Contents
Status at 31 October 2026: in force since 30 October 2026
Since 30 October 2026 an employer in England, Scotland and Wales must take all reasonable steps to prevent sexual harassment of its employees, and must not permit a third party such as a customer to harass them if it failed to take all reasonable steps to prevent it (Employment Rights Act 2025 sections 20 and 21, brought into force by S.I. 2026/1065). We checked legislation.gov.uk and Acas on 31 October 2026. The Government has a power to list steps that count as reasonable (new section 40B of the Equality Act 2010) but we found no regulations made under it.
The short version
- No official form. The law says “all reasonable steps”. It does not name a risk assessment or give a template. Regulations could one day specify assessments (section 40B(2)(a) allows it), but none have been made.
- Acas says to assess the risks. Its steps page says: “You should assess any possible risks in your organisation”, and “Sexual harassment can happen in any organisation. You must not assume that it will not happen.”
- Four questions. Acas’s order is: consider the risks, consider the steps that could reduce them, decide which of those steps are reasonable for you, then take them.
- Write it down. Acas does not make a written form compulsory, but a dated page is how you show what you considered. For a step you decide is not reasonable, Acas says it is a good idea to record why.
This guide is general information, not legal advice. It covers Great Britain, not Northern Ireland.
What Acas says to look at
Acas says a risk assessment should consider factors specific to your sector, the type of work, ways of working and the different roles in your organisation. It lists these as higher-risk factors:
- meeting clients or service users alone
- an environment where people are drinking alcohol
- work-related social events
- power imbalances between workers
- travelling for work, including overnight stays
It also says some people may be at higher risk, for example younger workers, including apprentices and interns, and people with learning difficulties. And it says that “in the course of their employment” is not just the main workplace: it can include working from home, travelling for work, meeting customers and clients in other locations, an external training course and an office party.
A template you can copy
One row for each situation where your staff could be harassed, by a colleague, a manager or a third party. Replace the bracketed text with your own words. Add rows for anything specific to your work.
| Situation | Who could be affected | Who could harass | Steps we will take | Who and by when | Reviewed |
|---|---|---|---|---|---|
| (describe the situation) | (roles or names) | Colleague, manager, customer, other third party | (what you will do to reduce the risk) | (name, date) | (date, outcome) |
| (another situation) |
For each row, ask: what could happen, how likely is it here, who is most at risk, what would reduce it, is that step reasonable for a business our size, and if not, why not.
A worked example: a small pub
This is an invented example to show the level of detail, not a model answer for your business. The steps are taken from the lists Acas gives, and whether they are reasonable for you depends on your size, premises and resources.
| Situation | Who could be affected | Who could harass | Steps we will take | Who and by when | Reviewed |
|---|---|---|---|---|---|
| Bar staff serving customers who have been drinking | All bar staff, especially under-25s | Customers | Two people on every evening shift; staff know they can step away and call the manager; sign saying harassment of staff is not tolerated and customers may be refused service | Landlord, sign up by 14 Nov | Review after any incident |
| Closing up alone | Whoever closes | Customers, delivery drivers | No one closes alone on Fridays and Saturdays; personal alarm for the closer | Landlord, from 14 Nov | In 3 months |
| Staff Christmas party | All staff | Colleagues, managers, customers who join in | Short reminder of the policy before the party; named manager who is not drinking and can be spoken to | Landlord, 1 Dec | After the party |
| Manager with power over rotas and tips | Junior staff | Manager | More than one person to report to, including someone who is not the manager; policy says complaints will not be ignored | Landlord, 14 Nov | In 3 months |
| Messages and social media between staff and customers | All staff | Colleagues, customers | Policy covers online conduct; staff told to show messages to the manager | Landlord, 14 Nov | Annually |
How to fill it in
- Name who owns it. Acas suggests having someone at senior level make sure the organisation is taking steps.
