Distance from the front line is not a guarantee for safety. Your security protocols must catch up

Russia is hitting warehouses, workshops, logistics hubs, exhibitions, and trains far from the front line. Many organizations working in Ukraine are not updating their duty of care as fast as the risks are changing, and make decisions on gut instinct.

On Sept. 13, a Russian drone struck the locomotive of a Kyiv-Warsaw train that carried more than 200 passengers at Yahodyn station in Ukraine, about 2 kilometers from the Polish border. A train carrying European officials had left the station only minutes earlier.

Nobody on the Warsaw-bound train was hurt. A monitoring team warned the crew in time, which acted on the warning, according to Ukraine's state railway company Ukrzaliznytsia.

Russia launched more than 2,500 jet-powered drones at Ukraine in August alone, according to Serhii "Flash" Beskrestnov, an adviser to President Volodymyr Zelensky. While Russia used to strike mostly at night, its drones now also increasingly arrive in daylight at locations previously treated as rear areas.

Russia targets the civilian-adjacent economy, meaning warehouses, transport and logistics complexes, industrial sites, assembly workshops, ports, rail junctions, and border crossings.

Anyone who works in Ukraine can describe the general risk of the war, but not every organization turns that general risk into specific decision-making about a particular day, route, and team. Many organizations sending staff into Ukraine must close that gap, as Russia's increasing long-range strikes across Ukraine widen it.

Geography is not a risk assessment

For years, organizations working in Ukraine relied on distance from the front line as the primary variable for their risk assessment. Kyiv was safer than Kharkiv, Lviv was safer than Kyiv, and a border crossing into Poland marked the end of the risk.

That model no longer works. For a company, an NGO, a newsroom, or another organization, the risk picture today is made up of variables independent of proximity to the front line.

A wide range of Russian drones, including long-range jet-powered types, and different alert categories require different behavior. Power and connectivity outages can interrupt communication plans at the worst possible moment. Damaged roads, railways, and crossings can invalidate a planned route for days.

An organizer must know about possible medical and evacuation constraints, such as knowing where the nearest facility for blast injuries is, how long an ambulance takes to arrive, or whether the insurer's evacuation clause is reliable.

They must know what is stored in the buildings next to them and who else uses the same facilities, such as warehouses or hotels.

Most of these things can be known in advance, but they seldom appear in organizations' travel policies, and even fewer shape the actual decisions.

Daily Humanity has trained more than 4,000 people in Ukraine, from global missions to international newsrooms and local businesses. It runs hostile environment awareness training, hostile environment first aid training (HEAT/HEFAT), trauma first aid, risk assessment audits, and drone-awareness courses in Ukraine and Portugal.

Returning faster than the protocols are rewritten

International delegations, reconstruction and energy teams, infrastructure contractors, investors, humanitarian organizations, and media are coming to Ukraine these days in volumes not seen since 2022.

Yet the decision to send people still tends to be made in one of two ways. Either it is based on the absence of issues from a previous visit, or on an undefined gut feeling about a certain place or time.

Both, however, rest on one person's intuition, usually the most senior person in the room rather than the one who will be standing on the platform at 5 a.m.

In Daily Humanity's pre-training assessments of more than a thousand participants in 2025–26 only, about nine in 10 could not walk through a structured risk assessment for their own upcoming deployment. The most common source of pre-trip safety information is a colleague or friend who had visited recently, the assessments showed.

Standard duty of care is not enough

Most corporate travel policies were written for ordinary business travel. They cover insurance, medical assistance, emergency contacts, a country-level risk rating, and an evacuation plan on paper. But a team in Ukraine will face more questions within 48 hours of arrival.

When an alert sounds during a site visit, how does one distinguish between different alert types and behave accordingly? Who decides whether a meeting continues in a shelter or ends? What happens if connectivity drops and the team gets separated? Should the team take the train, knowing Russia targets passenger trains, or drive and risk being at a gas station during a Russian strike? Who has authority to change the plan after departure if the person who approved it is asleep in another time zone? If someone is badly injured, who applies a tourniquet in the first three minutes, before help arrives?

