October 2026 Harassment Reforms – Why “all” really matters

Unless you have been reading our regular updates, you may have missed a subtle change in language on sexual harassment that will have a major effect on employers.

From 30th October 2026, the Employment Rights Act 2025 raises the bar on harassment prevention. The existing duty to take “reasonable steps” to prevent sexual harassment becomes a duty to take “all reasonable steps”, and a brand-new duty requires employers to take all reasonable steps to prevent their staff being harassed by third parties too – customers, clients, patients, service users, contractors, suppliers or members of the public.

For most employers, this isn’t simply a subtle change and a policy refresh. It changes what “compliance” actually means.

It is not just about having a policy

A harassment policy in the Staff Handbook is important, but on its own, it is unlikely to be enough. Employers will need to show they have actually thought about where problems could arise in their own organisation – and that will look different from one business to the next. Questions worth asking include:

• • Do employees work alone with customers, clients or service users?
• • Are staff exposed to abusive behaviour from members of the public?
• • Does alcohol increase the risk of inappropriate behaviour at work, or work events?
• • Are employees working late at night or in isolated settings?
• • Are there work events where professional boundaries may become blurred?
• • Do staff communicate with customers or clients through social media, messaging apps or personal devices?

From compliance to evidence

Having a policy, running some meaningful training and offering a reporting line used to be enough to show good intentions. Especially if you diligently followed up on every reported incident; the Courts would generally look favourably on how you operated.

Under this new, strengthened duty, that is no longer enough. Employers will need to show they have identified specific harassment risks, taken proportionate action to address them, and kept that action under review.

And, at the moment, there is no checklist for “all reasonable steps”; no guidance issued by the Government. And, even when that guidance eventually arrives (not expected before 2027/28), it is likely to set a floor rather than a ceiling. Employers will still need to work out what is reasonable for their own workplace.

Why the sexual harassment duty matters more now

One crumb of good news: employees cannot bring a standalone claim purely because the duty was breached. In other words, just because your policy and actions do not protect employees sufficiently, that alone will not allow them to take you to a Tribunal. But, the EHRC can enforce the duty directly, and the reputational fallout of getting this wrong is significant.

But, if a sexual harassment claim succeeds, that is where the trouble starts. If a Tribunal finds the “all reasonable steps” duty was not met, compensation can rise by up to 25%. In practice, if a Claimant can point to even one missed reasonable step, the duty will likely be found breached.

That matters because we are seeing more claims, not fewer; ACAS reported a 39% rise in sexual harassment claims in 2025. And, do not forget that since April 2026, reporting sexual harassment has counted as a protected disclosure for whistleblowing purposes.

A new, wider duty on third-party harassment

And, from 30th October this year, employers must also embrace a much wider duty on third-party harassment of any sort.

Again, they must take all reasonable steps to prevent staff being harassed by third parties – customers, clients, contractors, delivery drivers, even co-tenants in shared premises – covering online conduct as well as face-to-face.

Crucially, this duty is not limited to sexual harassment; it covers harassment related to any protected characteristic. Unlike the old third-party regime (repealed in 2013), there is no threshold of prior incidents before liability can arise, and employees can bring a standalone claim directly against their employer. Retail, hospitality, care and transport are most exposed, but almost every workforce has some third-party contact, and hence risk of third-party harassment.

The Government has acknowledged that employers have less control over third parties than over their own staff, and would not be expected to police every private conversation, or foresee the truly unforeseeable. An incident occurring does not automatically mean an employer has failed in its duties; though if a claim is made, the key question is likely to be whether the risk was reasonably foreseeable, and whether sensible preventative steps could have been put in place beforehand. Genuine grey areas remain too, particularly around unidentifiable third parties, and how context affects what counts as “reasonable”. Practical, consistent, well-documented decision-making is likely to be an employer’s strongest protection while case law catches up.

What to do now

Both duties turn on the same test, so the response should be common across your business. The question behind every step is simple: if challenged, could you show not just what you did, but why, and how you checked it was working? Document everything, including where you considered a step and decided it was not reasonable to take it.

Review or commence your prevention of harassment risk assessment, covering both sexual harassment and wider third-party risks – the EHRC has said employers are unlikely to demonstrate compliance without one.

Identify your higher-risk roles and situations: customer-facing work, lone working, late-night working, events, alcohol and online communications.

Check your policies and complaint reporting arrangements, so employees know what behaviour is unacceptable and how to raise concerns through multiple, including anonymous, routes.  Keep records of how complaints were handled, formally depending on the seriousness of the situation, but it is vital that managers document how and why informal resolutions were dealt with.

Make sure Managers understand their responsibilities; inappropriate behaviour from a customer or client should never simply be dismissed as “part of the job”.

Deliver scenario-based training to staff and Managers on identification, reporting, investigation and documentation, and keep records of completion.

Put practical, proportionate controls in place – these need not be complicated or expensive, and could include clearer customer behaviour standards, stronger lone-working arrangements, additional staffing, CCTV or security measures, or clearer procedures for dealing with abusive customers.

Keep your controls under review; if an incident occurs, investigate it properly and reassess whether your existing measures remain adequate.

Support for BackupHR clients

We are updating our sexual harassment risk assessment documentation to reflect the wider duties coming into force. If our retained clients wish to receive an example Prevention of Harassment Risk Assessment, including suggested hazards and example control measures, which they can then adapt to suit their own organisation’s particular needs, risks and working arrangements, please let us know.

The message for employers is straightforward: do not wait until there is a complaint or incident before thinking about the risks. A little work now to identify risks, review policies and put sensible controls in place, will put you in a much stronger position when the new requirements take effect on 30th October 2026.

Clients are welcome to raise any concerns with our Consultant team, who would be pleased to advise you on any element of the issues arising from this newsletter.