The HR Professional's implementation guide to the October 2026 harassment duty
Updated: 3 days ago
Guidance for HR directors and senior HR professionals in Harpenden, St Albans, Hertfordshire and London on getting ready for the harassment law changes that take effect in October 2026.
UK workplace harassment law is about to shift in a meaningful way. From October 2026, employers face a higher bar for preventing sexual harassment and a new form of liability for harassment by people outside the organisation.
This guide sets out a practical, step-by-step approach to help HR leaders prepare their organisations before the new rules arrive.
The two changes arriving in October 2026
1. A tougher preventative duty on sexual harassment
Employers have been under a duty to take "reasonable steps" to prevent sexual harassment since October 2024. In October 2026, the wording becomes "all reasonable steps".
That one extra word makes a real difference to the legal test. To find that an employer has complied, a tribunal will need to be satisfied that nothing further could reasonably have been done.
The duty extends to any sexual harassment sufficiently connected to the employee's work. That includes incidents away from the workplace, at social events and harassment carried out by third parties.
2. Direct liability for third-party harassment
Employers will become directly liable where an employee is harassed during their employment by a third party, such as a client, customer, contractor or service user, unless the employer can show that it took all reasonable steps to prevent it.
This is not limited to sexual harassment. It covers harassment related to any relevant protected characteristic, including age, disability, gender reassignment, race, religion or belief, sex and sexual orientation. These protections were taken out of the legislation in 2013, so bringing them back substantially widens what employers are responsible for.
The same standard, all reasonable steps, applies to both duties. In each case, what counts is the action you took before anything happened, not how you dealt with it afterwards.
Five steps to prepare your organisation
Step 1: Review the evidence you already hold
Before designing anything new, get a clear picture of your starting position.
Gather every document and record you have that relates to preventing harassment:
Your anti-harassment policy
Training records
Earlier risk assessments
Reporting procedures and the outcomes of complaints
Next, test that material with some tougher questions.
When was the policy last reviewed? Can every employee easily find it, or is it tucked away on a shared drive? Does it deal specifically with third-party harassment? Does it address harassment linked to every relevant protected characteristic, or sexual harassment alone?
Look closely at your training records. Could you prove who took part, on what date and what the session covered? If you use eLearning, can you report on completion rates and show that the content moves beyond raising awareness to changing behaviour?
Then examine your reporting data. How many complaints have been raised over the past two years? How was each one handled? Were the outcomes recorded and communicated?
Any gaps you uncover are valuable. They show you precisely where your risk lies and what to tackle first.
For more on this, read why your sexual harassment policy probably isn't doing what you think it is.
Step 2: Carry out a documented harassment risk assessment
A risk assessment sits at the heart of showing that you have complied.
The EHRC's guidance is clear that the assessment must reflect your own workplace, the roles within it and the environment you operate in.
Begin by identifying where harassment is most likely to happen. Consider who comes into contact with whom, where those interactions take place and what power dynamics are involved.
Look at the make-up of your workforce. Do any teams have a marked gender imbalance? Are there lone workers? Do people regularly deal with members of the public? Are some employees working night shifts, or working remotely with little regular contact with colleagues?
Map out the particular risk factors across the organisation, such as:
Roles facing customers or clients, especially in retail, hospitality, healthcare and professional services
Roles that involve alcohol, social events or staying away overnight
Teams with a significant imbalance in seniority
Sites with limited oversight or where people work in isolation
Contractor or agency worker arrangements where reporting lines are unclear
Because the third-party duty now extends to harassment connected with any relevant protected characteristic, the assessment needs to look beyond sexual harassment. Think about racially motivated behaviour from customers, harassment linked to disability, religion or gender reassignment, and any other conduct connected to a protected characteristic.
For each risk factor, record the controls already in place and any gaps that remain. Give every action an owner and set a date for review.
Treat this as an ongoing process rather than a one-off task. The new duty expects risk assessments to be revisited regularly, especially when working arrangements change, teams are restructured or incidents are reported.
Step 3: Plan and run manager training
If a claim reaches a tribunal, manager training is the area most likely to come under the microscope.
Managers must be able to spot harassment, respond properly when someone tells them about it and deal with situations involving third parties. They also need enough understanding of the legal framework to act promptly and appropriately.
