If your organisation already has a bullying and harassment policy, provides employee training and has a process for dealing with complaints, you might reasonably think you are doing everything you need to prevent workplace harassment.
But from 30 October 2026, employers will need to take “all reasonable steps” to prevent harassment of their employees.
There is also a new legal obligation relating to harassment including sexual harassment by third parties, such as customers, clients and members of the public in the case of all protected characteristics other than maternity and pregnancy and marital status.
So, what does this actually mean for employers?
It does not mean that every organisation will need to follow an identical checklist. Instead, employers need to consider the risks within their own organisation, take the preventative measures that are reasonable in the circumstances, make sure people understand what is expected of them and review whether those measures are working.
In other words, having a harassment policy is important, but it is only one part of a wider preventative approach.
The key question for employers is becoming:
Could we demonstrate that we have identified the risks and taken all reasonable steps to prevent harassment in our organisation?
This guide explains what is changing, what employers should be considering and how to move from a reactive approach to a more proactive approach to preventing harassment.
Quick Links
- What is changing on 30 October 2026?
- What does “all reasonable steps” mean?
- Is having a harassment policy enough?
- What steps should employers take?
- Third-party harassment
- What if harassment happens anyway?
- Employer Checklist
- Frequently Asked Questions
- Further guidance
What is changing on 30 October 2026?
There are two important changes to harassment law coming into force on 30 October 2026 under the Employment Rights Act 2025.
1. The duty to prevent sexual harassment is getting stronger
Since 26 October 2024, employers have had a legal duty to take reasonable steps to prevent sexual harassment of their employees.
From 30 October 2026, this will change to a duty to take all reasonable steps.
The aim is to strengthen the existing preventative duty. Employers should not simply wait for an incident to happen and then respond. They are expected to consider the risks of sexual harassment happening within their organisation and take appropriate action to reduce those risks.
2. New rules will apply to harassment by third parties
From the same date, employers will also have a new legal obligation to demonstrate they have taken all reasonable steps to prevent harassment by third parties in the case of all protected characteristics other than maternity and pregnancy and marital status as well as sexual harassment.
A third party could include:
- customers
- clients
- service users
- contractors or self-employed consultants
- suppliers
- visitors
- people attending conferences or events
- members of the public
This provision is broader than sexual harassment. It covers harassment by third parties under the Equality Act 2010, including sexual harassment and harassment related to relevant protected characteristics other than maternity and pregnancy and marital status.
For example, a customer making repeated offensive comments to an employee, or a member of the public harassing a worker in the course of their employment, could create risks that the employer needs to consider and address.
The legislation provides that an employer will be liable where a third party harasses an employee in the course of their employment and the employer has failed to take all reasonable steps to prevent it.
These two changes are related, but they are not the same thing. The “all reasonable steps” duty specifically strengthens the existing duty to prevent sexual harassment, while the new third-party provision introduces a new form of employer liability for harassment by people outside the organisation.
From “reasonable steps” to “all reasonable steps”
The phrase “all reasonable steps” can sound as though employers are expected to introduce every possible precaution.
That is not the right way to approach it.
What is reasonable will depend on the circumstances of the organisation, including factors such as its size, sector, working environment, roles, working arrangements and the risks employees may face.
Acas guidance already recommends that employers consider the risks within their organisation, decide which steps are reasonable and take those steps.
The important change is therefore one of breadth and consistency.
Employers should not simply choose one or two measures and assume that is enough. They should consider the range of reasonable preventative measures that are relevant to their organisation.
There is also provision in the Employment Rights Act 2025 for regulations to specify certain steps that will be regarded as “reasonable” when assessing whether an employer has taken all reasonable steps. These may include areas such as risk assessments, policies, reporting arrangements and complaint handling.
As further regulations and guidance develop, employers should make sure they are working from the latest official information.
Prevention rather than reaction
One of the simplest ways to understand the change is to think about the difference between a reactive and preventative approach.
A reactive approach might look like this:
Something happens → an employee complains → the employer investigates → action is taken.
A preventative approach looks more like this:
Identify the risk → take preventative action → communicate expectations → train people → monitor what is happening → review and improve.
Employers cannot guarantee that an incident will never happen.
