One word changes UK workplace law: employers must now take ‘all reasonable steps’ to stop sexual harassment
One word changed in British employment law on Friday, 30 October 2026, and it matters to every employer in Great Britain. Until that day, employers had to take “reasonable steps” to prevent sexual harassment of their workers. From 30 October, they must take “all reasonable steps”. It sounds like a small change. In an employment tribunal, it is not.
The same package also creates, for the first time, a direct claim against an employer when a customer, client, patient or other outsider harasses a member of staff and the employer failed to take all reasonable steps to prevent it.
The change is part of the Employment Rights Act 2025, which received Royal Assent on Thursday, 18 December 2025 and is being brought into force in stages through 2026 and 2027. The harassment measures apply to employers of every size and in every sector, and the duty is anticipatory: employers must act before anything happens, not only respond after a complaint.
At a glance
What happened: From Friday, 30 October 2026, employers in Great Britain must take “all reasonable steps” to prevent sexual harassment of their workers, up from “reasonable steps”, and they can be liable if a third party such as a customer or client harasses a worker and they failed to take all reasonable steps to prevent it.
Why it matters: The old standard let an employer argue it had taken some sensible precautions. The new standard asks whether there was any further reasonable step it could have taken and did not. If a sexual harassment claim succeeds and the employer breached the duty, a tribunal can increase compensation by up to 25%.
What happens next: The government has the power to set out in regulations exactly which steps count as reasonable, but those regulations are not expected until 2027 or 2028.
What changed on 30 October
The duty itself is not new. Since Saturday, 26 October 2024, section 40A of the Equality Act 2010 has required employers to take reasonable steps to prevent sexual harassment of their employees in the course of their employment. That duty was already anticipatory: employers had to think ahead and put measures in place before anything happened.
Sections 20 to 22 of the Employment Rights Act 2025 change that duty in three ways. First, section 20 adds a single word: “reasonable steps” becomes “all reasonable steps”. Second, section 21 creates the new third-party harassment liability. Third, section 22 gives ministers the power to make regulations specifying the evidence-based steps employers must take. That power came into force on 30 October, but the regulations themselves have not yet been made.
The change applies in England, Wales and Scotland. It does not generally extend to Northern Ireland, where equality law is devolved and separate legislation applies.
The EHRC can take enforcement action against an employer that fails to comply with the duty, and a worker cannot bring a free-standing tribunal claim for breach of the duty alone. But where an employee brings a successful sexual harassment claim, the tribunal must consider whether the employer complied, and if it did not, it can increase the compensation by up to 25%.
The third-party rule: customers, clients and patients
The third-party change is the part most employers had not planned for. Under the new law, an employer must not permit a third party to harass an employee: it is liable if a third party harasses a worker in the course of their employment and it failed to take all reasonable steps to prevent it.
A third party is anyone who is not the employer or an employee of the employer. That includes customers, clients, patients, service users, contractors, suppliers, members of the public, and people met at conferences or work events. It covers harassment in person and online.
Before 30 October, there was no stand-alone employer liability for harassment by a third party. The old duty was potentially wide enough to include steps against harassment by customers, and the EHRC’s guidance already referred to third-party harassment. But a worker could not, in general, hold the employer directly liable merely because a customer had harassed them. The new law changes that.
The third-party protection is also wider than sexual harassment. It covers harassment related to a relevant protected characteristic, and less favourable treatment of a worker because they rejected, or submitted to, sexual harassment or harassment related to sex or gender reassignment. The relevant characteristics include race, sex, disability, age, religion or belief, sexual orientation and gender reassignment. Hospitality, retail, healthcare, transport and contact centres carry the most exposure, because their staff deal with the public all day.
There are limits. The government’s factsheet says the steps an employer can reasonably take about third parties are clearly more limited than for its own employees, because an employer can discipline its own staff but cannot discipline a customer, and tribunals will take that into account. Employers are not expected to foresee the wholly unforeseeable, or to police customers’ private conversations.
What “all reasonable steps” actually means
The law does not give a fixed list of steps. What is reasonable depends on the employer’s size, sector, working environment, workforce, resources and risks. A large hospital and a five-person design studio will not be expected to take identical steps, but both must take every step that is reasonable for them.
