Employment law rarely turns on a single word. On 30 October 2026 it does. Since October 2024, employers have been under a duty to take reasonable steps to prevent sexual harassment of their workers. From 30 October, under the Employment Rights Act 2025, that becomes a duty to take all reasonable steps. One word, and a materially higher bar: an employer that took some sensible measures could previously argue reasonableness, whereas the new standard invites a tribunal to ask which reasonable step you did not take, and why. Alongside it arrives something employers have not faced in over a decade: liability for harassment of staff by third parties, including customers, clients, patients and contractors.
With around five weeks to commencement, this is now an operational deadline rather than a horizon issue. This guide sets out what is already in force, exactly what changes on 30 October, what “all reasonable steps” is likely to mean in practice, and the preparation that matters most, with training and its evidence at the centre, because that is where tribunals and regulators will look first.
What is already law
The baseline has been in place since 26 October 2024. The Worker Protection (Amendment of Equality Act 2010) Act 2023 introduced the preventative duty: employers must take reasonable steps to prevent sexual harassment of their workers, with the Equality and Human Rights Commission’s technical guidance setting expectations around risk assessments, policies, reporting channels and training. The duty has teeth through the compensation route: where a sexual harassment claim succeeds and the employer has breached the preventative duty, the tribunal can uplift compensation by up to 25%.
A further change already landed this year with less attention than it deserves: since 6 April 2026, a report of sexual harassment automatically counts as a protected disclosure for whistleblowing purposes. Workers who raise sexual harassment concerns are protected from detriment and dismissal for doing so, which means every internal report now carries whistleblowing risk if it is handled badly. Employers who have not briefed managers on that change are already behind, before October arrives.
What changes on 30 October 2026
Two things, and both are significant.
First, the standard rises. The duty to take reasonable steps to prevent sexual harassment becomes a duty to take all reasonable steps. There is no exhaustive statutory list of what those steps are; the Government has the power to specify steps in regulations, but these are not expected until 2027 or 2028, so in the meantime the EHRC’s technical guidance remains the practical benchmark. The test stays objective and proportionate to the employer’s size, resources, sector and risk profile, but the word “all” removes the comfort of partial effort. If a step was reasonable for an organisation of your size and risk, and you did not take it, the new duty is not met.
Second, third-party harassment liability returns, and broader than before. Employers must not permit a third party to harass their employees. An employer is treated as permitting it where the harassment occurs in the course of employment and the employer failed to take all reasonable steps to prevent it. Two features deserve emphasis: a single incident is enough, with no requirement for previous occasions, and the third-party duty covers harassment related to protected characteristics generally, not only sexual harassment. Staff facing abuse from customers, service users, patients, pupils’ parents or contractors are the population this duty exists for, and employees will be able to bring claims where the employer failed in it.
Who feels the third-party duty most
Every employer has third parties somewhere, but exposure concentrates where staff serve the public or work inside other organisations’ premises. Hospitality, retail and leisure sit at the sharp end, with front-of-house teams facing customers nightly; the operational realities are ones we cover in depth across our hospitality, catering and leisure work. Healthcare and social care staff deal with patients and families in distress. Facilities, cleaning and security teams work inside client buildings among people their employer does not control. Transport staff, housing officers and public-facing council teams all carry similar profiles. For these sectors, October’s question is concrete: what have you actually done to prevent a customer harassing your bar staff, and can you show it?
What “all reasonable steps” looks like in practice
Pulling together the EHRC guidance and the direction of the legislation, a defensible programme has a consistent shape:
- A current, harassment-specific risk assessment, reviewed for the new duty, identifying where risks arise in your operation, including third-party contact points, lone working, events and alcohol, and power imbalances.
- A standalone anti-harassment policy that names third-party harassment, states consequences, and is genuinely communicated rather than filed.
- Working reporting channels, ideally more than one route, with the whistleblowing implications of the April change reflected in how reports are triaged and how reporters are protected.
- Training for everyone, plus a distinct manager layer, covering what harassment and sexual harassment are, the standards expected, how to report, and for managers how to receive a report, act on third-party incidents and avoid victimisation.
- Visible third-party measures such as customer conduct statements, contract clauses with clients and contractors, and empowering staff to withdraw service.
