Sexual harassment law – October 2026. What’s happening?

The law requiring employers to prevent sexual harassment at work is being strengthened again.

Since 26 October 2024, employers have had a proactive legal duty to take reasonable steps to prevent sexual harassment. From 30 October 2026, the Employment Rights Act 2025 will raise that standard by requiring employers to take all reasonable steps.

The Act will also introduce stronger protection for employees who are harassed by customers, clients, contractors and other third parties.

The addition of the word “all” might not look particularly dramatic, but it could make a considerable difference to the steps employers are expected to take—and the evidence they will need if their arrangements are challenged.

What changed in October 2024?

The Worker Protection (Amendment of Equality Act 2010) Act 2023 introduced a new preventative duty from 26 October 2024.

This requires employers to take reasonable steps to prevent sexual harassment of their employees during the course of their employment.

The duty is proactive. Employers should not wait for an incident or complaint before taking action.

They are expected to consider where sexual harassment could occur, identify who may be at risk and introduce appropriate measures to prevent it.

This may include considering risks associated with:

• workplace relationships and power imbalances;
• lone working;
• work-related social events;
• alcohol;
• business travel and overnight stays;
• conferences and networking events;
• work-related messaging groups and social media;
• customers, clients and members of the public; and
• younger or otherwise vulnerable workers.

Having an equal opportunities or anti-harassment policy is important, but a policy sitting in a handbook is not enough on its own.

What is changing in October 2026?

The Employment Rights Act 2025 strengthens the existing protection in two important ways.

Employers must take “all reasonable steps”

From 30 October 2026, employers must take all reasonable steps to prevent sexual harassment.

Under the current duty, an employer might seek to demonstrate that it took a reasonable package of preventative measures. This could include introducing a policy, providing training and establishing a reporting procedure.

Under the strengthened duty, the employer may also need to answer a further question:

Were there any other reasonable steps the employer could have taken—and, if so, why were they not taken?

This does not mean every employer must introduce every conceivable preventative measure.

What is reasonable will depend on factors such as:

• the size and resources of the organisation;
• the nature of the workplace;
• the level of risk;
• the type of work being carried out;
• the employees and third parties involved;
• the effectiveness of the proposed measure; and
• the cost and practicality of implementing it.

However, it will be harder for an employer to defend its position if an obvious, proportionate and potentially effective measure was available but not implemented.

Doing something will not necessarily be enough if the employer could reasonably have done more.

Liability for harassment by third parties

The Employment Rights Act 2025 will also introduce clearer employer liability where an employee is harassed by a third party during the course of their employment.

Third parties could include:

• customers;
• clients;
• suppliers;
• contractors;
• patients;
• residents;
• service users;
• event attendees;
• visitors; and
• members of the public.

This provision is not restricted to sexual harassment. It also covers most other forms of harassment under the Equality Act, including harassment related to race, disability, age, religion or belief, sex and sexual orientation.

An employer will need to show that it took all reasonable steps to prevent the third-party harassment.

For example, if a customer makes inappropriate sexual comments to a receptionist, or racially harasses an employee in a public-facing role, the employer cannot simply dismiss the behaviour as something outside its control.

The employer should have considered the risk and decided what it could reasonably do to protect its employees.

What could reasonable third-party protections look like?

The appropriate measures will depend on the business and the level of risk.

They could include:

• making acceptable standards of behaviour clear to customers and visitors;
• displaying notices explaining that harassment of employees will not be tolerated;
• including appropriate provisions in client, supplier and contractor agreements;
• giving employees clear instructions about how to report an incident;
• empowering employees to end a call, meeting or customer interaction;
• ensuring managers are available to intervene;
• introducing procedures for removing or banning individuals;
• changing which employees deal with a particular customer;
• reviewing lone-working and staffing arrangements;
• recording incidents to identify repeated behaviour or patterns; and
• ending a commercial relationship in particularly serious cases.

The law will not necessarily expect an employer to prevent every incident from ever occurring. However, employers will need to demonstrate that they properly considered the risk and took all reasonable preventative measures.

What should employers do before 30th October 2026?

