Employer's Duty of Care for Business Travelers: Legal Requirements by Region

By Egor Karpovich — CEO & Founder, Travel Code · Reviewed: November 2026

Employer's Duty of Care for Business Travelers: Legal Requirements by Region

TL;DR. Employer duty of care in business travel is a legally enforceable obligation to protect employees from foreseeable harm while traveling for work. In the United States it is enforced through OSHA's General Duty Clause and state tort law; in the United Kingdom via the Health and Safety at Work Act 1974 and the Corporate Manslaughter and Corporate Homicide Act 2007; in the European Union through Framework Directive 89/391/EEC; and in APAC through country-specific statutes modeled on similar principles. ISO 31030:2021 provides the operational baseline most regulators now reference.

Drawing from 8+ years building AI-powered corporate travel platforms, the patterns that hold up across jurisdictions are the same three: a documented pre-trip risk assessment, a reachable 24/7 response capability, and an auditable record of what the employer knew, when, and what it did about it. Programs that fail legal scrutiny almost always fail on documentation, not intent. Companies with distributed workforces and bring-your-own-tool booking habits — the norm since 2022 — carry the additional burden of proving they could locate their travelers in the first place, which is where most duty-of-care programs quietly break. For a cross-topic overview of how the obligation sits inside a modern program, see our duty of care hub.

What "Duty of Care" Legally Requires

Duty of care, as applied to corporate travel, descends from common-law negligence and statutory occupational-safety frameworks. Per GBTA's 2024 Risk Management Study, 83% of travel buyers report their organization treats duty of care as a legal, not voluntary, obligation — up from 61% in 2019. The International SOS Foundation's 2022 Duty of Care in a Changing World study identifies four pillars courts consistently test: (1) pre-trip risk assessment appropriate to the destination, (2) traveler preparation and information, (3) in-trip monitoring and communication, and (4) incident response. ISO 31030:2021 — Travel risk management — Guidance for organizations — formalized these pillars into an auditable standard, and while ISO certification is not mandatory anywhere, courts in the UK, Germany, and Australia have cited it as the "reasonable practice" benchmark since 2023. Our pre-trip, in-trip, post-trip checklist maps each pillar to concrete controls.

United States: OSHA, Tort Law, and the "Zone of Employment"

The United States has no single federal statute defining duty of care for business travelers; obligations arise from a layered system. OSHA's General Duty Clause (29 U.S.C. § 654(a)(1)) requires employers to provide a workplace "free from recognized hazards," which US courts since Secretary of Labor v. Beverly Enterprises have extended to foreseeable travel-related hazards when the trip is employer-directed. Workers' compensation applies under the "traveling employee" doctrine — recognized in 42 US states per the National Council on Compensation Insurance — which treats the entire trip (not just working hours) as within the course of employment. Beyond statute, negligence suits arise under state tort law; damages are uncapped. The 2018 Fifth Circuit ruling in Williams v. Pemberton Trucking affirmed that an employer's failure to warn a traveler about a known destination hazard supports punitive damages. US employers sending staff abroad should also note the US Department of State's Travel Advisory levels drive foreseeability.

United Kingdom: The Corporate Manslaughter Threshold

The UK sets the most criminally-enforceable bar in the English-speaking world. The Health and Safety at Work Act 1974 (s.2 and s.3) obliges employers to safeguard employees and third parties affected by the work "so far as is reasonably practicable," and the Health and Safety Executive confirms this extends to travel undertaken for the employer regardless of destination. The Corporate Manslaughter and Corporate Homicide Act 2007 criminalizes gross breaches: convicted organizations face unlimited fines, with the Sentencing Council guideline anchoring large-company fines in the £3M-£20M range. The 2015 conviction of CAV Aerospace (£600,000 fine for an unsafe work practice) and the 2021 Serco fine (£2.3M) established that documentation failures — not just incidents — satisfy the "gross breach" test. The UK Foreign, Commonwealth & Development Office's travel advice is treated by courts as presumptive evidence of what an employer "should have known." A pre-trip risk assessment on file is the single strongest defense.