- Records of all of it, because a step you cannot evidence is a step a tribunal may treat as not taken. The sixth item is the one that decides cases. The legal commentary around these reforms has converged on a single phrase: the shift is from compliance to evidence. It will rarely be enough to say training happened; the question is who completed it, when, what it covered, whether it was understood, and whether it was refreshed.
Training: the step tribunals always examine
Within the “all reasonable steps” framework, training is the step with the clearest jurisprudential history: case law under the old regime repeatedly found that stale, tick-box or unevidenced training did not amount to reasonable steps, and the higher standard will only sharpen that scrutiny. A programme that stands up in October looks like this: harassment and sexual harassment prevention training deployed to every worker, with completion assessed rather than assumed; a separate manager module covering complaint handling, third-party incidents and the new whistleblowing status of reports; refresher cycles automated so training is demonstrably current rather than a one-off from 2024; content that reflects your actual risk assessment, so a pub group’s module addresses intoxicated customers and a care provider’s addresses patients and families; delivery that reaches night shifts, deskless teams and non-native speakers, in 100+ languages where needed; and a timestamped completion record for any individual, exportable the day a grievance, claim or EHRC enquiry arrives.
That is precisely the job a modern workplace training platform does: ready-made, accredited harassment prevention courses deployable to the whole workforce in days, an AI course builder that turns your own policy and risk assessment into organisation-specific modules in minutes, automated refresher cycles with alerts before anything lapses, and evidence exportable in under a minute. For HR and people teams carrying this alongside everything else the Employment Rights Act is bringing, our HR services work covers the wider picture of turning legislation into deployed, evidenced training at the pace commencement dates demand.
Five weeks: a realistic order of work
If preparation is starting now, sequence it: review and update the risk assessment for the strengthened and third-party duties this week; refresh the policy and communicate it; deploy all-staff training immediately, since digital rollout with completion tracking fits comfortably inside the window; run the manager layer, including the April whistleblowing change; put visible third-party measures in place at customer-facing points; and confirm you can produce completion evidence on demand. None of this is wasted effort even where details await future regulations, because everything above sits squarely inside the EHRC’s existing expectations, and the organisations that evidence it will meet whatever the regulations eventually specify from a standing start.
The duty changes on 30 October whether employers are ready or not. If you would like your harassment training deployed, assessed and evidenced before then, book a demo and we will show you the rollout against your own policy, live.
Frequently asked questions
What changes on 30 October 2026? Under the Employment Rights Act 2025, the duty to prevent sexual harassment rises from taking “reasonable steps” to taking “all reasonable steps”, and a new duty prevents employers from permitting third-party harassment of their employees, covering customers, clients, patients, contractors and other third parties.
What is the difference between “reasonable steps” and “all reasonable steps”? The current duty can be satisfied by a proportionate selection of sensible measures. The new duty expects every step that would be reasonable for an employer of your size, resources and risk profile, so a tribunal can ask which reasonable step was missed. The test remains objective, with the EHRC’s technical guidance as the practical benchmark until Government regulations specify steps, which are not expected before 2027.
Does third-party harassment need repeated incidents before liability arises? No. A single incident can be enough where it occurs in the course of employment and the employer failed to take all reasonable steps to prevent it, and the third-party duty covers harassment related to protected characteristics generally, not only sexual harassment.
Is harassment training legally required? Training is one of the core preventative steps the EHRC guidance expects, and tribunals have repeatedly treated stale or unevidenced training as failing the reasonable steps test. Under the higher standard, deployed, assessed, regularly refreshed and evidenced training for all staff, with a distinct manager module, is effectively the foundation of a defensible position.
What evidence should employers keep? The risk assessment and its reviews, the policy and proof of communication, training completion records per named individual with dates and refresher cycles, records of third-party measures, and documentation of how reports were handled. The reforms shift the question from whether you complied to whether you can prove it.
What about the whistleblowing change in April 2026? Since 6 April 2026, reporting sexual harassment automatically qualifies as a protected disclosure, so reporters are protected from detriment and dismissal. Managers need to understand this when receiving reports, because mishandling a report now carries whistleblowing risk alongside discrimination risk.
