Preventing sexual harassment at work: How to meet the extended “all reasonable steps” duty

From 30 October 2026, employers are subject to a more stringent legal duty to prevent sexual harassment at work [1]. This article explains what the extended duty involves and, more importantly, the practical steps employers can take to meet it and to evidence what they have done.

Employment law

Published: 22 October 2026•13 minutes read

The Employment Rights Act 2025 raises the standard from taking “reasonable steps” to taking “all reasonable steps” to prevent sexual harassment [2][3]. It also makes employers directly liable for harassment of employees by third parties, such as customers, clients and members of the public, unless they have taken all reasonable steps to prevent it [3][4].

For employers, this means reviewing existing arrangements and identifying whether further action is needed. Having a policy in place is important, but employers will need to consider how effectively their measures prevent harassment in practice.

For background on the preventative duty introduced in October 2024, see our roadmap for employers on sexual harassment legislation.

Summary

From 30 October 2026, the duty to prevent sexual harassment requires employers to take “all reasonable steps”, rather than “reasonable steps” [1][2][3].
The earlier “reasonable steps” duty has applied since 26 October 2024, so this is a higher standard built on obligations employers already have [2][5].
Employers are also directly liable if a third party, such as a customer, client or contractor, harasses an employee, unless the employer took all reasonable steps to prevent it. This goes beyond sexual harassment and covers all other protected characteristics as well [3][4].
There is no statutory list of what counts as “all reasonable steps”. Regulations are not expected until 2027 or 2028, so the Equality and Human Rights Commission (EHRC) technical guidance and eight-step guide remain the practical benchmark [3][4].
Evidence matters. Employers should be able to show what they assessed, what they did, how they reviewed it, and why they decided not to take any step [6].
The EHRC can enforce the duty, and a tribunal can increase compensation by up to 25% in a successful harassment claim where the duty was breached [2][5].
Since 6 April 2026, disclosures about sexual harassment can qualify for whistleblowing protection [2][4]. Restrictions on confidentiality clauses are expected from 2027 [7].
A written policy and a single round of training are unlikely to be enough on their own to meet the extended duty to prevent sexual harassment [2].

What does the extended duty change?

Employers have had a legal duty to take “reasonable steps” to prevent sexual harassment of their employees since 26 October 2024 [2][5]. The Employment Rights Act 2025 changes that in two ways with effect from 30 October 2026 [1].

Area	Before 30 October 2026	From 30 October 2026
Standard	Take “reasonable steps” to prevent sexual harassment of employees	Take “all reasonable steps”
Third parties	Sexual harassment by third parties falls within the “reasonable steps” duty	Employers are directly liable for harassment of employees by customers, clients, contractors and other third parties unless they took all reasonable steps. This covers harassment related to all protected characteristics, not just sexual harassment
What counts as “reasonable”	Judged on the facts, using EHRC technical guidance	Still no statutory list. At the time of writing, regulations are expected after consultation in 2027 or 2028
Enforcement	EHRC enforcement, and compensation can be increased by up to 25% where the duty is breached	The same, but measured against the higher standard

What does “all reasonable steps” mean?

The legislation doesn’t define it, but some principles are clear.

It is an objective test that depends on the employer. The EHRC guidance points to factors such as the size and nature of the business and its working environment, and weighs the time, cost and disruption of a step against its benefit [5].
It is a higher bar. It mirrors the standard employers already must meet to defend a vicarious liability claim, and employers cannot rely on having taken only some of the available steps [2][4].
It is not unlimited. Employers are not expected to stop all harassment from ever occurring [7]. During the passage of the Act, a government minister said employers would not be penalised for failing to anticipate the unforeseeable or to take other unreasonable steps [8].
Third-party harassment has its own limits. The government has indicated that trivial third-party conduct will not trigger liability, and that the steps an employer can reasonably take in relation to third parties are more limited than those it can take in relation to its own staff [7].
Reasoning matters. Why an employer chose not to take a particular step, and what it did instead, could be decisive [6].

Third-party harassment: Are employers liable for harassment by customers?

The third-party liability is worth separate attention, because it reaches situations employers have less control over. Employees do not need to show repeated incidents or that the employer knew about the problem beforehand [3][4]. It covers the characteristics protected from harassment under the Equality Act 2010: age, disability, gender reassignment, race, religion or belief, sex and sexual orientation [4]. Hospitality, retail and healthcare are among the sectors identified as particularly exposed [3].

Eight practical steps to meet the duty

The steps below broadly mirror the structure of the EHRC’s eight-step guide to preventing sexual harassment [9]. They are a framework, not a rigid checklist. How far you take each one should reflect the size of your business and the risks it faces.

Step 1: Carry out (or refresh) a risk assessment

The EHRC guidance says employers are unlikely to be able to meet the duty without one [5]. A good starting point is to assess where and when sexual harassment is most likely to occur in your organisation. Employers should not rely on a generic assessment or assume that existing arrangements remain adequate. Consider:

customer-facing roles, and anyone who deals with the public or visits other sites
lone working, night working and remote working
business travel, social events and work-related events away from the workplace
power imbalances, such as junior staff reporting to senior colleagues
online and messaging-based harassment
groups who may be more vulnerable, such as young, agency or newly hired staff.

Complete separate assessments for sexual harassment by colleagues and for third-party harassment, ask staff what they see and experience, and record how you reached your conclusions [6]. Anonymous surveys can also help identify concerns that employees might be reluctant to raise directly [9].

Once you have identified the risks, decide what measures are needed to address them. Record your findings, the action you will take and when the assessment will be reviewed.