Acas puts it plainly: before 30 October, employers might have chosen to take some reasonable steps. Now they are expected to take them all, with no exceptions, focusing on prevention across the whole organisation rather than only reacting to incidents. It covers online and in-person conduct alike.
The EHRC’s existing technical guidance and eight-step guide remain the main reference point while the new regulations are awaited, covering policy, staff engagement, risk assessment, reporting, training, complaint handling, third-party measures and monitoring. The EHRC is expected to update its guidance to reflect the October 2026 changes.
Acas gives two examples. In one, a worker faces an intimidating culture of “banter” and a harassing co-owner; the policy has not been reviewed for years and nothing is done about the culture. Acas says it is very unlikely that employer took all reasonable steps. In the other, a new starter is given the policy and mandatory training at induction and told how to report harassment. Acas says that employer is likely to have taken all reasonable steps.
Acas says sexual harassment can happen in any organisation and employers must not assume it will not happen in theirs. Higher-risk factors include meeting clients alone, alcohol at work, social events, power imbalances and work travel, including overnight stays. Younger workers, apprentices and interns, and people with learning difficulties, may be at higher risk.
What employers should do now
There is no single checklist in the law, but the advice from lawyers and from Acas converges on the same steps. First, review the risk assessment, make sure it covers third parties as well as colleagues, and record the steps taken and why they are proportionate. Second, update policies: the sexual harassment, bullying, grievance, disciplinary and whistleblowing policies should reflect the new duty and third-party liability, and cover work functions outside the office, such as conferences and Christmas parties, and online conduct.
Third, train people properly, not as a tick-box exercise. All staff should be trained to recognise sexual harassment and to know how to report it, managers need extra training on risk and complaints, and training should be refreshed and attendance recorded. Fourth, make reporting easy: more than one route, including one that does not go through the worker’s own manager, ideally anonymous.
Fifth, deal with third parties directly: tell customers and clients what behaviour is expected, display notices that harassment of staff will not be tolerated, back staff who end an interaction with an abusive customer, and review supplier contracts for respectful-conduct clauses. Sixth, keep records of everything: risk assessments, training attendance, actions taken, and reviews of whether the measures work. If a claim is made, the employer must prove it took all reasonable steps, and that is very hard to do from memory.
What it means if you are an employee
For workers, the change strengthens protection in two ways. First, the employer must now show it took every reasonable preventive step, not just some of them. Second, harassment by a customer, client or patient is now squarely the employer’s responsibility to prevent, where it can reasonably do so. That matters most for people in public-facing jobs: shop workers, bar and restaurant staff, hotel workers, care workers, nurses, receptionists, and delivery and transport staff.
A related protection already changed earlier in 2026. Since Monday, 6 April 2026, a disclosure that sexual harassment has occurred, is occurring or is likely to occur expressly qualifies as a protected disclosure for whistleblowing purposes, so a worker who reports it may benefit from whistleblowing protection, subject to the other requirements in the legislation, including the public interest test.
None of this means every unpleasant encounter at work is unlawful harassment: rude behaviour and trivial remarks do not necessarily meet the legal test.
The wider October package
The harassment changes did not arrive alone. The same tranche of the Act that took effect on 30 October also brought the third phase of the trade union reforms.
Independent trade unions gained a new statutory right to request access to workplaces, physical or virtual, to meet, support and communicate with workers, or to conduct collective bargaining, but not to organise industrial action. The right applies even where there is no existing union recognition, except for employers with fewer than 21 workers. Where no access agreement can be reached, the Central Arbitration Committee will decide. Employers must also give union representatives reasonable facilities and paid time off, and must not penalise workers for taking part in industrial action. The requirement for a statement of workers’ right to join a union was pushed back to 1 January 2027.
Why the timing worries lawyers
The striking feature of the 30 October changes is the gap between the new legal standard and the detailed guidance that is supposed to explain it. The power to make regulations specifying what counts as a reasonable step came into force on the same day as the duty itself, but the regulations are not expected until 2027 or 2028, after consultation. The stricter duty and the new third-party liability are therefore legally enforceable now, with no statutory list of what satisfies them. Lawyers expect the meaning of “all reasonable steps” to be tested in tribunal cases over the coming months and years.
