Getting ready for the October 2026 harassment duty

From October 2026, UK employers will have to take all reasonable steps to prevent sexual harassment at work. That is a higher bar than the duty in place since October 2024, and it means prevention has to be active, planned and something you can prove. Here is what is changing, and what to do about it now.

What is changing

Since October 2024, under the Worker Protection Act, employers have had a duty to take reasonable steps to prevent sexual harassment of their workers. From October 2026, under the Employment Rights Act, that duty steps up to all reasonable steps.

The change is more than wording. The current duty asks whether you took reasonable steps. The new one asks whether you took all of them, meaning whether there was anything further you could reasonably have done. That is a tougher test, and it expects prevention to be active and documented, rather than a policy you point to after the event.

Two related changes arrive around the same time:

• Employers become liable again for harassment of their staff by third parties such as customers, clients and contractors, not only colleagues.
• From April 2026, a disclosure about sexual harassment can qualify as a protected disclosure under whistleblowing law. That does not turn every complaint into a whistleblowing case, but where the legal tests are met a worker who raises concerns may have whistleblower protection, which makes handling reports properly even more important.

What "all reasonable steps" expects

The law does not hand you a checklist, because what counts as reasonable depends on your organisation. But the Equality and Human Rights Commission (EHRC) is the statutory regulator for the Equality Act 2010, and therefore for the Worker Protection Act, which amends it. It has set out clearly what it expects employers to do. In practice that includes:

• A clear anti-harassment policy your people actually know and understand.
• A risk assessment that looks honestly at where harassment could happen in your workplace.
• Easy and safe ways to report, including a confidential route.
• Training for all staff, and for managers in particular, so they can both prevent problems and respond well.
• Prompt, fair and sensitive handling of any complaint.
• A plan for harassment by third parties such as customers and contractors.
• Regular checks that what you are doing is actually working, with changes made when it is not.

The move to all reasonable steps raises the expectation on every one of these. Doing something is no longer the same as doing enough, and the courts have made that point in practice.

In Allay (UK) Ltd v Gehlen (2021), an employer tried to defend a harassment claim by showing it had policies in place and had trained its staff. The training had been delivered around two years earlier. The tribunal, upheld by the Employment Appeal Tribunal, found that the training had gone "stale" and was no longer effective, so the employer could not rely on the "all reasonable steps" defence and was liable. The appeal judges stressed the word "all": it is not enough to have a policy and a training record. What matters is whether the training was good, current and genuinely effective. It was a race harassment case, but the defence is the same one that applies to sexual harassment.

A second case shows that prevention is only half the job. In X v Volkerrail Limited (2021), a senior manager made repeated unwanted advances toward a colleague. The claims about the advances themselves were ruled out of time, but the tribunal found that the way the employer handled her grievance and appeal amounted to harassment in its own right, and upheld a related victimisation claim. The employer did not even attempt the reasonable steps defence. The lesson is blunt: a poor response to a complaint can create fresh liability all on its own.

Why this is worth getting right

There is a real legal cost to falling short. If a sexual harassment claim succeeds and the employer is found not to have met the duty, a tribunal can increase the compensation awarded by up to 25 percent.

But the legal risk is rarely the biggest one. In a connected, always-on world, where stories travel fast and reputations are judged in public, the reputational cost of getting this wrong can dwarf any tribunal award. Customers, staff and partners increasingly expect organisations to act on conduct, and to be seen to act.

The fall of the Confederation of British Industry is a stark example. In 2023 the CBI, then one of the most influential business groups in the country, was engulfed by allegations of sexual misconduct. As the allegations, and questions about how they had been handled, became public, dozens of major member companies walked away, the government and political parties distanced themselves, and the organisation came close to collapse. It survived, but emerged permanently weakened. Tellingly, some members pointed not only to the allegations themselves but to how the organisation had responded. Damage on that scale is not something most organisations could absorb.

Getting this right protects your people first, and your organisation second. If you would value expert support in putting the right foundations in place, our sister organisation OneSource HR, a trauma-informed HR specialist in sexual misconduct at work, can help.

What to do now

You have time, but not a lot, and the steps that carry the most weight take a while to do properly. A sensible order:

1. Carry out or refresh your risk assessment. This is the foundation, and the step the EHRC treats as essential.
2. Check your policy and reporting routes are clear, current and genuinely used.
3. Look hard at your training. Ask not whether people have done it, but whether it would change what they do in a real moment. Training that is forgotten within a week will not count for much.
4. Keep a record of the action you take, so you can show it if you ever need to.

What good preparation looks like

The employers who will be ready in October 2026 are not the ones with the thickest policy folder. They are the ones whose managers can actually handle the moment when it comes: the disclosure, the difficult conversation, the situation that catches them off guard.

That is what Scenari is built for: realistic practice that builds genuine capability, with a clear record of what your people have done. If you want one place to start, begin with your risk assessment, then look honestly at whether your current training would hold up when it is tested for real.

Common questions

When does the new duty start?

From October 2026, when the duty to take all reasonable steps to prevent sexual harassment is expected to come into force under the Employment Rights Act.

How is it different from the current duty?

Since October 2024 employers have had to take reasonable steps. From October 2026 the test becomes all reasonable steps, a higher bar asking whether there was anything more you could reasonably have done.

Do we have to do a risk assessment?

The law does not name it as compulsory, but the EHRC has said an employer is unlikely to comply without one, so in practice it is essential.

What happens if we do not comply?

If a claim succeeds and the duty was not met, a tribunal can increase the compensation awarded by up to 25 percent, on top of the reputational damage.

Sources

• Worker Protection (Amendment of Equality Act 2010) Act 2023, in force 26 October 2024.
• Employment Rights Act 2025, strengthening the duty to "all reasonable steps" from October 2026 and reintroducing third-party harassment liability.
• Equality and Human Rights Commission, technical guidance and Employer 8-step guide (2024).
• Allay (UK) Ltd v Gehlen [2021], Employment Appeal Tribunal.
• X v Volkerrail Limited and Others (2021), Employment Tribunal, case 1806329/2020.