The October 2026 Harassment Duty: What 'All Reasonable Steps' Requires

Four weeks from now, the bar for preventing sexual harassment at work moves again.

From October 2026, employers no longer need to show they took reasonable steps to prevent sexual harassment. They need to show they took all reasonable steps. The word "all" is doing the legal work here, and most organisations aren't ready for what it demands.

Photo by Redd Francisco on Unsplash

Two changes land at once

First, the prevention duty tightens. Since October 2024, UK employers have had a positive duty to take reasonable steps to prevent sexual harassment. That duty escalates this October to "all reasonable steps." It's a higher evidential bar. It expects documented, systematic prevention work. A policy sitting in a handbook nobody reads won't meet it.

Second, third-party harassment liability returns. Employers become accountable for harassment carried out by clients, customers, contractors and suppliers, not just by their own staff. This duty existed in UK law until 2013, when it was removed. It's back, covering every protected characteristic under the Equality Act, sex included. For any organisation with client-facing staff, that's a meaningful shift in where liability can come from.

Here's what makes this different from the 2024 duty. That one asked employers to do something. This one asks them to prove it. Employment tribunals can already increase compensation by up to 25% where an employer has failed to take reasonable steps. From October, the test they're measured against gets harder to pass.

What "all reasonable steps" means in practice isn't fully settled. Statutory guidance defining the standard in detail isn't expected until after the duty takes effect. That leaves employers proving compliance against a standard that's still being written. Build a defensible record now, while the standard is still open. Waiting for case law to define it means starting from behind.

Six things before October

Photo by Vitaly Gariev on Unsplash

A harassment-specific risk assessment, covering roles and situations where third-party contact is highest: client-facing teams, hospitality, healthcare, retail, field sales.

Training that's role-specific and refreshed on a cycle, not a single induction module completed once and forgotten. Tribunals and regulators are looking for evidence of ongoing effort, not a box ticked in year one.

A reporting mechanism people trust enough to use. TUC research puts the proportion of women who've experienced workplace harassment at well over half, and fewer than a third of them report it. A policy that exists on paper but isn't used in practice won't hold up as evidence of reasonable steps, let alone all reasonable steps.

Clear documentation of what's been done, when, and what's planned next. Under this test, the paper trail is the evidence.

Photo by Dimitri Karastelev on Unsplash

Two more, less obvious, belong on that list too. Complaint investigation procedures need to hold up to scrutiny, not just exist. And non-disclosure agreements used in past settlements are worth a second look, since how an organisation has historically handled complaints speaks directly to whether its current steps are reasonable.

Leadership accountability sits underneath all of this. A prevention duty backed by a policy nobody senior has read, or a training budget nobody senior defends, won't survive contact with a tribunal asking who signed off on it. The organisations that come through this well are the ones where someone at board level owns the answer to that question, not just HR.

Where this leaves you

We've built harassment prevention training for organisations who know the difference between a policy that exists and a policy that gets used. The gap between those two things is exactly where tribunals, and now potentially third-party liability claims, will look first.

Four weeks isn't long enough to build a compliance programme from nothing. It is long enough to get the risk assessment done, the training booked, and the documentation started. Organisations that treat this as a real prevention exercise, not a compliance refresh, will be the ones with a defensible answer when someone asks what reasonable steps they took.

If your last harassment training was a single online module two years ago, that's worth a conversation before October, not after.