— ERS Briefing 013 · July 2026

Safe until
January.

Abu Dhabi and Dubai rated among the safest postings in the world. In January 2026 that rating stopped being the relevant question. When the regional calculus changed, ERS was engaged by multiple firms to help move key people out of the Gulf, and across those engagements one pattern repeated: nobody's safety rating was wrong, and nobody's plan existed.

Download the PDF →✦ Four pages · No registration required
01

The assumption

The UAE earned its reputation honestly. Low crime, stable governance, world-class infrastructure, and a business environment that made Abu Dhabi and Dubai natural hubs for finance, technology, and digital-asset firms placing senior people abroad. Every risk model rated the posting green, and every risk model was right, in the terms the model measured. Jurisdictional safety describes the environment on an ordinary day. It says nothing about what happens when the region around a safe city changes character in a week. Those are different properties. "Safe" and "evacuable on twelve hours' notice" are not the same claim, and almost no one had ever audited the second one, because the first one kept coming back green.

02

The pattern we observed

When hostilities opened in early 2026, firms with people in the Gulf reached the same realization within days of each other, and ERS was engaged by several of them to help move key personnel. We will not describe any engagement. We will describe the failure mode, because it was the same everywhere. No one had decided, in advance, who counted as a key person, so the manifest was being argued in the first hours. No one held pre-authorized decision rights, so movement waited on committees assembling across time zones. No pre-cleared movement options existed, so capacity was being procured in the same window everyone else was procuring it, at the moment it was scarcest. And normal communication channels degraded exactly when coordination mattered most, with no agreed fallback.

The result, everywhere we looked, was delay measured in days rather than hours, and coordination improvised under the worst possible conditions. Not because anyone was negligent. Because the planning question had never been asked while asking it was cheap.

03

Why this generalizes

The instinct after an event like this is to re-rate the jurisdiction, and it is the wrong lesson. The UAE was not the failure; the Gulf will not be the last region to change character quickly, and the next one will also be somewhere rated green. Any concentration of principals in any jurisdiction carries the same latent question: if this place had to be left quickly, by named people, on a bad week, what already exists? For most firms the honest answer is a travel-risk vendor's hotline number and an assumption that it will work out, which is the same answer the firms in the Gulf held in December.

04

What must exist before the crisis

Four things, and none of them can be built during the event. A key-person manifest, decided in calm conditions: who moves, in what order, including family members, and who decides additions in the moment. Pre-authorized decision rights: a named person who can spend money and trigger movement without convening anyone, because the committee is the delay. Pre-arranged movement capability: options identified, relationships in place, and the practical details, documents, assembly points, communications fallbacks, resolved on paper before they are needed. And a standing relationship with whoever will execute, because the firms that moved fastest in January were the ones for whom hour one was execution, and the slowest were the ones for whom hour one was procurement: scope, contract, and introductions negotiated while the situation deteriorated. The difference between those two starting positions was the entire outcome.

05

Method

This briefing draws on ERS engagements conducted during the early-2026 Gulf crisis, deliberately aggregated. We identify no client, no headcount, no route, and no engagement-specific timeline, and nothing here implies knowledge of any ongoing situation. The pattern is published because it will repeat somewhere else, and the fix is only available in advance. We publish the pattern and the protective takeaway. We omit operational detail.