On 30 October 2026, the law on workplace harassment changed again.

Employers are now legally responsible when customers, clients, contractors and other outsiders harass their staff, unless they took all reasonable steps to prevent it. At the same time, the duty to prevent sexual harassment was raised from "reasonable steps" to "all reasonable steps".

These changes didn't come out of nowhere. They are the latest chapter in a story that goes back 50 years, and the direction of travel has only ever been one way: up. Understanding that story is the best way to make sense of what "all reasonable steps" actually asks of you.

Defending Discrimination Claims

When discrimination (including harassment) happens at work, the employer can be held legally responsible, even if senior leaders knew nothing about it and would never have approved. The law gives employers one way out: a defence if they can show they did enough to prevent it.

The question has always been the same. How much is enough?

1975 to 2010: "Reasonably Practicable"

The first modern discrimination laws, the Sex Discrimination Act 1975 and the Race Relations Act 1976, made employers liable for discrimination by their employees in the course of their employment. An employer could escape liability if it proved it had taken "such steps as were reasonably practicable" to prevent it.

The key case on how that defence worked is Canniffe v East Riding of Yorkshire Council (Employment Appeal Tribunal, 2000). It set a simple two-stage test:

1. What steps, if any, did the employer actually take?
2. Were there any further reasonable steps it could have taken?

The crucial point is that it doesn't help an employer to argue that the missing step wouldn't have made any difference. If there was a reasonable step you didn't take, the defence fails. The tribunal memorably described the defence as an "eye of the needle" that employers must pass through.

2010: The All Reasonable Steps Defence

The Equality Act 2010 brought the old patchwork of discrimination laws together and reworded the defence. Under section 109(4), an employer has a defence if it can show it took all reasonable steps to prevent the act of discrimination - any discrimination, including sexual harassment. Let's call this "the 2010 all reasonable steps defence."

The 2010 all reasonable steps defence covers every protected characteristic. It is still the test that applies today whenever an employer's own staff discriminate against a colleague.

The EHRC's statutory Employment Code of Practice, applying to provisions of the Equality Act 2010, which tribunals must take into account, gives guidance on what the 2010 all reasonable steps defence means.

It covers things like having an anti-harassment policy, making sure everyone knows about it, training staff and managers, and dealing properly with complaints.

It also sets out a specific list of steps an employer might take to prevent third-party harassment (harassment by someone who is not a fellow employee - for example, a customer or client). This now sits alongside the new duty to take all reasonable steps to prevent third-party harassment covered later in this article.

2021: Allay v Gehlen, and Why Stale Training Isn't Enough

In Allay (UK) Ltd v Gehlen (Employment Appeal Tribunal, 2021), an employee was subjected to racist comments by a colleague. The employer had a policy and had delivered equality training, so it argued it had taken all reasonable steps.

It lost. The training had been delivered years earlier and was, in the tribunal's words, "clearly stale". Refreshing it would have been a reasonable step, so the defence failed.

The case settled two important points:

• The change in wording didn't lower the bar. "All reasonable steps" is no easier to meet than the old test, so Canniffe still applies.
• It is a high threshold. The burden is on the employer, and the tribunal will look at the quality and likely effectiveness of what was done, not just whether a training session happened.

2024: A Positive Duty to Prevent Sexual Harassment

On 26 October 2024, the Worker Protection Act 2023 introduced something new: a positive duty on employers to take reasonable steps to prevent sexual harassment of their workers (section 40A of the Equality Act 2010).

This was a real shift in thinking. Until then, prevention was mainly about building a defence once a claim had been made under the 2010 all reasonable steps defence. Now employers were expected to anticipate risks and act before anything happened.

There is no standalone claim for breaching the duty. But if a tribunal upholds a sexual harassment claim and finds the employer breached the duty, it can increase the compensation by up to 25%. The Equality and Human Rights Commission (EHRC) can also take enforcement action.

2025: Higgs, and Why Prevention Isn't a Licence to Silence

In Higgs v Farmor's School (Court of Appeal, February 2025), a school dismissed an employee after she shared social media posts expressing her religious beliefs about gender and sex education. The Court of Appeal found the dismissal was unlawful discrimination.

