From 30 October 2026, "reasonable steps" is no longer enough. Employers must take all reasonable steps to prevent sexual harassment, and they become directly liable when customers, clients, contractors or suppliers harass their staff.
One word has been added to the law. For small businesses, that one word changes a lot. A policy in a drawer and a quick word in the corridor won't cut it any more.
I've spent over 15 years in senior HR roles across food manufacturing, logistics, hospitality, education and charities. The businesses that get this right aren't the ones with the thickest handbook. They're the ones where everyone knows what's acceptable, and where leaders act the moment a line is crossed.
Here's what "all reasonable steps" looks like in practice, and what to do when a complaint lands on your desk.
What the law now says, plainly
The Employment Rights Act 2025 strengthens the duty that started in October 2024. From 30 October 2026, three things matter most.
- All reasonable steps to prevent sexual harassment. If a sexual harassment claim succeeds and you haven't met this duty, a tribunal can increase compensation by up to 25%.
- Third-party harassment. You're liable if a customer, client, contractor, supplier or member of the public harasses your employee and you didn't take all reasonable steps to stop it. This covers harassment linked to any protected characteristic, not just sexual harassment. Employees can bring a standalone claim for it.
- Whistleblowing. Reporting sexual harassment now counts as a protected disclosure, so people who speak up are protected from detriment.
The government plans regulations setting out what counts as "reasonable steps", but not before 2027. Until then, tribunals will look at what you actually did. The question they'll ask is simple: was there anything else you reasonably could have done?
Step 1: Start with a risk assessment
You can't prevent what you haven't looked for. A harassment risk assessment works just like a health and safety one: spot the hazards, judge the risk, put controls in place, review.
Look honestly at where harassment is more likely in your business:
- Customer-facing roles, such as hospitality, retail, care, reception and delivery drivers on client sites.
- Lone and remote working, including night shifts, home visits and staff working away.
- Power imbalances, like young or new starters, agency workers, apprentices and people on probation.
- Alcohol and social events, the Christmas party, team nights out and client entertaining.
- Workplace culture, where "banter" is the norm, teams are male- or female-dominated, or managers have been in post a long time unchallenged.
For each risk, write down what you'll do about it. That might be pairing staff on late shifts, a clear process for removing abusive customers, or a code of conduct for events. Date it, name who owns each action, and review it at least yearly or after any incident.
If you already do health and safety risk assessments, add harassment to them. A written, dated assessment is one of the first things a tribunal will ask to see.
Step 2: Have a policy people actually know about
A policy only protects you if your staff have read it, understood it and can find it. A good anti-harassment policy should:
- Name sexual harassment and harassment linked to every protected characteristic, with real examples.
- Cover third parties explicitly: customers, clients, contractors, suppliers and visitors.
- Explain how to report, including at least one route that bypasses the line manager.
- Promise that complaints will be taken seriously and that nobody will be victimised for raising one.
- Set out what happens next and the possible consequences, up to and including dismissal.
Then make it visible. Go through it at induction, get a signed acknowledgement, put it on the staff noticeboard or intranet, and remind people of it at least once a year. Tell your customers and contractors too, with signage, terms of business or a line in your contracts saying abuse of staff won't be tolerated.
Step 3: Train everyone, and train managers properly
Every employee needs training, not just the ones you think might need it. That includes part-timers, seasonal and agency staff. It should cover what harassment looks like, how to report it, and what to do if you witness it.
Managers need more. They're the people complaints come to first, and how they react in the first five minutes often decides whether a complaint is resolved or ends up at tribunal. Manager training should cover:
- Spotting the early signs, not just the obvious incidents.
- How to respond to a disclosure: listen, don't judge, don't promise confidentiality you can't keep.
- Their duty to act, even if nobody makes a formal complaint.
- How to record what they've been told, and who to escalate it to.
- Handling difficult customers and contractors.
A tick-box e-learning module done once in 2019 won't count. Keep training records, refresh it at least yearly, and make it relevant to your workplace with scenarios your team would actually recognise.
Step 4: Lead by example
Culture is set by what leaders do, not what the policy says. If the owner laughs at the inappropriate joke, the policy is worthless.
