From 30 October 2026, employers must take all reasonable steps, not just reasonable steps, to prevent sexual harassment of their employees. From the same day you are liable if a customer, client or contractor harasses an employee and you did not take all reasonable steps to prevent it. A policy alone will not do. You need a risk assessment, real reporting routes, training, a working complaints process and the evidence to prove it.
On 30 October 2026 the duty to prevent sexual harassment at work gets a lot harder to meet. One word does it. “Reasonable steps” becomes “all reasonable steps”. On the same day, you become directly liable when a customer, client or contractor harasses one of your people and you could have done more to stop it.
Most employers I speak to have a policy. Far fewer could show a tribunal what else they did. That gap is what this change is about.
What the law says now
Since 26 October 2024, section 40A of the Equality Act 2010 has required employers to take reasonable steps to prevent sexual harassment of their employees in the course of their employment. It came in through the Worker Protection Act 2023. It already covers harassment by third parties as well as by colleagues.
There is no standalone claim for breaching it. The Equality and Human Rights Commission can take enforcement action. And if a tribunal upholds a sexual harassment claim and finds you breached the duty, it can increase the compensation by up to 25% (section 124A).
What changes on 30 October 2026
Three sections of the Employment Rights Act 2025 come into force that day, under the Commencement No. 6 Regulations (SI 2026/1065).
- Section 20: section 40A now requires all reasonable steps. Doing some sensible things is no longer enough if there were other reasonable steps you did not take.
- Section 21: a new section 40(1A) to (1C) of the Equality Act. You must not permit a third party to harass your employee. You are treated as permitting it if the harassment happens in the course of their employment and you failed to take all reasonable steps to prevent it. A third party is anyone who is not you or one of your employees. This covers sexual harassment and harassment related to age, disability, gender reassignment, race, religion or belief, sex and sexual orientation. More on third-party harassment.
- Section 22: a power for the government to set out in regulations which steps count as reasonable, such as risk assessments, policies, reporting and complaint handling. No regulations have been made yet.
Two earlier changes sit alongside this. Since 6 April 2026, reporting sexual harassment can be a protected disclosure under the Employment Rights Act 1996, s.43B(1)(da), so people who speak up are protected from detriment. And for acts on or after 1 October 2026, most discrimination and harassment claims can be brought up to six months after the act complained of, not three.
What “all reasonable steps” means in practice
The question a tribunal will ask is simple and uncomfortable. Was there anything else you could reasonably have done? If the answer is yes, you have not met the duty.
Reasonable still depends on your size, your sector and your risks. A 40-person office and a 4,000-person retailer will not be judged the same way. But a policy on the intranet and a training video nobody watched will not get anyone over the line.
The checklist
Ten things to have in place, and be able to prove, by 30 October.
- A written risk assessment. Where could harassment happen? Think about lone working, late shifts, client sites, events, alcohol, power imbalances and customer-facing roles. Include third parties.
- A policy that says what it means. Name sexual harassment and third-party harassment, give examples, and say what will happen.
- More than one way to report. At least one route outside the line manager. Consider an anonymous option.
- Training that fits the risk. Everyone gets the basics. Managers get more, including how to respond to a report. Record who did what and when.
- A complaints process that works. Respond quickly, investigate properly, support the person who reported it and protect them from victimisation.
- Rules for third parties. Tell clients and contractors what you expect. Use signage where it helps. Be ready to warn, refuse service, bar someone or end a contract.
- Leaders who own it. A named senior owner, a regular report to the board, and decisions minuted.
- An action plan with dates. What you found in the risk assessment, what you are doing about it, and by when.
- Evidence you can hand over. Risk assessments, training logs, complaint records and review notes, kept together.
- A review cycle. After every incident, and at least once a year. Do not use confidentiality clauses to keep complaints quiet.
The EHRC’s technical guidance on sexual harassment and its eight-step guide for employers were last updated in September 2024, before these changes. Check the EHRC website for newer versions. Until then, they are still the best benchmark of what a tribunal will expect.
Where to start this week
Do the risk assessment first. Everything else follows from it. Then check your reporting routes and your third-party contracts, because that is where the new liability bites.
If harassment has already been reported, deal with it properly now. A well-run independent investigation is one of the strongest pieces of evidence you can have. The workplace investigation templates help if you are running it yourself.
The Harassment Prevention Pack gives you 15 documents and a training deck built on the EHRC eight steps: a reasonable steps risk assessment, a third-party risk assessment, a policy, a reporting framework, training records, an action plan and a board assurance report. From £149 + VAT.
This article reflects the law in Great Britain (England, Wales and Scotland) as checked on legislation.gov.uk on 20 October 2026. It is general guidance, not legal advice.