Third-party harassment and the “all reasonable steps” duty: what UK employers must do from 30 October 2026

From 30 October 2026, UK employers must take “all reasonable steps” to prevent sexual harassment of their workers, and they’re liable for harassment by customers, clients, suppliers and other third parties if they fail to take all reasonable steps to prevent it. Both changes come from the Employment Rights Act 2025 (ERA), and they apply to every employer, no matter your size or sector.

The old standard under the Equality Act 2010 was “reasonable steps”. If you did a risk assessment in 2024, it was built to meet that lower bar. Your first job is to check it against the new one, and to make sure it covers people who don’t work for you.

Key takeaways

Question	Answer
When does the new sexual harassment duty start?	30 October 2026. The standard rises from “reasonable steps” to “all reasonable steps”.
Are you liable if a customer harasses your staff?	Yes, if the harassment happens in the course of the worker’s job and you didn’t take all reasonable steps to prevent it.
Which types of harassment are covered?	Third-party liability covers all types of harassment, not only sexual harassment.
What happens if you get it wrong?	A tribunal can increase compensation by up to 25% in a successful sexual harassment claim. The Equality and Human Rights Commission (EHRC) can also take enforcement action.
How long do employees have to bring a claim?	Six months less one day for acts on or after 1 October 2026. It was three months less one day.
What should you do first?	Update your harassment risk assessment, train your managers and add third parties to your policy.

What is the new duty to take “all reasonable steps” to prevent sexual harassment?

From 30 October 2026, you must take “all reasonable steps” to prevent sexual harassment of your workers. The duty sits in the Equality Act 2010, and the Employment Rights Act 2025 raises it from “reasonable steps”, the standard in force since October 2024.

 

	Reasonable steps (October 2024 to 29 October 2026)	All reasonable steps (from 30 October 2026)
The test	Did you take reasonable steps to prevent it?	Did you take all reasonable steps to prevent it?
What the tribunal looks at	What you did	What you did, and what you didn’t do
Compensation	Uplift of up to 25%	Uplift of up to 25%

 

Under the old standard, a tribunal looked at what you did. Under “all reasonable steps”, it also looks at what you didn’t do. If the tribunal can name a reasonable step you skipped, you don’t meet the standard.

Gill McAteer, Director of Employment Law at Citation, says: “Reasonable steps and all reasonable steps sound similar, but they’re judged very differently by a tribunal. All reasonable steps means being able to show you have done every step that is reasonable for your size and sector, not just the ones you happened to already have in place.”

The EHRC’s September 2024 guidance on sexual harassment lists the factors a tribunal weighs:

• the size and resources of your business
• your sector
• the risks in your workplace
• how often your people deal with third parties
• whether anyone has already raised a concern
• whether the steps you took worked

The government has also taken a power to specify evidence based steps in regulations. That power came into force on 30 October 2026, but the regulations are due in 2027/28. They will sit alongside the all reasonable steps duty, not replace it.

What evidence shows a tribunal you took all reasonable steps?

A tribunal looks for evidence that:

• your harassment policy is current
• everyone in the business knows about it
• your people have been trained on it
• your managers know what to do when someone raises a concern
• the training is good quality, repeated regularly and checked

Write down your reasoning when you decide a step isn’t reasonable for your business. A tribunal that sees you weighed a step and had a good reason to reject it gives that decision real weight. A step you never considered puts you in a much weaker position.

Are employers liable for harassment by customers, clients and other third parties?

Yes. From 30 October 2026, you’re liable if someone who isn’t your employee harasses one of your workers in the course of their work, and you failed to take all reasonable steps to prevent it. The Employment Rights Act 2025 re-introduces this liability, and it’s not limited to sexual harassment.

A third party is anyone who isn’t your employee. That includes:

• customers and clients
• suppliers and contractors
• visitors
• patients, students and members of the public, where your work brings you into contact with them

The Equality Act 2010 recognises harassment related to age, disability, gender reassignment, race, religion or belief, sex and sexual orientation, plus sexual harassment itself. Third-party liability covers all of them.

