Sexual harassment at work: what employers need to change before 30 October

For many employers, workplace harassment is something addressed in a staff handbook, discussed briefly during induction and revisited only when somebody makes a complaint. Unfortunately, having a policy and having a functioning system for preventing harassment are two very different things. From 30 October 2026, the Employment Rights Act 2025 will strengthen employers' responsibilities by changing the existing duty to take reasonable steps to prevent sexual harassment into a duty to take all reasonable steps. It will also introduce an obligation not to permit third-party harassment, including conduct by customers, clients and service users. These changes matter to every employer, but they present particular challenges for smaller businesses and organisations whose staff regularly interact with the public.

Having a policy is not the same as having protection

One of the most persistent weaknesses in workplace harassment procedures is the gap between written policies and everyday management practices. A business might have an apparently comprehensive dignity at work policy, yet its middle managers have little practical understanding of how to implement it. Complaints may be dismissed as personality clashes, quietly ignored or mishandled because a manager is uncomfortable confronting another employee. Where the individual accused holds a senior position or has a close relationship with management, the temptation to minimise the situation can become considerable. Equally problematic is the opposite reaction, where the mere suggestion that harassment may have occurred causes management to become defensive, place everyone on notice and create an atmosphere in which the complaint itself becomes the problem.

Neither approach is satisfactory, and finding the appropriate balance is frequently more difficult than employers appreciate. An employee reporting harassment should be listened to, treated with dignity and protected from victimisation, but that does not remove the requirement for a fair and proportionate investigation which does not prejudge the person accused. The employer must be capable of supporting the complainant without treating an allegation as a proven fact, just as it must avoid allowing procedural fairness to become an excuse for inaction. The question is therefore not simply whether a harassment policy exists, but whether the organisation can demonstrate that its managers understand it, apply it consistently and know how to respond when something goes wrong.

When the problem is a customer or service user

Perhaps the most commercially challenging aspect of the reforms is the strengthened protection against third-party harassment. Consider a pub where a regular customer becomes intoxicated and makes inappropriate sexual comments to a member of staff. The customer may have spent money at the establishment for years and be well known to the owner, making the prospect of confrontation commercially and personally uncomfortable. For too long, some businesses have treated these situations as an unfortunate part of customer-facing employment, expecting staff to ignore the behaviour, laugh it off or avoid upsetting a paying customer. That approach is increasingly difficult to defend, particularly where an employer knows that certain customers present a recurring risk but has made little effort to address it.

For hospitality businesses already operating on tight margins, the practical difficulties should not be underestimated. Refusing service or excluding a regular customer can have financial consequences, and not every incident will present an obvious or straightforward response. Nevertheless, protecting employees cannot depend entirely upon whether the person responsible is commercially valuable to the business. Employers should be reviewing customer conduct policies, introducing appropriate signage, training employees and managers, and establishing reporting arrangements which permit staff to raise concerns promptly. A zero-tolerance policy should mean that harassment is taken seriously and addressed, rather than every incident automatically producing an identical response regardless of the circumstances. What matters is that the employer has identified the risks, considered the measures reasonably available and is prepared to act when necessary.

The situation becomes considerably more complicated in care environments, where inappropriate conduct may arise from a service user living with dementia or another condition affecting their understanding or behaviour. A care worker who experiences unwanted touching or sexual comments should not be expected to tolerate the situation simply because the individual responsible is vulnerable, yet excluding that person or treating the incident as deliberate misconduct may be neither appropriate nor possible. These circumstances require careful assessment, potentially including changes to staffing arrangements, increased supervision, individual risk assessments and consideration of the service user's needs alongside the employer's responsibilities towards its workforce. Staff must have a meaningful opportunity to report what has happened and confidence that their concerns will be taken seriously, even where the response is more complex than disciplinary action or exclusion. Taking a complaint seriously does not necessarily mean punishing the person involved; it means recognising the risk and taking appropriate steps to protect those affected.

Why smaller employers need to pay attention

Smaller employers frequently operate with informal management structures, where owners know their staff personally, workplace relationships are close and procedures may be considerably less structured than those found within larger organisations. There are advantages to that environment, but informality becomes dangerous when an employer assumes that a friendly workplace makes formal protections unnecessary. An employee may be particularly reluctant to complain where the alleged perpetrator is a close friend of the owner, a long-standing colleague or an important customer, especially if previous concerns have been dismissed as misunderstandings. The employer may genuinely believe that the matter can be resolved through a quiet conversation, but informal resolution must never become a means of suppressing serious complaints or avoiding an appropriate investigation.

Smaller organisations are not necessarily expected to introduce every measure available to a large corporation with a dedicated HR department. They are, however, expected to identify and take the steps that are reasonable in their particular circumstances, and this requires considerably more than inserting a generic policy into an employee handbook. Management must recognise that its own conduct, workplace culture and willingness to challenge inappropriate behaviour will influence whether employees feel able to raise concerns. A business which maintains an extensive written policy while consistently overlooking breaches may find that its documentation provides rather less protection than anticipated.

Three priorities before 30 October

For employers who have done little preparation, three immediate priorities stand out. First, make expectations clear to customers and other third parties. Customer-facing policies, signage, booking terms and contractual arrangements should be reviewed where relevant so the business can explain what conduct is unacceptable and how it will respond. Second, make sure employees understand their rights and know how to report concerns. Reporting arrangements must be accessible, including an alternative to approaching the immediate manager where that would be inappropriate. Managers must be trained to listen, recognise risks and respond fairly rather than becoming defensive or dismissive.

Third, confront existing weaknesses instead of hoping the changes will go away. Previous complaints, known risks, workplace culture and management practices should be examined, with appropriate assessments, training and recorded decisions forming part of a continuing prevention strategy. None of this requires an employer to guarantee that harassment will never occur, which would be unrealistic, but it does require a genuine attempt to anticipate and prevent foreseeable problems rather than relying solely upon reactive measures once a complaint has been made.

The consequences of inaction

The October reforms should not be understood as imposing automatic liability whenever somebody behaves inappropriately at work. Whether an employer took all reasonable steps to prevent the harassment will remain an important consideration, and the measures appropriate to one organisation may differ substantially from those required of another. Nevertheless, businesses which continue to rely upon outdated policies, inadequate training or an assumption that harassment is simply part of working with the public are exposing themselves to risks which are increasingly difficult to justify. Ignoring the changes in the hope that they will pass unnoticed is something of a tiger-by-the-tail situation: the longer a business avoids addressing the problem, the harder it may become to control the consequences.

Aubrey International supports employers with workplace policies, HR compliance and employment risk management. Businesses wishing to review their existing arrangements or understand the practical implications of the October changes are welcome to contact us for an initial discussion.

This article provides general information on the law in England, Scotland and Wales and should not be treated as advice on individual circumstances.

Practical support. Real solutions.