Policy & finance
Duty of Care in Business Travel: The SME Guide
What SMEs owe travelling employees, what duty of care requires in practice, and a checklist to cover the basics.
Duty of Care in Business Travel: The SME Guide
Duty of care sounds like a large-enterprise concern, the kind of thing with a dedicated risk team and a 24-hour operations centre. It isn't. The moment you send an employee on a work trip, you take on a legal and moral responsibility for their safety, whether you're fifty people or five thousand. The difference is that big companies have systems for it and most SMEs don't. They just hope nothing goes wrong. This guide covers what duty of care actually requires, why it applies to you, and a checklist to cover the basics without a risk department.
It's for the ops, HR, or office lead who books or oversees business travel and wants to get the fundamentals right.
Key Takeaways
• Duty of care is a legal and moral obligation to protect employees while they travel for work, it applies to companies of every size.
• The practical core: know where your people are, give them relevant information, and have a plan when something goes wrong.
• ISO 31030 is the recognised guidance standard for travel risk management.
• SMEs can cover the basics with a clear process and the right information, not a big team.
What does duty of care mean in business travel?
Duty of care is the responsibility an employer has to protect the health, safety, and wellbeing of employees while they're travelling for work. It's grounded in employment and health-and-safety law in most jurisdictions, and reinforced by a simple moral principle: if you ask someone to travel for the business, you're accountable for their safety while they do.
In 2021 the standard was formalised: ISO 31030, Travel risk management: Guidance for organizations, sets out how organisations of any size should identify, assess, and manage travel risk. It's guidance rather than law, but it's the reference point auditors, insurers, and courts increasingly look to. You don't need to certify against it; you do need to be able to show you took reasonable, considered steps.
The bar isn't perfection. It's whether you acted reasonably.
Do SMEs really have a duty of care?
Yes: the obligation doesn't scale with headcount, and assuming it only applies to large firms is the single most common (and most exposing) mistake. A 30-person company sending someone to a client meeting overseas carries the same fundamental responsibility as a multinational. What differs is the sophistication of the response expected (a court or insurer will weigh what was reasonable for a company your size) but "we're too small to worry about it" is not a defence.
The exposure is real: an incident abroad without any demonstrable duty-of-care process can mean legal liability, an invalidated insurance claim, and a duty you failed to meet to someone who trusted you. The good news is that "reasonable for an SME" is an achievable bar.
Small doesn't mean exempt. It means proportionate.
What does duty of care actually require?
Focus on three things: know, inform, respond. Almost everything practical hangs off those:
Know where your people are. You can't help someone you can't locate. At minimum, keep a current record of who is travelling, where, and when.
Inform them before they go. Relevant, current information for the destination: entry rules, health and safety, local risks, emergency contacts.
Respond when something happens. A clear, communicated plan for disruptions and emergencies, who the traveller calls, who acts, and how.
Around that core sit the supporting pieces: adequate travel insurance, a sensible travel policy, and a way to reach travellers quickly. None of it requires a risk department, it requires a process someone owns.
Reactive vs proactive: two ways SMEs handle it
Most SMEs start reactive and only feel the gap when something goes wrong. We think the shift to proactive is less about spending more and more about deciding, once, who owns it and what the plan is. The contrast is stark:
Reactive (default) | Proactive (achievable for SMEs) | |
Traveller location | Reconstructed from emails after the fact | Known from current booking records |
Pre-trip info | Ad hoc, if at all | Standard destination brief before travel |
In a disruption | Scramble, unclear who acts | Named contact, communicated plan |
Insurance | Assumed, rarely checked | Verified coverage for the trip type |
Moving from the left column to the right is mostly organisation, not budget.
How do you deliver duty of care without a big team?
Lean on process and your existing booking data, not headcount. Three moves get an SME most of the way:
Centralise your travel records. If trips are booked in one place, you automatically know who's where, the hardest part of duty of care solves itself as a by-product of organised booking.
Standardise a pre-trip brief. A simple, repeatable destination checklist (entry, health, safety, contacts) covers the "inform" obligation without bespoke work each time.
Make sure someone is reachable. Travellers need a clear channel to reach help fast when a trip breaks at an awkward hour.
