The Strengthened Sexual Harassment Duty from 30 October 2026: What HR Must Be Able to Evidence

Key Takeaways

• From 30 October 2026 you must take all reasonable steps to prevent sexual harassment. Section 20 of the Employment Rights Act 2025 inserts the word "all" into section 40A(1) of the Equality Act 2010, raising the preventative duty that has applied since 26 October 2024.
• The 30 October date is announced, but it is not yet law. As at 25 September 2026, sections 20, 21 and 22 of the Act are enacted but not in force, and no commencement regulations for them have been made. The government's employer guidance (updated 17 September 2026) and Acas both give 30 October 2026, so treat it as your deadline.
• Harassment of your staff by customers, clients, patients and contractors becomes your legal liability. New section 40(1A) to (1C) of the Equality Act makes you liable where a third party harasses an employee in the course of their work and you did not take all reasonable steps to prevent it. It covers sexual harassment and harassment related to age, disability, gender reassignment, race, religion or belief, sex and sexual orientation.
• One incident is enough, and the employee can bring the claim against you directly. There is no "three strikes" rule and no requirement that you knew of earlier incidents, unlike the third-party regime repealed on 1 October 2013.
• "All reasonable steps" is an existing test, and tribunals decide it on evidence. It mirrors the defence in section 109(4) of the Equality Act: you have taken all reasonable steps only if there was no further step you could reasonably have been expected to take, and brief or stale training has failed that test before.
• Start with a written risk assessment that maps where third parties meet your staff. The EHRC says an employer is unlikely to comply with the duty without one. Record the steps you considered and rejected as well as the ones you took, because Acas advises writing down why a step was not reasonable for you.
• A breach can add up to 25% to a sexual harassment award. Under section 124A, when a tribunal upholds a sexual harassment claim it must consider whether you also breached the preventative duty and can uplift the compensation. The EHRC can enforce the duty even where no incident has occurred.
• There is no official list of required steps yet. Section 22 lets ministers specify steps in regulations under a new section 40B, but none have been made and the government expects them in 2027/28 after consultation. The EHRC technical guidance has not yet been updated for the 2025 Act.
• Two related changes are already in force. Reporting sexual harassment has been a protected whistleblowing disclosure since 6 April 2026, and from 1 October 2026 a harassment claim can be brought up to six months after the act, not three.
• Our HR compliance software keeps the records this duty is proven on. WPC HR's HR compliance software stores risk assessments, policy acknowledgements, training records and complaint files in one structured, timestamped file per worker, and our sponsor licence compliance audit tests that file before a tribunal or a compliance officer does.

Introduction

On 30 October 2026, two changes to the Equality Act 2010 are due to take effect. The duty to prevent sexual harassment of your employees rises from "reasonable steps" to "all reasonable steps". And you become liable when a customer, client, patient, contractor or member of the public harasses one of your staff and you had not done everything reasonable to stop it. Both changes come from the Employment Rights Act 2025, and both are won or lost in the same way: on what your records show you did before anything went wrong.

This post settles three questions an HR team needs answered before that date. What does "all reasonable steps" require in practice? Are customers and clients now your problem? And what evidence would persuade a tribunal that you did enough? The short answers are: more than a policy and a yearly e-learning module; yes, for harassment related to any of seven protected characteristics; and a dated, reviewed file showing that risks were identified, acted on and revisited.

Be clear about status. As at 25 September 2026, the harassment provisions are enacted but not yet in force. The government has announced 30 October 2026 and Acas has built its guidance around that date, but the commencement regulations that will switch the provisions on had not been made when we checked legislation.gov.uk today. Throughout this post we say which rules are already law, which are enacted and waiting, and which do not exist yet.

The changes apply in England, Wales and Scotland, not Northern Ireland. This post leaves the full Employment Rights Act timetable, tribunal procedure, confidentiality agreements and unfair dismissal to other posts, and deals only with the harassment duties and the evidence behind them.

