October 2026 harassment rule changes
Since October 2024, you've had a legal duty to take "reasonable steps" to prevent sexual harassment at work.
From October 2026, that duty gets tougher. And a second, separate duty comes in alongside it.
Understanding both, and what they require in practice, is what this guide is for.
What's changing in the law
The October 2026 changes raise the bar in two distinct ways.
The first change is an upgrade to the existing sexual harassment duty.
The threshold moves from "reasonable steps" to "all reasonable steps". That single word makes a real difference. If a tribunal challenge lands, you'll need to show that there were genuinely no further steps you could reasonably have taken.
Detailed regulations setting out exactly what this requires are expected in 2027, but the EHRC's existing guidance is the working benchmark in the meantime.
The second change is a brand new, separate duty: direct liability for third-party harassment.
From October 2026, if a client, customer, contractor or member of the public harasses one of your employees on any protected ground and you haven't taken all reasonable steps to prevent it, you could face a tribunal claim. Even a single incident can be enough.
This applies across all protected characteristics. Race, disability, religion, age, all of it is in scope when third parties are involved, not just sexual harassment.
The Equality and Human Rights Commission has had the power to investigate employers and take enforcement action since October 2024. Those powers haven't changed, but the standard employers are being held to is rising, which means that enforcement activity is unlikely to ease.
And tribunals can increase compensation by up to 25% where a successful sexual harassment claim is brought and the employer is found to have failed the preventative duty. Discrimination compensation has no cap. There is no upper limit on what a tribunal can award.
What "all reasonable steps" actually means
The phrase "all reasonable steps" sounds vague and this lack of clarity is causing anxiety for small business owners.
In practice, it comes down to six things. If you can evidence all six, you're in a strong position. If you can't, you've got gaps.
Step 1: Is your harassment policy up to date?
Your policy needs to specifically reference the strengthened duty and cover harassment by third parties across all protected characteristics. A general dignity at work policy that hasn't been reviewed recently won't cut it.
Check that it clearly defines what harassment looks like, including examples relevant to your workplace. If your team works with the public or visits client sites, the policy should reflect that.
Step 2: Have your staff actually read it?
Having a policy is one thing. Being able to prove that your team has seen it is another.
You need a record of every employee acknowledging that they've read and understood the policy. A signature, a tick on your HR system, an email confirmation. Something you can produce quickly if you're ever asked.
We often see businesses with perfectly good policies that nobody has read. That's just as bad as not having one, even if you had the right intentions.
Step 3: Have your managers been trained?
Managers are your first line of defence. They're the ones who will see early signs, hear informal complaints and set the tone for what's acceptable.
But many managers in small businesses have never had any formal training on recognising or responding to harassment. They might brush things off, handle a complaint badly or simply not know what to do.
Under the "all reasonable steps" standard, generic training delivered once and never refreshed is unlikely to be enough. It should be role-specific and updated regularly. At minimum, it should cover what harassment looks like, how to respond when someone reports it and what to escalate.
Step 4: Is there a clear reporting process?
Your employees need to know how to report harassment, who to report it to and what happens when they do.
If the answer to "how would someone raise a concern?" is "they'd probably just come and tell me" that's a problem. You need a documented process. It should be written down somewhere your team can access it and it should cover what happens if the complaint involves a manager or the business owner themselves.
Step 5: Have you done a risk assessment?
Some roles carry higher harassment risk than others. Anyone working alone, on client premises, with the public or in care settings is more exposed.
A written risk assessment shows that you've thought about where your people are most vulnerable and what you've done to reduce that risk. It doesn't need to be complicated. It just needs to exist and make sense for your business.
This is especially important for the third-party harassment duty. If your employees regularly interact with customers or visit external sites, your risk assessment should specifically cover those situations and what steps you've taken to manage the risk.
Step 6: Could you pull all of this together quickly?
If the EHRC came knocking tomorrow or a tribunal asked for your evidence, could you produce it?
The policy, the acknowledgement records, the training logs, the reporting process, the risk assessment. All of it. If the answer is "I'd need a few days to dig through emails and folders" then that's a sign that your evidence isn't where it needs to be.
We're here to help
Even if you think you've crossed all of your t's and dotted all of your i's, it can be really beneficial to have a professional review your policies to make sure that everything is watertight.
We run harassment prevention reviews for business owners that cover your policy, training records, risk assessment and reporting process.
Get in touch and we can tell you exactly what needs fixing in your business before October.