Preventing Sexual Harassment at Work: The October 2026 Duty
What the new "all reasonable steps" duty means, what to put in place before October 2026, and how to show you have done it.
Most employers already have an anti-harassment policy sitting in the handbook. The October 2026 duty is different: it is not enough to have a policy on file — you have to be able to show you took active, proportionate steps to prevent harassment before it happens.
This guide sets out what "all reasonable steps" actually means in practice, what to have in place before October 2026, and how to keep the evidence that protects you.
What changes in October 2026
The Employment Rights Act 2025 builds on the preventative duty that has applied since October 2024. Three changes take effect in October 2026:
1. "Reasonable steps" becomes "all reasonable steps"
A higher bar. You are expected to consider whether there are further steps you could reasonably take — not just to have taken some.
2. Third-party harassment liability
Employers can be liable for harassment of staff by customers, clients and other third parties, unless all reasonable steps were taken. Public-facing businesses are the most exposed.
3. Longer tribunal time limits
Time limits for bringing most claims extend from three to six months, so contemporaneous records and training evidence matter for twice as long.
Does your anti-harassment policy reflect the October 2026 duty and third-party harassment?
Paste it into Bounda and see what needs adding before the deadline.
An "all reasonable steps" checklist
No fixed list guarantees compliance, but the EHRC expects these building blocks. We've tagged what is essential versus what strengthens your position.
A clear, current anti-harassment policy
RequiredWhat to do: Define harassment and sexual harassment, make clear it applies to third parties, and explain how to report it and what happens next.
Why it matters: The policy is the foundation. From October 2026 it must address harassment by customers and clients, not just colleagues.
A documented risk assessment
RequiredWhat to do: Identify where and how harassment could occur — lone working, client sites, alcohol at events, customer-facing roles — and what you will do about each risk.
Why it matters: This is the single step the EHRC most expects to see, and the one most employers are missing. Without it, "all reasonable steps" is hard to evidence.
Up-to-date training
RequiredWhat to do: Train all staff on what harassment is and how to report it, and managers on how to handle concerns. Refresh it; a one-off session years ago is not enough.
Why it matters: Current, role-appropriate training is a core part of the evidence that you took active steps.
Accessible reporting routes
RequiredWhat to do: More than one way to raise a concern, including a route that bypasses the person’s line manager, and clarity on confidentiality.
Why it matters: A single reporting route through a manager fails people whose concern is about that manager.
Act on what you learn — and record it
RequiredWhat to do: Take reports seriously, deal with them promptly and fairly, and keep records of concerns, decisions and actions.
Why it matters: Longer tribunal time limits mean your records need to stand up for six months, not three.
Third-party measures for customer-facing teams
Depends on your businessWhat to do: Signage, staff scripts, the right to refuse service, and support for staff who experience customer harassment.
Why it matters: Essential for hospitality, retail and healthcare; less relevant for a back-office team with no public contact.
The part most policies miss: third-party harassment
Many anti-harassment policies only cover colleagues. From October 2026 you can be liable for harassment of your staff by customers, clients and members of the public.
Example: a regular customer repeatedly makes sexual comments to a bar worker. If the employer knew, did nothing, and had taken no preventative steps, that can now be the employer's liability — not just the customer's conduct. A short third-party section, staff scripts and manager backing are proportionate answers.
When to get professional advice
Getting your policy, risk assessment and training in place is something most businesses can do themselves. Bring in specialist HR or legal advice when:
- a live complaint or grievance of sexual harassment has been raised
- an incident could lead to dismissal or a tribunal claim
- the situation involves a senior person, a power imbalance, or possible victimisation
- you are unsure whether your steps would meet the "all reasonable steps" bar
Bounda keeps your policy current and helps you evidence the routine steps; investigating a specific complaint is where a qualified specialist earns their cost.
How Bounda helps you prepare for October 2026
Start with your current policy
Paste in your anti-harassment or dignity-at-work policy — no rebuild needed.
See what the October 2026 duty adds
Bounda flags missing third-party wording, reporting routes and preventative-duty language.
Update the wording
Generate a clearer version aligned to the "all reasonable steps" standard, in your own tone.
Understand every change
Each finding cites the EHRC guidance or legislation, with a plain-English explanation to review.
Stay current
When the EHRC issues further guidance, Bounda shows which parts of your handbook may be affected.
Bounda helps with the routine work of checking, explaining and updating your policies — so you can reserve professional legal advice for the cases that genuinely require it. The policy is one of the "reasonable steps"; the risk assessment and training sit alongside it.
Frequently Asked Questions about the Sexual Harassment Duty
What is the new duty to prevent sexual harassment?
Since October 2024, employers have had a proactive duty to take reasonable steps to prevent sexual harassment of their workers (Worker Protection Act 2023). From October 2026 the Employment Rights Act 2025 strengthens this to "all reasonable steps" and extends employer liability to harassment of staff by third parties such as customers and clients. It is a preventative duty: you must act before anything happens, not only respond to complaints.
When does the "all reasonable steps" duty start?
The strengthened "all reasonable steps" standard and third-party harassment liability take effect in October 2026 under the Employment Rights Act 2025. The existing "reasonable steps" duty has applied since October 2024, so a policy and risk assessment should already be in place — October 2026 raises the bar.
What counts as "all reasonable steps"?
There is no fixed checklist, but the EHRC expects at least: a clear anti-harassment policy, a documented risk assessment identifying where harassment could occur, up-to-date training for staff and managers, accessible reporting routes, and evidence that you act on concerns. "All reasonable steps" is a higher bar than "reasonable steps" — it means considering whether there are further steps you could take, not just some.
Are employers liable for harassment by customers or clients?
From October 2026, yes. Employers can be liable for harassment of their staff by third parties such as customers, clients and members of the public, unless they took all reasonable steps to prevent it. Public-facing businesses — hospitality, retail, healthcare — are the most exposed and should assess third-party risk specifically.
Does a small business need a sexual harassment policy?
Yes. The preventative duty applies to all employers regardless of size. A small business does not need a 40-page document, but it does need a clear policy, a proportionate risk assessment, training, and a way for people to raise concerns. The steps expected of you scale with your size and resources, but the duty itself does not.
What happens if we do not take all reasonable steps?
The EHRC can take enforcement action for breach of the preventative duty. Separately, if an employee wins a sexual harassment claim at tribunal and you failed to take reasonable steps to prevent it, compensation can be increased by up to 25%. Compensation for harassment is uncapped and includes injury to feelings.
Is your harassment policy ready for October 2026?
Paste in your existing policy and see what the new duty means you need to add.
7-day free trial, no credit card required.