People may still behave inappropriately despite having policies, training and procedures in place.
The focus is therefore on whether the employer has properly considered the risks and taken the reasonable preventative steps that apply to its organisation.
Is having a harassment policy enough?
In a word, no.
A harassment policy is an important part of an employer’s approach, but having a policy sitting in an HR folder is unlikely to be enough on its own.
A policy tells people what the organisation expects. Prevention is about putting those expectations into practice.
Imagine an employee is given a harassment policy when they join the organisation but never hears about it again. They may not remember what constitutes inappropriate behaviour, who they should speak to if something happens or what will happen after they raise a concern.
That is why a policy needs to sit alongside other preventative measures. The Equality and Human Rights Commission has an 8-step guide that you should follow. You can check their website for all the details, but additional to the policy you should ensure you provide:
- appropriate training
- clear reporting routes
- manager awareness
- communication of expected standards
- risk assessments
- monitoring and review
- a complaints handling process and action plan following incidents
What should a harassment policy cover?
A good policy should make clear:
- what harassment and sexual harassment are
- examples of unacceptable behaviour
- what employees are expected to do
- how concerns can be raised
- what happens when a complaint is made
- how investigations are handled
- what action may be taken
- how employees who raise concerns will be supported and not suffer any detriment for disclosing a concern
It should also reflect the way people actually work.
If employees regularly communicate through messaging platforms, work remotely, travel for work or attend work-related social events, the organisation should consider whether its expectations around behaviour are clear in those situations too.
What steps should employers take?
There is no single checklist that will look exactly the same for every employer.
However, there are several areas organisations should consider when reviewing their approach.
1. Carry out a harassment risk assessment
Start by asking: Where could harassment happen in our organisation?
Consider different roles, locations and working arrangements rather than treating the workforce as one group.
Potential risk factors could include:
- customer-facing roles
- lone working
- night shifts
- business travel
- work-related accommodation
- workplace social events
- alcohol at work functions
- online communication
- hierarchical relationships
- significant power imbalances
- interactions with clients or members of the public
Previous complaints and incidents can also provide useful information.
If a particular type of incident has happened before, consider whether it highlights a wider risk that needs to be addressed.
Employee feedback can be valuable too. People working in a particular environment may identify risks that are not immediately obvious to management.
Acas specifically recommends that employers consider factors such as their sector, type of work, working arrangements, different roles, contact with third parties and whether sexual harassment has happened previously.
2. Review your policies and procedures
Once you understand the risks, review whether your existing policies actually address them.
Ask:
- Is our harassment policy up to date?
- Does it clearly explain unacceptable behaviour?
- Does it cover sexual harassment?
- Does it explain how employees can raise concerns?
- Are alternative reporting routes available where appropriate?
- Do managers understand their responsibilities?
- Does it cover work-related events and digital communication?
- Does it address relevant third-party risks?
- Does the investigation procedure work in practice?
- Is the policy communicated regularly?
It is also worth checking whether the policy reflects the organisation’s current working environment.
A policy written several years ago may not adequately address hybrid working, messaging platforms, changing working patterns or new customer-facing arrangements.
3. Provide appropriate training
Training is an important part of prevention, but it should not become a tick-box exercise.
Employees should understand:
- what harassment is
- what sexual harassment is
- what inappropriate behaviour can look like
- how workplace behaviour can affect colleagues
- how to raise a concern
- what support is available
Managers may need more detailed training.
They could be the first person an employee approaches after experiencing or witnessing inappropriate behaviour. They therefore need to understand how to respond appropriately, when to escalate a concern and how to avoid making the situation worse.
Training should also reflect the organisation’s actual risks.
For example, the training needs of a predominantly office-based organisation may be very different from those of a business where employees regularly interact with customers or members of the public.
4. Give employees clear ways to report concerns
An employee should not have to guess how to report harassment.
Reporting routes should be clear, accessible and communicated regularly.
Depending on the organisation, these could include:
- line managers
- HR
- a designated employee relations or safeguarding contact
- a senior manager
- an alternative manager where the normal reporting route is inappropriate
- an anonymous reporting mechanism, where appropriate
It is also important to consider what happens if the person accused of inappropriate behaviour is the employee’s line manager or someone senior within the organisation.
