Preventing Sexual Harassment at Work: What UK Employers Need to Do Before October 2026
Most businesses have a harassment policy. A good number of them are not ready for 30 October 2026. Not because the policy is wrong, but because prevention is not the same thing as documentation.
When harassment goes unaddressed, the cost rarely starts with a tribunal. It starts with management time, sickness absence, people leaving, team confidence collapsing and employees deciding there is no point reporting things. From 30 October 2026, the legal duty strengthens from taking reasonable steps to taking all reasonable steps to prevent sexual harassment, alongside a new obligation concerning third-party harassment.
Employment law differs in Northern Ireland. The legislative changes discussed in this article principally apply to England, Scotland and Wales unless stated otherwise.
This is not really a policy-writing exercise.
A policy matters. Training matters. Reporting routes matter. But the sexual harassment prevention duty for UK employers in 2026 asks a much more practical question: have you looked properly at where harassment could happen in your organisation, and have you done everything reasonable in your circumstances to reduce that risk?
That moves the conversation from what is written in the handbook to what actually happens at work.
For some businesses, that means looking closely at alcohol and client entertainment. For others it is lone working, overnight travel, conferences, junior employees working with powerful clients or managers, or teams where inappropriate behaviour has gradually become accepted as banter.
There is no single checklist that makes every employer compliant.
And that is probably the most important thing to understand before October.
What changes to the sexual harassment prevention duty in October 2026?
The current preventative duty comes from the Worker Protection (Amendment of Equality Act 2010) Act 2023. It came into force on 26 October 2024 and requires employers to take reasonable steps to prevent sexual harassment of employees in the course of their employment.
The Employment Rights Act 2025 strengthens that requirement.
From 30 October 2026, employers will be expected to take all reasonable steps to prevent sexual harassment rather than simply reasonable steps. Acas describes the difference fairly plainly: employers may previously have been able to choose between several reasonable preventative steps; the new standard expects them to take all of the steps that are reasonable for their organisation.
That one word, “all”, does quite a lot of work.
It means a business is going to find it harder to say, “We had a policy and everyone completed training”, if there were other obvious preventative steps it could reasonably have taken.
The legislation also gives ministers power to specify particular steps that will count as reasonable in future regulations. Those regulations can cover areas such as risk assessments, plans or policies, reporting arrangements and the handling of complaints. As at 1 September 2026, Acas says further specification of what counts as reasonable steps will come in the future.
So the sensible approach now is not to wait for another checklist.
The existing Acas and Equality and Human Rights Commission guidance already gives employers a very good picture of the preventative work expected.
What does “all reasonable steps” mean for UK employers?
There is no universal set of all reasonable steps for sexual harassment that every UK employer must take in exactly the same way.
The steps need to make sense for your organisation.
Acas says relevant factors include the size of the business, the work people do, the risks within the working environment, who employees come into contact with, how frequently they deal with third parties, whether harassment has happened previously and the resources available to the employer.
That proportionality matters.
A twenty-person professional services business does not have to create the same infrastructure as a national retailer employing thousands of people.
But being small does not remove the duty.
In fact, there are situations in smaller businesses where the risks can be more concentrated. Reporting may lead directly back to the founder. A senior employee may hold a disproportionate amount of commercial power.
There may be no independent HR function. Client relationships can carry enormous weight.
If the person someone needs to complain about is also the person they would normally complain to, having a grievance policy on the shared drive does not solve very much.
What matters is whether the system works in the situation employees are actually in.
How should employers assess the risk of sexual harassment?
We would start with the risk assessment before rewriting anything.
Acas explicitly tells employers to assess possible risks of sexual harassment within their organisation and then consider measures that could reduce them. Higher-risk factors can include lone working with customers or service users, alcohol, work social events, power imbalances and overnight business travel.
The EHRC takes the same approach. Its eight-step employer guide recommends looking at questions including where power imbalances exist, whether employees work alone or at night, whether they are customer-facing, whether alcohol is involved, whether people attend external events and whether crude or disrespectful behaviour is already present.
This is where a generic harassment policy often falls short.
Look at the work your people actually do
Imagine a client-facing business where junior team members regularly attend industry events and client dinners.
The obvious risks are probably not sitting at somebody’s desk at 10am.
They may appear after dinner. At a hotel bar. In a taxi.
On an overseas shoot. In a WhatsApp group that mixes clients and employees.
A risk assessment should recognise that.
A hospitality business will have different concerns. So will a healthcare organisation, retailer, professional services firm or technology company.
If employees regularly deal with clients, customers or service users, third-party behaviour has to form part of the assessment too.