The Equality and Human Rights Commission's guidance on sexual harassment and harassment at work provides a useful framework for reviewing your approach.

Step 2: Update your anti-harassment policy

Your anti-harassment policy should reflect the extended legal requirements and explain how your organisation will prevent, report and respond to harassment. Check that it:

defines sexual harassment and gives clear examples, including online conduct
covers harassment by customers, clients, contractors and other third parties
extends to the other protected characteristics, not just sex
explains how to report concerns, how they will be investigated and what the possible outcomes are
links to your grievance, disciplinary and whistleblowing policies.

A standalone sexual harassment policy can be more effective than a short paragraph in a general policy [7]. Make sure the policy is visibly backed by senior leadership, communicated to everyone and referenced in your handbook. Read our guide on drafting an employee handbook and how to keep it up to date.

Step 3: Make reporting easy

Workers may be reluctant to report harassment if they fear they will not be believed, that nothing will change or that raising a concern could damage their career.

Employers should provide clear reporting routes and consider offering more than one way to raise concerns, including an option to report anonymously [9]. This is particularly important where the allegation involves a line manager or someone in a position of authority.

Since 6 April 2026, a disclosure that sexual harassment has happened, is happening or is likely to happen can qualify as a protected disclosure, so managers need to recognise a report when they hear one and avoid any detrimental treatment of the person raising it [2][4]. The employment law changes in April 2026 article covers that change.

Review whether workers know who they can speak to, what happens after a report is made and how they will be kept informed.

Employers should respond promptly and appropriately to concerns, even where no formal complaint has been submitted. Informal reports and patterns of behaviour may reveal risks that need to be addressed.

Step 4: Train everyone, and train managers properly

All workers should understand what is and isn’t acceptable and how to report it. Managers need more: how to spot problems, how to respond when someone raises a concern, when to escalate and how to avoid retaliation [9]. Customer-facing staff benefit from scenario-based training on handling third-party behaviour [6][7]. Keep records of who attended, what was covered and when, and refresh the training periodically rather than treating it as a one-off. Our training services may help.

Step 5: Put measures in place for third parties

The third-party liability makes this step essential for any business that deals with the public or works on other people’s premises [7]. Practical measures include:

setting out expected standards of behaviour in contracts and terms with clients and suppliers
displaying clear notices in customer-facing areas
giving staff a simple escalation route and permission to step away from an abusive situation
offering support after an incident, and following up with the third party where appropriate
considering safety when staff attend work events or visit client sites [9].

Step 6: Handle complaints promptly and fairly

Act quickly, ask the person raising the concern what outcome they want, and protect them from further harassment while the matter is dealt with [9]. Consider whether the conduct may be criminal and discuss police reporting with them. Treat complaints about third parties as seriously as complaints about colleagues and keep a log of each report and the action taken. Our article on professional approaches to workplace conflict resolution covers grievance processes and investigations.

Step 7: Listen, monitor and review

A quiet inbox can mean under-reporting, not an absence of problems [6]. Use one-to-ones, staff surveys and exit interviews to understand how people experience your workplace [9] and compare that with your complaints data to spot patterns. Review whether your steps are working, and update your policy, training and risk assessments after any incident or significant change to the business [5]. Exit interview comments should never replace a proper route for raising and investigating a harassment concern.

Step 8: Keep an evidence file

If the duty is ever tested, the question will be what you can show. Keep:

your risk assessments, with dates and who contributed
the steps you considered, the ones you took and your reasons for not taking any other steps
policy versions and review dates
training content and attendance records
complaint and incident logs, and the outcome of each
notes of reviews and any changes made as a result.

Tribunals are likely to look for risk assessments that are specific to the employer’s circumstances and regularly reviewed, rather than generic, off-the-shelf documents [4].

What happens if employers do not comply?

Employers who fail to meet their legal obligations may face significant consequences. The EHRC can take enforcement action in relation to the preventative duty [2]. Where an employee brings a successful discrimination claim involving sexual harassment, an employment tribunal may also increase compensation by up to 25% if the employer has failed to comply with the preventative duty [2][5].

Under the third-party harassment duty, an employer may also face liability where the statutory conditions are met, including a failure to take all reasonable steps to prevent the harassment [3].

The changes therefore make it important for employers to assess their actual practices rather than relying solely on written policies or reacting only when complaints arise.

Future changes: Confidentiality clauses and regulations

Two further developments are worth monitoring. The position may have moved on since this article was written, check gov.uk legislation tracker for updates.

Confidentiality clauses. The government has indicated that clauses preventing workers from making certain allegations or disclosures about harassment or discrimination will become legally unenforceable. A limited exception is proposed for agreements that meet specific conditions, including requirements relating to independent legal advice [7]. The implementation date has not been confirmed yet, although changes are expected sometime in 2027. The consultation outcome has also yet to be published. Employers should review confidentiality clauses in employment contracts and settlement agreements in preparation for the changes.
Regulations on “reasonable steps”. Further regulations are expected following consultation, alongside likely updates to the EHRC guidance [3][7]. In the meantime, the existing technical guidance and eight-step guide remain the best available benchmarks.

Final thoughts

The change from “reasonable steps” to “all reasonable steps” is not about adding paperwork for its own sake. It is about being able to show that prevention is part of how your business runs, not something that gets attention only after a complaint.

Employers should review their risks, update their policies, train managers and workers, and ensure that effective reporting and response procedures are in place. The measures required will vary between organisations, but the underlying principle is the same: prevention needs to be active, proportionate to the risks and regularly reviewed.

Taking these steps will help employers meet the extended requirements, support their workers and build a workplace culture in which harassment is recognised, challenged and addressed.