Contents
Status at 31 October 2026: in force since 30 October 2026
The Employment Rights Act 2025 sections 20, 21 and 22 came into force on 30 October 2026 (S.I. 2026/1065, regulation 3). They apply in England, Scotland and Wales. The “reasonable steps” duty has applied since 26 October 2024. The Government has a power to make regulations listing steps that count as reasonable (new section 40B of the Equality Act 2010, in force from 30 October 2026, regulations would need Parliament’s approval), but we found no regulations made under it on 31 October 2026. Check before relying on this guide after that date.
The short version
- The duty gets tougher. Since 26 October 2024 an employer must take reasonable steps to prevent sexual harassment of its employees. From 30 October 2026 it must take all reasonable steps.
- Customers and other third parties. From the same date an employer must not “permit” a third party to harass an employee. You permit it if the harassment happens in the course of the employee’s job and you did not take all reasonable steps to prevent it.
- No list of steps. The law does not say what you must do. What is reasonable depends on your size, sector, the work and the risks.
- Prove it. Acas says to assess the risks, take steps, and record what you did and why. If something goes wrong, your records are your evidence.
- Money. A tribunal can add up to 25% to compensation if it finds sexual harassment and that you breached the duty. The Equality and Human Rights Commission (EHRC) can also enforce the duty.
This guide is general information, not legal advice. It covers Great Britain, not Northern Ireland, and it is about sexual harassment of employees, with a note on the wider third-party wording.
What changes on 30 October 2026
| Topic | Until 29 October 2026 | From 30 October 2026 |
|---|---|---|
| Preventing sexual harassment of employees | Take reasonable steps (Equality Act 2010, section 40A) | Take all reasonable steps (Employment Rights Act 2025, section 20) |
| Harassment of an employee by a customer, client or other third party | No specific rule makes the employer liable for it. The Equality and Human Rights Commission treats the preventative duty as covering it, but the duty cannot be enforced by a worker on its own | Employer must not permit a third party to harass an employee, unless it took all reasonable steps to prevent it (new section 40(1A) to (1C) of the Equality Act, from section 21) |
| A list of steps treated as reasonable | None | The Government can make regulations listing steps (new section 40B, from section 22); we found none made yet |
The new third-party wording is about “harassment” as the Equality Act defines it in section 26. That covers unwanted conduct of a sexual nature, and also unwanted conduct related to sex, race, disability, age, religion or belief, sexual orientation or gender reassignment. So a customer’s racist abuse of a member of staff can matter under the same rule, even though the main change is about sexual harassment.
A “third party” is anyone who is not the employer and not one of its employees. Acas gives customers, clients, service users, self-employed contractors and tradespeople, people at events and members of the public as examples.
What “all reasonable steps” means
Acas says it means taking all of the steps that are reasonable for your organisation, not just some. It focuses on preventing harassment, not only reacting to it, and on steps across the whole organisation. It includes online and in-person harassment.
There is no fixed list. Acas lists things to weigh up: the size of your organisation, the kind of work, the risks, who your workers meet and how often, whether it has happened before, and your resources. Larger or more complex employers are likely to need more steps. If you decide a step is not reasonable, Acas suggests recording why.
What it can cost you
- Compensation uplift. If an employment tribunal finds sexual harassment, orders compensation, and finds you also breached the duty, it may increase the compensation by up to 25%, reflecting the extent to which it finds you failed in the duty.
- EHRC enforcement. A worker cannot bring a stand-alone tribunal claim for breach of the section 40A duty itself, but the EHRC can enforce it.
- Claims about customers and other third parties. From 30 October 2026 an employee can bring a tribunal claim under new section 40(1A) if a third party harassed them in the course of their job and you failed to take all reasonable steps to prevent it.
- Responsibility for your employees. You can be held responsible for what your employees do in the course of their jobs, unless you show you took all reasonable steps to prevent it.
- Time limit. For acts on or after 1 October 2026 a tribunal claim under the Equality Act can be brought within six months of the act. Before that, the limit was three months, and the older limit still applies to acts that ended before 1 October 2026 (for conduct over a period, the date that counts is the end of the period). Some Acas pages may still say three months.
A 30-day plan for a small employer
The new duties start on 30 October 2026 and the commencement regulations give no grace period, so treat this as a plan to start now, not a deadline that begins on 30 October. You decide what is reasonable. This is a sensible order for a business with no HR department. Acas pages on steps for employers and the policy are the best free reference.
- Name someone responsible. Acas suggests a senior person who makes sure the organisation is taking steps.
- Assess the risks. Think about customers meeting staff alone, alcohol, work social events, power imbalances, travel for work, young workers and late or lone shifts. Ask staff what makes them uncomfortable.