- Ask your staff. Acas lists anonymous surveys as a way to understand people’s experiences, and says it is the employer’s responsibility to encourage workers to report, including situations where they felt at risk even if nothing happened. A chat at a team meeting or a note box works in a small team.
- List the situations. Walk through a normal week, start to finish, and think about where staff are alone with customers, around alcohol, travelling, working from home or on social occasions.
- Choose the steps. Acas’s examples include more than one way to report (for example, to someone other than the line manager), panic buttons or alarms for workers who are alone with customers, standards of behaviour for work social events, telling customers the consequences of harassing workers, training, and monitoring reports.
- Record why not. If you consider a step and decide it is not reasonable, write the reason and the date. Acas says this could include taking a step for only some workers.
- Set a review. Acas says to review risk assessments regularly and to review policies if sexual harassment happens. It gives no fixed interval. After any report, when your work changes, and at least once a year is a sensible default (our suggestion, not Acas’s).
What it does not do
A risk assessment is one step, not the whole duty. Acas gives an example of an employer with a policy that was not reviewed or used, and training in only one area, and says it is very unlikely to have taken all reasonable steps. So the assessment has to lead to things you actually do: a policy people can find, a briefing, a way to report, and records.
Free checklist and the full kit
The free 30-Day Action Checklist (two pages from our kit, unaltered) puts the first month in order, week by week. The Sexual Harassment Prevention Kit (£14) has a ready-made risk assessment with the factors and third parties already listed, plus the policy, third-party procedure, manager’s guide, staff briefing sheet and three logs. No template makes you compliant: the law does not list the steps, so the kit helps you decide, take and record yours.
Frequently asked questions
Is a sexual harassment risk assessment required by law?
The law requires you to take all reasonable steps to prevent sexual harassment. It does not name a risk assessment. Acas says you should assess possible risks, so in practice an assessment is the sensible first step. If regulations under section 40B are ever made, they could specify assessments.
Does it have to be in writing?
The law does not say. Writing it down, with dates, is the simplest way to show what you considered and decided. Acas suggests recording why you did not take a step you decided was not reasonable, and keeping a record of incidents and the action taken.
Does a business with two or three staff need one?
The duty is on employers of any size. Size is one of the things Acas lists for deciding what is reasonable, so a short one-page assessment can be enough for a small team. You still need to think about the risks and write down what you decided.
Do we need to cover customers?
Yes, if your staff meet any. Since 30 October 2026 an employer can be liable if a third party harasses an employee in the course of their job and the employer failed to take all reasonable steps to prevent it. Acas lists customers, clients, service users, self-employed consultants, contractors or tradespeople and members of the public as examples of third parties. See our guide on customers harassing your staff.
Do we need to include home workers?
Acas says working from home can be “in the course of employment” and suggests regularly checking in with people working from home, where inappropriate behaviour might be less obvious. Add a row for it.
Sources
Last checked 31 October 2026.
- Employment Rights Act 2025, section 20 and section 21, legislation.gov.uk (in force 30 October 2026, S.I. 2026/1065 regulation 3)
- Equality Act 2010, section 40B, legislation.gov.uk (power to specify reasonable steps; no regulations found)
- Steps for employers to prevent sexual harassment, Acas (updated 30 October 2026)
- Preventing harassment, Acas (updated 30 October 2026)
- Harassment related to protected characteristics, Acas (third parties and “in the course of employment”)
Changes to this guide
- 2 November 2026: Reviewed by Liam Humphreys; no changes to the guidance.
- 31 October 2026: Published, with the byline By Plainfiles until a named review.
This guide is general information written from the official sources listed above and checked on 2 November 2026. It is not legal, tax or financial advice, and Plainfiles is not endorsed by any government body. Rules change, so check the linked official pages for your own situation. Written and designed by Plainfiles with the help of artificial intelligence (AI) tools, then checked against the official legislation and guidance listed in the sources. How we write and check our guides.