All reasonable steps: what changes for employers on 30 October 2026

Two things change on 30 October 2026. They are usually reported as one change. They are not, they do not cover the same ground, and an employer who prepares for one and not the other is still exposed.

Both sit in the Employment Rights Act 2025, and both work by amending the Equality Act 2010. They apply in England, Wales and Scotland, but not Northern Ireland, where this area of law is devolved (business.gov.uk).

One word, and where the burden lands

Since October 2024 employers have had to take reasonable steps to prevent sexual harassment of their staff, under section 40A of the Equality Act 2010 (business.gov.uk). Section 20 of the Employment Rights Act 2025 does one thing to that provision. It inserts the word "all" (Employment Rights Act 2025 section 20).

That single word moves where the burden sits. The old question was whether what you did was reasonable. The new question is whether anything further was reasonably open to you that you did not do. A policy and an annual training slide is an answer to the first question. It is not an answer to the second.

Acas puts the test in plain terms: all reasonable steps means doing what is possible with the resources available to you, and what is required will depend on the size of the organisation, the sector, and the kind of work your people do. Crucially, Acas also says employers should record why they decided not to take a step they considered (Acas). That is the single most useful sentence in the current guidance, and it tells you the duty is evidenced on paper or not at all.

There is money attached too. Where a sexual harassment claim succeeds, a tribunal must consider whether the preventative duty was complied with, and can increase the compensation awarded by up to 25 per cent if it was not, under section 124A of the Equality Act 2010 (Equality Act 2010 section 124A). That uplift is not for the harassment. It is for the prevention you skipped.

The genuinely new liability

The second change is a different duty altogether, and it is broader than the first.

Section 21 of the Employment Rights Act 2025 inserts new subsections 40(1A) to (1C) into the Equality Act 2010. The wording is blunt: an employer must not permit a third party to harass its employee. An employer is treated as permitting it where the harassment happens in the course of the employee's employment and the employer failed to take all reasonable steps to prevent it. A third party means anyone other than the employer or another of its employees (Employment Rights Act 2025 section 21).

Two consequences follow, and they are the ones employers miss.

First, this duty is not limited to conduct of a sexual nature. Section 40A, which section 20 amends, is about sexual harassment specifically. Section 40 is about harassment as the Equality Act defines it, which is conduct related to a relevant protected characteristic (Equality Act 2010 section 26). So a racist remark from a customer, hostility from a contractor towards a disabled member of staff, or ageist comments from a supplier are all in scope of the third-party duty.

Second, the range of people involved is wide. Acas gives customers, clients, service users such as patients or students, self-employed contractors and tradespeople, people at conferences and events, and members of the public in shared spaces. It can happen in person or online (Acas).

Nor is there a first-incident concession. The obligation is to prevent, so it bites before anything has happened, not after the first complaint has taught you that it might.

If your people deal with the public, and especially if they do so alone, in the evening, on someone else's premises, or while refusing something to somebody, this is the change to worry about.

What all reasonable steps looks like in practice

Section 22 of the Act inserts a new section 40B, which gives the government power to specify by regulations what counts as reasonable. The list of what those regulations may cover is instructive: carrying out assessments, publishing plans or policies, steps on the reporting of sexual harassment, and steps on the handling of complaints (Employment Rights Act 2025 section 22). Those regulations are expected during 2027, subject to consultation. They are not settled yet, but the direction of travel is on the face of the Act, and assessments are first on the list.

The Equality and Human Rights Commission has published an eight step guide, and business.gov.uk directs employers to it along with the Commission's technical guidance (EHRC, business.gov.uk). The eight steps are an effective anti-harassment policy, engaging your staff, assessing and reducing risk, reporting, training, handling complaints when they arrive, third-party harassment, and monitoring and evaluation (EHRC). The Commission's technical guidance is explicit that an employer should consider the risks of sexual harassment occurring, consider what steps could reduce those risks, consider which of them are reasonable, and implement them (EHRC technical guidance).

Read that alongside the new standard and a pattern appears. Nearly every step requires a record. Not a policy in a folder, but evidence that something was done, on a date, by a named person, and looked at again afterwards.

Acas suggests measures including assessing risks regularly and acting on them, monitoring and recording incidents and the action taken, a policy that deals with third-party harassment, training such as staff safety and de-escalation, reviewing customer and supplier contracts and terms so they carry the relevant obligations, and telling customers what the consequences of harassing your staff will be. In higher-risk settings it goes further, to staffing levels, personal alarms, and cameras (Acas).

Very little of that is expensive. Almost all of it is administrative. Employers fail this duty not because they cannot afford the steps but because nobody was made responsible for taking them.

What to do between now and 30 October

Start with the assessment. It is first on the list of matters the regulations may specify, the Commission's guidance is built around it, and everything else follows from what it finds. Then close the gaps it identifies, in writing, with owners and dates. Where you decide a step is not reasonable for your business, write down that decision and your reasons, because Acas expressly invites you to.

For a business of 5 to 50 people with no HR function, that is a day of work, not a project. It is also the difference between having a defence and having an apology.

Download

We have prepared a harassment risk assessment template for UK employers, covering both the sexual harassment duty and the new third-party duty, structured around the Commission's eight steps and written for the standard that applies from 30 October 2026. It is free, it is editable, and it is designed to be completed by a business owner rather than a compliance department.

Download the harassment risk assessment template

If it has already happened

An assessment is prevention. Once a complaint has landed the question is different, and so is the risk. Harassment grievances become tribunal claims more often than any other kind, and from 1 October 2026 claimants have six months less one day rather than three months in which to bring most claims, so the file you create now will be read a great deal later than you expect. The time limit change is covered in our tribunal time limits briefing.

Electra HR runs the HR process, the documentation and the investigation through our grievances and disciplinaries support. Where a matter needs legal advice, or looks likely to end in litigation, solicitor-led legal support is available via Bonsai Law.

Talk to us about a harassment complaint

For the wider changes and dates, return to the Employment Rights Act 2025 pillar.

Related reading