Many employers were not ready. Acas research, reported in October, found that 41% of employers were unaware of the forthcoming strengthened duty. A separate survey by Worknest, reported by the law firm Gilson Gray, found that only 4% of employers had put measures in place to monitor and prevent workplace harassment. The Worknest figure is a survey result reported by a law firm, not an official statistic, but the two surveys point the same way: many employers approached the deadline without having reviewed their risk assessments, policies or training.
What is still to come
In September 2027, new provisions are expected to restrict the misuse of non-disclosure agreements in workplace harassment or discrimination cases. They will generally render void an agreement that stops a worker making allegations or disclosures about such harassment, with exceptions for agreements meeting conditions set out in regulations.
The biggest change in the whole Act arrives on Friday, 1 January 2027. From that date, employees will need only six months’ service, rather than two years, to claim unfair dismissal, and the cap on the compensatory award will be scrapped. The government had originally wanted protection from day one, but compromised on six months, so anyone hired from Wednesday, 1 July 2026 onwards qualifies.
Frequently asked questions
Does the new law apply to my workplace?
If you work in England, Wales or Scotland, yes. The duties apply to employers of every size, including small businesses, though what counts as reasonable reflects the organisation’s size and resources. Northern Ireland has separate law.
What is the difference between “reasonable steps” and “all reasonable steps”?
Under the old standard, an employer could argue it had taken reasonable steps even if it had only taken some sensible precautions. Under the new standard, it must show it took every step that was reasonable for it.
Can my employer be liable if a customer harasses me?
From 30 October 2026, yes, if it happened in the course of your employment and your employer failed to take all reasonable steps to prevent it. This covers sexual harassment and harassment related to a relevant protected characteristic.
Does my employer have to stop every incident?
No. The duty is to take all reasonable steps to prevent harassment, not to guarantee it never happens.
What should I do if I am harassed at work?
Report it through your employer’s reporting route, if you can to someone other than your own manager, or anonymously if that is available. Keep a record of what happened, when and where, and who was present.
What happens if an employer fails to take all reasonable steps?
The EHRC can take enforcement action, and there is no free-standing tribunal claim for breach of the duty alone. But if an employee brings a successful sexual harassment claim and the tribunal finds the employer breached the duty, it can increase the compensation by up to 25%.
When will the government say exactly which steps are required?
Ministers have the power, in force since 30 October 2026, to make regulations specifying the steps employers must take. Those regulations are not expected until 2027 or 2028, after consultation. Until then, employers should rely on EHRC and Acas guidance.
Conclusion
A single word rarely changes the law. This one does, because it changes the question a tribunal will ask: not whether an employer took reasonable steps, but whether there was any further reasonable step it could have taken and did not. That cannot be answered with a policy written years ago and never reviewed.
The third-party rule makes the change concrete for the millions of people whose jobs involve dealing with the public. Employers cannot discipline a customer, but they can set expectations, train staff, and give workers a way to end an abusive interaction.
The guidance that would make all of this precise has not arrived yet, and will not arrive until 2027 or 2028. The sensible response is the same on both sides: assess the real risks, write them down, take the steps that are reasonable, and keep the evidence.
This article is for general information and education only. It is not legal or financial advice.
Sources
- https://www.acas.org.uk/sexual-harassment/steps-for-employers-to-prevent-sexual-harassment (Acas, accessed 1 November 2026)
- https://www.personneltoday.com/hr/employment-law-changes-october-2026/ (Personnel Today, 30 October 2026)
- https://gilsongray.co.uk/blog/new-sexual-harassment-laws-and-what-they-mean-for-employers/ (Gilson Gray, 30 October 2026)
- https://www.eversheds-sutherland.com/en/south-africa/insights/the-uk-employment-rights-bill-significant-new-employer-harassment-duties (Eversheds Sutherland, accessed 1 November 2026)
- https://www.birketts.co.uk/legal-update/employment-rights-act-2025-five-key-changes-for-employers-in-october-2026/ (Birketts, 23 October 2026)
- https://www.penningtonslaw.com/insights/preventing-harassment-are-you-prepared-for-the-new-duties/ (Penningtons Manches Cooper, 27 October 2026)
