From 30 October 2026, employers in the UK will face a tougher legal standard when it comes to preventing harassment at work. The Employment Rights Act 2025 will strengthen the existing preventative duty on sexual harassment and introduce a new obligation in relation to harassment by third parties, such as clients, customers, contractors, suppliers, service users and members of the public.
The focus is moving away from reacting to individual incidents and towards demonstrating a proactive, risk-based approach to prevention. In practice, employers will need to be able to show what they did, why those steps were appropriate, and whether there was anything further they could reasonably have done.
What is changing?
There are two headline changes employers should be preparing for.
The duty will increase from “reasonable steps” to “all reasonable steps”
Since October 2024, employers have been under a proactive duty to take reasonable steps to prevent sexual harassment of employees in the course of their employment. From 30 October 2026, that standard will increase to a duty to take all reasonable steps. This is a higher threshold. Employment Tribunals are likely to ask not only whether steps were taken, but whether there were any further steps the employer could reasonably have taken in the circumstances.
Employers will be liable for third-party harassment unless they can show prevention
From 30 October 2026, employers will also be liable where an employee is harassed by a third party in the course of their employment, unless the employer can show that it took all reasonable steps to prevent that harassment. This protection will apply to all forms of unlawful harassment, not just sexual harassment. This means employers will need to consider harassment risks arising not only from colleagues, but also from external people their employees interact with at work, including clients, customers, patients, service users, contractors, suppliers, visitors and members of the public.
What are “all reasonable steps” likely to involve?
The legislation does not yet provide a complete list of what will amount to “all reasonable steps”. Further regulations and guidance are expected. However, the direction of travel is clear: employers will need to treat harassment prevention as an ongoing compliance and culture issue, not as a one-off policy exercise.
In practical terms, this is likely to include:
- Risk assessments; identify where harassment could happen;
- Targeted policies: clear rules for staff, clients, third parties;
- Regular training: role specific and refreshed;
- Trusted reporting routes: clear escalation and early intervention;
- Active monitoring: culture checks, follow up, intervention carrying out harassment risk assessments which identify where risks are most likely to arise;
Third-party harassment: the major change
One of the most significant changes under the Employment Rights Act 2025 is the expansion of employer liability for third-party harassment. A third party is anyone who is not the employer or one of its employees, but who interacts with employees because of their work.
This could include a customer harassing a cashier, a client making inappropriate comments to a consultant, a patient or service user harassing a healthcare worker, or a contractor behaving unlawfully towards an employee on site.
The new duty is broad. It is not limited to sexual harassment, and it can cover unlawful harassment related to protected characteristics such as age, disability, race, religion or belief, sex and sexual orientation.
Third-party harassment: “three strikes”
From October 2026, employers will be liable for third-party harassment of their employees on the first instance, unless they can show they took all reasonable preventative steps. In short, if a single customer harasses a worker, the employer can be on the hook, even if it had no prior warning, provided it did not have adequate safeguards in place.
For employers, this means that third-party risk should be built into harassment prevention planning. Organisations should consider where employees are exposed to external people, the type of interactions involved, whether there have been previous issues, and what practical safeguards could reduce the risk.
Is your organisation ready?
With the new rules coming into force in October 2026, employers should use the time now to prepare. Key steps include:
- Audit existing policies and procedures: check whether harassment, sexual harassment, bullying, equal opportunities, grievance and whistleblowing policies reflect the current and upcoming law.
- Update training: move beyond generic annual training and consider targeted sessions for managers, HR teams and higher-risk roles.
- Strengthen reporting routes: ensure employees know how to raise concerns, including concerns about customers, clients or other third parties.
- Review contracts and external-facing documents: consider whether client, contractor, supplier or service-user arrangements should make expected standards of behaviour clear.
- Keep records: retain evidence of risk assessments, training attendance, policy rollouts, communications, complaints and steps taken in response.
- Monitor and review: revisit measures regularly and update them where risks change or incidents reveal gaps.
If an organisation’s approach is challenged by the Equality and Human Rights Commission or in the Employment Tribunal, the question will be: what can the employer show it did to prevent harassment?
Useful evidence may include up-to-date policies, policy rollout communications, training materials, attendance records, risk assessments, incident logs, investigation procedures, management briefings and records of action taken following concerns. In short, employers should build an audit trail that demonstrates prevention, not just response.
Key takeaway
Although the October 2026 reforms may appear to be a small change in wording, they are likely to make a real difference in practice. Employers will need to show that they have done everything reasonably possible to prevent harassment, including harassment by third parties.
If more could reasonably have been done, employers may find it harder to defend claims and could face increased compensation, enforcement action and wider reputational consequences.
Now is the time to review policies, assess risk, strengthen training and reporting routes, and keep clear records of the preventative steps taken. A proactive approach will reduce legal exposure and help create a safer, more respectful workplace culture.
The October 2026 changes raise the bar for employers. Policies and training will still matter, but they are unlikely to be enough on their own. Employers should be taking a tailored, risk-based and evidence-led approach now so that, if challenged, they can demonstrate that they took all reasonable steps to prevent harassment from occurring.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
