World Tourism Day | AI governance in tourism: 10 keys to responsible integration

A chatbot that manages reservations. An algorithm that adjusts prices based on demand. A system that automatically generates room descriptions or analyzes reviews to identify operational issues. Artificial intelligence is already part of everyday life in the tourism sector, but do we really know what these systems are doing, how they are being supervised, and who is responsible when something goes wrong? 

On the occasion of World Tourism Day, we are sharing the research study “The artificial intelligence integration gap: rapid adoption vs. slow governance”, conducted by Paula Toro and Sara Carboneras, students in the Bachelor's Degree in Digital Business and Innovation at CETT-UB, together with Dra. Ainhoa Carballido-Risco. The study examines how European small and medium-sized enterprises are incorporating artificial intelligence and highlights a clear reality: AI adoption is moving faster than AI governance. 

This challenge has become even more relevant in light of the new regulatory landscape. Since August 2026, the European Union's Artificial Intelligence Act (AI Act) has established specific obligations for organizations using general-purpose AI systems such as ChatGPT, Gemini, or Claude, with penalties of up to €15 million or 3% of annual revenue for non-compliance and an 18-month period to prepare and address shortcomings. 

Based on its findings, the research translates academic knowledge and regulatory requirements into 10 best practices that tourism businesses can implement. These measures do not necessarily require major investments in technology, but rather organization, clarity, and documentation.

10 steps to improve AI governance in tourism 

• Identify all AI systems 

The first step is to understand which tools actually use artificial intelligence. A chatbot, a room recommendation system, a tool that classifies reviews, or a system that predicts cancellations may use AI even if the organization does not identify them as such. The recommendation is to create an inventory and classify each system according to its function: customer service, operations, pricing, marketing, or analytics. 

• Appoint someone with real responsibility and authority 

62% of the SMEs studied had appointed someone as the person “responsible for AI,” but only 37% had assigned that person verifiable time and authority. Responsibility must translate into dedicated time, access to technical documentation, and the authority to intervene or stop a system when problems are detected. 

• Document supervision 

Simply reviewing AI outputs is not enough. Organizations need to determine who is responsible for supervision, how often reviews take place, which criteria are used, and how each review is recorded. Traceability transforms informal supervision into an auditable procedure. 

• Define what data can be shared 

Companies should establish clear policies regarding what information can be entered into external tools. Credit card details, identity documents, medical information, and employee data, for example, require special protection. These rules should be documented and clearly communicated to teams. 

• Identify risks 

Not all AI applications have the same impact. Answering whether a hotel room has Wi-Fi does not involve the same level of risk as automatically rejecting a reservation or changing a price based on a customer's profile. For each system, organizations should assess potential errors, discrimination, the processing of sensitive data, and the consequences of system failure. 

• Require transparency from providers 

When the technology belongs to a third party, companies should contractually require information about training data, changes to algorithms, decision logs, potential anomalies, and metrics related to error rates, accuracy, or bias. The recommendation is to negotiate these safeguards before implementing the tool. 

• Inform customers 

If someone interacts with a chatbot, they should know that they are communicating with a machine. They should also have the option to contact a person and understand how the information they provide will be used. Transparency is a regulatory requirement, but it is also an essential element in building trust. 

• Keep records of decisions 

When a system accepts or rejects a reservation, assigns a price, cancels a booking, or prioritizes a customer, organizations need to be able to reconstruct what happened. Records should include the date and time, input data, criteria applied, the decision made, and its outcome. The AI Act requires records to be retained for a minimum of six months; the research proposes keeping them for two to three years as a best practice. 

• Train teams 

Governance also depends on the people using the technology. Sharing information that should not be entered into a system, blindly trusting an incorrect response, or failing to report a problem are some of the risks identified. The research proposes 30- to 60-minute training sessions for teams working with AI, particularly those in front desk operations, customer service, Revenue Management, and other operational areas. 

• Prepare for an audit 

The final step is to document the entire process: which systems the organization uses, what they are used for, what risks they present, how they are supervised, what data they process, what safeguards providers offer, and how customers are informed. The recommendation is to review this documentation quarterly and prepare an internal self-audit report on AI implementation and use. 

From regulatory obligation to competitive advantage

Artificial intelligence governance should not be viewed solely as a response to regulation. On this World Tourism Day, the conversation goes beyond adopting new technologies. Artificial intelligence is already part of the sector's present; the challenge now is to decide how we want to use it, how we supervise it, and for what purpose. 

Moving toward smart tourism means using technology as a means rather than an end, while building the mechanisms of transparency, accountability, and trust that the sector needs to continue growing responsibly.

World Tourism Day 2026 at the CETT Campus

On the occasion of World Tourism Day 2026, CETT is organizing the AI Tourism Lab-class: Redesigning Tourism with Artifical Intelligence, an activity that invites students to explore how AI can help address the current and future challenges facing tourism and contribute to the transformation of the sector. 

The activity brings together two complementary perspectives — tourism management and technological development — to imagine solutions in areas such as sustainability, coexistence, visitor flow management, the visitor experience, and the local economy. 

The activity will take place on September 29, from 10:30 a.m. to 1:30 p.m., at class B09. It will be open to all students and facilitated by professors Núria Guitart and Ainhoa Carballido.