Look at where power sits
Seniority is one form of power, but it is not the only one.
There is commercial power too.
A client responsible for a large percentage of revenue can feel very powerful to the person expected to keep that client happy.
So can a famous creative director, a high-billing salesperson or someone the business sees as commercially indispensable.
The question is not simply whether you believe those people would harass someone.
It is whether employees would feel able to challenge or report them if something happened.
Those are different questions.
Look at what employees have already told you
Formal grievances are only one source of information.
Exit interviews, engagement surveys, one-to-ones, anonymous reports and conversations with managers can show you where people feel uncomfortable before a formal complaint arrives.
The EHRC recommends centralised confidential records of formal and informal concerns precisely because patterns matter.
A series of comments that look minor in isolation can look very different when somebody joins them together.
Does every UK employer need a workplace sexual harassment policy?
A workplace sexual harassment policy in the UK is not useful simply because it exists.
It needs to tell people what the organisation expects, what sexual harassment can look like in their working environment, how somebody can report it and what will happen next.
Acas says employers should consider having a specific sexual harassment policy and ensure related policies, including disciplinary and social media policies, are consistent with it. Its guidance also says employers need a full and fair process for handling complaints in line with the Acas Code of Practice on disciplinary and grievance procedures.
We think specificity is particularly important here.
“Sexual harassment will not be tolerated” is true, but it does not help an employee work out whether the thing that has just happened to them is something they can report.
Examples should reflect your workplace.
That might include sexual comments, messages, images, unwanted touching, repeated invitations after someone has said no, comments about somebody’s body, sexual jokes, conduct at work social events and behaviour through work-related digital channels.
It should also explain third-party harassment.
If customers, clients, contractors or service users can interact with your people, employees need to know the organisation’s expectations apply there too.
And there needs to be more than one reporting route.
If the only option is “speak to your manager”, what happens when the manager is the person involved?
What changes with third-party harassment liability in 2026?
This is one of the most important changes for employers with customer-facing or client-facing teams.
From 30 October 2026, employers will have an express obligation not to permit harassment of employees by third parties.
The Employment Rights Act 2025 provides that an employer permits third-party harassment where an employee is harassed by a third party in the course of employment and the employer failed to take all reasonable steps to prevent it. A third party means somebody who is neither the employer nor another employee.
And the protection is broader than sexual harassment alone.
The explanatory notes confirm that the third-party provision covers the forms of harassment under section 26 of the Equality Act 2010, including harassment related to protected characteristics covered by that provision.
So third-party harassment liability for UK employers in 2026 needs to be considered anywhere employees interact with people outside the organisation.
· Customers.
· Clients.
· Patients.
· Service users.
· Suppliers.
· Consultants.
· People attending conferences and industry events.
A business cannot control everything another person does. That is not the legal test.
The question is whether it took all reasonable preventative steps.
What could third-party prevention look like?
For a hospitality employer, it might mean making clear to customers that harassment of staff will not be tolerated, giving managers authority to remove customers and making sure employees know they will be supported when they challenge inappropriate behaviour.
For a client-facing business, it might mean addressing behavioural expectations in client relationships, providing a route to report concerns about clients and having a plan for situations where somebody should no longer work directly with a particular client.
For a healthcare organisation, it could mean looking at lone working, patient behaviour, reporting processes and how managers respond when the person responsible for harassment is vulnerable or has complex needs.
Reasonable will look different in each case.
Ignoring an obvious risk because the person creating it is commercially important is going to be increasingly difficult to defend.
What are the sexual harassment training requirements for UK employers?
There is not currently a statutory rule saying every employer must provide a particular training course every twelve months.
That distinction matters.
But both Acas and the EHRC identify training as an important preventative measure, and the strengthened duty means employers need to consider whether training is one of the reasonable steps their organisation should take.
Acas recommends training workers to recognise and understand sexual harassment, training managers on assessing and managing risk and ensuring somebody is capable of advising employees who are considering making a complaint. Acas also says employers should review whether their training remains effective.
The EHRC similarly recommends training workers, managers and senior people on what harassment looks like, what to do when they experience or witness it and how complaints should be handled. It also recommends refresher training and reviewing effectiveness.
So when people ask us about sexual harassment training requirements for UK employers, we think the more useful question is:
What does your training need to change?
If everyone clicks through an online module and behaves exactly as they did before, having a completion certificate is not particularly reassuring.
Case study: Allay (UK) Ltd v Gehlen and the problem with stale training
Allay (UK) Ltd v Mr S Gehlen was a race harassment case, not a sexual harassment case, but it remains a useful warning about the “reasonable steps” defence.