Employers should review the work they completed following the 2024 changes rather than assuming that their existing arrangements will automatically satisfy the higher standard.

1. Review the risk assessment

The risk assessment should be specific to the organisation and the work its employees actually perform.

It should consider:

• who employees work with;
• where and when work takes place;
• whether employees work alone;
• the use of alcohol at work-related events;
• travel and overnight accommodation;
• informal communication channels;
• workplace culture;
• previous complaints or concerns; and
• contact with customers, clients and other third parties.

The assessment should also record the measures considered, the actions agreed and the reasons for any decision not to introduce a particular measure.

2. Check that identified actions were completed

A risk assessment that identifies actions which are never implemented will provide little protection.

Employers should check that actions have been completed, responsibility has been allocated and appropriate timescales have been set.

3. Review policies

Harassment, grievance and whistleblowing policies should be reviewed to ensure that they:

• define sexual harassment clearly;
• give practical examples of unacceptable conduct;
• cover behaviour by third parties;
• explain how concerns can be raised;
• provide an alternative reporting route where the concern involves a manager or business owner;
• explain how complaints will be investigated;
• prohibit victimisation; and
• reflect the latest legal protections.

4. Provide effective training

Training should help employees understand what sexual harassment looks like, how to report it and what to do if they witness inappropriate behaviour.

Managers will normally require additional training on receiving concerns, responding sensitively, escalating complaints and avoiding victimisation.

Training should be meaningful, kept up to date and repeated periodically. Employers should also retain evidence showing who received the training and when.

5. Make reporting concerns straightforward

Employees should have more than one appropriate route for raising a concern.

They should not be expected to report an allegation to the person accused of the behaviour, or to a manager who is too closely involved to deal with it impartially.

Employers should also consider whether employees feel safe enough to use the reporting process in practice.

6. Keep appropriate records

Employers should record:

• training provided;
• risk assessments and reviews;
• reports and complaints;
• action taken;
• recurring concerns;
• incidents involving customers or clients; and
• any changes introduced following an incident.

An absence of formal grievances does not necessarily mean there is no problem. Informal reports, exit interview comments, sickness absence patterns and repeated low-level concerns may all provide useful information.

7. Review arrangements regularly

Preventative measures should be reviewed periodically and whenever there is:

• a complaint or incident;
• a change in the workforce;
• a new workplace or working arrangement;
• an increase in customer-facing work;
• a significant event involving alcohol or overnight stays; or
• evidence that an existing measure is not working.

What are the consequences of getting it wrong?

Where an employee succeeds in a sexual harassment claim and the employer has breached the preventative duty, an Employment Tribunal can increase compensation by up to 25%.

The Equality and Human Rights Commission can also take enforcement action against employers that fail to comply with the preventative duty.

Depending on the circumstances, an employer could also face claims involving:

• discrimination;
• victimisation;
• whistleblowing detriment;
• unfair dismissal; and
• constructive unfair dismissal.

There may also be considerable reputational and employee-relations consequences.

Since 6 April 2026, workers who disclose that sexual harassment has occurred, is occurring or is likely to occur may also qualify for whistleblowing protection. Employers must therefore be particularly careful that someone raising a wider concern about sexual harassment is not subjected to detrimental treatment.

Is your existing approach enough?

If your organisation properly assessed its risks and introduced preventative measures following the October 2024 changes, you already have a useful foundation.

However, the new requirement to take all reasonable steps means that employers should revisit that work before 30 October 2026.

The important questions are no longer simply:

• Do we have a policy?
• Have we delivered some training?

Employers should instead be asking:

• Have we properly identified the risks in our particular organisation?
• Have we considered every reasonable preventative measure?
• Have we implemented all the measures that are appropriate?
• Can we demonstrate that those measures work in practice?
• Have we properly considered harassment by customers, clients and other third parties?
• Do employees feel safe raising concerns?
• Can we evidence what we have done?

A policy is part of the answer. Training is part of the answer. The real requirement is to show a considered, practical and ongoing approach to prevention.

If you need support reviewing your existing arrangements, completing a sexual harassment risk assessment, updating your policies or providing appropriate training, please contact us.