Companies are spending more on business travel than ever before – a forecast USD 1.71 trillion in 2026, up 7.2%. Yet the number of trips is growing by just 1.3%. In other words, each journey costs more and carries more risk. When a single trip is worth that much, travel risk stops being an administrative detail and becomes an operational decision.
Key takeaways
- Travel volume is almost flat, but cost and risk per trip are rising.
- Airspace, borders and even hotel Wi-Fi have become sources of risk.
- In Italy, duty of care for travelling staff is a legal obligation with no geographic limit.
- ISO 31030 is increasingly the benchmark organisations are judged against.
Four shifts shaping travel risk in 2026
1. Disruption has gone geopolitical
Drone incursions have closed airports in Belgium, Denmark, Norway, Sweden and Germany. India–Pakistan airspace bans affect around a fifth of India’s international flights. More worrying still, a growing number of states now treat the detention of foreign nationals as a bargaining chip.
2. Borders have become data checkpoints
The EU’s Entry/Exit System reached full implementation in April 2026. U.S. Customs and Border Protection examined 55,318 electronic devices in 2025, and Hong Kong can now compel travellers – including those in transit – to hand over passwords, with criminal penalties for refusing. For European companies, this creates a real conflict between GDPR obligations and border law.
3. Cyber risk travels with your people
Two-thirds of business travellers (66%) worry about being hacked or falling victim to cybercrime when abroad. In July, Microsoft disclosed CaptiveCrunch, a state-linked campaign that hijacked hotel and conference Wi-Fi login pages to steal credentials and Microsoft 365 tokens.
4. Employees are paying attention
43% of business travellers feel less safe than they used to, 58% think their employer could do more, and 60% would consider leaving a job where safety wasn’t a priority. Safety is now part of how people judge an employer.
What Italian law expects
In Italy, protecting staff who travel is not a matter of good practice. It is the law:
| Source | What it means |
|---|---|
| Art. 2087 Civil Code | The employer’s duty to protect workers applies with no geographic limit. |
| D.Lgs. 81/2008 | Risk assessment is a non-delegable duty of the employer, including geopolitical, health and logistical risks abroad. |
| Court of Cassation (2014) | Conditions at the destination must be verified in advance. |
| D.Lgs. 231/2001 | Liability can extend to the organisation itself. |
| ISO 31030:2021 | Turns these duties into a working system – and is increasingly the benchmark in a dispute. |
2026 doesn’t call for travelling less. It calls for travelling with a framework that would stand up to scrutiny.
The bottom line
The test is simple: would a regulator, a court, a client – and, first of all, your own employees – recognise your travel risk framework as adequate?
Travel risk sits where duty of care, compliance, cyber security and geopolitical intelligence meet. Managed in silos, it leaves gaps. Managed as one picture, it closes them.
- GBTA Business Travel Index Outlook 2026 – global spend forecast USD 1.71T (+7.2%), trips +1.3%
- Zurich – Business Travel Outlook 2026 (43% / 58% / 60% / 66%)
- Microsoft Threat Intelligence – CaptiveCrunch (31 July 2026)
- Statista – CBP electronic device searches, FY2025 (55,318)
- EU Entry/Exit System – full implementation from 10 April 2026
- Hong Kong – border officers can compel travellers to disclose device passwords
- International Airport Review – airports affected by drones
- Skift – Pakistan shuts airspace to Indian carriers
- Art. 2087 Codice Civile (Normattiva)
- D.Lgs. 81/2008 (Normattiva)
- D.Lgs. 231/2001 (Normattiva)
- Cass. pen., sez. IV, 5 Feb 2014, n. 2626 – Ambiente & Sicurezza
- ISO 31030:2021 – Travel risk management
How MandAI can help
MandAI advises organisations on duty of care, travel risk frameworks aligned to ISO 31030, and the geopolitical and cyber exposures facing mobile workforces.