S16.4 · Corporate & Business Travel Management
A sub-segment of Corporate & Business Travel Management. Market structure, and how AI is reshaping it.
Duty of Care & Traveler Risk Management serves the employer's duty-of-care obligation to a traveling or posted workforce: traveler tracking and location intelligence, risk alerting and country intelligence, 24/7 assistance and case management, medical and security evacuation, crisis response and business-continuity support, and medical-and-security assistance memberships. International SOS, Crisis24/GardaWorld, Global Rescue, Healix, Riskline, Safeture, Everbridge and Sitata-class providers define the field. Risk-bearing travel medical and evacuation insurance underwriting sits outside the boundary — this node covers the non-underwriting assistance, intelligence and response layer, including the servicing arm of an insurer where separable — as do booking and expense software, managed travel programmes, general corporate security guarding and cybersecurity. What sets the segment apart, uniquely among the segments in this pair, is that the obligation attaches to the employment relationship rather than the trip transaction: it is triggered by headcount and posting decisions, not a booked itinerary. That insulates it from the OTA/agent disintermediation fight defining consumer and corporate booking — and exposes it to a different vector entirely, because the obligation can, in principle, be discharged without ever buying a vendor at all.
The sizing here is unreliable and definitionally inconsistent, and the spread is itself informative. Research and Markets puts "travel risk management services" at $114.8bn in 2024, growing to $171.6bn by 2030 — a figure that bundles travel security, crisis management, "data security" and general corporate travel spend well beyond this segment. Market Research Future's narrower "traveler security services" cut is $7.5bn in 2024, rising to $14.8bn by 2035, closer to the true addressable pool of assistance, evacuation and crisis-response spend, though still likely inflated by adjacent executive-protection and guarding revenue. Neither source cleanly excludes insurance underwriting. A defensible working range for the non-underwriting assistance and intelligence layer globally is roughly $7-15bn.
Concentration sits at the top. International SOS alone generated approximately $1.5bn in the year to June 2025 at a double-digit EBITDA margin (company disclosure, 2025) — 10-20% of the entire addressable market on one company's books. Crisis24 and a long tail of national and regional boutiques (Anvil, FocusPoint, Sitata) fill out the rest. Response capability concentrates in North America, the UK/Europe and Singapore/APAC hubs; demand concentrates wherever multinationals post staff into elevated-risk geographies.
Pricing runs on per-employee or per-traveler annual subscription or membership models, with enterprise multi-year contracts of two to five years bundling intelligence, tracking, a 24/7 hotline and an evacuation guarantee. The margin structure splits by layer: high gross margin on intelligence and software, materially lower on response once the fixed cost of a global 24/7 assistance center, a vetted-clinic network and on-call aircraft and ground-team capacity are loaded in. Revenue is mostly recurring, with an event-driven surge component — evacuation call-outs, crisis surges — that does not scale with headcount alone.
Duty of care is a legal obligation, not a product permission, and that distinction governs the segment's entire AI exposure. The UK Corporate Manslaughter and Corporate Homicide Act 2007, the EU's framework directive 89/391/EEC and posted-worker rules, and US employer-negligence and workers'-compensation exposure all attach liability to the employer directly, independent of any vendor purchase. ISO 31030:2021, the governing standard, is explicitly guidance rather than a certifiable requirement and names no specific human role or sign-off (confirmed by Everbridge and WTW analysis); it distributes responsibility across security, HR, legal and medical functions without gating anything. Buying a duty-of-care vendor is therefore one way to discharge a mandatory obligation, not the obligation itself. That makes the commercial layer bypassable in principle — a large employer with in-house AI-assisted monitoring, a legal function and a contracted medical network could plausibly self-discharge, particularly for lower-risk destinations. The physical layer cannot be bypassed the same way. An evacuation still requires an aircraft, a licensed doctor and country-specific operating rights; no AI substitutes for a landing slot or a medevac license, and that asset intensity is the segment's real moat.
Inside the intelligence layer specifically, country-content writing is a plausible and partly realized automation target. Large language models already draft the templated tier — visa, vaccine and petty-crime boilerplate — and industry reporting confirms AI is displacing aggregation-and-speed tasks (ITIJ, 2025). Practitioners are equally explicit that AI "cannot reliably... determine severity, intent, likely escalation, or correct duty-of-care action," so judgment-heavy crisis assessment stays human. The net effect is a cost-side tool for the bespoke analyst tier, with automation exposure concentrated narrowly on commodity country-profile content and the subscription fee attached to it. No single booking event exists for an agent to intercept upstream of this layer; what might look like interception — falling traveler-day counts — is instead a demand effect, as AI-enabled remote collaboration modestly suppresses business-travel volume and shrinks the per-traveler subscription base. The labor-market evidence is inconclusive: no vacancy data specific to travel-risk analysts or case managers was found, and adjacent corporate-security hiring data shows simultaneous downsizing and expansion — a mixed signal, not evidence of a clean surplus either way.
The segment's two asset types get opposite answers on AI. The country-intelligence library is authored content, and AI makes it more reproducible, not more valuable — the exposure described above. The physical response network — vetted clinics, on-call aircraft, ground teams, in-country operating licenses — is proprietary and non-reproducible, and AI makes it relatively more valuable by commoditizing the intelligence layer built around it. Rising geopolitical risk, separately, is a genuine demand tailwind for this entire segment, but it predates and runs independently of AI and should not be credited to it.