A travel policy written for normal conditions leaves these questions open and can create legal problems after an incident.

EU Directive 89/391 requires employers to assess the risks their workers face, and together with the international risk standard ISO 31030 sets the expectation of a documented, deployment-specific process. After an incident, an insurer, a regulator, or a court will ask about the assessment and the decision-making.

The gap exists not only between headquarters and the field. Risk is rarely discussed in a shared language. Headquarters, a Kyiv office, and a team in Dnipro or Odesa may use the same words, such as "safe," "acceptable," or "shelter," and mean different things.

Staff living in Ukraine have years of hard-won instinct. While it can work, it is often unwritten, differs from city to city, and depends on conditions that can disappear overnight: a mobile network, a familiar route, a driver who knows which checkpoint to avoid. When one of those dependencies fails, or a new threat appears, common sense has nothing to fall back on.

What replaces the gut call

The alternative is a short, repeatable process that runs before every deployment and that any manager can complete in under an hour.

The process starts with identifying specific risks. "War" is too broad to plan around, so a prepared team should name the physical, environmental, medical, legal, reputational, cultural, and data and communications risks for each site, route, and team member.

Each of these risks should then be rated by likelihood against impact, assessing whether specific risks are likely to occur and how severe the consequences would be.

Once the risks are assessed and rated, the organization must make a go/no-go decision against criteria it set in advance. It is imperative that these criteria exist before any trip is proposed, as they might otherwise be adjusted to fit a trip people may be eager to make.

Once a decision to go has been made, the highest-ranked risks get mitigated first with concrete measures, owners, and deadlines. Those could include shelters mapped at every planned location, alternative routes, a medical plan with real travel times, a communication protocol that assumes interception, first-aid kits, and training. Internal communications should be considered with particular care, as schedules, locations, and guest lists are valuable to the adversary and pose a high risk once exposed.

Finally, a plan must also account for conditions changing after a team or individual has departed. That could mean a loss-of-contact procedure, rally points, check-in intervals, and extraction triggers that define when the team leaves without waiting for permission.

Somebody has to have the authority to say no

One named person must have final authority over the go/no-go decision, and the whole team must know who it is before departure. The team should not have to figure this out during an incident, while three people with partial information argue over a bad connection.

That person needs real power to cancel, including against commercial pressure, a visiting executive's schedule, or a deadline. The culture around the decision matters as much as the organizational chart. If calling off a trip is treated as a career risk, teams will keep going when they should turn back. No one should ever be penalized for stopping.

Training before deployment

A risk assessment also only works if the people carrying it out can execute it. Each team member needs to know how to respond to each type of air alert, what changes when the threat is a drone rather than a missile, how to reach the shelter identified on arrival, how to stop catastrophic bleeding, and how to act in the first minutes of an incident when no one else can help.

That is what HEAT and HEFAT, along with first aid, risk assessment, and drone-specific courses, are for. Many organizations assume that junior or newly hired staff will pick up these skills by working alongside experienced colleagues, but mere exposure will not prepare them suitably. An untrained team member is at risk themselves and becomes a liability for everyone who has to make decisions around them.

Training must happen before deployment, giving each team member ample time to practice and feel fully prepared.

Making deliberate decisions

Risk management cannot make a volatile environment safe, but it can replace a gut call with a transparent decision, before the trip and after.

Before anyone travels, the organization should be able to answer six questions: What are the risks? How serious are they? What has been done about them? Who made the decision? Who can stop it? What happens if things change?

At Yahodyn, someone had an answer ready, and a train full of passengers eventually kept moving without casualties. The question for every organization sending people into Ukraine is whether its own team would have one.

Daily Humanity's personal risk assessment worksheet, which its teams run before every deployment, is freely available at dailyhumanity.dk/duty-of-care.