Before 30 October 2026, a small UK employer should have four things: a written risk assessment covering where harassment could happen in the business, including harassment by clients and visitors; an anti-harassment policy that covers third parties as well as colleagues; more than one route for staff to raise a concern; and records showing that staff and anyone who manages people have been trained. None of these is prescribed by law. What matters is that you did them and could show it.
What changes on 30 October 2026?
The duty to prevent sexual harassment is not new. It has applied to every UK employer since 26 October 2024. Three things change on 30 October 2026.
-
The standard rises. Employers must take reasonable steps to prevent sexual harassment of their workers. From 30 October, you have to take all reasonable steps. Choosing a few measures and stopping there is no longer enough.
-
Employers become liable for harassment by third parties. If a customer, client, supplier, contractor or visitor harasses one of your workers, and you have not taken all reasonable steps to prevent it, you can be liable.
-
That third-party liability is wider than sexual harassment. It covers harassment related to protected characteristics generally, including race, disability, religion or belief, age and sexual orientation.
Where an employment tribunal upholds a sexual harassment claim and finds the preventative duty was breached, it can increase the compensation award by up to 25%. The Equality and Human Rights Commission (EHRC) can also enforce the duty on its own, without anyone bringing a claim.
Does the harassment duty apply to small businesses?
Yes, from your first employee. The duty applies to all employers regardless of headcount. There is no threshold, no small-business exemption, and no phase-in.
What differs by size is not whether the duty applies but what counts as reasonable. A ten-person firm is not expected to do what a bank does. Reasonable is measured against your size, sector, workforce, and risks. The article should reassure small employers without suggesting the duty is optional or trivial.
What does "all reasonable steps" mean?
There is no prescribed list. No statute sets out the steps, and no training package makes an employer compliant on its own. The government has taken a power to specify in regulations what steps employers must take, and it has not used that power yet, so nobody can currently publish an authoritative list of what the phrase requires.
What is reasonable depends on your risks. Risk assessment is the starting point, not an optional extra.
Under the current duty, the EHRC's technical guidance sets out an eight-step approach, and assessing and reducing workplace risk is one of the eight.
Until regulations arrive, the practical test is whether you could show what you did and why.
What does a risk assessment look like in a 12-person business?
It looks like one page, with a date. Here is a worked example for a twelve-person professional services firm.
This is not a legal template, and it is not a compliance product. The point is that somebody in the business thought about where the risk actually sits and wrote it down with a date on it. One page in a shared folder counts. Nothing counts if it only exists in someone's head.
12-person risk assessment example
|
Where the risk sits |
Why |
What we have done |
How we would show it |
|
Client meetings and site visits |
Staff are alone with people we do not employ |
Policy covers third-party conduct, and staff have been told how to report it |
Policy version and date, plus briefing record |
|
Team socials |
Alcohol, blurred lines, out of hours |
Expectations circulated before events, with a named person available |
Copy of note and named contact |
|
One manager, nine reports |
Concerns all flow through one person |
A second named contact for raising concerns |
Where published and date added |
|
Work group chat |
Out-of-hours messaging outside formal systems |
Conduct expectations extended to work chats |
Policy wording and communication date |
What if harassment comes from a customer or client?
From 30 October, you can be liable for it. If a client harasses one of your staff and you have not taken all reasonable steps to prevent it, that is your exposure, not only theirs. Third parties mean customers, clients, suppliers, contractors, visitors, and the people your staff meet at events and conferences.
Ask: Which of our people deal with clients or the public, and in what settings? Do they know they can report a client's behaviour? What would we actually do if a good client behaved badly toward a junior member of staff?
The practical focus should be on whether the business has thought through the risk, reporting route and response, rather than on a rhetorical “customer is always right” test.
What records should a small employer keep?
Enough to answer the question “what did you do, and when”. There is no prescribed format and no required document pack.
Useful evidence includes a dated risk assessment, the anti-harassment policy and review date, published reporting routes, training completion records, manager training records, a written procedure, a named senior owner, and a review date.
There is no scoring here, because there is no pass mark in law. Not being able to produce evidence does not by itself establish a breach. It identifies the part you would struggle to evidence, which is where to start.
What training do employees need? What about managers?
No legally prescribed set of courses exists, and no course makes an employer compliant on its own. Training is one reasonable step among several, and the risk assessment is what tells you which training you actually need.
Everyone in your team needs to recognise harassment, including harassment by clients and visitors, know the standard expected of them, and know how to raise a concern and what happens next.
Anyone who manages someone needs to take a disclosure without making it worse, know what to do in the first hour, escalate it, and avoid anything that could look like retaliation.
Anyone handling employee matters needs to understand records, confidentiality, data protection when sensitive personal information is involved, and when to bring in outside help.
Equality and diversity training is relevant because third-party liability generally covers harassment related to protected characteristics.
Can a sexual harassment complaint be whistleblowing?
It can, but not automatically. Since 6 April 2026, a disclosure about sexual harassment can be a qualifying disclosure for whistleblowing purposes, which brings protection from detriment and from dismissal. The condition matters: the worker must reasonably believe the disclosure is in the public interest. Not every complaint qualifies.
The practical point for a small employer is that the person receiving a concern may be receiving a protected disclosure without recognising it, and getting the response wrong can create a second claim alongside the first.
What are the key dates in 2026?
6 April 2026: Sexual harassment disclosures can qualify for whistleblowing protection where the statutory conditions are met.
1 October 2026: The time limit for bringing most employment tribunal claims extends from three months to six.
30 October 2026: The preventative duty strengthens to all reasonable steps, and employer liability for third-party harassment begins.
Are you regulated by the Financial Conduct Authority?
These employment law changes apply to employers generally. If your firm is regulated by the Financial Conduct Authority (FCA), you also need to consider the FCA's non-financial misconduct rules (NFM), which came into force on 1 September 2026.
They are a separate regime with a different enforcer and a different test. The FCA rules sit alongside the employment-law duties described above rather than replacing them. For more details, explore our NFM hub for small businesses.
Where to start
Most small businesses working through that checklist will find they have some of this and not all of it. The useful next step is to know which parts you would struggle to evidence, and close those first.
If training is identified as a gap, CoreCompliance makes it easy to close it. Our platform provides ready-made courses ranging from 5 to 45 minutes, covering topics including Understanding Harassment, Third-Party Harassment, and Preventing Sexual Harassment for both employees and managers.
Simply add your users, assign the relevant training, and set a deadline. Automated notifications and reminders take care of the follow-up, while completion records are tracked and updated automatically.
As regulations evolve, we keep our course library up to date, helping you deliver relevant training and maintain accurate records without adding to your workload.
Sources
- Acas, Employment Rights Act 2025
- Acas, Sexual harassment: harassment law changes
- GOV.UK business support, Workplace sexual harassment and third-party harassment
- EHRC, Sexual harassment and harassment at work: technical guidance
- legislation.gov.uk for the specific Employment Rights Act 2025 provisions
Written by: Robert Glynn
Robert Glynn is a Compliance Solutions Manager at Skillcast. He specialises in helping organisations navigate their unique compliance challenges with tailored digital solutions. Robert also specialises in how data, training, and innovation can deliver insights that foster a culture of compliance and prevention. He currently leads Skillcast's CoreCompliance Solution, where he works with small businesses to enhance their compliance training.