Hospitality, retail and healthcare employers are most exposed, but any business whose workers deal with people outside the business is affected. McAteer says: “Add third-party harassment into the mix, and any business where staff come into contact with people who don’t work for the business needs to think about protection that goes well beyond internal HR policy.”

You have much less control over a customer than over an employee, and a tribunal accepts that, provided you’ve done your best. Start with a risk assessment of where harassment could happen. Then put steps in place, such as posters where members of the public come in, and checks on the harassment training your agency workers and contractors have had.

How long do employees have to bring a harassment claim?

Employees now have six months less one day to bring most Employment Tribunal claims, including harassment and discrimination claims. The ERA doubled the limit from three months less one day on 1 October 2026. It applies where the act complained of happens on or after that date.

If a complaint covers a series of acts, the last act decides. Acas early conciliation still pauses the clock, and since 1 December 2025 it can run for up to 12 weeks.

McAteer says “the risks of sloppy record-keeping or a badly handled dismissal just went up drastically, because the window for something to come back on you is twice as long.”

What should you do now?

Start with the risk assessment, because everything else follows from it.

• Update your sexual harassment risk assessment. Cover customers, clients, suppliers and visitors, and write down the steps you’ve chosen and why. Record any step you considered and rejected, with your reasons, at the time.
• Set up a reporting route for third-party harassment. Tell your people how to report a customer or supplier, and make sure managers know what to do when they get a report.
• Make harassment training mandatory and track it. Cover all staff and train managers separately on handling a report. Check that people understood the training, not just that they completed it.
• Deal with refusals. If someone won’t complete the training, find out why first. If it’s workload or an access problem, fix it. If there’s no good reason, treat it as a refusal of a reasonable management instruction.
• Take third-party steps that match your workplace. That might mean posters where the public come in or checking the harassment training your agency workers and contractors have had.
• Check your bullying and harassment policy. It should cover third parties and every type of harassment, not only sexual harassment.
• Tighten your records on grievances and disciplinaries. Record what was raised, what you did and why, at the time, not afterwards. A decision made in October can be challenged next April.

Quick answers (FAQs)

When does the “all reasonable steps” duty start?

The duty to take all reasonable steps to prevent sexual harassment started on 30 October 2026. It replaces the “reasonable steps” duty that applied from October 2024.

Am I liable if a customer harasses my staff?

Yes, if the harassment happens in the course of the worker’s job and you failed to take all reasonable steps to prevent it. This applies from 30 October 2026 under the Employment Rights Act 2025. It covers customers, clients, suppliers and other third parties.

Does third-party harassment liability cover more than sexual harassment?

Yes. It covers harassment related to age, disability, gender reassignment, race, religion or belief, sex and sexual orientation, as well as sexual harassment.

What is the difference between “reasonable steps” and “all reasonable steps”?

Under “reasonable steps”, a tribunal looked at what you did. Under “all reasonable steps”, it also looks at what you didn’t do. If it can name a reasonable step you skipped, you don’t meet the standard.

Can I discipline an employee who refuses harassment training?

Yes, if there is no reasonable explanation for the refusal. Find out why they’re refusing first. If the reason is workload or an accessibility problem, fix it. If they still refuse, treat it as a refusal of a reasonable management instruction. A tribunal will want to see that you took your harassment obligations seriously.

How long do employees have to bring a harassment claim?

Six months less one day, for acts on or after 1 October 2026. For acts before that date, the limit stays at three months less one day.

Need help getting your harassment steps in place?

Citation’s employment law advisers can review your harassment policy and risk assessment, and they’re on the phone when a complaint lands.

If a harassment claim reaches tribunal, follow our advice and we defend it and pay any award, up to £150,000 per matter. Call us on 0345 844 1111 or visit the Citation ERA Hub for the full timeline of changes.