If a customer harasses one of your staff, is that your problem? From 30 October 2026, the answer is a clear yes – and a lot of UK employers haven’t yet caught up with what that actually means.
The Employment Rights Act 2025 tightens the existing duty to prevent sexual harassment from “reasonable steps” to “all reasonable steps.” At the same time, it brings back something that was scrapped back in 2013: employer liability when employees are harassed by third parties – customers, clients, contractors or members of the public. That’s a significant shift for employers who have spent the past decade focusing their harassment policies largely on what happens between colleagues, and the deadline is just a few months away.
There are actually two changes here. The strengthened preventative duty relates specifically to sexual harassment. The new third-party protection is wider, covering harassment under the Equality Act more broadly.
So let’s break down what’s changing, why the third-party piece catches so many employers out, and what you can do about it before the new requirements take effect.
What’s actually changing from 30 October 2026?
Two things are happening at once, and it’s easy to blur them together.
The bar for preventing sexual harassment is going up. Employers already have to take reasonable steps to prevent sexual harassment at work. From 30 October 2026, that becomes “all reasonable steps” – a stricter test, and one that’s tied directly to the legal defence employers rely on if a harassment claim is brought against them (Brodies LLP).
Third-party harassment becomes your responsibility. This is the bigger shift for most organisations. Employers can be liable if a customer, client, contractor or member of the public harasses a member of staff in the course of their employment and the employer failed to take all reasonable steps to prevent it. This applies even if there’s been no previous incident and no prior complaint (Shoosmiths). If your teams deal with the public, service users, contractors or clients (which most businesses will) this is worth sitting up for.
Why this catches so many employers out
For years, harassment policies and training have mostly looked inward: colleague to colleague, manager to report. That’s still essential. But it’s only ever covered half the picture.
Think about who your people actually deal with day to day. Care staff with service users and families. Teachers and support staff with parents, visitors and pupils. Site teams with contractors and members of the public. Retail and hospitality staff with customers. None of that is covered by a policy that only mentions “colleagues”.
And the internal picture isn’t reassuring enough to assume the external one is under control. Unite’s 2025 survey of over 6,600 women found that 75% of those who’d experienced harassment at work never reported it, and only 26% felt their employer actively promoted a zero-tolerance culture. If that’s the state of reporting for harassment between colleagues – where policies, HR teams and reporting lines already exist – it’s probably a fair bet that harassment from someone outside the business is even less visible, and that organisations are even less prepared for it.
The data backs that up. WorkNest’s survey, reported by People Management, found that 41% of employers had no sexual harassment risk assessment in place at all, and 34% hadn’t run any harassment training since the existing duty began. It’s not a fringe concern either: enquiries to the Acas helpline about workplace harassment climbed 39% in the first six months of 2025, taking the total to 5,583 calls. People are asking more questions. But not enough organisations have answers ready yet.
A good reason to look at the bigger picture
Sexual harassment may be driving the October deadline, but it shouldn’t be the only thing on your review list. The new third-party provisions are wider, covering harassment related to age, disability, gender reassignment, race, religion or belief, sex and sexual orientation.
For HR and L&D teams, that makes this a useful moment to look at your wider discrimination and harassment training too. Does it reflect the situations your people actually encounter at work? Would employees recognise inappropriate behaviour if it came from a customer rather than a colleague? And would they know what to do next?
You don’t necessarily need to start again. But if you’re reviewing your sexual harassment arrangements ahead of 30 October anyway, it makes sense to check whether the rest of your discrimination and harassment training is keeping pace too.
A free place to start
We know two months isn’t long when you’re already juggling a full L&D calendar. So if you’re not already a client, we’re offering free access to our Preventing Workplace Discrimination and Sexual Harassment Prevention courses to HR and L&D leaders. It’s a practical starting point if you’re using the October changes as an opportunity to review your wider discrimination and harassment training.
What “all reasonable steps” is likely to look like in practice
There’s no one-size-fits-all checklist for what “all reasonable steps” will mean for every employer, and further guidance on the new requirements is expected. But existing EHRC guidance already gives employers a pretty clear steer on where to focus:
- Risk assess properly, role by role. A care worker doing home visits faces different risks to an office-based finance assistant. A one-size-fits-all policy won’t cut it.
- Update your policies to name third parties explicitly. If your anti-harassment policy only talks about staff-on-staff conduct, it needs a rewrite.
- Review your training – including for leadership and managers. Practical, up-to-date training should reflect the risks people actually face, including what harassment from a client, customer or contractor might look like and what to do about it.
- Give people a real way to report it. Clear, accessible and known about – not buried three pages into a handbook nobody’s opened since induction.
- Keep a record. Logging incidents (and near-misses) is part of showing you’re taking this seriously, not just saying you are.
None of this needs to be complicated. But it does need to happen before 30 October, not after something goes wrong.
Common questions
Does this apply to my small business? Yes. The duty applies whatever your size, though what counts as “all reasonable steps” for a small care provider with five employees may look very different from what is reasonable for a 500-person organisation. There’s no exemption for SMEs, and no waiting until you’re “big enough” to need a policy.
Who counts as a “third party”? A third party is someone who isn’t the employer or another employee, such as a customer, client, contractor, visitor, service user or member of the public. The important point is whether your employees encounter them in the course of their work.
We don’t have a formal HR team – where do we even start? Start small and specific. Check whether your current policy mentions anyone outside your own staff – and whether people in public-facing roles have had up-to-date training that covers third-party harassment. You don’t need a compliance department to answer those two questions, just an honest look at what’s actually in place.
Does training staff really count as a “reasonable step”? On its own, no – a single generic module won’t be enough to satisfy “all reasonable steps.” But practical, role-relevant training is a core part of the wider picture, alongside a risk assessment, an updated policy and a clear way to report incidents. Think of training as one solid piece of the puzzle, not the whole thing.
Where to start this week
You don’t need every policy rewritten by Friday. But you do need to know where you stand. Start by asking: does our current harassment policy even mention customers, clients or contractors? Have people in public-facing roles had up-to-date training that covers third-party harassment? If you’re not sure, that’s your starting point. Find out what’s already in place, identify the gaps and use the time before 30 October to close them.
Ready to train your team?
Staff Skills academy+ gives your team access to 750+ Continuing Professional Development (CPD)-certified courses. Start a free 14-day trial today or speak to our team about what works for your organisation.
Please note: This article provides general information about employment law changes and isn’t intended as legal advice. Employers should seek appropriate legal or HR advice about how the requirements apply to their individual circumstances.
