The (re)introduction of third-party harassment from 30 October 2026. What the duty means for employers.

Quick answer

From 30^th October 2026, employers in England and Wales may be liable for harassment from a third party (such as a customer or supplier) towards their employees. All ‘protected characteristics’ under the Equality Act are protected meaning employers will face liability for harassment by third parties, unless they can show that all reasonable preventative steps were taken.

Key takeaways

​

• From 30 October 2026, employers may be liable where an employee is harassed by a third party in the course of their employment.
• Third parties can include customers, clients, contractors, suppliers, service users, people attending events and members of the public.
• Employers will need to show that they took all reasonable steps to prevent third-party harassment.
• Employers should assess where third-party harassment could occur and introduce appropriate preventative measures before an incident happens.
• Policies, training, reporting procedures, risk assessments and records of the preventative action taken will become increasingly important.
• The steps required will depend on the nature of the organisation, its workforce and the risks employees face when dealing with third parties.
  ​
  ​

What changes on 30 October 2026?

The Employment Rights Act introduces liability where an employee is harassed by a third party in the course of employment and the employer failed to take all reasonable steps to prevent that harassment. Third parties can include customers, clients, service users, contractors, people attending conferences or events, and members of the public.
​
The third-party change is broader than sexual harassment alone. The statutory amendments cover harassment within the Equality Act 2010 framework, including harassment related to protected characteristics, so the provisions extend beyond sexual harassment.
​
Employers can also read our guidance on sex discrimination and sexual harassment at work for the wider legal context.
​
​

What should you be doing now?

1. Refresh your risk assessment.
Identify where harassment is realistically more likely to arise, including client entertaining, situations where alcohol will be consumed, travel and overnight stays, customer-facing roles, suppliers working for you, online communications and any previous complaints or near misses.
​
2. Address third-party risk directly.
Consider your terms of business with clients and suppliers, notices to customers, event arrangements, security measures, staffing levels, escalation routes and whether repeat offenders can be warned, removed or refused service. Acas specifically identifies these types of controls as potentially relevant.
​
Employers reviewing their wider policies and procedures may also find our employment law advice for employers useful.
​
​

What is the risk if you fall short?

From 30 October 2026, the substantive third-party harassment provisions create an additional route to liability where the statutory conditions are met.
​
Beyond litigation, complaints can also create employee-relations, cultural and reputational consequences, particularly if an employer appears to have ignored a known risk.
​
​

Practical preparation

• Carry out or refresh a documented third-party-harassment risk assessment.
• Decide and document the decisions taken in relation to the risks found. This may include:
• Identifying third-party — customer, client and contractor — touchpoints where additional controls may be needed.
• Deciding what additional controls are required to mitigate the risks identified.
• Updating harassment, equality, whistleblowing, grievance, disciplinary and related policies.
• Reviewing and delivering training to inform staff of the changes made and to upskill managers.
• Decide on a mechanism for reporting and logging issues.
• Nominate senior ownership and set a date for the next review.
  ​
  ​

Frequently asked questions

​

When does the new third-party harassment duty come into force?

The new provisions are due to come into force on 30 October 2026. Employers should use the period before implementation to review their risks, policies, training and reporting arrangements.
​

Is third-party harassment limited to customers?

No. Acas gives a much wider range of examples, including clients, service users, contractors, people at events and members of the public.
​

What does “all reasonable steps” mean?

There is no single set of measures that will be appropriate for every employer. What is reasonable will depend on factors including the organisation, its size, the sector in which it operates, the type of work employees undertake and the risks they face.
​

Do employers have to wait for a complaint before taking action?

No. The duty is preventative. Employers should consider foreseeable risks and the steps that can reasonably be taken to reduce those risks before harassment occurs.
​

What records should employers keep?

Employers should consider retaining relevant risk assessments, training records, policy reviews, reports of incidents and records of the measures considered or introduced.
​
This can help demonstrate the preventative steps the organisation has taken.

This article provides general information only and is based on the law and official implementation timetable available on 10 September 2026. It is not legal advice. Future commencement dates remain subject to parliamentary processes and may change.