The Duty to Prevent Sexual Harassment Just Got Stronger: What Employers Need to Know

If your business has customers, clients, patients, service-users, or visitors on site — not just employees — this change matters to you directly. From 30 October 2026, the legal bar for preventing sexual harassment at work rises, and for the first time in over a decade, employers can be held liable for harassment carried out by people who don’t even work for them.

This guide explains what’s changing, in plain English, with no assumed knowledge.

A quick explainer of the terms you’ll see

• Sexual harassment — unwanted conduct of a sexual nature that violates someone’s dignity or creates an intimidating, hostile, degrading, humiliating or offensive environment for them.
• The anticipatory duty — a legal duty that requires employers to act before harassment happens, not just respond after a complaint is made.
• Third party — anyone who isn’t the employer or one of its own employees. This includes customers, clients, patients, service-users, contractors, suppliers, and visitors.
• EHRC — the Equality and Human Rights Commission, the public body responsible for enforcing equality law and issuing guidance on this duty.
• Employment Rights Act 2025 — the new UK law behind this change, which we’ve covered in previous articles. It became law on 18 December 2025, with individual provisions (like this one) commencing on separate dates.

The current position

Since 26 October 2024, employers have already been under a proactive duty to take reasonable steps to prevent sexual harassment of their employees. This was a meaningful shift at the time — it meant employers had to anticipate and plan for the risk, not just deal with complaints after the fact. The EHRC’s guidance already expects employers to:

• assess where the risk of sexual harassment might arise in their workplace,
• put preventative measures and clear policies in place,
• provide practical reporting routes,
• deliver up-to-date, properly recorded staff training, and
• take complaints seriously and act on them promptly.

What’s changing on 30 October 2026

1. “Reasonable steps” becomes “all reasonable steps”

This is a small change in wording with a real change in substance. Employers will now need to show they’ve taken every reasonably available preventative step, not just some of them. In practice, this raises the standard from “have we done a reasonable amount” to “is there anything else reasonable we could have done and didn’t.”

There’s no fixed checklist yet — the government has indicated that regulations may eventually set out what qualifies, but these aren’t expected before 2027, after this change already takes effect. That means employers will be working from EHRC guidance and their own risk assessment for some time, with more legal clarity still to come.

There’s no standalone claim just for failing this duty on its own. But if a sexual harassment claim succeeds and a tribunal finds the employer also failed the “all reasonable steps” duty, compensation can be increased by up to 25%.

2. A new duty covering third-party harassment

This is the bigger practical shift for many businesses. From the same date, employers become liable if an employee is harassed by a third party — a customer, client, patient, service-user, contractor, supplier or visitor — where the employer failed to take all reasonable steps to prevent it.

Key details:

• This isn’t limited to sexual harassment — it covers all forms of unlawful harassment relating to a protected characteristic (for example, race, disability, sex, or sexual orientation).
• A single incident is enough. The old pre-2013 version of this protection needed a pattern of at least two previous incidents before it applied. That requirement is gone — one incident can be sufficient.
• Employers are likely to run into difficulty if there was even one reasonable preventative step available that they simply didn’t take.

Why this matters especially for client-facing and care sectors

If your business regularly puts staff in contact with the public — service-users, patients, tenants, customers, or visitors — this duty is directly relevant, not theoretical. Sectors like care, social housing, and any client-facing manufacturing or engineering role (site visits, service calls, front-of-house contact) should treat this as a real operational risk to plan for, not just a policy update.

What employers should do now

1. Carry out (or refresh) a harassment risk assessment. Identify where risk is highest — lone working, night shifts, service-user contact, customer-facing roles — and document what you find.
2. Review your policies specifically for third-party harassment. Many existing anti-harassment policies focus only on staff-to-staff conduct. Make sure yours addresses harassment by customers, clients, patients, and visitors too.
3. Strengthen your reporting routes. Staff need a clear, safe, and genuinely accessible way to report harassment from anyone — not just colleagues.
4. Invest in real training, not a one-off module. A single e-learning session ticked off years ago won’t hold up under an “all reasonable steps” standard. Training should be regular, relevant to the actual risks in your workplace, and properly recorded.
5. Document everything. Because there’s no fixed checklist yet, the strength of your position rests on evidence: what you assessed, what you put in place, and when. Keep clear, dated records.
6. Take every report seriously and act promptly. How you respond to a single incident may itself become evidence of whether you’ve met the duty.

How Cheviot HR can help

Meeting an “all reasonable steps” standard is about demonstrable, ongoing prevention — not a single policy update. We can carry out a harassment risk assessment for your workplace, review and strengthen your policies to cover third-party harassment, and help you put training and reporting routes in place that will hold up to scrutiny.

Get in touch at heidi@cheviothr.co.uk or visit https://cheviothr.co.uk to talk through what this means for your business.