October 2026 Sexual Harassment Law Changes: What Employers Need to Do Now

5 Oct

From 30 October 2026, the legal expectations placed on employers around workplace harassment will change significantly.

The Employment Rights Act 2025 strengthens the existing duty to prevent sexual harassment, moving employers from a requirement to take “reasonable steps” to a requirement to take “all reasonable steps”. It also introduces employer liability for harassment by third parties, such as customers, clients, contractors, service users and members of the public, unless the employer has taken all reasonable steps to prevent it. These provisions apply in England, Wales and Scotland.

One additional word might not sound transformative. But “all” changes the question employers may ultimately have to answer.

It is no longer simply: what did we do to prevent harassment?

It becomes: what risks did we identify, what preventative measures were reasonably available to us, which did we take, and can we demonstrate that we did so?

For organisations that have historically relied on an anti-harassment policy and periodic online training, that deserves attention.

What changes on 30 October 2026?

There are two important developments.

The first concerns sexual harassment prevention.

Employers have been under a preventative duty since October 2024 to take reasonable steps to prevent sexual harassment. From 30 October 2026, employers will instead be expected to take all reasonable steps that are appropriate for their organisation.

Acas explains that this means taking all steps that are reasonable in the circumstances, rather than selecting some reasonable measures and stopping there. Prevention should also operate across the organisation rather than simply responding to individuals or incidents after something has happened.

The second change concerns third-party harassment.

An employee may encounter people through their work who are not employed by the same organisation: a customer in a shop, a patient in a hospital, a client at a professional services firm, a contractor on site, a delegate at a conference or a member of the public.

From 30 October, an employer can be liable where a third party harasses an employee in the course of their employment and the employer failed to take all reasonable steps to prevent it.

That significantly broadens the practical risk landscape organisations need to consider.

“All reasonable steps” will look different from one employer to another

There is no universal list of measures that every organisation can implement and declare itself finished.

What is reasonable will depend on factors including the organisation's size, sector and the type of work its people carry out. A hotel employing night staff who routinely interact with intoxicated guests has a different risk profile from an accountancy firm. A charity sending employees overseas has different considerations from a retailer operating hundreds of public-facing sites. A construction company needs to consider relationships between employees, subcontractors, site visitors and clients. A university may need to think about interactions involving staff, students, external speakers and visitors.

That makes harassment risk assessment increasingly important.

The EHRC's guidance already recommends identifying factors that could increase the likelihood of sexual harassment, including power imbalances, lone or night working, customer-facing roles, alcohol, external events and job insecurity. Employers are expected to think proactively about where harassment could occur rather than waiting for a complaint to reveal the risk. This is perhaps the biggest practical shift organisations need to understand.

Harassment prevention is becoming less about possessing the right documents and more about demonstrating an active system of prevention.

A policy is important, but it cannot do the job by itself

Policies remain essential. Employees need clear standards, reporting routes and an understanding of what behaviour will not be tolerated.

But a policy cannot tell you whether managers know what to do when someone discloses harassment to them.

It cannot tell you whether employees working with customers understand how to respond when a boundary is crossed.

It cannot tell you whether concerns raised in one part of the organisation form part of a wider pattern.

And it cannot tell you whether the person appointed to investigate a serious allegation actually knows how to conduct a fair, sensitive and evidence-led investigation.

The EHRC explicitly warns against relying on policies and procedures alone. Its current guidance covers risk assessment, reporting arrangements, training, complaint handling, third-party harassment and ongoing monitoring as interconnected elements of prevention.

For HR, People, Employee Relations, Compliance and Ethics teams, October 2026 therefore presents a useful opportunity to look beyond documentation and ask whether the organisation's arrangements actually work.

Why sexual harassment training needs another look

Training is likely to form an important part of many employers' response to the October 2026 sexual harassment law changes.

But the existence of a training module is not necessarily the same thing as having an effective prevention programme.

The EHRC recommends training workers, managers and senior staff on what workplace sexual harassment looks like, what to do when they experience or witness it, and how complaints should be handled. In environments where third-party harassment is more likely, training should also address those particular risks. Training effectiveness should be reviewed and refresher sessions provided regularly.

There is good reason for the emphasis on different audiences.

An employee needs to recognise inappropriate behaviour, understand organisational expectations and know where they can report a concern. A manager needs a different set of skills.

If an employee says, “Can I tell you something that happened with a client last night?”, the manager is suddenly making decisions that matter.

