Many employers have invested significantly in their preventative policies, processes and internal reporting arrangements. However, the “journey” is not over and employers should be careful not to conclude that workplace harassment has been “solved” just because it has a “speak-up” helpline which no one has used. The changes to the preventative duty from October focus on on-going prevention.
What’s Changing – Legal Landscape
From 30 October 2026, employers will be expected to take all reasonable steps, rather than simply reasonable steps, to prevent sexual harassment at work (including from third parties). Employers will also face potential liability where an employee is harassed by a third party in the course of their employment and the employer has failed to take all reasonable steps to prevent that harassment. Third parties may include customers, clients, service users, students, patients, contractors, consultants, suppliers, conference attendees and members of the public. The new third-party duty applies to both sexual harassment and harassment related to most protected characteristics (i.e. age, sex, race, disability, sexual orientation, religion/belief and gender reassignment).
These are huge changes and should be a significant focus for all employers.
What does the “all” in “all reasonable steps” mean?
Nothing is absolute and there can be no guarantees that a fellow colleague or customer won’t harass or sexually harass a colleague at work. That said, employers cannot turn a blind eye to foreseeable risks within their workplace, they cannot just be reactive. The word ‘all’ matters. The question is not simply whether the employer did something, but whether there were further reasonable preventative steps it could have taken.
In relation to the current “reasonable steps” sexual harassment preventative duty, the Equality and Human Rights Commission (EHRC) Guidance sets out an 8-step guide as to how employers should approach the duty. What is clear is that there is no one-size fits all approach. What is “reasonable” depends on the employer’s size, sector, resources, working environment, for example, how do your colleagues work and who do they come into contact with on a day to day basis – it is fact and risk-profile specific.
It may well be that the current EHRC guidance is updated. Moreover, the Government has stated that it will set out in Regulations what steps are considered “reasonable” when determining whether an employer has taken all reasonable steps; however, these are not expected to be in place until 2027/28, following consultation. The absence of new guidance is not a reason to delay action. Employers have had sufficient information to revisit their risk assessments, reporting routes, policies, contracts, training and governance arrangements.
Are risks closer than you think?
Employers should not wait for an incident to occur before asking what could have been done differently. The point of both the sexual harassment and third-party preventative duties is to ask the question in advance: “could this happen here, and if so, what can we do to prevent such behaviour?”.
Many businesses have already introduced speak-up helplines, confidential reporting channels, employee assistance arrangements or whistleblowing reporting. Some have invested in workplace mediation, while others have improved their grievance and investigation procedures. That is great – keep revisiting and refreshing what you are doing. Many employers say “we don’t have any issues here” but this does not necessarily mean there are no problems. It may mean that employees cannot easily access a reporting route, they may not trust them or do not believe anything will change if they do speak up. Fear may also be a factor. An employee may be reluctant to speak up because the concern involves a senior leader, important client or influential customer. In a challenging market, an individual may decide that raising concerns could place their employment at risk. Fear of retaliation or victimisation, although unlawful, can be a powerful deterrent to speaking up.
Start with a meaningful risk assessment
A generic risk assessment is not enough. Employers should identify where their colleagues may be exposed to risk. Relevant factors might include:
- Lone or late-night working, shift or irregular work;
- Colleagues who regularly attend conferences or hospitality events, including with third parties and particularly those involving alcohol;
- Where there is travel (domestic or foreign) or overnight stays;
- Colleagues who attend home visits, work in private residences or attend external meetings;
- Face to face contact, online meetings and digital communications;
- Where there is power imbalance within a team or business; or
- Where colleagues have contact with third parties – members of the public, clients, contractors and suppliers.
The assessment should identify who may be at risk, where and when the risk might arise, the people from whom it might arise, the controls currently in place and what further preventative steps may reasonably be taken – and when this should be achieved by and who has responsibility/ownership.
Risk assessments are living documents and should be regularly revisited – especially following a complaint/issue or a significant workforce change or operational change, or where new risks emerge. ACAS also recommends regularly assessing third-party risks, monitoring incidents, maintaining appropriate policies, training workers and reviewing customer, client and supplier terms. It also advises employers to record why a possible step was not considered reasonable, especially where a control is introduced for only part of the workforce.