Where the Law Stands on 25 September 2026

Most commentary on this subject blurs three layers of law. Keep them apart, because each carries a different consequence today.

The commencement point, spelled out

Sections 20, 21 and 22 did not come into force on Royal Assent, so each needs commencement regulations. The most recent commencement regulations under the Act, SI 2026/954, were made on 1 September 2026 and bring in only the longer tribunal time limits, from 1 October 2026. Nothing we found commences the harassment provisions, and legislation.gov.uk still marks all three, including the power in section 22, as prospective.

In practice, 30 October 2026 is the government's stated plan, Acas has written its guidance around it, and you should treat it as your deadline. Do not describe the new duties as law in a policy, contract or staff communication until the regulations exist. One practical warning: legislation.gov.uk can lag behind. It still shows the time limit provision as prospective even though SI 2026/954 commences it, so search for the statutory instrument itself rather than relying on the annotation on a section.

What "All Reasonable Steps" Adds to the Duty You Already Have

Since 26 October 2024, section 40A of the Equality Act 2010 has required you to take reasonable steps to prevent sexual harassment of your employees in the course of their employment. Sexual harassment here means unwanted conduct of a sexual nature that has the purpose or effect of violating someone's dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment for them (section 26(2)). The duty is anticipatory. It does not wait for a complaint.

Section 20 of the 2025 Act changes one word. The effect is to line the positive duty up with a standard employers already face. Under section 109(4), an employer sued over harassment by one of its own staff escapes liability only if it took all reasonable steps to prevent it. The Department for Business and Trade's factsheet on the change says the aim is to remove any perception that the preventative duty was the lower bar.

Because the words are now identical, the existing approach to section 109(4) is the best guide to how tribunals will read the strengthened duty. The EHRC technical guidance summarises that approach:

• You have taken all reasonable steps only if there were no further steps you could reasonably have been expected to take (paragraph 3.50).
• A tribunal can find that a step was reasonable even if it would not have prevented the harassment in question (paragraph 3.52).
• You may weigh a step's likely effect against its time, cost and disruption, but a step that would work can outweigh those costs (paragraph 3.53).
• Investigating and disciplining after the event is not enough on its own, although it can show your policy is taken seriously (paragraph 3.54).
• Training that staff attended but did not absorb can count against you. The guidance cites Allay (UK) Ltd v Gehlen (UKEAT/0031/20), where the Employment Appeal Tribunal upheld a finding that stale training did not satisfy the defence (paragraph 3.56).

Acas's guidance on the sexual harassment change puts the shift in three plain points: take all of the steps that are reasonable for your organisation rather than some of them; focus on preventing harassment rather than reacting to incidents; and apply steps across the whole organisation, not only to the people involved in a past incident. It confirms the duty covers online as well as in-person harassment, and that larger or more complex organisations are likely to need to do more.

How the duty is enforced

There is still no standalone claim for breach of section 40A. It is enforced in two ways. First, the EHRC can investigate, issue an unlawful act notice requiring an action plan, enter a binding agreement or seek an injunction under the Equality Act 2006, and it does not need an incident to have happened before it acts (EHRC paragraphs 3.36 and 3.37). Second, where a tribunal upholds a sexual harassment claim and awards compensation, section 124A requires it to consider whether you also breached the preventative duty, and lets it add an uplift of up to 25% reflecting the extent of the breach.

The uplift is a percentage of the whole compensation award, which can include loss of earnings, injury to feelings and personal injury. On a £40,000 award, the maximum uplift is £10,000. Section 124A applies to any contravention of section 40 that involved sexual harassment, and the new third-party provision sits inside section 40, so on the wording of the Act a successful claim of sexual harassment by a customer or client can attract the uplift too.

Third-Party Harassment: Are Customers and Clients Now Your Problem?

Yes. Section 21 of the 2025 Act inserts three subsections into section 40 of the Equality Act 2010. An employer must not permit a third party to harass one of its employees. It "permits" harassment only if the third party harasses the employee in the course of their employment and the employer failed to take all reasonable steps to prevent it. A third party is anyone other than the employer itself or one of its employees.

