Sexual Harassment Duty 2026: What Employers Must Do

Key takeaways

The preventative duty introduced in October 2024 is being strengthened, not replaced.
From 30 October 2026, employers must take “all” reasonable steps to prevent sexual harassment.
There is no single checklist that will be sufficient for every employer; what is reasonable depends on the organisation, sector, workforce and actual risks. Employers should take advice on what to do.
Policies and training remain important, but employers should also identify real risk areas, provide workable reporting routes and keep evidence of what they have — and have not — done.

The law on workplace sexual harassment is changing again. Since October 2024, employers have been under a positive duty to take reasonable steps to prevent sexual harassment of employees. The Employment Rights Act 2025 strengthens that duty from 30 October 2026. You can follow our wider Employment Rights Act updates for further developments affecting employers.

For employers, this is less about adding another policy to the handbook and more about being able to show that foreseeable risks have been considered and that all reasonable preventative measures have been taken. The October 2026 changes make an evidence-based approach even more important.

For background on the preventative duty introduced in 2024, see our earlier guidance on preventing workplace sexual harassment.

What changes on 30 October 2026?

The current statutory duty to take reasonable steps to prevent sexual harassment will become a duty to take “all” reasonable steps. ACAS explains the distinction in practical terms: an employer that previously chose some reasonable measures may no longer be able to stop there. It will be expected to take all of the preventative steps that are reasonable for its organisation.

What does “all reasonable steps” mean in practice?

The legislation does not create a universal list of mandatory actions for every employer. What is reasonable will depend on factors such as the size and resources of the organisation, the sector, the type of work being carried out and previous incidents.

That makes context important. A small professional-services firm and a large hospitality business will take different steps because their exposure to risk is different. The relevant question is not whether an employer has copied a generic compliance checklist, but whether, looking at the actual risks within its organisation, it identified all reasonable steps it could and should take, and whether it took those.

The Employment Rights Act also gives ministers power to specify evidence-based steps by regulations at a later date. As at the time of writing, 10 September 2026, those regulations have not yet set a definitive statutory checklist. Employers should not wait for them before preparing for the October duty.

What should you be doing now?

1. Refresh — or undertake — your risk assessment.
Identify where harassment is likely to arise, including work-related social events, situations where alcohol will be consumed, lone working, travel and overnight stays, power imbalances, customer-facing roles, online communications and any previous complaints or near misses.

2. Address the risks you identify.
Take steps to ensure the situations you have identified reduce or minimise the risk of sexual harassment occurring, and document the steps you take for each risk identified. This will likely include:

Reviewing and amending policies. A policy should explain prohibited and/or expected conduct, reporting routes, how complaints will be handled and possible disciplinary consequences.
Giving your staff more than one credible reporting route. An individual may be reluctant to report to a direct manager, particularly if the manager is involved. Employers should consider alternative contacts, HR routes and, where appropriate, confidential or anonymous channels operated by a third party.
Training. Generic annual training can be part of the answer, but managers, HR teams and staff may need more tailored training. Induction should also explain the organisation’s standards and reporting arrangements. Training all staff on the updated policy and how sexual harassment in the workplace is unacceptable will likely be a minimum requirement.

3. Address and consider third-party risk too.
Given the additional liability that is also introduced on 30 October 2026, consider client and supplier terms, notices to customers, event arrangements, security measures, staffing levels, escalation routes and whether any offenders can be warned, removed or refused service. ACAS specifically identifies these types of controls as potentially relevant.

4. Record decisions and follow up.
Keep a record of risk assessments, training, incidents, complaints, remedial action and the reasons why a possible step was or was not considered reasonable. Evidence created at the time is more persuasive than a reconstruction after the event.

5. Review effectiveness, not just completion.
Policies and training should be revisited regularly — at least annually — and after incidents, survey feedback, changes in working arrangements or new risk information. The objective is prevention across the organisation, not simply responding well after something has happened.

Will a policy and annual training be enough?

Not necessarily. A well-drafted policy and effective training are important and likely to be key steps in showing you have taken reasonable steps, but they do not remove the need to consider and take all reasonable steps.

If you know, for example, that staff regularly work alone with customers in a setting where harassment has occurred before, a tribunal may look beyond the existence of a policy and ask why other practical controls were not put in place.

Equally, without undertaking a risk assessment of your business to know where the risks are, it is unlikely that you will be able to show you knew what risks you were addressing in the policy update and/or that the training was relevant.

ACAS’ August 2026 guidance is particularly useful on this point. It stresses that the new duty is preventative, should operate across the organisation and may require more from larger or more complex employers.

Do not forget third-party harassment and whistleblowing

For many businesses, this is a significant part of the October law changes. You should map the third parties your staff deal with and ask what control or controls you can realistically exercise.

For example, a hospitality employer might look at security, customer notices, staffing and escalation procedures. A professional-services firm might consider client conduct clauses, event protocols and routes for staff to report concerns about clients’ behaviour.

Since 6 April 2026, reporting sexual harassment has been expressly included as a relevant ‘protected disclosure’ for whistleblowing purposes. A disclosure about sexual harassment can, therefore, give the person making the report whistleblowing protection where the statutory tests are met. Employers dealing with these issues may also find our discrimination and whistleblowing support for employers useful.

This makes it even more important that employers take care when managing sensitive workplace complaints, and that no retribution is sought against the person who reports the issue. Retaliatory treatment can create separate claims for victimisation — another form of discrimination, which is often easier for an employee to prove — and/or detrimental treatment towards a whistleblower.

What is the risk if you fall short?

Where an individual worker succeeds in a sexual harassment claim and the tribunal finds that you breached your preventative duty, the tribunal can increase compensation by up to 25%.

Further, the Equality and Human Rights Commission has the power to investigate and take enforcement action.

Practical preparation

Carry out or refresh a documented sexual-harassment and third-party-harassment risk assessment.
Decide and document the decisions taken in relation to the risks found. This will likely include:
Updating harassment, equality, whistleblowing, grievance, disciplinary and related policies so they work together.
Checking and updating reporting routes and making sure employees know how to use them.
Delivering training to all staff and managers to increase awareness of the changes and reporting routes.
Decide on a mechanism for logging reported issues, including processes for reviewing previous incidents and near misses.
Nominate senior ownership and set a date for the next review.

Frequently asked questions

Does the new duty apply only to large employers?

No. The duty applies to all employers, although what counts as all reasonable steps should vary according to the organisation, its resources, sector and risk profile.

Can an employer wait for further regulations before acting?

No. The increased duty is due to take effect on 30 October 2026. The Act allows later regulations to specify evidence-based steps, but that power complements rather than replaces the broader duty.