This is where booking and duty of care overlap. A travel platform that keeps bookings in one view (Accomy, for instance, also puts a human concierge on the channels travellers actually use (WhatsApp, Line, WeChat)) means you know who's booked where and your people have someone to reach, without standing up a 24-hour desk. The tooling is optional; the process is not. In our experience, the SMEs that get this right treat duty of care as a checklist someone owns, not a system someone buys.
Duty of care, done proportionately, is mostly the discipline of deciding in advance.
Duty-of-care checklist for SMEs
Copy this and fill it for your company: it covers the reasonable basics.
Before the trip
Traveller, destination, and dates recorded centrally
Destination brief shared (entry rules, health, safety, local risks)
Emergency contacts provided to the traveller
Travel insurance confirmed for this trip type
During the trip
A way to know where the traveller is / reach them
A clear channel for the traveller to reach help quickly
Awareness of any developing risk at the destination
If something goes wrong
Named person responsible for responding
Documented steps: who the traveller calls, who acts
Insurance / assistance details to hand
Governance
A named owner for travel duty of care
Reference to ISO 31030 as your guidance baseline
Annual review of the process
Frequently Asked Questions
What is duty of care in business travel?
It's the legal and moral responsibility an employer has to protect the health, safety, and wellbeing of employees while they travel for work. It's grounded in employment and health-and-safety law and, since 2021, guided by the ISO 31030 travel-risk-management standard. In practice it means knowing where your travelling people are, informing them of relevant risks before they go, and having a plan to respond if something goes wrong. It applies from the moment you ask someone to travel until they return, and it covers physical safety, health, and increasingly mental wellbeing. Importantly, it isn't discharged by buying insurance: insurance pays out after something goes wrong, whereas duty of care is about reducing the chance it does in the first place.
Do small companies have a duty of care to travelling employees?
Yes. The obligation doesn't scale with headcount, a 30-person company carries the same fundamental responsibility as a multinational. What differs is the sophistication expected: you're judged on what's reasonable for a company your size. "We're too small" is not a legal defence, and a failure can mean liability and invalidated insurance. The achievable bar for an SME is a clear, owned process.
What is ISO 31030?
ISO 31030:2021, Travel risk management: Guidance for organizations, is the international standard for how organisations identify, assess, and manage the risks of employee travel. It's guidance, not a certifiable requirement, but it's the reference point insurers, auditors, and courts increasingly use to judge whether an employer acted reasonably. SMEs can use it as a baseline without formally certifying.
How can an SME provide duty of care without a dedicated team?
Through process and existing booking data, not headcount. Centralise travel records so you always know who's where, standardise a pre-trip destination brief to cover the "inform" duty, and make sure travellers have a clear channel to reach help fast. Booking travel in one place means you know who's booked where as a by-product, which is the hardest part solved cheaply. Add adequate travel insurance and a named owner for the process, and a small company can meet a reasonable standard of care with no dedicated headcount: the obligation is met by organisation, not by size of team.
What should a duty-of-care plan include?
Three cores: know, inform, respond: a current record of who's travelling where and when; a pre-trip brief covering entry rules, health, safety, and emergency contacts; and a communicated response plan naming who the traveller calls and who acts. Around that: verified travel insurance, a sensible travel policy, a named owner, and an annual review against ISO 31030.
Quick Takeaways
Duty of care applies to every company that sends people on work trips: SMEs included.
The core is know, inform, respond; ISO 31030 is the guidance baseline.
You're judged on what's reasonable for your size, not on enterprise-grade systems.
Centralised booking means you know who's booked where: the hardest part, solved cheaply.
Assign an owner and review the process annually.
About Accomy: Accomy is an APAC-first travel operating system for SME and mid-market companies, covering booking, negotiated rates, policy, payment, and human traveller support. More at About Accomy.
Related reading:
How to write a corporate travel policy (where duty of care is codified)
Managed vs unmanaged travel (why centralised booking matters)
Company trip to Taiwan (duty of care in a real destination context)
Sources & notes
ISO 31030:2021, Travel risk management — Guidance for organizations — named as the recognised guidance standard; readers should consult the official ISO page and local employment/health-and-safety law for their jurisdiction.
This is a Tier B how-to; it asserts no external statistics, so no citations are required. Legal points are general and jurisdiction-dependent — not legal advice.