JavaScript disabledLearn how to enable JavaScript

Deciphering “All Reasonable Steps”: Preparing for the Updated Sexual Harassment Duty

Most employers know that UK sexual harassment law requires them to take prevention seriously. But from October 2026, expectations of employers will be higher, and what was considered acceptable before may no longer be enough.

In October 2026, the duty to prevent sexual harassment will move from “reasonable steps” to “all reasonable steps”, and liability extends for the first time in over a decade to cover harassment carried out by third parties, including customers, clients, contractors, and patients.

This guide covers what the updated sexual harassment law means for UK employers, what ‘all reasonable steps’ looks like in practice, and how to prevent sexual harassment in the workplace in a way that both protects your people and demonstrates compliance.

The Current Duty to Prevent Sexual Harassment In the Workplace

The Worker Protection (Amendment of the Equality Act 2010) Act 2023 came into force in October 2024, introducing a proactive duty on all UK employers to take “reasonable steps” to prevent sexual harassment in their workplace.

Under the current duty, employers are expected to:

Assess the risk of sexual harassment in their workplace.
Take preventive action.
Maintain policies and reporting channels.
Provide training.
Take complaints seriously when they’re raised.

If an employment tribunal finds that an employer has breached it, any compensation awarded to a successful claimant can be uplifted by up to 25%.

More recently, from 6 April 2026, sexual harassment became a qualifying disclosure under whistleblowing law. In practice, this means that workers who report sexual harassment (whether of themselves or others) are now protected from dismissal and detriment on the grounds of having made that disclosure.

What’s Changing in October 2026

Two significant changes will come into force in October 2026.

The duty rises from “reasonable steps” to “all reasonable steps”.

The Employment Rights Act amends the duty in Section 40A of the Equality Act 2010 so that employers must now take “all reasonable steps” to prevent sexual harassment.

This means that employers will be expected to take a more thorough, more proactive, and more evidence-based approach.

This closes an important gap in the law. Employers already had to demonstrate “all reasonable steps” to defend themselves against vicarious liability claims for their employees’ behaviour. But the preventative duty only required “reasonable steps”. That inconsistency has now been removed, and the two standards are aligned.

Employers will be liable for third-party harassment.

From October 2026, employers will also be responsible if they permit harassment of their employees by third parties. This includes customers, clients, patients, contractors, or members of the public encountered through work.

This form of liability existed briefly between 2008 and 2013 before being repealed, and its return is significant for any business where employees regularly interact with people outside the organisation.

The law doesn’t expect employers to be able to prevent every conceivable incident. But you are expected to think carefully about the nature and frequency of your team’s contact with third parties and to take proportionate steps to protect them.

“Reasonable Steps” vs “All Reasonable Steps”: What Is the Difference?

Under the current duty, an employer could point to a policy and a training session and make a reasonable argument for compliance. Under the new standard, that is unlikely to be sufficient on its own.

“All reasonable steps” means doing everything reasonable in your specific circumstances. What’s reasonable for your organisation will depend on factors such as:

The size of your business.
The sector you operate in
Your working environment
The frequency and nature of your team’s contact with third parties.
The resources available to you. A small business with a closely managed team of ten will have different obligations from a multi-site employer with hundreds of customer-facing staff.

The EHRC’s eight-step framework provides a useful benchmark for employers working through this. It covers risk assessment, policies and procedures, staff engagement, reporting mechanisms, training, monitoring, and tackling third-party harassment.

Employers who can demonstrate their approach has been assessed against it will be in a significantly stronger position if they’re ever challenged.

One further development to note: the law will specify what “all reasonable steps” means in more detail through secondary regulations, following the October 2026 changes. That further specification is expected in 2027. In the meantime, the EHRC’s eight-step framework remains the clearest practical benchmark available, and employers who can demonstrate alignment with it will be in the strongest position.

What “All Reasonable Steps” Looks Like in Practice

There’s currently no single formula for what “all reasonable steps” looks like, but there are clear areas every employer should be addressing now.

Carry out a risk assessment.

