The Employment Rights Act 2025 changes how employers in Great Britain have to deal with workplace harassment. It tightens a duty that has applied since October 2024, and it adds a form of liability that employers have not faced for more than ten years: responsibility for harassment of staff by people from outside the business.
From 30 October 2026, an employer in Great Britain must take all reasonable steps to prevent sexual harassment, and can be liable when a customer, client or other third party harasses a worker, even if the employer did not know it was happening.
What Changes on 30 October 2026?
Two sections of the Employment Rights Act 2025 do the work. Section 20 adds the word “all” to section 40A(1) of the Equality Act 2010, so the existing duty to take reasonable steps to prevent the sexual harassment of employees becomes a duty to take all reasonable steps. Section 21 inserts new subsections into section 40 of the Equality Act, which say an employer must not permit a third party to harass an employee.
The government’s implementation timetable and its business guidance give 30 October 2026 as the start date. A commencement order bringing the sections into force should be confirmed on legislation.gov.uk before an employer relies on that date. Both changes apply in England, Wales and Scotland. Northern Ireland has its own equality law, so they do not apply there.
What “Reasonable Steps” Has Required Since 2024?
The sexual harassment prevention duty is not new. It came into force on 26 October 2024 under the Worker Protection (Amendment of Equality Act 2010) Act 2023, and it required employers to take reasonable steps. The Equality and Human Rights Commission (EHRC) published technical guidance on it in September 2024, which says what counts as reasonable depends on the employer’s size and resources, the likely effect of a particular step and whether concerns have already been raised.
The duty is enforced by the EHRC, and a worker cannot sue an employer for breaching it on its own. What a tribunal can do is increase compensation by up to 25% where a harassment claim succeeds and the employer has failed to comply with the duty.
Why “All” Reasonable Steps Is a Higher Standard?
The change in wording brings the duty into line with an existing defence. Under section 109(4) of the Equality Act 2010, an employer escapes liability for an employee’s discrimination only if it took all reasonable steps to prevent it. The preventative duty now uses the same test.
In practice the question shifts. An employer used to ask whether it had done enough to count as reasonable. It now has to be able to say that it left no reasonable measure untried. A policy and an annual training session may have met the old standard. They are harder to defend as “all” the steps if a risk assessment would have flagged something else.
There is still no statutory list of steps. Section 22 of the Act gives ministers a power to make regulations setting out what employers must do, such as carrying out assessments, publishing policies and providing reporting and complaint procedures. The government has said it will consult first, with regulations expected in 2027 or 2028. Until then, the EHRC’s technical guidance is the main reference point.
Third-Party Harassment: Who Counts and What is Covered?
A third party is anyone who is not employed by the business: customers, clients, suppliers, contractors and members of the public. Under the new section 40 provisions, an employer permits third-party harassment where the third party harasses the employee in the course of their employment, and the employer failed to take all reasonable steps to prevent it. Conduct can include a customer repeatedly filming a worker and posting the footage, and the UK law on filming people in public shows where that behaviour also crosses into criminal harassment.
Nothing in that test requires the employer to have known about the conduct or to have received an earlier complaint. The old rule that applied between 2008 and 2013, which needed an employer to be aware of at least two earlier incidents, has not been brought back. The rule covers sexual harassment and harassment related to these characteristics:
- Age
- Disability
- Gender reassignment
- Race
- Religion or belief
- Sex
- Sexual orientation
Disability is on that list, and it is not limited to visible conditions. A customer who mocks a worker over a mental health condition may be harassing them on grounds of disability, which makes whether anxiety counts as a disability under the Equality Act 2010 a practical question for employers as well as for the worker concerned.
Pregnancy and maternity, and marriage and civil partnership, are not covered by the third-party rule.
What Employers Can Do to Show They took all Reasonable Steps?
The government’s guidance and the EHRC’s technical guidance point to the same set of measures. None of them is a legal checklist, but together they are what a tribunal is likely to look for:
- A sexual harassment risk assessment that includes contact with customers and clients, work events, travel and lone working
- A written policy that is communicated to all staff and not left in a handbook
- Training for managers and staff, with refreshers
- Reporting routes that include a confidential or anonymous option
- A process for handling complaints promptly, with outcomes recorded
- A regular review of whether the measures are working
An employer who holds the records of what it did, and when, is in a much better position than one that acted but cannot show it. Because the standard is what the employer took, not what it intended, the paper trail matters as much as the policy.
How Enforcement and Claims Work?
The EHRC enforces the sexual harassment prevention duty. A worker who has been harassed by a third party does not depend on the EHRC: the new section 40 provisions allow a claim to be brought against the employer in an employment tribunal, and an employer that cannot show it took all reasonable steps is exposed to that claim.
The employer’s duty is a civil obligation, so it runs separately from criminal law. A shop worker who is physically assaulted by a customer is protected by the offence of assaulting a retail worker only once that offence is brought into force, which it has not been yet. Until then, the assault is dealt with under existing criminal law, and the employment duty sits alongside it.
What Is Still Unclear?
As of 6 October 2026, three points remain open. The commencement date comes from government guidance, and employers should confirm that regulations have been made. The regulations that will say what “all reasonable steps” means are still to come, after a consultation. The EHRC has also said it is updating its technical guidance, so the version employers rely on now may change.
A further uncertainty is how tribunals will apply the word “all”. There is no case law on it yet, and the first decisions will set the practical standard. The government’s own guidance on workplace sexual harassment and third-party harassment, published on business.gov.uk, and the EHRC’s technical guidance on sexual harassment and harassment at work are the places to check for updates.
Frequently Asked Questions
Yes. The duty applies to every employer, but what counts as reasonable depends on the employer’s size and resources, according to the EHRC’s guidance.
Anyone who is not employed by the business, including customers, clients, suppliers, contractors and members of the public.
Yes. It covers sexual harassment and harassment related to age, disability, gender reassignment, race, religion or belief, sex and sexual orientation. It does not cover pregnancy and maternity, or marriage and civil partnership.
No. The changes apply in England, Wales and Scotland. Northern Ireland has its own equality law.
