The Conventional Wisdom
Ask most compliance teams how they'll meet the UK's tougher harassment standard, and you'll hear the same answer: track completions, track policy acknowledgements, and keep the dashboards green. If the regulator or a tribunal asks, you hand over the spreadsheet.
It's a sensible instinct. From October 30, 2026, section 20 of the Employment Rights Act 2025 changes the duty under the Worker Protection Act from "reasonable steps" to "all reasonable steps" to prevent sexual harassment. The same standard will also apply to harassment by third parties, across every Equality Act protected characteristic. Employers will need evidence behind each step, so the logic runs: more evidence means more safety.
Why It's Incomplete
Here's the problem. A completion record proves that a course was assigned and clicked through. It doesn't prove the course worked, that people understood the policy, or that anyone trusts the reporting channel.
The new test is not "did you do some things?" It's "did you do everything reasonable?" That's about coverage and quality, not volume. A perfect record of training for employees tells a tribunal nothing about the contractor on your site, the customer who harasses your front-line staff, or the report that sat unanswered for weeks.
Training managers often feel the pressure to produce a clean number. But a 100% completion rate can sit alongside a workplace where nobody has ever raised a concern. A good dashboard can become a way of feeling safe rather than being safe.
The Evidence
Start with the wording of the standard itself. Before, a company could point to training, or a policy, or a reporting channel, and argue it had taken reasonable steps. Under "all reasonable steps," picking one or two of those is no longer a defense in itself. If a step is reasonable to take, you must have taken it. That shifts the question from "what did we record?" to "what did we leave undone?"
Now consider the third-party duty. You can't fire a customer who harasses your staff, but you can decline their business. That means the reasonable step isn't a training module at all. It's a defined policy on when you'll walk away from a client, and everyone needs to know it exists. A completion report can't capture that. It's a decision rule, plus a culture where staff believe it will be used.
The same pattern shows up in Germany's draft reform of Section 30 of the Administrative Offences Act (OWiG). If adopted as written, an effective compliance program could reduce a fine, but the draft is explicit that boilerplate doesn't count. The program must be built to prevent misconduct, actually operated, and matched to the company's real risks. A system used to hide misconduct can raise the fine. Regulators in more than one jurisdiction are converging on the same idea: they're looking for a working program, not a well-filed one.
Finally, tribunal time limits are doubling from three months to six for most claims from October 1, 2026. Your records now have to hold up over a longer period, and a longer window gives a claimant more time to ask what you actually did, not just what you logged.
What to Do Instead
Keep the records. Then add the questions the records can't answer.
Map the gaps, not just the completions. List every group who could harass your people or be harassed at work: employees, agency and casual staff, contractors, customers, clients, members of the public. For each group, ask what reasonable step reaches them. If the answer is "nothing yet," that's your priority.
Write the customer policy. Define when you'll decline or end a relationship after harassment of your staff. Make sure managers know it and staff know it. Record who has seen it.
Test the reporting channel. The expectation for most companies includes a channel where staff can report without fear of reprisal, and it's hard to argue you took all reasonable steps without one. Don't just confirm it exists. Check how reports are triaged, how quickly someone responds, and whether outcomes are tracked. A channel nobody uses tells you something.
Check understanding, not attendance. Use short scenario questions after training. Look at which answers people get wrong. That shows you where the program is thin, and it's evidence of a program that's actually operated.
Run a drill. Stage a mock harassment report and walk it through your process within 48 hours. Note who decided what, and why. Fix the gaps before an authority or tribunal finds them for you. The same drill supports the investigation credit Germany is proposing, where independence from anyone involved in the misconduct matters.
Keep the evidence together. Reports, investigations, training records, and risk assessments are far easier to produce when they live in one place.
When the Conventional Wisdom Is Right
None of this is an argument against documentation. Without it, you can't prove anything. Evidence behind each step is exactly what the new standard asks for, and a tribunal won't take your word that training happened. Tracked completion and acknowledgement are table stakes: who completed training and when, who has seen the latest policy, who knows where to take a concern.
For a small employer, a clean record of a handful of well-chosen steps may be most of what "reasonable" looks like. What counts as reasonable differs between a two-person shop and a multinational.
So keep the spreadsheet. Just don't mistake it for the program. The records show you did the work; the work still has to be real. If your team can answer "what haven't we done that a reasonable employer would?" as confidently as "who finished the course?", you're in a much stronger position.