How do they respond without minimising what has happened?
What should they record?
What can they promise about confidentiality?
Who needs to know?
Does any immediate action need to be taken?
How do they avoid inadvertently prejudging the allegation?
What should happen if the employee asks them not to take the matter any further?

Those questions cannot be answered by telling managers simply to “refer it to HR”.

Manager harassment training needs to prepare people for the moment a concern actually lands in front of them.

Third-party harassment training needs to reflect the real workplace

The new third-party liability provisions also make generic training less useful. Acas recommends measures including regular third-party harassment risk assessment, incident monitoring, appropriate policies, staff training and, where relevant, reviewing terms with customers, suppliers and clients.

The practical scenarios will vary enormously between organisations.

For one workforce, the relevant scenario may involve inappropriate comments from an important client. For another, it could involve aggressive behaviour from a member of the public. Elsewhere, it could involve a contractor, a patient, a hotel guest or somebody attending a corporate event.

Training becomes considerably more valuable when employees can work through situations they might genuinely encounter and understand both the organisation's expectations and the practical options available to them.

That means asking questions such as:

What should the employee do at the time?
When should a manager intervene?
When might the organisation remove a worker from the situation rather than expecting them to manage it?
How should incidents be recorded?
When does repeated low-level behaviour become a pattern requiring further action?
What control does the organisation have over the third party, and how should that control be exercised?

Those conversations move training away from abstract compliance and towards actual prevention.

Investigation capability is part of prevention too

There is also a tendency to treat prevention and investigation as separate disciplines. They should not be.

When harassment is reported, the way an organisation handles the concern can determine whether it understands what has happened, identifies wider risks and prevents the same problem recurring.

A competent workplace investigation requires more than interviewing the complainant and the person complained about. Investigators may need to identify and preserve evidence, establish an appropriate scope, manage conflicting accounts, interview witnesses sensitively, distinguish evidence from assumption and produce findings that can withstand scrutiny.

The investigation can also reveal something larger than the allegation itself. Perhaps managers repeatedly failed to escalate concerns. Perhaps several employees experienced similar behaviour from the same customer. Perhaps staff did not trust the existing reporting mechanism. Perhaps training concentrated entirely on employee-to-employee harassment despite significant third-party exposure. Those are prevention issues.

The organisation only benefits from finding them if there is a mechanism for investigation findings and lessons to feed back into risk assessments, policies, management practice and future training.

The evidence trail matters

Another consequence of the move towards all reasonable steps is that organisations should think carefully about what they could actually demonstrate if challenged.

That might include records showing:

when harassment risks were assessed;
what risks were identified;
what preventative measures were considered;
what action was taken;
who received training and when;
whether managers received role-specific training;
how concerns were reported and handled;
whether patterns and trends were reviewed;
and how lessons from incidents or investigations led to changes.

The EHRC already has enforcement powers in relation to the preventative duty. Where an employment tribunal upholds a sexual harassment claim and finds that the preventative duty was breached, compensation can also be increased by up to 25%.

Evidence therefore serves two purposes. It can help an organisation demonstrate what it has done. More importantly, collecting and reviewing that evidence helps determine whether its prevention arrangements are actually effective.

What should employers be doing before October?

There is still time to prepare, but this is probably not something to leave until the final week of October.

Organisations should be looking across the whole system: identifying where harassment risks exist, reviewing policies against those risks, considering third-party interactions, checking reporting routes, testing investigation capability and looking critically at existing sexual harassment training and manager training.

For many employers, the useful question is not simply “Do we provide training?” It is:

“Does our training equip the right people to prevent, recognise and respond to the risks that actually exist in our organisation?”

That is a much higher bar. And it is one worth addressing before the law changes rather than afterwards.

Preparing your people for the October 2026 changes

At EthicsVision International, we design and deliver practical workplace investigations and misconduct training for organisations in the UK and internationally.

For organisations reviewing their approach ahead of 30 October 2026, we can provide tailored training for employees, managers, HR and People teams, Employee Relations professionals, Compliance and Ethics teams, and workplace investigators.

Rather than relying on generic scenarios, training can be built around the organisation's own working environment, policies and risk profile, including the third-party situations its employees actually encounter.

For managers, that can mean practising how to receive and respond to disclosures appropriately.

For HR and investigators, it can mean developing the skills required to scope and conduct fair, sensitive and defensible harassment investigations.

For organisations more broadly, it means turning written expectations into something people understand and can use when a real situation arises.

The October 2026 changes increase the legal expectation. The more important question is whether the people expected to make prevention work in practice are genuinely equipped to do it.