Short answer: From 30 October 2026, employers must take “all reasonable steps” to prevent sexual harassment of their employees, up from “reasonable steps” today. Employers will also be liable where a third party, such as a customer or client, harasses an employee in the course of their employment and the employer failed to take all reasonable steps to prevent it. A written risk assessment and action plan is the sensible starting point.
The legal duty to prevent sexual harassment is not new. Since October 2024, employers have had to take reasonable steps. What changes on 30 October 2026 is the standard, and the reach. The bar is raised from “reasonable steps” to “all reasonable steps”, and employers become responsible for harassment of their staff by third parties unless they can show they took all reasonable steps to prevent it.
The Employment Rights Act 2025 makes two changes to the Equality Act 2010. Section 20 inserts the word “all” into section 40A, so the duty to prevent sexual harassment of employees becomes a duty to take “all reasonable steps”. Section 21 adds a new rule that an employer must not permit a third party to harass an employee. An employer permits it only if the third party harasses the employee in the course of their employment and the employer failed to take all reasonable steps to prevent it. “Third party” means anyone other than the employer or its employees, so it can include customers, clients, contractors, patients, service users and visitors.
Both changes take effect on 30 October 2026 under the Employment Rights Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, made on 1 October 2026. Section 22 also gives a minister a power to specify in later regulations the steps employers must take or that count as reasonable. Those regulations are not expected until 2027, so for now the tribunal will judge what is reasonable on the facts.
The two changes have different reach. The “all reasonable steps” prevention duty concerns sexual harassment. The third-party rule is wider: it is not limited to sexual harassment, and it applies to the forms of harassment covered by the Equality Act, which means harassment related to a protected characteristic as well as sexual harassment. The Government’s guidance notes that pregnancy and maternity, and marriage and civil partnership, are not relevant characteristics for harassment under the Act.
The law does not give a fixed checklist, and the later regulations are still to come. The Equality and Human Rights Commission technical guidance already explains what the current reasonable steps duty looks like. It is the best guide to what a tribunal will expect, and the higher standard will only push expectations up. It says an employer is unlikely to comply without a risk assessment, and it sets out steps including:
What is reasonable depends on size, resources, sector, the working environment and how much contact staff have with third parties. A step can be reasonable even if it would not have prevented a particular incident.
The EHRC guidance lists risk factors that matter in practice:
Care homes, hospitality, retail, security, domestic services and any business with a customer-facing front line should treat third-party harassment as a live risk now, not after 30 October.
1. Run the risk assessment. Cover sexual harassment and third-party harassment of every kind. Walk through each role and location. Ask who deals with the public, who works alone, who works late, where alcohol is involved and where power imbalances are greatest. Ask staff, not just managers.
2. Write the action plan. Convert findings into specific actions, an owner and a date. A plan that sits in a drawer does not help.
3. Update the policy. It should cover sexual harassment by colleagues, managers and third parties, say how to report, say what happens next, and confirm that complaining will not lead to detriment.
4. Create a third-party route. Tell customers and clients what behaviour is unacceptable. Give staff clear authority to leave an encounter, end a call or ask a manager to step in. Decide in advance how repeat offenders will be dealt with, including refusing service where that is possible.
5. Train managers properly. They need to recognise harassment, take a complaint seriously, avoid promising confidentiality they cannot keep and know when to escalate. Training should be recorded.
6. Prepare for complaints. Decide who investigates, how interim protections work and how you will keep the person who complained safe from reprisals.
7. Record everything. The all reasonable steps defence is about evidence. Keep the assessment, the plan, training attendance, policy acknowledgements and complaint outcomes.
Want a tested approach? Our harassment prevention audit combines the risk assessment, control testing, evidence capture and a prioritised action plan. [Book a harassment prevention review]
Where an employer is found to have breached the duty and a harassment claim succeeds, the tribunal can increase compensation by up to 25%. The EHRC can also enforce the duty directly. Harassment claims have no cap on compensation, and awards can include injury to feelings. Since 6 April 2026, a disclosure about sexual harassment is also a protected whistleblowing disclosure, so workers who raise concerns are protected from detriment and dismissal.
What is the new sexual harassment law for employers? From 30 October 2026, employers must take all reasonable steps to prevent sexual harassment of their employees, replacing the current requirement of reasonable steps. Employers will also be responsible for harassment of their employees by third parties, such as customers, unless they took all reasonable steps to prevent it.
Are employers liable for harassment by customers? From 30 October 2026, yes, where a customer harasses an employee in the course of their employment and the employer failed to take all reasonable steps to prevent it. That applies to sexual harassment and to harassment related to a protected characteristic.
Do small businesses have to comply? Yes. There is no exemption for small employers. What counts as reasonable depends on size and resources, so a small business may need simpler steps than a large one, but it still needs to assess the risk and act.
Is a harassment policy enough? No. A policy alone will not usually satisfy the duty. Tribunals will look for risk assessment, an action plan, training, accessible reporting and evidence that the steps work in practice.
What is the penalty for failing to prevent sexual harassment? Compensation in a successful harassment claim can be uplifted by up to 25% where the duty was breached, and the EHRC can take enforcement action. Awards are uncapped.
We help employers build harassment prevention into day-to-day management, with risk assessments, policies, manager training and complaint handling on a fixed monthly fee. Get a quote or Speak to one of our experts.
Reviewed 8 October 2026. This article is general guidance and not legal advice.