Leading by example means:
- Watching your own language and behaviour, at work and at work socials.
- Calling out "banter" that crosses the line, even when it's a senior person or a top performer.
- Applying the same standards to everyone. Your best salesperson or your oldest friend in the business gets no free pass.
- Talking openly about why this matters, so staff know you mean it.
If staff see leaders take it seriously, they'll trust that it's safe to speak up. That trust is your best early warning system.
Step 5: Stop relying on informal chats
"I had a quiet word with him" is one of the most common things I hear, and one of the most dangerous. An unrecorded chat leaves no evidence that you acted, no clear warning to the person responsible, and no protection for the person who complained.
If it isn't written down, as far as a tribunal is concerned it didn't happen. So:
- Record every concern, however minor it seems, with the date, who raised it, what was said and what you did.
- Treat harassment as a conduct matter and deal with it through your proper disciplinary or grievance procedure.
- Don't let "keep it informal" become "bury it". If the person who complained genuinely wants an informal resolution, that can be fine, but document it, confirm the outcome in writing, and follow up.
- Spot patterns. Three "quiet words" about the same person is a pattern, and you'll only see it if each one was recorded.
This isn't about creating a culture of fear. It's about making sure nothing falls through the cracks.
Step 6: Act immediately on unacceptable behaviour
The duty is to prevent harassment, and that means acting before behaviour escalates, not after a formal complaint arrives.
If you see or hear something inappropriate, deal with it there and then. Make it clear that it's not acceptable, record it, and take it forward through the right process. Waiting for someone to complain sends the message that the behaviour is tolerated.
The same goes for third parties. If a customer is abusive to a member of staff, step in, support your employee, and be prepared to warn, refuse service or end a contract. Your staff need to know you'll back them over a client.
What to do when a complaint comes in
How you handle the first conversation shapes everything that follows. Work through these steps:
- Listen and take it seriously. Thank them for coming forward. Don't minimise it, question their motives or suggest they're overreacting.
- Write it down. Record what they tell you in their own words, with dates, times, places and any witnesses. Ask them to check and sign it.
- Make them safe. Consider changes to shifts, locations or reporting lines while you investigate. Never move the complainant against their wishes, as that can look like punishment.
- Be honest about confidentiality. Promise discretion, not secrecy. You may need to share details to investigate fairly.
- Investigate promptly and fairly. Appoint someone impartial, interview both parties and witnesses, and gather evidence such as messages, CCTV or rotas. Use an external investigator if the accused is senior or close to the decision-maker.
- Decide and act. Where it's upheld, take proportionate disciplinary action. Where it isn't upheld, still look at what you can learn.
- Protect against victimisation. Make sure nobody suffers for raising a concern or giving evidence, and keep checking in with the complainant afterwards.
- Review and learn. Update your risk assessment, policy and training based on what happened.
If you're unsure at any point, get advice early. A misstep in the first week is far harder to fix than to avoid.
Your "all reasonable steps" checklist
- ☐ Written, dated harassment risk assessment, including third-party risks
- ☐ Anti-harassment policy covering sexual harassment, all protected characteristics and third parties
- ☐ Policy shared at induction, acknowledged in writing and refreshed yearly
- ☐ Customers, clients and contractors told that harassment of staff won't be tolerated
- ☐ Training for all staff, with extra training for managers, and records kept
- ☐ More than one way to report, including a route around the line manager
- ☐ Every concern recorded, including informal ones
- ☐ Leaders modelling the standards and acting on the spot
- ☐ A clear complaints and investigation process
- ☐ Regular review after incidents and at least once a year
Need a hand?
People. Process. Protection. That's what this duty is really about: protecting your people, having the right processes, and protecting your business when something goes wrong.
At HR PPL, I help SMEs put all of this in place without the jargon or the long contracts. That includes risk assessments, policies, manager training and support through live complaints. It's just me, so you'll always deal with someone who knows your business.
Get in touch at natasha@hrppl.co.uk or visit www.hrppl.co.uk.
This article is general guidance, not legal advice. The law is correct as at October 2026.