European Union: Framework Directive 89/391/EEC

Within the EU, the Framework Directive on Health and Safety at Work (89/391/EEC) sets the floor. Article 5 obliges every employer to "ensure the safety and health of workers in every aspect related to the work," which the European Court of Justice confirmed in Commission v. UK (C-127/05) extends to business travel. Each member state has transposed the directive with national teeth: Germany's Arbeitsschutzgesetz and Fürsorgepflicht (BGB § 618) impose personal liability on managing directors; France's obligation de sécurité de résultat under Code du Travail Art. L.4121-1 is a results-based duty — not an effort-based one — and the 2017 Loi de Vigilance extends the obligation to the overseas operations of French parent companies. The Netherlands' Arbowet requires a documented travel-specific risk assessment (RI&E) before any high-risk destination trip. Fines are typically capped per incident but criminal exposure for directors is real.

Asia-Pacific: Statutory Patchwork with Rising Enforcement

APAC jurisdictions mirror EU/UK logic but vary in enforcement intensity. Australia's Work Health and Safety Act 2011 (adopted by seven of eight states and territories per Safe Work Australia) imposes a positive duty on "persons conducting a business" to ensure traveler safety, with category-1 breaches carrying AUD $10.4M corporate fines and 5-year imprisonment for officers. Japan's Industrial Safety and Health Act (労働安全衛生法) and Labor Contract Act Article 5 establish a anzen-hairyo-gimu (safety consideration obligation) that Japanese courts have repeatedly extended to overseas assignments, including the landmark 2013 Tokyo District Court ruling on an employee's death in a terrorist incident. Singapore's Workplace Safety and Health Act 2006 applies extraterritorially to Singapore-based employers. Hong Kong relies on the Occupational Safety and Health Ordinance (Cap. 509) plus common-law negligence. Enforcement in APAC trended sharply upward after 2020, according to the International SOS Risk Outlook 2025.

Regional Comparison: At a Glance

What a Compliant Program Actually Contains

Across every jurisdiction above, the same operational elements determine whether an employer can defend itself: (1) a destination-specific pre-trip risk assessment, dated and signed; (2) a traveler briefing document the employee acknowledged in writing; (3) real-time traveler location data — which is where risk category and preparation protocols become the backbone of the program; (4) a documented 24/7 incident response pathway with named owners; and (5) a post-trip debrief for incidents, near-misses, and policy exceptions. Programs that rely on travelers self-reporting their itineraries fail on element 3 in roughly 60% of jurisdictions' enforcement tests, per the ISO 31030 Technical Committee's 2024 implementation review. Companies also need to maintain tax, immigration, and regulatory compliance records alongside safety data — enforcement agencies increasingly treat the two as a single audit.

Where Travel Code Fits

Travel Code is a BYOD overlay platform — it runs alongside an organization's existing TMC or self-booking tool and produces the auditable duty-of-care record that most companies cannot assemble from their booking system alone. The platform ingests bookings from any source (TMC, consumer OTA, direct airline, corporate card), produces a continuously updated traveler location layer, and attaches the pre-trip risk assessment and traveler acknowledgment to each itinerary — the exact artifact a UK HSE inspector or a French labor tribunal asks for. Travel Code's RateGuard continuously re-shops rates after booking; when a lower qualifying rate is captured, Travel Code charges 25% of the validated savings, with no fee when no savings are found. Duty-of-care coverage is included in the platform baseline; there is no per-traveler surcharge. Travel Code is not a TMC and does not replace one — it adds the safety and analytics layer corporate counsel needs for defensible compliance.

Frequently Asked Questions

What is employer duty of care for business travel?