The case isn't about harassment as such, but it sets an important limit on how employers respond to complaints:

• The right to hold a belief is absolute. The right to express it can be limited, but only where that is proportionate.
• Disciplining someone simply for expressing a protected belief, or because others object to it, is unlawful.
• Action is only justified where there is something objectively objectionable about the way the belief was expressed, and the response is proportionate.

For employers, this means that a complaint about something offensive still needs to be looked at objectively and in context. Preventing harassment matters, but so do freedom of belief and freedom of expression, and getting that balance wrong can create a different legal risk.

30 October 2026: The Bar Rises Again

The Employment Rights Act 2025 brought in two major changes on 30 October 2026.

1. Employers Are Now Liable for Third-Party Harassment

An employer must not permit a third party to harass its employees in the course of their employment. A third party is anyone who isn't the employer or one of its employees, so customers, clients, patients, contractors, suppliers, visitors and members of the public are all included.

This isn't limited to sexual harassment. It covers harassment related to any protected characteristic, such as race, disability, religion or belief, sexual orientation or age.

The employer will be liable unless it can show it took all reasonable steps to prevent the harassment. Let's call this "the 30 October all reasonable steps proactive duty to prevent third-party harassment".

A similar rule existed between 2008 and 2013, but only kicked in after an employer knew of two previous incidents. That "three strikes" requirement has gone: there is no need for any earlier incident.

2. The Sexual Harassment Duty Is Strengthened

The positive duty introduced in 2024 now requires employers to take all reasonable steps to prevent sexual harassment, not just reasonable steps. The 25% compensation uplift still applies. Let's call this "the 30 October all reasonable steps proactive duty to prevent sexual harassment".

On the same day, the EHRC published updated technical guidance and an updated eight-step guide for employers. The guidance isn't legally binding, but tribunals are likely to look to it when deciding whether an employer has done enough.

What's Coming Next

The Employment Rights Act 2025 also gives the government the power to make regulations setting out what counts as "reasonable steps" to prevent sexual harassment, such as carrying out assessments, publishing policies and handling complaints.

Those regulations are expected in 2027/28, after consultation, and will cover sexual harassment only.

Until they arrive, there is no fixed legal checklist. Employers need to work out what is reasonable in their own circumstances, guided by the EHRC's statutory Employment Code and its updated technical guidance.

What This Means for Your Organisation

"All reasonable steps" is a high bar, and there is no single action that will meet it. A tribunal will look at the whole picture. In practice, that usually means:

• Increase self-awareness. Harassment hinges on unwanted conduct. To better understand unwanted conduct we need to increase levels of self-awareness about our own behaviours and how they impact others. This is not just a training video. This is a commitment to people development more generally.
• Understanding your risks. Think about where harassment is most likely to happen, including customer-facing roles, lone working, late shifts, events and work socials. Include the risk from third parties, not just colleagues. Get a lot of different perspectives on this!
• Keeping policies alive. Make sure your policy covers third-party harassment and all protected characteristics, and that people actually know about it. Consider telling customers, clients and contractors what behaviour you expect.
• Making training regular, relevant and effective. Training should reflect real situations your people face, be refreshed regularly and focus on behaviour, not just legal definitions. As Allay shows, out-of-date training can count against you.
• Making it easy to speak up. People need to know how to raise concerns, feel confident they will be taken seriously and be protected from victimisation. How confidential is your confidential process?
• Equipping your managers. Managers are often the first to see problems and the first people employees go to. They need to know how to respond, including when the harasser is a customer or client.
• Investigations, mediation and informal dispute resolution. These are the processes where issues get resolved. Would it not be a reasonable step to ensure that these processes are robust, fair, undertaken by people trained in this area and designed to help cultural improvements within the organisation?
• Acting on every concern. Respond promptly and fairly, and use what you learn to review whether your measures are working.
• Keeping a record. If you are ever challenged, you'll need to show what you did, why you did it and how you kept it under review.

How We Can Help

At Impact Lawyers, we combine employment law expertise with practical HR experience and an understanding of human behaviours.

We can help you review your policies and risk assessments, and we deliver practical, human and impactful anti-harassment training for all staff, managers and leaders.

If you'd like to talk about where your organisation stands under the new rules, please get in touch.

---

This article is a general overview. It is not legal advice, and you should take specific advice on your own situation. For specific legal advice tailored to your business, please contact the Impact Lawyers team at contact@impactlawyers.co.uk .