The approach below will help you build a programme that can be rolled out in a realistic timescale.
Start with the highest-risk groups
Use your risk assessment to decide who goes first. Team leaders in client-facing roles, managers of large or widely spread teams and anyone who manages contractor relationships should be in the opening cohort.
Base the training on realistic scenarios
Rather than generic explanations of what harassment means, focus on situations your managers are likely to meet in practice. For example, a customer making inappropriate remarks to a member of staff, a complaint about a colleague's behaviour at a work social event, or an employee who raises a concern informally and asks for it to go no further.
Explain the legal changes clearly
Managers should understand the move from "reasonable steps" to "all reasonable steps" and how it affects their role.
They should also know that, from April 2026, disclosures about sexual harassment are protected under whistleblowing law. Any detrimental treatment following a report could therefore lead to a separate claim.
Keep a full record
Log attendance, the content delivered and any follow-up actions. Retain evidence showing how the training was tailored to your organisation rather than bought in off the shelf.
Schedule refresher sessions
One session on its own will not be enough to show continuing compliance.
Plan follow-up activity, such as six-monthly refreshers, case study discussions or scenario workshops built into your existing management development programmes.
Step 4: Put third-party harassment protocols in place
From October 2026, employers will be liable for harassment by third parties if they have not taken all reasonable steps to prevent it.
This covers every form of harassment related to a relevant protected characteristic, not sexual harassment alone. So if a client directs racist abuse at a member of your team, or a customer harasses an employee because of their disability or religion, the same duty applies. Without all reasonable steps in place, the liability sits with you.
Where your people regularly deal with customers, clients, patients, service users or members of the public, clear protocols are essential.
Make your expectations clear externally
Check whether your client contracts, terms of engagement or service agreements include a clause setting out the standard of behaviour you expect.
In customer-facing settings, visible signage stating your position is a simple step to take.
Set up escalation routes
Staff need to know what to do at the moment an incident happens. Who should they contact? What authority do they have to remove themselves from the situation? What happens afterwards?
Empower employees to respond
Many people in client-facing roles have learned to put up with poor behaviour because "the customer is always right".
That expectation needs to be challenged directly. Your policies and training should state plainly that employees are entitled to protection, whoever the perpetrator is.
Record and review incidents
Introduce a simple, consistent way of logging incidents involving third parties.
Even when no formal complaint is made, a pattern of behaviour from a particular client or customer group is useful intelligence to feed into your risk assessment.
For more on this, read when a customer harasses your employee, who pays the price?
Step 5: Create a 30-day action plan
Getting ready does not have to be a six-month project, but it does need to begin now.
Weeks one and two
Finish the audit of your evidence and pinpoint the gaps
Carry out, or refresh, your harassment risk assessment
Identify the teams at greatest risk and put them first in line for manager training
Weeks two to four
Design the manager training for the first cohort and get it scheduled
Draft new, or update existing, third-party harassment protocols
Update your anti-harassment policy to reflect the strengthened duty and third-party liability
Brief your senior leadership team on the changes and secure their sign-off
Ongoing
Book refresher training and put risk assessment reviews in the diary
Review reporting data and incident trends every quarter
Appoint a named owner for harassment prevention compliance who reports into your governance structure
When October arrives, the aim is to be able to show a documented, proactive approach, backed by clear evidence of what you did and why.
How Progressive HR Solutions can support you
We partner with HR teams to design and deliver harassment prevention programmes, carry out risk assessments and produce the training and documentation needed to meet the strengthened duty.
This is especially valuable where internal capacity is stretched, or where an independent perspective gives the process added credibility.
Bringing in an external facilitator for manager training can also encourage more candid discussion, particularly on sensitive subjects.
Our support includes:
Auditing your existing evidence trail and highlighting compliance gaps
Carrying out a harassment risk assessment specific to your workplace
Designing and delivering scenario-based manager training tailored to your sector
Developing third-party harassment protocols for customer and client-facing teams
Providing a structured implementation plan with clear timelines and ownership
If your team does not have the capacity to get this done before October, get in touch. A short conversation will help us understand what you need and where to start, and we can move quickly.