Start by assessing the specific risk of sexual harassment in your workplace. Consider:

Your sector.
The types of roles in your organisation.
How your team works.
The nature and frequency of contact with third parties.

Risk factors to think through include lone working with clients, environments or events where alcohol is involved, employees who travel for work, and online and social media interactions where professional boundaries can blur.

Review and update your policies.

Policy surrounding sexual harassment should cover both employee-to-employee conduct and third-party situations. It should also address behaviour in digital spaces and on social media as well as in person.

Policies are living documents: they need to be reviewed regularly and fully understood by the people they cover. If your current policies are due for a review, our HR Policies and Procedures support can help you get them into good shape.

Train your employees and managers.

Employees should fully understand what sexual harassment looks like and the channels they can use to report it.

Managers need specific, additional training on their own responsibilities: how to recognise concerns, respond appropriately, and avoid conduct that could constitute or enable harassment.

If your managers would benefit from structured support in this area, our People Management Training is designed to build exactly that confidence.

Strengthen your reporting and investigation processes.

Employees should have more than one way to raise concerns, including options that don’t require a direct conversation with their line manager, which isn’t always practical or comfortable.

When complaints are raised, they need to be taken seriously and acted on promptly. Inaction is a compliance risk in its own right.

Build a culture that doesn’t tolerate harassment.

This is both the least straightforward and most important action you can take to prevent sexual harassment.

Policies and training matter, but what protects your people and your business is a workplace where the culture supports them.

Culture is evidenced by behaviour and experience, and building it requires visible leadership, consistent management, and ongoing attention. If you’d like to think through what that looks like strategically for your organisation, our HR Strategy support is a good place to start.

Not Sure Where Your Culture Actually Stands?

For many employers, the most difficult part of all of this is understanding their current culture and knowing what needs to be done to improve it.

An absence of complaints doesn’t mean an absence of problems. It may mean that people don’t feel safe or confident enough to raise concerns, which is itself a cultural issue worth understanding.

Petaurum’s Culture Scan is designed specifically for this challenge. It’s a confidential, structured diagnostic that gives you an independent read of your workplace culture around harassment and sex inequality, telling you what your people actually experience, not just what your policies say should be happening.

The findings are benchmarked against the aforementioned EHRC’s eight-step framework, giving you clear evidence of where you stand and what needs attention.

What you receive at the end is board-ready evidence that directly supports a “reasonable steps” position if you’re ever challenged, a prioritised action plan mapped to the legal duty with clear owners and timescales, and a direct readout to your senior leadership team that secures ownership of the response.

It’s also led by people with the right experience. Our team includes a former Police Inspector and safeguard specialist who was instrumental in developing the globally recognised ‘Ask for Angela’ scheme. That depth of expertise is what makes the process credible, both to your people who participate in it and to any regulator who might scrutinise the outcome.

The Culture Scan is built for SMEs, scaled and priced for your organisation and delivered in four to eight weeks. With October 2026 approaching, there’s still time to act.

Your Questions Answered

Does this apply to small businesses? Yes. The duty applies to all employers, regardless of size or sector. What counts as “all reasonable steps” will be proportionate to your circumstances, but no employer is exempt.

What if we haven’t had any complaints? An absence of complaints is not evidence of compliance. It may mean harassment isn’t happening, but it may also mean people don’t feel confident enough to report it. The duty specifically requires employers to be proactive, not reactive.

Do we need to think about what happens on social media? Yes. Online conduct can constitute harassment, and both your employees and any third parties your team interacts with online fall within scope.

How far does our liability for third parties extend? You’re expected to take all reasonable steps in proportion to the nature and frequency of your employees’ contact with third parties. You’re not required to police every customer interaction or anticipate the entirely unpredictable. But you are expected to have assessed the risks and taken proportionate action to manage them.

A Better Culture, Starting Today

The work of building a safe and compliant workplace culture takes time, but most of what’s required is also simply good employment practice: listening to your people, taking concerns seriously, and making sure your managers have the confidence and tools to respond well.

Take a look at our HR Strategy support to see how we can help you build a long-term approach, or get in touch to find out more about the Culture Scan and what it could mean for your organisation.