Effective and well communicated policies
Policies and procedures should be up to date, accessible and clearly communicated. They should explain expected standards, what may constitute unacceptable behaviour, possible consequences if behaviour falls short (i.e. summary dismissal), reporting routes, and available support.
Is a policy enough? No – employers need to “walk the walk” and not just “talk the talk”. Any relevant policy must be understood and be authentic, by this I mean, firstly, that it should be relevant to the business/working environment and not a template, and secondly that employees have to believe that issues won’t be swept under the carpet. Another area of focus should be internal investigation processes. Are processes thorough enough, are investigators properly trained, and, in more complex issues, should an external investigator be used?
Creating a “speak-up” culture
Employers should also review their speak-up arrangements. Routes might include to HR, another appropriate manager, a confidential helpline, a trained contact, or using a whistleblowing process. Employers should also consider whether employees have access to an anonymous reporting route. Employees should know how to raise issues, and managers should know how to spot, manage and escalate concerns if they arise – no matter who the complaint is from or about.
If an employer says that it has a “zero-tolerance” approach to unacceptable conduct, it must be ready to demonstrate what that means in practice. If an employer over promises and under delivers, this can undermine trust. Employees must also feel empowered to speak up regardless of who the concern is about. That includes concerns involving board members, clients, customers, investors, service users or other third parties.
Asking difficult questions
Assessing risk, can lead to employers having to reflect on some difficult questions; for example, considering:
- Why are employees leaving?
- Are there unusually high levels of turnover in particular teams?
- What do exit interviews and leaver surveys reveal?
- Are employees confident that concerns will be taken seriously?
- Are there patterns in grievance, disciplinary or whistleblowing data?
- What does sickness absence data show?
- Are particular managers, locations, events or client relationships repeatedly mentioned?
- What do customers, clients or contractors say about the organisation’s culture?
Staff surveys should ask focused questions about dignity, respect, trust in management and confidence in reporting arrangements, also questions about workplace culture and whether they believe managers are held to the same standards of conduct and behaviour as employees.
Training must reflect the employer’s risk profile
A generic, one-off training video or talk is unlikely to be sufficient in demonstrating a commitment to preventing harassment and sexual harassment at work. Training should link directly to the employer’s policies, reporting routes, work environment and identified risk profile. Also, different groups require different training and information. Employees need to understand expected behaviour and how to raise concerns. Managers need to recognise warning signs, respond appropriately and know how to escalate matters. Boards and senior leaders need to understand governance, accountability, legal exposure and reputational risk. Training should be regularly refreshed and evaluated. Keep records and also make attendance mandatory – this is important for senior leaders and Boards.
Third-party prevention
Assessing third-party risks could require employers to consider different parts of the business as the interactions colleagues have with third parties may differ from site to site. In a third-party risk assessment, employers should consider the following measures, documenting why measures have/have not, been taken, for example (this is not exhaustive):
- Revisiting internal policies, processes and training – Does it cover third party risks? Is the zero tolerance messaging and speak-up culture clear?;
- Looking at commercial contracts and terms;
- Adding suitable wording to event invitations or terms and conditions;
- Notices or signage (for example in emails or posters in customer areas);
- Training for colleagues and managers on what to do with difficult customers or clients; and
- “On the ground” support – maybe through security or ensuring there is appropriate supervision of colleagues at all times.
Prevention is the point
Workplace sexual harassment and harassment risks have not disappeared, and the changes taking effect on 30 October 2026 will require employers to examine much more closely whether they have taken every reasonable preventative step available to them.
Legal exposure is only part of the picture. Poor workplace culture can damage wellbeing, retention, recruitment, productivity, reputation and client confidence. Complaints can consume considerable HR and management time, particularly where a complex external investigation is required.
Wherever an employer is on its preventative journey, it should not sit back and say: “These issues do not arise here”, or “We completed this exercise two years ago. Do we really have to do it again?!”
Risks evolve, technology changes, workplaces change and the preventative measures put in place must be tested for effectiveness. Prevention is the point.
We are here to help
Risk audits, risk assessments, investigations, policies, bespoke and tailored risk-specific training, support with grievances or claims – reach out, we are here to help.
The articles, webinars or podcasts published on this website are current at the date of publication and are for reference purposes only. They do not constitute legal advice and should not be relied upon as such. We cannot assume legal responsibility for the accuracy of any particular statement. Specific legal advice about your own circumstances should always be sought separately before taking any action
