October 2026 Workplace Harassment Updates: Are All Reasonable Steps Being Taken?

From October 2026, a further strengthening of workplace harassment law is expected to be introduced under the Employment Rights Act 2025. The existing duty on employers to take reasonable steps to prevent sexual harassment will be raised to a higher standard: all reasonable steps must be taken. In addition, protection will be extended where harassment is carried out by third parties, including customers, clients, contractors, patients, service users and visitors.

This change should not be viewed as a minor policy update. A more proactive, preventative and evidenced approach will be required. Employers will be expected to show that workplace risks have been assessed, appropriate controls have been introduced, concerns have been acted upon, and staff have been protected before incidents occur.

What Is Changing?

Since 26 October 2024, employers have been required to take reasonable steps to prevent sexual harassment in the workplace. This duty was introduced to ensure that action is taken before harm is caused, rather than simply after a complaint has been made.

From October 2026, this obligation will be strengthened. The word “all” will be inserted into the duty, meaning that employers will be required to take all reasonable steps to prevent sexual harassment of employees.

A further obligation will also be introduced in relation to third-party harassment. An employer must not permit an employee to be harassed by a third party during the course of employment. This will include circumstances where harassment is carried out by a customer, client, contractor, supplier, patient, service user or other external individual, and where all reasonable preventative steps have not been taken.

Why This Matters for Employers

Harassment is not always caused by another employee. In many workplaces, staff are exposed to members of the public, customers, clients, visitors, contractors or service users. This is particularly relevant in sectors such as hospitality, retail, healthcare, education, transport, construction, professional services and care.

Where third-party contact forms part of the working environment, the risk must be recognised and managed. It will no longer be sufficient for inappropriate behaviour from customers or clients to be dismissed as “part of the job”. Staff should be protected, reporting channels should be made clear, and action should be taken where warning signs are identified.

The focus will be placed on prevention, not reaction. Policies, training, risk assessments and reporting procedures will need to be capable of demonstrating that a reasonable and proportionate system has been put in place.

What Could Be Considered “All Reasonable Steps”?

Although detailed regulations may be used to specify steps that will be treated as reasonable, employers should begin preparing now. The Employment Rights Act 2025 allows regulations to be made which may set out steps to be regarded as reasonable when determining whether the duty has been met.

In practice, the following measures should be considered:

Workplace harassment risks should be assessed across roles, locations, shift patterns and customer-facing activities.

Anti-harassment policies should be reviewed and updated to include sexual harassment, third-party harassment, reporting routes, investigation processes and protection from victimisation.

Training should be provided to managers and staff, with emphasis placed on recognising harassment, responding appropriately and escalating concerns.

Clear reporting channels should be made available, including options for confidential reporting where appropriate.

Managers should be equipped to act promptly when concerns are raised.

Customer, client and contractor standards of behaviour should be communicated clearly where staff are exposed to third parties.

Complaints and incidents should be recorded, reviewed and used to improve preventative measures.

Action plans should be kept under review, especially where patterns, repeat incidents or high-risk areas are identified.

The Risk of Doing Nothing

A failure to take all reasonable steps could expose an organisation to legal, financial and reputational risk. Where a successful sexual harassment claim is brought, employment tribunals already have the ability to consider whether the preventative duty has been breached, and compensation may be increased where the duty has not been met.

Beyond legal liability, workplace culture may also be damaged where concerns are ignored or minimised. Staff retention, morale, sickness absence and trust in management can all be affected where inappropriate behaviour is allowed to continue unchecked.

A documented, practical and properly communicated approach should therefore be treated as essential.

How Should Businesses Prepare?

Preparation should begin before October 2026. Policies should be reviewed, risk assessments should be updated, training should be refreshed, and clear evidence should be retained to show that preventative steps have been taken.

Particular attention should be given to roles where staff are required to deal directly with customers, clients, contractors or the public. In those settings, third-party harassment risks should be assessed and controls should be introduced.

A suitable policy alone will not be enough. It should be supported by implementation, communication, training, reporting, monitoring and review. In short, compliance must be demonstrated, not simply stated.

Workplace Harassment Compliance Support

The October 2026 updates should be treated as an opportunity to strengthen workplace protection, reduce risk and support a respectful working environment.

Policies, procedures, staff training, risk assessments and reporting frameworks should be reviewed now to ensure that all reasonable steps are being taken.

For support with workplace harassment compliance, policy review, employment documentation or preventative training, contact Ilisi Expert Legal Compliance today.