Employer Duty of Care for Business Travellers: What the Middle East Crisis Revealed

On the evening of March 1, 2026, UAE airspace closed. Not gradually. Overnight. More than 52,000 flights were cancelled across the region. An estimated six million passengers were affected. And in boardrooms and HR offices far from the Gulf, a very specific kind of panic began to set in: where are our people, and how do we get them home?

For some companies, this question had a clear answer. For many others, it didn't - not because they lacked good intentions, but because their duty of care existed mostly on paper.

I've spent the weeks since that crisis speaking with travel managers, HR teams, and security experts who were on the front lines of the response. What I heard was consistent: the organisations that handled it well weren't necessarily the ones with the most resources. They were the ones who had already solved a seemingly mundane problem - knowing exactly where their people were, and having all the information they needed to act in one place.

‍

The gap between having a travel risk management plan and being ready to use it

Most organisations assume they have a duty of care plan. In the calm of a normal quarter, that assumption is rarely tested. The Middle East crisis tested it for thousands of companies at once.

What became apparent quickly is that many protocols hadn't kept pace with how mobile workforces have actually become. Business travel, workations, long-term assignments - the complexity of who is where, under what visa, with what documentation, has grown significantly. But the systems managing that information hadn't grown with it.

‍

‍

These aren't hypothetical concerns. When Iran launched drone strikes toward the UAE - a country widely regarded as one of the safest in the world - many companies discovered their crisis protocols were built for a different era. You may not have had a plan that specifically said 'what if Iran launches drone strikes toward the UAE.' But what you should have, through training, is a foundational understanding of how to respond to that type of threat.

The organisations that struggled weren't short on care. They were short on the right care at the right time.

‍

What employer duty of care looked like on the ground

Consider what companies with employees in the UAE faced in the hours after airspace closed. The overland route to Oman was the only viable exit - but many employees needed a visa to cross the border. More than 10,000 people were competing for the same scarce transport slots. Every minute of delay was a minute closer to those slots disappearing.

For a crisis team, the first question in that moment isn't 'how do we evacuate?' It's a more basic one: who exactly needs to get out, what documents do they have, and where are they right now?

If that information lives in three different systems - or worse, in someone's email inbox - the crisis team is already a step behind before they've even started.

‍

^{CASE · ANONYMISED · GLOBAL TECHNOLOGY COMPANY}‍

When the airspace closed, the plan was already ready

A global technology company had approximately 12 employees in the UAE when airspace was shut. The overland exit to Oman was the only option - but it required visa clearance, real-time transport coordination, and contingency planning for border closure scenarios. Because visa data for all 12 employees had been submitted and was instantly accessible in a single platform, no intake process was needed when the crisis hit. By 05:30 the following morning - just 8.5 hours after airspace closed - a full evacuation plan was in place: land route confirmed, accommodation contingencies mapped, visa clearance synchronised with transport. The UAE airspace reopened at 14:30 that day. The evacuation never needed to be executed. But the plan existed within hours - because compliance data and crisis response lived in the same place.

WorkFlex SOS supported the response described above.

‍

This is the detail that tends to get lost in post-crisis analysis. The outcome was fine - the airspace reopened. But the ability to respond quickly had nothing to do with luck and everything to do with infrastructure built before the crisis began.

‍

The human dimension is as important as the operational one

Not every crisis plays out at a company-wide scale. Some of the most difficult moments are intensely personal - a single employee in a difficult situation, with a family member alongside them, in a country they don't know well.

‍

^{CASE · ANONYMISED · INDIVIDUAL EMPLOYEE SUPPORT}

5 minutes from first contact to full support structure in place

An employee on a business trip in Dubai had his wife, 30 weeks pregnant, travelling with him. When airspace closed overnight, he was stranded with limited information and no clear route home. Within minutes of the situation being flagged, a WhatsApp group was created with a security expert, a medical doctor, and a support team - all in one channel. His hotel location was assessed against known attack targets. A doctor confirmed which nearby hospitals met European medical standards - relevant because of his wife's pregnancy. A personalised safety briefing was built around their specific circumstances. The following morning, the team checked in before the working day started. The case wasn't closed overnight. Support continued until they were safely home.

WorkFlex SOS supported the response described above.

‍

Communication was absolutely key - not just operational communication, but the human dimension of it. Being present, being consultative, doing regular check-ins, making sure people felt heard. That human contact in a crisis is irreplaceable.

‍

This is what duty of care looks like in practice. Not a policy document. Not a helpline number that redirects you to an endless waiting list. A real person - or a coordinated team - present and responsive when an employee is scared and needs help.

‍

The accountability gap: what employers owe their travelling employees

One of the clearest observations from crisis experts who work with organisations across industries is that duty of care is still behind the curve in most companies - particularly when it comes to international travel.

"You don't get handed a hi-vis vest for international travel. But the consequences of getting it wrong are just as serious - you can find yourself in court, across multiple jurisdictions, with significant consequences." The worst thing that can happen is negligence in a crisis situation, and your own employee suing you for your negligence.

Personal liability is real. Reputational consequences are real. The Middle East crisis was widely covered in international media, and the contrast between organisations that responded quickly and those that left employees to navigate chaos independently was visible. Based on our experience, the companies who have quality duty of care for their employees are perceived very highly and push the value of their employer brand up – offering the team a real benefit of safety.

ISO 31030 - the international standard for travel risk management - provides a framework for what good looks like. But compliance with a framework is only as meaningful as the operational infrastructure behind it. A policy that says 'we will track employee locations and respond to emergencies' requires systems that can actually do that, in real time, under pressure.

‍

What good travel risk management actually requires

Based on what we observed during the Middle East crisis, and the conversations that followed with crisis management professionals, four things separate companies that handled it well from those that didn't.

Pre-travel risk assessment tailored to the individual

A generic country threat rating is a starting point, not a plan. What actually protects employees is an assessment done 48 to 72 hours before departure - enough lead time to do it properly - and calibrated to the specific person travelling. Their role, nationality, ethnicity, religion, any health conditions. In many jurisdictions, this preparation isn't just good practice; it's a legal requirement. The challenge is having complete information about the travelling employee before they leave. That information needs to live somewhere accessible - and someone needs to be responsible for it.

‍

{{download-box}}

‍

Real-time visibility of who is where

Not a spreadsheet updated monthly. A live picture of where employees are traveling, under what documentation, with what risk exposure - and the ability to filter and act on that data immediately when conditions change.

‍

Compliance data and crisis response in the same place

The single biggest operational advantage during the UAE crisis was having visa data, travel itineraries, and emergency response workflows accessible from one travel risk management platform. Organisations using dedicated travel risk management software moved from ‘airspace closed’ to ‘evacuation plan ready’ in hours. Those without it were still trying to gather information when the window was closing.

‍

Human presence, not just process

The medical director who confirmed which hospitals met European standards for a pregnant traveller. The security expert who assessed a hotel's proximity to attack targets. The team that checked in before the working day started and didn't close the case until the employee was home. Systems enable this - but they don't replace it.

"Having a plan is necessary, but rehearsing that plan - building genuine muscle memory and redundancy in key roles - is what actually matters."

The Middle East crisis will not be the last test of this kind. Geopolitical spikes happen fast, and the window between 'situation developing' and 'window closing' is measured in hours, not days. The organisations that respond well are those that have already done the unglamorous work: consolidating their data, aligning their compliance and safety infrastructure, and making sure the people responsible for crisis response know exactly what to do - and have the tools to do it.

Duty of care is not a checkbox. It’s a capability. And capabilities, unlike policies, have to be built before they’re needed.