policy then becomes what it should be — the financial instrument inside a managed programme, not the programme itself.
Implications for the Gulf's travel programmes
Business travel from Saudi Arabia and the wider Gulf is growing with the economies themselves — new sectors, new trade routes, delegations and project teams moving constantly. Three practical conclusions for organisations building programmes here.
- Buy group, not per-trip. Annual group business travel cover priced on traveller volume removes the administrative failure mode where an urgent trip departs uninsured. It is also where embedded distribution genuinely helps: cover attached automatically at the point a trip is booked or an employee is onboarded closes the gap by design rather than by diligence.
- Evaluate the assistance network for where your people actually go — project sites and secondary cities, not just capitals. Ask for the provider's real capabilities in those locations, and test the line.
- Write the travel risk policy before you need it. A two-page document stating who approves trips to which destination categories, how travellers check in, and who owns an incident is most of what ISO 31030 asks of a smaller organisation — and it costs a fraction of the premium already being paid.
The honest limitation: this piece describes the general shape of duty of care as an employer obligation and ISO 31030 as international guidance; specific legal duties vary by jurisdiction and sector, and Gulf labour law questions belong with counsel, not a blog. But the operational conclusion does not vary anywhere: the company that can answer where are our people right now has a travel programme. The company that can only answer we have a policy has a payment method.