Third-party harassment: what UK employers must do from 30 October

On 30 October 2026, your responsibility for harassment follows your people out of the building. Two changes in the Employment Rights Act 2025 take effect that day. The duty to take "reasonable steps" to prevent sexual harassment becomes a duty to take "all reasonable steps." And for the first time since Parliament repealed the previous version in 2013, you become liable when a customer, client, patient, contractor, or supplier harasses one of your staff.

If your harassment program was built around colleagues and managers, it now covers the wrong population.

What changes on 30 October

The first change raises the bar on an existing duty. Since 26 October 2024, employers have had to take reasonable steps to prevent sexual harassment under the Worker Protection Act 2023. From 30 October, you need to take all of them. A written policy and an annual training module will not clear that bar on their own.

The second change is new. You must not permit a third party to harass an employee in the course of employment, and the law treats you as permitting it if you failed to take all reasonable steps to prevent it. This is a standalone tribunal claim, so an employee does not need an underlying discrimination claim to bring it.

Two points get missed in the coverage. Third-party liability goes beyond sexual harassment: it covers harassment relating to any relevant protected characteristic, including race, disability, religion or belief, age, sex, sexual orientation, and gender reassignment. And "third party" means anyone who is not you or a member of your staff, which pushes the duty outside your own premises. Delivery drivers at the door, care workers in a client's home, and engineers on a customer site all sit inside scope.

Nobody has defined "all reasonable steps" yet

Regulations specifying what counts as all reasonable steps are not expected until 2027 or 2028, and may never arrive. Tribunals will fill the gap case by case, measured against your sector and the risks you could reasonably have seen.

The EHRC's eight-step guide stays the working benchmark, and three of those steps carry most of the weight:

• Risk assessment. The EHRC is blunt that an employer is unlikely to comply without one. For third-party risk, map where staff deal with the public, who works alone with clients, where alcohol is involved, and where the power in the interaction sits with the customer.
• Reporting channels. Staff need more than one way to raise a concern, including the option to report anonymously.
• Monitoring. A one-off intervention does not demonstrate an ongoing duty.

The duty has moved from holding the right documents to evidencing the right behavior. A policy proves intent. A record proves steps.

Most of this harassment never reaches you

The Government Equalities Office's 2020 survey of more than 12,000 people found that 29% of employees had experienced some form of sexual harassment in a work-related setting in the previous 12 months. Around 14% of those said the person harassing them was not an employee, usually a customer, client, or patient.

The number that matters for your risk is the last one. Only about 15% made a formal report. People stayed quiet because they judged the incident not serious enough, or because they expected reporting it to cost them their career.

From 30 October, that silence becomes a legal exposure rather than a cultural one. A tribunal can ask what you did to prevent harassment by a customer your managers never heard about, and "no complaints were raised" is a weak answer when the only reporting route was a line manager the employee did not trust.

The whistleblowing change nobody put in the calendar

Six months before the October duties, a quieter amendment landed. Since 6 April 2026, disclosing sexual harassment is an express qualifying disclosure under UK whistleblowing law, where the worker reasonably believes the disclosure is in the public interest.

A harassment report can now be a protected disclosure. The person who makes it is protected from detriment, and dismissal for making it is automatically unfair with no qualifying service period.

In most organizations, harassment complaints and whistleblowing reports have run on separate tracks: one through HR, one through the speak-up channel. Those tracks now overlap. If a harassment report arrives through your grievance process and gets handled as a routine HR matter, you may have mishandled a protected disclosure without knowing it.

Two fixes are worth making before 30 October. Name sexual harassment explicitly in your whistleblowing policy as a qualifying disclosure. Then train the people who receive reports to recognize a protected disclosure at the moment it is made, because the protection attaches to the disclosure, not to the channel it came through.

What to do before 30 October

1. Extend your risk assessment to third parties. Document the assessment, the risks you found, and what you changed in response. That document is your defense.
2. Rewrite the policy to name customers, clients, and contractors. Most anti-harassment policies still describe colleague-to-colleague conduct only.
3. Open a channel staff will use. Roughly 85% of incidents never surface as a formal report, which is why anonymous reporting exists.
4. Brief customer-facing managers. They decide, in the moment, whether a customer's behavior gets logged or laughed off.
5. Keep the record. Dates, attendance, risk assessments, reports received, and the outcome of each. From 1 October 2026, claimants have six months rather than three to file, so your evidence needs to survive longer.

If you cannot currently show who reported what, when you knew, and what happened next, close that gap first. Your team can take workplace and HR grievances and anonymous misconduct reports through one intake route, with the case trail recorded as you go.

Frequently asked questions

When does third-party harassment liability start in the UK?

30 October 2026, under the Employment Rights Act 2025.

Does it only cover sexual harassment?

No. It covers harassment relating to any relevant protected characteristic under the Equality Act 2010 where it happens in the course of employment.

Who counts as a third party?

Anyone who is not the employer or a member of staff. Customers, clients, patients, suppliers, contractors, and members of the public.

What happens if we get it wrong?

An employee can bring a standalone tribunal claim. Separately, breach of the sexual harassment preventative duty allows a compensation uplift of up to 25%, and the EHRC can investigate and enforce even where no individual has brought a claim.

Is a policy enough to show all reasonable steps?

Unlikely on its own. The EHRC treats risk assessments and working reporting mechanisms as central, and expects you to monitor whether your measures work.

This article is for general information only and is not legal advice. For guidance on your organization's obligations, speak to a qualified employment lawyer.