That definition is wide. Acas's guidance on third-party harassment lists customers, clients, service users such as patients or pupils, self-employed consultants, contractors and tradespeople, people at conferences and events, and members of the public in shared spaces, whether the harassment happens in person or online. In most organisations it will also include your clients' and suppliers' staff, agency workers engaged through someone else, and anyone your people deal with while working on another organisation's premises.

The missing knowledge requirement is the biggest difference from the previous regime. Until 1 October 2013, the Equality Act made employers liable for third-party harassment only once they knew of two earlier incidents. That rule was repealed in 2013, and in Unite the Union v Nailard (2018) the Court of Appeal confirmed that the repeal left nothing in its place. The new provision has no threshold at all.

Nor is there a carve-out for remarks an employee merely overhears. Parliament's Joint Committee on Human Rights raised the point and the government declined, relying on two existing safeguards. Conduct counts as harassment only if it is reasonable for it to have that effect, taking into account the employee's perception and the other circumstances (section 26(4)). And tribunals must balance freedom of expression under Article 10 of the European Convention on Human Rights. The government's factsheet is explicit that employers are not expected to foresee the wholly unforeseeable or police customers' private conversations, and that what you can reasonably do about third parties is more limited than what you can do about your own staff.

Where third parties meet your staff

Map the points of contact before you try to control them. The EHRC's list of risk factors (paragraphs 4.10 and 4.11) is a sound starting point: customer-facing duties, lone and night working, working alone with a third party, alcohol, events and conferences, travel and overnight stays, secondments and work at other locations. If your staff work on a client's premises, the client's employees are third parties to you, and your ability to prevent harassment depends largely on what your contract with that client says. Our guide to right to work records for contractors covers the file for workers placed on third-party sites, and the same contract review can pick up harassment terms.

The Evidence File: What a Tribunal Would Expect and the Record That Proves It

At a hearing the argument is framed around your steps, but it is decided on documents. The claimant's representative will ask what you did, when, for whom, and how you knew it worked. The table below sets each step against what a tribunal is likely to expect, drawn from the EHRC technical guidance and Acas, and the record you would produce. It is the same approach we took for exploitation allegations in our post on modern slavery and sponsor licences: the file is the argument.

Record the steps you decided against

This is the record most employers do not keep, and it matters most under the new wording. A tribunal will ask whether there was a further reasonable step you did not take. If you considered body cameras, extra security staff, a second person on night shifts or an external reporting line and decided against them, that decision is evidence. Acas advises recording why you judged a step not reasonable, including where you applied it to some teams only. Without the note, a tribunal sees an omission. With it, the tribunal sees a judgement it can assess.

Keep the note short: the step, the date, the risk it addressed, the reason (cost, practicality, or a better alternative already in place) and who decided. Revisit it at each review, because a step that was unaffordable last year may not be now, and a step later specified in regulations under section 40B will stop being optional.

Contracts and terms with clients, venues and suppliers

Third-party harassment is where contracts do real work. Acas suggests reviewing client, customer and supplier contracts and terms so they include the relevant parts of your policy, and making sure individual transactions, such as hotel bookings, carry up-to-date terms and conditions. Useful clauses include an obligation on a client to have its own anti-harassment arrangements for your staff on its site, a named contact and a timescale for dealing with complaints, your right to withdraw staff, and, for customers and service users, a conduct standard and a right to refuse or end the service. Where agency workers are involved, the EHRC expects the agency and the hirer to agree in writing who handles complaints (paragraphs 4.42 to 4.47).

Keep the signed versions. A clause that appears only in a template adopted after the incident proves nothing about the date that matters.