A reporting procedure that only provides one route may not be suitable in every circumstance.
5. Look at workplace culture
Policies and procedures are important, but workplace culture matters too.
Consider whether inappropriate behaviour is dismissed as:
- “banter”
- “just a joke”
- “what they’re like”
- “part of the industry”
- “something that happens at social events”
Small behaviours can become normalised if nobody challenges them.
That does not mean every awkward interaction is harassment. It does mean employers should consider whether their workplace culture makes inappropriate behaviour more likely to be tolerated or less likely to be reported.
Leadership behaviour matters too.
Employees are more likely to understand that standards are taken seriously when senior leaders and managers consistently model those standards themselves.
A useful question for employers is:
What happens in practice when someone crosses the line?
If employees see concerns being dismissed or minimised, a written policy may have little practical impact.
6. Consider third-party harassment
For organisations with customer, client or public-facing roles, third-party harassment deserves particular attention.
Consider where employees may interact with:
- customers
- clients
- patients or service users
- contractors
- suppliers
- visitors
- members of the public
- people attending events or conferences
Depending on the circumstances, preventative measures could include:
- clear customer or visitor behaviour standards
- contractual provisions
- appropriate terms and conditions
- signage
- reporting and escalation procedures
- appropriate staffing arrangements
- security measures
- de-escalation training
- incident recording
- reviewing repeat incidents involving particular individuals or situations
The right measures will depend on the organisation and the risks involved.
For a small professional services firm, the appropriate approach may look very different from that of a busy retail or hospitality business.
The important thing is to identify the risk and consider what can reasonably be done about it.
Acas gives examples of preventative measures for third-party harassment including risk assessments, incident recording, relevant policies, staff training, contractual provisions and communicating consequences to customers.
7. Learn from incidents
Prevention does not stop when an organisation has dealt with a complaint.
An incident can reveal something about the organisation’s existing preventative measures.
After an incident, ask:
- Did we identify this risk before?
- Was the relevant policy clear?
- Did the employee know how to report it?
- Did managers know how to respond?
- Was there a particular workplace or working arrangement that contributed to the risk?
- Do we need additional training?
- Does the risk assessment need updating?
- Do we need to change how a particular activity is organised?
This turns individual incidents into an opportunity for organisational learning.
A complaint should not simply be viewed as an isolated HR case. It may also provide information about a wider workplace risk.
What could “all reasonable steps” look like in different workplaces?
The steps an employer needs to take will depend on the risks within that organisation.
| Workplace | Potential risks to consider |
|---|---|
| Office-based employers | Power imbalances, inappropriate comments or jokes, social events, business travel, online communication and relationships between managers and direct reports |
| Retail and hospitality | Customer behaviour, alcohol, late-night working, lone working, interactions with members of the public and physical safety |
| Healthcare and care | Patients or service users, isolated working, home visits, physical contact and particular power dynamics |
| Hybrid and remote employers | Email, messaging platforms, video calls, online meetings, virtual social events and inappropriate messages outside normal working hours |
The important point is not to assume that one organisation’s approach will automatically be appropriate for another.
The employer should consider its own workforce, working arrangements and risks and take appropriate preventative action.
What if harassment happens despite your preventative measures?
Taking all reasonable steps to prevent harassment does not mean an employer can guarantee that an incident will never happen.
People may still behave inappropriately despite an organisation’s policies, training and preventative measures.
The response remains important.
Take the concern seriously
Employees should know that concerns will be listened to and handled appropriately.
Consider immediate protective measures
Depending on the circumstances, the employer may need to consider temporary measures to protect the people involved while a matter is investigated.
Investigate fairly and appropriately
Complaints should be handled through an appropriate process, taking account of the circumstances and maintaining fairness for everyone involved.
Take appropriate action
Where allegations are substantiated, the employer should take appropriate action in line with its policies and procedures.
Learn from what happened
Finally, ask whether the incident reveals a gap in the organisation’s preventative approach.
This last stage is easy to overlook.
The question should not only be:
“How do we deal with this incident?”
It should also be:
“What can this incident tell us about the risks in our organisation and what we need to do differently?”
Could your organisation demonstrate that it has taken all reasonable steps?