The Employment Appeal Tribunal considered training that had been given around two years before the harassment occurred. The evidence showed that employees and managers had failed to act when harassment took place.
The tribunal found the training had become stale and that refresher training was a reasonable further step the employer could have taken. Later tribunal decisions citing Allay have emphasised that it is not enough to ask whether training happened. Its quality, likely effectiveness and whether it has become stale all matter.
We think that principle is particularly relevant ahead of October 2026.
“Everyone completed the course” is evidence of activity.
It is not necessarily evidence that the organisation has done all it reasonably could.
Why a policy and annual training are not enough
Something we see repeatedly with compliance work is the temptation to turn an uncomfortable organisational issue into an administrative one.
Update the policy.
Book the training.
Record attendance.
Done.
Except this duty is deliberately preventative.
Acas says employers cannot simply wait until sexual harassment happens. They need to assess risk and put measures in place beforehand.
That means the evidence of compliance is likely to be spread across the organisation.
· Your risk assessment.
· Your policy.
· The way you communicate it.
· Training records.
· Manager guidance.
· Reporting options.
· Notes showing how risks were reviewed.
· Actions taken after employee feedback.
· Records of previous concerns and what changed afterwards.
· Measures dealing with third parties.
· The way senior leaders respond when an issue is raised.
That last one matters more than many businesses realise.
People notice what happens when an allegation involves somebody powerful.
Culture gets set very quickly in those moments.
Case study: what the McDonald’s EHRC agreement tells employers
McDonald’s Restaurants Limited provides a useful real-world example because the regulator’s response did not focus on one document or one training course.
In February 2023, McDonald’s signed a legally binding section 23 agreement with the Equality and Human Rights Commission following concerns about the handling of sexual harassment complaints from staff in UK restaurants.
The commitments included communicating a zero-tolerance approach, surveying workers anonymously about workplace safety, improving policies and procedures, anti-harassment training for employees and specific materials to help managers identify areas of risk and prevent sexual harassment.
The agreement is particularly useful because it shows what prevention looks like when viewed as a system.
· Policy.
· Listening.
· Training.
· Manager capability.
· Risk identification.
· Reporting.
· Follow-through.
The EHRC subsequently continued its involvement. In November 2025, the regulator announced that it had extended the agreement and strengthened the action plan following further serious allegations.
There is an important point in that.
Doing preventative work once does not freeze risk in place.
You have to know whether it is working.
And when the evidence says it is not, you change it.
How should managers respond when somebody raises a concern?
You can write a very good policy and still lose someone’s trust in the first thirty seconds of the conversation.
Managers therefore need more than awareness of what sexual harassment is.
They need to know what to do when somebody tells them something has happened.
· Listen.
· Do not dismiss it as banter.
· Do not immediately start testing whether the person has enough evidence.
· Do not promise absolute confidentiality if you cannot give it.
· Do not confront the person accused before deciding how the matter should be handled.
· Do not tell the employee to sort it out directly if the situation requires organisational action.
Acas says employers should use a full and fair complaint procedure and make clear how sexual harassment complaints will be handled.
The EHRC also recommends protecting complainants and witnesses from continuing harassment or victimisation while a complaint is being investigated and communicating outcomes and appeal routes properly.
Managers are often the point at which a beautifully written procedure either works or falls apart.
That is why manager training needs to cover response as well as recognition.
What should employers do before 30 October 2026?
We would not start by buying another generic training course.
Start by working out what you have and where the gaps are.
1. Carry out a sexual harassment risk assessment
Map the situations in which harassment could realistically occur.
Include social events, travel, alcohol, client contact, lone working, online communication, power imbalances and areas where junior employees depend heavily on senior people.
Document what you find.
2. Review your policy against the risks
Make sure the examples actually reflect your organisation.
Include third-party harassment.
Check reporting routes.
Make clear what managers should do when they receive a concern.
Then check that disciplinary, grievance, social media and related policies say compatible things.
3. Check whether people know how to report concerns
Do not assume that because a reporting route exists, employees trust it.
Ask them.
The EHRC recommends anonymous reporting mechanisms and staff surveys as useful ways of understanding what is happening.
4. Review your training rather than just the attendance records
· Who was trained?
· When?
· What did the training actually cover?
· Did managers receive additional guidance?
· Does it deal with your workplace risks?
· Could employees tell you what they would do if they witnessed sexual harassment tomorrow?
If the answers are not convincing, there is probably more work to do.
5. Address third-party risk specifically
List the third parties your employees regularly deal with.