Complaints, outcomes and data protection

A central complaints register is one of the strongest pieces of evidence you can hold, because it shows both that you knew what was happening and what you did about it. The EHRC recommends logging informal complaints as well as formal grievances (paragraph 4.29), and warns against reading a low number of complaints as a low level of harassment (paragraph 4.31). The register must comply with UK GDPR: tell workers in your privacy notice that the data will be held, restrict access and record your lawful basis. The same care applies to telling a complainant what action was taken against a harasser. The EHRC says disclosure will often be lawful where you have been clear that outcomes may be shared and you act proportionately, and that you should record the decision and your reasons (paragraphs 4.84 to 4.86).

Review Dates: Keeping the Evidence Current

Evidence goes stale. A policy last reviewed years ago, training delivered once at induction, and a supervisor who tells a complainant to "toughen up" are exactly what the Acas and EHRC examples of failure describe. Put review dates in the file and meet them.

Keep the file long enough to answer a claim: from 1 October 2026, a harassment claim can be brought up to six months after the act complained of, not three, where that act happens on or after that date (SI 2026/954).

Sexual Harassment Is Now a Protected Disclosure

Since 6 April 2026, a disclosure that sexual harassment has occurred, is occurring or is likely to occur has been a qualifying disclosure under section 43B(1)(da) of the Employment Rights Act 1996, inserted by section 23 of the 2025 Act. As with any qualifying disclosure, the worker must reasonably believe it is made in the public interest. A worker who makes it is protected from detriment, and an employee dismissed for making it is treated as automatically unfairly dismissed.

For HR, the practical point is how complaints are handled. A complaint treated as a nuisance, a complainant moved to worse shifts, or a manager who has a quiet word about loyalty can now found a whistleblowing claim alongside the harassment claim. Your complaint file should show that the complainant was supported and not disadvantaged. Our sister firm WorkPermitCloud explains the April 2026 change in its guide to UK employment law changes in April 2026.

Sponsored Workers: Where Harassment Meets Your Sponsor Duties

If you hold a sponsor licence, harassment of a sponsored worker, or a complaint from one, is also an HR records matter that can surface on a compliance visit. Paragraph C1.53 of the sponsor guidance, part 3 (version 08/26, valid from 28 August 2026) makes compliance with wider UK law a sponsor duty, including UK employment law and "ensuring your workers are aware of their employment rights". The guidance does not mention harassment, and it does not say how a harassment complaint or tribunal finding would be treated, so we do not suggest a single complaint puts a licence at risk.

The realistic exposure is the file. Compliance officers may interview sponsored workers (paragraph C7.14), and a worker who has raised a complaint may mention it. You want to be able to show that the worker knew their rights and how to report, that the complaint was logged and handled like any other, and that the worker suffered no detriment. If a complaint leads to a change in a sponsored worker's duties, hours or place of work, check it against your reporting duties before you make it. Our guides to sponsor duties, Appendix D record keeping and preparing for a Home Office compliance visit cover the rest of the file.

How Can WPC HR Help?

The strengthened duty is proven through records: a dated risk assessment, a policy every worker has acknowledged, training with dates, a complaints register and the notes that explain your choices. Our HR compliance software gives each worker one structured file, so policy acknowledgements, training certificates and complaint documents sit alongside the rest of their HR record, and the timestamped compliance report shows you check it regularly. For sponsored workers, our worker rights duty support helps you record that each worker was told their employment rights.

If you hold a sponsor licence, our sponsor licence compliance audit reviews your HR records the way a compliance officer would, and gives you a prioritised list of gaps to close before 30 October 2026.

Conclusion

The word "all" looks like a small amendment. In practice it moves the question a tribunal asks from "did you do something sensible?" to "was there anything else sensible you did not do?", and it arrives alongside a new liability for harassment by people you do not employ. Neither question is answered by good intentions. Both are answered by a file.

With five weeks to go, the priorities are clear: a risk assessment that maps third-party contact points, a policy that covers third parties and every form of harassment, a training schedule with refresh dates, more than one reporting route, updated client and supplier terms, and a note of every step you considered and rejected. Watch for the commencement regulations, and for the updated EHRC guidance, which will replace parts of the current version that the new law overtakes.

Glossary