The key question for employers is not simply:
“Do we have a harassment policy?”
It is:
“Can we demonstrate that we have identified the risks, taken appropriate preventative action, communicated our expectations, trained our people, provided effective reporting routes and reviewed whether those measures are working?”
The move to an “all reasonable steps” duty is an opportunity to look at harassment prevention as an ongoing part of good people management rather than a document that sits in an HR folder.
Employers should also keep an eye on further official guidance and regulations as the new requirements are implemented.
If you are not sure whether your current approach is sufficient, now is a good time to review it before the new duty comes into force.
“All Reasonable Steps” Employer Checklist
Use the following questions as a starting point for reviewing your organisation’s current approach.
Risk
☐ Have we identified the risks of harassment within our organisation?
☐ Have we considered risks associated with different roles and working environments?
☐ Have we considered risks from customers, clients or other third parties?
☐ Have we reviewed previous complaints and incidents?
☐ Have we consulted employees about potential risks?
Policies and procedures
☐ Is our harassment policy up to date?
☐ Does it clearly explain unacceptable behaviour?
☐ Does it cover sexual harassment?
☐ Does it explain how employees can raise concerns?
☐ Are alternative reporting routes available where appropriate?
☐ Does it cover work-related events and digital communication?
☐ Does it address relevant third-party risks?
☐ Does the investigation procedure work in practice?
Training
☐ Have employees received appropriate harassment prevention training?
☐ Do managers understand how to respond to concerns?
☐ Do people understand their responsibilities?
☐ Does training reflect the risks within our organisation?
☐ Do we review whether training is effective?
Culture
☐ Do leaders consistently model expected standards?
☐ Are inappropriate behaviours challenged?
☐ Do employees feel able to raise concerns?
☐ Do we monitor themes and patterns in complaints?
Monitoring and review
☐ Do we record relevant incidents?
☐ Do we review complaints for recurring patterns?
☐ Do we update risk assessments when circumstances change?
☐ Do we review whether preventative measures are working?
☐ Could we demonstrate what action we have taken and why?
Frequently Asked Questions About “All Reasonable Steps”
From 30th October 2026, employers will need to take all reasonable steps to prevent sexual harassment of their employees.
What is reasonable will depend on the circumstances of the organisation, including factors such as its size, sector, working arrangements and specific risks.
Employers should consider the risks within their organisation, identify the preventative measures that are reasonable for those risks and take those steps.
The strengthened duty to take all reasonable steps to prevent sexual harassment comes into force on 30th October 2026.
No. The steps that are reasonable will depend on the circumstances of the organisation, including its size, sector, working environment, roles and specific risks.
There is not currently one identical checklist that applies to every employer. However, the legislation gives the Government the power to specify certain steps that will be regarded as reasonable through future regulations.
No, a policy is an important part of prevention, but employers should also consider risk assessment, training, reporting mechanisms, management responsibilities, workplace culture, monitoring and other measures relevant to their organisation.
Third-party harassment is harassment directed at an employee by someone outside the organisation, such as a customer, client, service user, contractor or member of the public.
From 30th October 2026, employers will have a new legal obligation not to permit third parties to harass their employees where the employer has failed to take all reasonable steps to prevent it.
Employers should take the concern seriously, consider whether any immediate protective measures are appropriate, investigate the matter fairly and take appropriate action.
They should also consider whether the incident identifies a wider risk that requires additional preventative measures.
No. The preventative duty does not mean an employer can guarantee that no incident will ever occur.
The focus is on whether the employer has identified the risks and taken the reasonable preventative measures that apply to the circumstances of its organisation.
Further guidance
For further information about preventing sexual harassment and the 2026 changes, employers should refer to the latest guidance from:
Acas — Preventing sexual harassment at work
Acas — Employment Rights Act 2025 and harassment law changes
Equality and Human Rights Commission — Sexual harassment and harassment at work
GOV.UK — Employment Rights Act 2025 implementation timeline
As the new requirements come into force, employers should check the latest official guidance and any further regulations that may affect what is considered reasonable.
This article provides general information for employers and should not be treated as legal advice. Employment law and official guidance can change, so employers should check the latest information and seek appropriate professional advice for their particular circumstances.
