A recent legal change has transformed common control gaps into significant liabilities for employers. This shift targets a typical failure pattern: having a harassment policy and annual training but lacking real preventive mechanisms. Let's explore what this new law means for your team.
Understanding the New Requirements
On 30 October 2026, two provisions of the Employment Rights Act 2025 came into force for all UK employers. Employers must now take "all reasonable steps" to prevent sexual harassment of their staff and harassment by third parties, like customers.
This change emphasizes prevention over reaction. Simply having a policy for handling complaints is no longer enough. Your responsibility now extends beyond your employees to include third parties.
Key Dates to Remember
Here's how the timeline affects your team:
- Before 30 October 2026: Most employers relied on policies, complaint routes, and periodic training, assuming these would prevent harassment.
- 30 October 2026: The new duties took effect, requiring prevention measures, including protection from third-party harassment.
- From that date forward: If harassment occurs, you'll need to show the steps you took were reasonable. Without evidence, defending your actions becomes difficult.
Identifying Control Gaps
Consider these common gaps as areas to evaluate:
1. No documented risk assessment. Without identifying where harassment is likely, you can't tailor your policies effectively. Risk varies by role, location, and customer interaction.
2. Unmanaged third-party exposure. Staff interacting with the public face risks that internal policies might not cover. Determine who interacts with third parties and in what settings.
3. Ineffective training. Attendance records don't prove a safer workplace. Training should change conditions, not just inform.
4. Late-starting complaints route. If your first control is post-report, prevention is lacking. A weak initial response can jeopardize both the complainant and the process.
5. Lack of inclusive design. Policies and training should accommodate neurodivergent employees and consider overlapping obligations like disability and discrimination.
6. Ignoring data protection in investigations. Harassment investigations involve sensitive data. Ensure your process complies with UK GDPR.
Meeting the Standard
The duty is to take "all reasonable steps." The law sets the bar but doesn't provide a checklist. Reasonableness depends on your circumstances.
A structured approach is essential. Two frameworks can guide you:
- ISO 37301 Compliance Management Systems: This framework involves identifying obligations, assessing risks, setting controls, monitoring results, and improving. It's a logical approach that regulators expect.
- Seven Elements of an Effective Compliance Program: Though a US framework, its elements, like written standards and confidential reporting, are useful for designing your program.
Reasonable steps should be proportionate to documented risks, proactive, and evidenced.
Action Items for Your Team
Conduct a risk assessment. Identify where staff are most exposed, including customer interactions. Document your findings and update them as needed.
Develop a third-party plan. Outline how to handle harassment by customers or clients. Ensure staff know how to report it and managers know their responsibilities.
Shift prevention upstream. Implement controls before complaints arise, like setting clear behavioral expectations and supervising high-risk settings.
Enhance training. Align it with your risk assessment to address real scenarios. Track outcomes to ensure reports are resolved and trusted.
Incorporate neurodiversity. Ensure policies and training are clear and accessible. Plan for cases involving neurodivergent individuals.
Prepare your first response. Document the initial steps after a complaint, including support for the complainant and criteria for suspension.
Ensure data protection compliance. Plan how to handle investigation data under UK GDPR.
Maintain evidence. Document every step to prove reasonableness. Keep records of assessments, decisions, and training.
You don't need a perfect program from day one. Start with a risk assessment, as every other control relies on it. Your efforts should be visible, reasoned, and improve over time.