- Write a policy. Acas says it should explain what sexual harassment is, say you will not tolerate it, say what to do, explain how managers handle complaints, cover third parties, set out support, say how you handle time off because of sexual harassment, and cover how you manage risks. Give people more than one person to report to. If you write a specific policy, Acas says to consult any recognised union or, if there is none, other worker representatives.
- Deal with customers and suppliers. Acas lists risk assessment, a policy, training such as de-escalation, terms for customers and suppliers, telling customers the consequences of harassing staff, and recording incidents. For higher-risk places, it lists enough staff, alarms and sometimes cameras.
- Tell and train people. Give everyone the policy and brief them. Train managers on how to take a report. Include it in induction.
- Know how to handle a report. Take it seriously, keep an open mind, do not discourage the person, never cover it up, and follow a fair procedure in line with the Acas Code. You cannot use a non-disclosure agreement to stop someone reporting a crime to the police or making a whistleblowing disclosure about sexual harassment (sexual harassment disclosures have been protected whistleblowing since 6 April 2026).
- Keep records. A log of reports and what you did, who was briefed and when, and each review. Keep the log private and secure, because it is personal data.
- Review. After any report, when something changes, and regularly (once a year is a sensible default).
What the law does not say
- It does not say you need a particular policy, training course or risk assessment form. The steps are for you to decide.
- It does not say you have to prevent every incident. It asks whether you took all reasonable steps.
- It does not (yet) say what counts as reasonable. If regulations are made, they will, and you should read them.
- The new duties are written about “employees”, but in the Equality Act that word is read with section 83, which covers a contract of employment, a contract of apprenticeship and a contract personally to do work, so it reaches further than the usual employment-law meaning. Agency and other contract workers are protected by a separate section (41), and job applicants by section 40(1), neither of which these changes amended. Treating everyone who works for you the same way is simpler and safer.
Frequently asked questions
Does this apply to a business with one or two employees?
Yes. The duty is on employers of any size. Size is one of the things that decides what is reasonable, so a small business may need fewer or simpler steps than a large one. You still need to assess the risks and take every step that is reasonable for you.
Does it apply to Northern Ireland?
No. Sections 20 to 22 extend to England, Wales and Scotland. Northern Ireland has its own equality law.
Is a policy enough?
No. Acas says to assess risks and take steps, not only to have a policy. Acas gives an example of an employer with a policy that was not reviewed or used, and training in only one area, as very unlikely to have taken all reasonable steps. A policy nobody knows about does not help you.
Are we responsible when a customer harasses our staff?
For harassment that happens on or after 30 October 2026, yes, if you failed to take all reasonable steps to prevent it and it happened in the course of the employee’s job. If you did take all reasonable steps, you are not treated as permitting it.
Does the new third-party rule cover harassment that is not sexual?
The wording of the new rule is about harassment generally under section 26 of the Equality Act, so it is not limited to sexual harassment. Acas describes it as covering harassment from third parties.
Where is the official guidance?
Acas has guidance for employers on its harassment law changes pages. The Equality and Human Rights Commission also publishes guidance on preventing sexual harassment. Neither is a checklist that guarantees a result.
Sources
Last checked 31 October 2026.
- Employment Rights Act 2025, section 20, section 21 and section 22, legislation.gov.uk
- The Employment Rights Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (S.I. 2026/1065), legislation.gov.uk (regulation 3: 30 October 2026)
- Equality Act 2010, section 40A, section 26, section 109, section 123 and section 124A, legislation.gov.uk
- The Employment Rights Act 2025 (Commencement No. 5 and Transitional Provisions) (Amendment) Regulations 2026 (S.I. 2026/954), legislation.gov.uk (six-month tribunal limit from 1 October 2026)
- Harassment law changes: sexual harassment and third party harassment, Acas
- Steps for employers to prevent sexual harassment, Creating a sexual harassment policy and Handling a sexual harassment complaint, Acas
Changes to this guide
- 28 October 2026: Published as a draft for review.
- 31 October 2026: Status box changed from “takes effect on 30 October” to “in force since 30 October” after checking legislation.gov.uk (sections 20 to 22 and S.I. 2026/1065) and Acas. Links to two new related guides added. This change is not covered by the 28 October review.
This guide is general information written from the official sources listed above and checked on 31 October 2026. It is not legal, tax or financial advice, and Plainfiles is not endorsed by any government body. Rules change, so check the linked official pages for your own situation. Written and designed by Plainfiles with the help of artificial intelligence (AI) tools, then checked against the official legislation and guidance listed in the sources. How we write and check our guides.