Key takeaways
- From 30 October 2026, UK employers must take all reasonable steps to prevent sexual harassment of their employees, not only “reasonable steps”.
- From the same day, employers must not permit third parties — customers, clients, service users and similar — to harass staff in the course of employment, unless they took all reasonable steps to prevent it.
- There is no fixed statutory checklist yet. What is reasonable depends on size, sector, risks and resources. Acas expects prevention, not only reaction after a complaint.
- Ministers now have power to specify evidence-based steps in regulations later. Those regulations are not yet the day-to-day rulebook; follow current Acas and EHRC material and record what you did.
- Small employers still need a clear policy, more than one reporting route, induction and refresher training, a risk assessment that includes customers, and a fair complaint process.
What changed on 30 October 2026?
Two Employment Rights Act 2025 provisions came into force on 30 October 2026 under SI 2026/1065:
- Section 20 amends Equality Act 2010 section 40A so employers must take all reasonable steps to prevent sexual harassment of employees.
- Section 21 adds a duty not to permit a third party to harass an employee in the course of employment. An employer “permits” that harassment only if the third party harassed the employee at work and the employer failed to take all reasonable steps to prevent it. A “third party” is anyone other than the employer or its employees.
The government’s 30 October 2026 announcement and the Plan to Make Work Pay timeline both list these as live measures from that date. The same commencement instrument also brought section 22 into force: a power for ministers to make regulations that specify steps regarded as “reasonable”. Those detailed regulations are separate; do not wait for them before acting on the duties that already apply.
Acas updated its employer guidance on the same day. See what sexual harassment is and steps for employers to prevent sexual harassment.
Who does this affect?
Every employer covered by the Equality Act work provisions in Great Britain. The change is not limited to large companies or unionised workplaces.
Acas says protection covers employees and workers, contractors and self-employed people hired to personally do the work, and job applicants. Sexual harassment is unwanted conduct of a sexual nature that violates dignity or creates an intimidating, hostile, degrading, humiliating or offensive environment. It can be a one-off or a pattern, in person or online (meetings, email, messaging, social media).
For small UK businesses that serve the public — shops, hospitality, clinics, trades visiting homes, agencies meeting clients — the third-party limb is often the biggest practical shift. Staff who deal with customers alone, late shifts, alcohol, overnight travel or power imbalances are the risk factors Acas flags for assessment.
Northern Ireland employment equality law is largely separate. Do not assume these commencement dates apply there without checking local rules.
What “all reasonable steps” means in practice
Acas is clear: before 30 October 2026 an employer might have taken some reasonable steps; the strengthened duty expects employers to take all steps that are reasonable for their organisation, with no picking and choosing among steps that are still reasonable to take.
There is still no single mandatory checklist. Reasonableness turns on factors such as:
- organisation size and resources
- sector and the work people do
- how often staff meet third parties
- whether harassment has happened before
- online as well as in-person risks
Focus on prevention across the organisation, not only a reaction aimed at people involved in a past incident. If you decide a step is not reasonable for you, Acas advises recording why.
GOV.UK notes that cases turn on specific circumstances and that more specific EHRC guidance is due in due course. Until then, treat Acas as the practical starting point and keep your own written trail.
Practical checklist for small employers
Use this as an action list, not as a guarantee of compliance.
- Write or refresh a sexual harassment policy — say what behaviour is unacceptable, how to report (including if the concern is about a manager), how complaints are handled, and that victimisation for reporting in good faith will not be tolerated. Publish the current version where staff can find it.
- Map third-party risk — list roles that meet customers, clients or the public alone; note alcohol, late hours, travel and home visits; decide concrete controls (pairing, check-ins, refusal rights, posters or booking terms that set behaviour expectations).
- Give more than one reporting route — manager, another named person, and where workable an anonymous option. Encourage reports of near-misses as well as incidents.
- Train at induction and refresh — cover what sexual harassment is, how to report, and what managers must do when they hear a concern. Review training after incidents or when roles change.
- Run a fair complaint process — follow a full and fair procedure in line with the Acas Code of Practice on disciplinary and grievance procedures. Act promptly; protect confidentiality as far as you can; do not move the complainant as a first and only fix if that feels like a penalty.
- Keep records — policy versions, who read them, training dates, risk assessments, complaints and outcomes. Patterns matter when you review whether steps are still adequate.
- Review after every serious concern — update the risk assessment and controls; do not treat a single local training session as enough if culture problems sit elsewhere.
Where CitoHR helps (and where it does not)
CitoHR does not investigate complaints, design training content, or decide whether you have taken all reasonable steps. That remains your responsibility, with legal advice where you need it.
What we can do for a small UK team:
- Keep the staff handbook and sexual harassment policy as the current version, with a record of who has read it, in policy management.
- Store related HR files on the person — contracts, acknowledgements, investigation notes you choose to retain — in the document hub.
- Give people one place to find the live policy instead of a shared drive copy that went stale last year.
If you are still building the basics of people records and leave alongside compliance documents, start from our employee management overview or the wider Employment Rights Act 2025 note.
Sources
- GOV.UK: New action to tackle harassment at work (30 October 2026)
- GOV.UK: Plan to Make Work Pay and Employment Rights Act timeline update
- Employment Rights Act 2025, section 20
- Employment Rights Act 2025, section 21
- Employment Rights Act 2025, section 22
- SI 2026/1065 (Commencement No. 6)
- Acas: sexual harassment and the Employment Rights Act changes
- Acas: steps for employers to prevent sexual harassment
This article is for general information for UK small employers. It is not legal advice. For a live dispute or a complex risk profile, speak to Acas, an employment solicitor, or another qualified adviser.
Frequently asked questions
When did the all reasonable steps duty start?
On 30 October 2026. Section 20 of the Employment Rights Act 2025 came into force that day by SI 2026/1065. It inserts the word “all” into the Equality Act duty to prevent sexual harassment of employees.
Does the duty cover customers and clients?
Yes. From the same date, section 21 says an employer must not permit a third party to harass an employee in the course of their employment. Liability turns on whether the employer failed to take all reasonable steps to prevent it.
Is there a fixed government checklist of steps?
No. Acas says there is no set list every employer must take. Section 22 gives ministers power to make regulations that specify evidence-based steps later. Until those regulations exist, follow Acas guidance and keep records of what you decided was reasonable for your workplace.
Who does Acas say is protected?
Employees and workers, contractors and self-employed people hired to personally do the work, and job applicants. Sexual harassment can be in person or online, and it can come from colleagues, managers, customers, clients or members of the public.
Does CitoHR investigate harassment complaints?
No. We help you publish the policy, record who has read it, and keep related HR documents in one place. Investigation, training design, and legal advice remain with you or your adviser.