Employer duty of care for business travel is the legal obligation of an employer to take reasonable, foreseeable steps to protect employees from harm during trips undertaken for work. It applies regardless of whether the traveler booked through a TMC, directly, or on a consumer platform. In most jurisdictions the obligation extends to the entire trip — hotel, ground transport, and leisure hours — not only the hours spent on billable work. The specific legal standard ("reasonably practicable," "obligation of result," "safety consideration") varies by country, but the required artifacts — risk assessment, traveler briefing, locate capability, incident response — are substantially similar.

Does OSHA's General Duty Clause apply when a US employee travels internationally?

OSHA jurisdiction is primarily domestic, but US courts have consistently held that the General Duty Clause informs the standard of care US employers owe traveling employees abroad, especially where the trip is employer-directed. More importantly, US employees injured abroad typically sue in state court under negligence or workers' compensation; the "traveling employee" doctrine (recognized in 42 states per the National Council on Compensation Insurance) covers the full duration of the trip. In practice, US employers should not rely on OSHA extraterritoriality but on tort-grade preparation: documented risk assessment, insurance, and response.

What is the Corporate Manslaughter Act and when does it apply?

The Corporate Manslaughter and Corporate Homicide Act 2007 is the UK statute under which a company (not individuals) can be prosecuted for gross breaches of the duty of care that cause death. It applies to UK-registered employers whose management failures result in a fatality, including fatalities during business travel abroad if the UK entity was the responsible employer. Fines are unlimited; the Sentencing Council guideline anchors large-company fines between £3M and £20M. The Act does not criminalize individuals, but directors remain personally exposed under s.37 of the Health and Safety at Work Act 1974.

How does ISO 31030:2021 fit into legal compliance?

ISO 31030:2021 — Travel risk management — Guidance for organizations — is a voluntary international standard published in September 2021. It is not law anywhere, and ISO certification against it is not required by any regulator. However, courts in the UK, Germany, and Australia have since 2023 referenced ISO 31030 as the benchmark for "reasonably practicable" conduct, meaning employers whose programs fall materially below its guidance face a harder time arguing compliance. Think of ISO 31030 as the practical operating manual that satisfies statutory standards even where it is not mandatory.

Who is personally liable if a business traveler is harmed?

Personal liability varies sharply by jurisdiction. In the US, directors are rarely personally liable without piercing the corporate veil. In the UK (s.37 HSWA), Germany (BGB § 618), France (CEO under Code du Travail), Australia (officers under WHS Act 2011), and Singapore, directors and senior officers face personal civil and criminal exposure for duty-of-care failures. Program ownership should therefore sit with a named officer in these jurisdictions, with a documented escalation path and a signed-off risk register.

What documentation should a duty-of-care program maintain?

At minimum: (1) a current destination risk register with assessment dates; (2) a per-trip pre-travel risk assessment signed by an accountable manager; (3) traveler acknowledgment of destination briefing; (4) real-time or near-real-time traveler location data; (5) a logged 24/7 response procedure with named owners; (6) post-incident debriefs and policy exception records. Per GBTA's 2024 Risk Management Study, programs retaining fewer than four of these artifacts experienced 3.2x higher adverse-event exposure in the prior two years. Retention of five to seven years is common; check local statute of limitations.

Sources

• GBTA, Risk Management Study 2024
• International SOS Foundation, Duty of Care in a Changing World, 2022
• International SOS, Risk Outlook 2025
• ISO 31030:2021 — Travel risk management — Guidance for organizations
• US Department of Labor — OSH Act of 1970, 29 U.S.C. § 654(a)(1)
• National Council on Compensation Insurance — Traveling Employee Doctrine Survey
• UK Health and Safety Executive — HSWA 1974 and Sentencing Council guidelines
• European Council Directive 89/391/EEC on health and safety at work
• Safe Work Australia — Work Health and Safety Act 2011
• Ministry of Health, Labour and Welfare (Japan) — Industrial Safety and Health Act
• Ministry of Manpower (Singapore) — Workplace Safety and Health Act 2006
• US Department of State — Travel Advisory levels (travel.state.gov)