From 30 October 2026, employers must take all reasonable steps to prevent sexual harassment

On 30 October 2026, the law on workplace harassment in Great Britain takes its most significant step in a generation. Employers must now take all reasonable steps to prevent sexual harassment of their employees, and they become liable when staff are harassed by third parties such as customers, clients, contractors and members of the public. If your organisation has been relying on a policy and an annual training module, now is the time to look again.

What changes on 30 October 2026

Since October 2024, employers have been under a preventive duty to take reasonable steps to prevent sexual harassment, set out in section 40A of the Equality Act 2010. The Employment Rights Act 2025 strengthens that duty in two ways.

• From reasonable steps to all reasonable steps. The test becomes stricter. In practice, an employer will need to be able to show that there were no further steps it could reasonably have taken.
• Liability for third-party harassment. Employers will be liable for harassment of their staff by third parties where they have not taken all reasonable steps to prevent it. This protection is not limited to sexual harassment; it extends to harassment related to other protected characteristics under the Equality Act 2010.

The Act also gives the government power to set out in regulations the steps employers should take. Those regulations are not expected until 2027, so for now the best benchmark is the Equality and Human Rights Commission’s technical guidance on sexual harassment and harassment at work.

How this connects to whistleblowing

Since 6 April 2026, a disclosure about sexual harassment has been its own category of qualifying disclosure under whistleblowing law. That means a member of staff who reports sexual harassment, whether it happened to them or to a colleague, may be protected as a whistleblower, with protection from detriment and, for employees, from unfair dismissal. Further restrictions on non-disclosure agreements that stop people speaking up about harassment or discrimination are planned for 2027.

Taken together, these changes put the way you receive and handle reports at the centre of your legal position. A tribunal looking at whether you took all reasonable steps will want to see more than a policy on the intranet.

What all reasonable steps is likely to look like

Drawing on the EHRC’s guidance, these are the areas most organisations should be able to evidence:

1. A current risk assessment. Identify where harassment is most likely, including customer-facing roles, lone working, late shifts, events, travel and settings where alcohol is served.
2. A clear, published policy. Explain what harassment is, how to report it, what happens next and how people raising concerns will be protected.
3. Training that fits the role. Managers and anyone handling complaints need more than awareness training; they need to know how to respond, record and escalate.
4. More than one way to report. Not everyone will feel able to go to their line manager. Offer confidential and anonymous routes, available at any time and on any device.
5. Prompt, consistent handling. Acknowledge reports quickly, investigate fairly, keep the reporter informed and record every decision.
6. Third-party controls. Set expectations with customers, clients and contractors, display clear conduct messages in public-facing spaces and review contracts so that responsibilities are clear.
7. Monitoring and review. Use anonymised reporting data to spot patterns, report to your board and update your risk assessment when things change.

Why the reporting channel matters

Harassment, and particularly harassment by people outside the organisation, often goes unreported. Staff worry about not being believed, about the impact on their career or about a customer relationship. A route that lets people report anonymously, and still answer follow-up questions, gives you the information you need to act and the evidence that you were looking for problems rather than waiting for them.

It also protects the organisation. A secure, time-stamped record of each report, the steps taken and the outcome is exactly what you will want to show if a claim is ever brought, or if a regulator asks how concerns are handled.

A short checklist for the next fortnight

• Review your harassment risk assessment and add third-party risks.
• Update your harassment and whistleblowing policies so they cross-refer, and name sexual harassment as a protected disclosure.
• Check that staff have a confidential, anonymous way to report, and that they know about it.
• Brief managers on the new standard and how to respond to a report.
• Agree how harassment data will be reported to your board.

Please note that these changes apply in England, Scotland and Wales. Northern Ireland has separate employment law, and the Employment Rights Act 2025 changes do not extend there. For a wider view of the duties that apply to your organisation, see our UK safeguarding and whistleblowing legislation guide.

This article is general information, not legal advice. Take professional advice on your organisation’s circumstances.

Speak Out Safe gives your people a secure, anonymous way to raise concerns, including about harassment, and gives you a full audit trail of how each one was handled. Book a 30-minute demo to see how it works.