Having an anti-harassment policy is no longer enough. From 30 October 2026, employers must show they have done everything reasonably practicable to prevent sexual harassment – including harassment from customers and clients.
This is not just a tweak to existing rules. The Employment Rights Act 2025 raises the bar significantly from the “reasonable steps” duty introduced in October 2024. Under the new rules, employers must take “all reasonable steps” to prevent sexual harassment and must not permit third-party harassment of their employees.
If a claim or investigation arises, the question will not be “Did you have a policy?” It will be “What did you actually do, and can you prove it?” This article explains what is changing, what tribunals will look for, and how to prepare your business before the deadline.
What is actually changing on 30 October 2026?
The changes come from the Employment Rights Act 2025 and build on protections introduced by the Worker Protection Act 2023. There are three key shifts employers need to understand:
1. “All reasonable steps” to prevent sexual harassment
Employers must now take all of the steps that are reasonable for their organisation to prevent sexual harassment of employees. This is a higher standard than simply taking “reasonable steps”.
2. A new duty not to permit third-party harassment
Employers will be obliged not to permit harassment of their employees by third parties – including customers, clients, contractors, suppliers and members of the public.
3. Broader scope of harassment covered
The third-party harassment duty covers all types of harassment under the Equality Act 2010, including sexual harassment and harassment related to protected characteristics. The only exceptions are pregnancy and maternity, and marriage and civil partnership.
These measures apply across England, Wales and Scotland, but not Northern Ireland where equality and discrimination law is devolved.
The practical shift is significant. Tribunals and regulators will ask: “Did the employer do everything reasonably practicable?” – not simply “Did they do something?”
From “reasonable” to “all reasonable”: What tribunals will look for
The difference between “reasonable steps” and “all reasonable steps” matters.
Under the previous test, tribunals asked whether the employer took steps that a reasonable employer might take. Under the new test, they will ask whether the employer took every step that was reasonably practicable in the circumstances.
What does “reasonably practicable” mean? Tribunals will consider factors such as:
- Size and resources of the employer
- Nature of the work and level of third-party contact
- Previous incidents or known risks in the organisation or sector
- Whether measures were actually implemented and followed, not just written down
A policy sitting in a shared drive that no one has read will not cut it. Training that happened once three years ago will look weak. Tribunals will want to see a system of ongoing prevention – not a document filed and forgotten.
The key message: It is about building a system, not just having a document.
What “all reasonable steps” can look like in practice
So what does this actually mean day to day? Here are the building blocks of a credible approach.
Policies and procedures
Your anti-harassment and dignity-at-work policy needs to be clear, up to date and explicitly cover third-party harassment. It should:
- Set out examples of unacceptable behaviour by colleagues and third parties
- Explain how employees can report concerns
- Describe what happens after a report is made
- Be communicated to all staff, not just included in the handbook
Training and culture
Training should be regular and role-specific:
- All staff need to understand what harassment is, how to report it, and what support is available
- Managers need additional training on how to spot issues, handle disclosures appropriately, and escalate third-party incidents
Use realistic scenarios, especially for customer-facing roles. Think about the kinds of situations your staff actually face – inappropriate comments from clients, unwanted contact at events, persistent behaviour from regulars.
Reinforce that reporting is safe and that retaliation will not be tolerated.
Reporting routes and support
Make it easy for employees to report concerns:
- Offer multiple routes – line manager, HR, or an anonymous option
- Have a clear process for third-party incidents: who to tell, what information to capture, when to remove an employee from a situation
- Provide access to support such as an Employee Assistance Programme, counselling or occupational health
Risk assessment and practical controls
Identify roles and locations with higher risk of third-party harassment. Think about:
- Late shifts or lone working
- Client sites, hospitality venues, or care settings
- Events, conferences or off-site meetings
Practical controls might include:
- Chaperoning or buddy systems for high-risk visits
- Clear “right to refuse service” or “right to end meeting” protocols
- Client codes of conduct and contract terms covering behaviour expectations
- Adjusting rotas or locations after repeated incidents
The point is to show a range of measures that together form a coherent approach – not just one or two token efforts.
Sector-specific examples: What this means in real workplaces
The duty applies wherever employees interact with third parties, but the measures will look different depending on your sector.
Hospitality
Customers making sexual comments to bar or restaurant staff is a known risk. Empower staff to stop service or call for manager backup. Keep incident logs and make clear that management will support them.
Retail
Inappropriate behaviour from shoppers towards cashiers or floor staff happens regularly. Have a clear escalation route to security or police, consider signage about acceptable behaviour, and train staff on de-escalation.
Care and health
Harassment by service users or family members towards care workers is common but often unreported. Conduct risk assessments for home visits, consider pairing workers for higher-risk situations, and ensure clear reporting and support routes.
Professional services
Harassment by clients at meetings, dinners or off-site events can be harder to address. Use pre-event briefings, designate a named contact for concerns, and give staff clear “opt-out” options if they feel uncomfortable.
How to document your approach so you can evidence compliance
If you cannot show what you did, a tribunal may assume it did not happen. Documentation does not need to be perfect, but it should show consistent, ongoing effort.
Keep records of:
- Policy versions and dates of updates – showing when you added third-party harassment and “all reasonable steps” language
- Training attendance, content and frequency – including manager-specific training
- Risk assessments for roles and locations, and any actions taken as a result
- Incident reports, investigations and outcomes – including third-party cases
- Communications to staff – reminders, campaign materials, intranet posts, team briefings
Consider creating a simple “harassment prevention file” – physical or digital – that pulls all of this together. It makes it much easier to demonstrate your approach if you ever need to.
Common pitfalls to avoid
Based on typical employer mistakes, here are some traps to watch out for:
- Having a policy but never updating it to reflect the new duties
- Running one-off training years ago and assuming you are covered
- Ignoring third-party behaviour because “they’re just clients” or “it’s part of the job”
- Failing to record incidents properly or at all
- Not supporting employees who report, or allowing a culture where complaints are discouraged or dismissed
Tribunals will look at what you actually did over time – not what you intended to do or planned to get around to.
What to do before 30 October 2026
Here is a simple checklist to help you prepare:
- Review and update your anti-harassment policy to include third-party harassment and “all reasonable steps” language
- Map your training plan: who has been trained, who still needs it, and when refreshers are due
- Identify high-risk roles and areas and put practical controls in place
- Check your reporting routes and make sure staff know how to raise concerns
- Start keeping an evidence file of policies, training records, risk assessments and incident reports
If you are unsure where to start, speak to your HR adviser or employment law specialist to prioritise the actions that matter most for your business.
Quick checklist: Are you ready for 30 October?
✅ Policy updated to cover third-party harassment
✅ “All reasonable steps” language included
✅ Training delivered to all staff and managers
✅ Risk assessment completed for high-risk roles
✅ Reporting routes communicated to employees
✅ Evidence file started and maintained
Three questions a tribunal might ask
If a claim is brought, be prepared to answer:
- “What training did managers receive on handling harassment complaints?”
- “How do you handle harassment from customers or clients?”
- “What changed after your last incident?”
If you cannot answer these clearly and with evidence, you may struggle to show you took “all reasonable steps”.
This article is for general information only and does not constitute legal advice. If you need specific guidance on your situation, please contact us or speak to an employment law specialist.
