Preventing sexual harassment at work: the October 2026 duty

The Employment Rights Act 2025 builds on the preventative duty that has applied since October 2024. Three changes take effect in October 2026, the tribunal change on 1 October and the harassment duties on 30 October:

No fixed list guarantees compliance, but the EHRC expects these building blocks. Each one is tagged so you can tell what is essential from what strengthens your position.

1. 1

   A clear, current anti-harassment policy

   Required

   What to do: Define harassment and sexual harassment, make clear it applies to third parties, and explain how to report it and what happens next.

   Why it matters: The policy is the foundation. From October 2026 it must address harassment by customers and clients, not just colleagues.

2. 2

   A documented risk assessment

   Required

   What to do: Identify where and how harassment could occur (lone working, client sites, alcohol at events, customer-facing roles) and what you will do about each risk.

   Why it matters: This is the single step the EHRC most expects to see, and the one most employers are missing. Without it, "all reasonable steps" is hard to evidence.

3. 3

   Up-to-date training

   Required

   What to do: Train all staff on what harassment is and how to report it, and managers on how to handle concerns. Refresh it; a one-off session years ago is not enough.

   Why it matters: Current, role-appropriate training is a core part of the evidence that you took active steps.

4. 4

   Accessible reporting routes

   Required

   What to do: More than one way to raise a concern, including a route that bypasses the person's line manager, and clarity on confidentiality.

   Why it matters: A single reporting route through a manager fails people whose concern is about that manager.

5. 5

   Act on what you learn, and record it

   Required

   What to do: Take reports seriously, deal with them promptly and fairly, and keep records of concerns, decisions and actions.

   Why it matters: Longer tribunal time limits mean your records need to stand up for six months, not three.

6. 6

   Third-party measures for customer-facing teams

   Depends on your business

   What to do: Signage, staff scripts, the right to refuse service, and support for staff who experience customer harassment.

   Why it matters: Essential for hospitality, retail and healthcare; less relevant for a back-office team with no public contact.

Many anti-harassment policies only cover colleagues. From October 2026 you can be liable for harassment of your staff by customers, clients and members of the public.

Getting your policy, risk assessment and training in place is something most businesses can do themselves. Bring in specialist HR or legal advice when:

• a live complaint or grievance of sexual harassment has been raised
• an incident could lead to dismissal or a tribunal claim
• the situation involves a senior person, a power imbalance, or possible victimisation
• you are unsure whether your steps would meet the "all reasonable steps" bar

1. 1

   Start with your current policy

   Paste in your anti-harassment or dignity-at-work policy. No rebuild needed.
2. 2

   See what the October 2026 duty adds

   Regulyn flags missing third-party wording, reporting routes and preventative-duty language.
3. 3

   Update the wording

   Generate a clearer version aligned to the "all reasonable steps" standard, in your own tone.
4. 4

   Understand every change

   Each finding cites the EHRC guidance or legislation, with a plain-English explanation to review.
5. 5

   Stay current

   When the EHRC issues further guidance, Regulyn shows which parts of your handbook may be affected.

Regulyn helps with the routine work of checking, explaining and updating your policies, so you can reserve professional legal advice for the cases that genuinely require it. The policy is one of the "reasonable steps"; the risk assessment and training sit alongside it.