Then ask what the organisation can reasonably do to prevent harassment in each relationship.
For some businesses, this will be one of the biggest changes required before October.
6. Decide who owns prevention
Acas suggests having somebody at senior level responsible for making sure the organisation is taking steps to prevent sexual harassment.
That makes sense.
If prevention belongs vaguely to everybody, it often belongs to nobody.
7. Keep evidence of what you have done
The strengthened duty makes documentation important.
Not because the goal is to build a defence file while ignoring the people involved.
Because a proper record forces the organisation to show its thinking.
· What risk did you identify?
· What did you do?
· What did employees tell you?
· What changed afterwards?
· When will you review it again?
That is much stronger than discovering after an incident that everyone remembers the process differently.
Get in touch
What happens if an employer does not take reasonable steps?
The existing preventative duty can be enforced by the EHRC.
Where an employment tribunal upholds a sexual harassment claim and also finds that the employer breached the preventative duty, it can increase compensation by up to 25%.
From 30 October 2026, the preventative standard becomes all reasonable steps and the third-party harassment provisions also take effect.
But we would not make the tribunal risk the main reason to do this work.
The commercial cost often starts much earlier.
· Management time.
· Sickness absence.
· People leaving.
· A team losing confidence in a manager.
· Employees deciding there is no point reporting things.
· Senior leaders being pulled into investigations that could have been prevented.
· Clients becoming involved.
· Recruitment becoming harder once a reputation develops.
The legal requirement matters.
So does what happens to a business when people stop believing it will protect them.
How JourneyHR can help
We work with organisations on both sides of this issue: preventing sexual harassment before something happens and helping businesses respond properly when a concern has already been raised.
Our Anti-Sexual Harassment Training + Compliance Support includes sexual harassment audits, policy creation and review, and active bystander learning developed in partnership with The Consent Collective. We also support employers through our Employee Relations team with bullying and harassment investigations, grievances, hearings and appeals.
Ahead of the October 2026 changes, the useful starting point is usually understanding what you already have.
A business with an established policy, recent risk assessment, effective reporting channels and role-specific training needs something quite different from an organisation that downloaded a policy three years ago and has never discussed it since.
We can review that position with you, identify the areas that need attention and help you put practical measures in place before the strengthened duty takes effect.
We can also support managers with training that deals with what actually happens when somebody raises a concern, rather than leaving them with a definition and hoping they work the rest out themselves.
Final thought
30 October is not the moment to discover whether your sexual harassment policy works.
The stronger duty is really asking employers to look earlier than that.
Where could this happen here? Who might find it hardest to speak? Which managers would know what to do?
Where do clients, customers or other third parties create risk? And what reasonable step are you currently not taking?
If there is a good answer to all of those questions, you are probably well on the way.
If there is not, there is still time to do something about it.
FAQs
What is the sexual harassment prevention duty for UK employers in 2026?
UK employers currently have a legal duty to take reasonable steps to prevent sexual harassment of employees. From 30 October 2026, the Employment Rights Act 2025 strengthens that standard to all reasonable steps. Employers will need to consider every preventative measure that is reasonable for their organisation, taking account of factors such as size, sector, working arrangements, previous incidents and exposure to third parties.
What does “all reasonable steps” mean for preventing sexual harassment?
“All reasonable steps” means employers should take all preventative measures it would be reasonable to expect in their particular circumstances, rather than choosing only some of them. There is no single universal checklist. Risk assessments, effective policies, appropriate reporting routes, worker and manager training, third-party controls and ongoing review are among the measures Acas and the EHRC tell employers to consider.
Are employers required to provide sexual harassment training in the UK?
There is currently no fixed statutory rule requiring every UK employer to deliver a particular sexual harassment course at a specified interval. However, Acas and the EHRC identify appropriate worker and manager training as an important preventative step. Employers should consider the quality, relevance and effectiveness of training and whether refresher training is needed rather than relying solely on evidence that a course was once completed.
What is changing for third-party harassment in October 2026?
From 30 October 2026, employers will have an express duty not to permit third parties to harass employees. A third party could be a customer, client, patient, service user or another person who is neither the employer nor a fellow employee. Liability can arise where harassment occurs in the course of employment and the employer failed to take all reasonable steps to prevent it.
Is having a sexual harassment policy enough to comply with the law?
No. A policy is one part of prevention, but the legal duty is about the steps an employer actually takes. Acas and EHRC guidance expects employers to assess risk, communicate standards, provide effective reporting routes, consider training, address third-party risk, respond properly to complaints and regularly review whether preventative measures are working. A policy that nobody understands or uses will not answer those wider questions.
