Table of Contents

From October 2026, UK employers face a higher legal bar on workplace harassment. The Employment Rights Act 2025 strengthens the existing duty to prevent sexual harassment and makes employers liable when their workers are harassed by third parties.

Most employers know the Act has passed. Fewer know what it concretely requires, or by when. This article sets out the duty, the dates, and what counts as doing enough.

What does the Employment Rights Act change?

Timeline of the Employment Rights Act 2025 harassment duty: Royal Assent in December 2025, harassment reports gaining whistleblower protection in April 2026, and the duty in force in October 2026

The Employment Rights Act 2025 received Royal Assent on 18 December 2025. Its provisions take effect in phases across 2026 and 2027, and the harassment provisions are due in October 2026.

Two changes matter most.

The first amends the preventative duty in the Equality Act 2010. Employers already have a duty to take reasonable steps to prevent sexual harassment of their staff. From October 2026, that becomes a duty to take all reasonable steps. The word “all” raises the bar: an employer will be expected to show they considered the full range of steps available, not only a few convenient ones.

The second introduces liability for third-party harassment. If a worker is harassed by a customer, client, or contractor, and the employer has not taken all reasonable steps to prevent it, the employer can be held responsible. This applies to harassment related to any protected characteristic.

An employee serving a customer at a café counter, a customer-facing workplace of the kind the new third-party harassment liability covers

One further change arrives earlier. From April 2026, a worker’s report of sexual harassment counts automatically as a protected disclosure, which strengthens their protection from being penalised for raising it.

What does “all reasonable steps” mean?

It is not one action, and there is no statutory checklist. What counts as reasonable depends on the employer: its size, its sector, the working environment, and where harassment is most likely to occur.

The Equality and Human Rights Commission (EHRC), the body that enforces the Equality Act, points consistently to a combination of measures:

  • a clear anti-harassment policy that staff actually know about
  • regular risk assessments that identify where harassment could happen, including from third parties
  • reporting and complaints routes that people trust enough to use
  • training, so that staff and managers understand what harassment is and how to respond
  • monitoring, so the employer can see whether any of it is working

Each of these is a step. None on its own is the duty. The shift to “all reasonable steps” means an employer should expect to evidence several of these together, and to show the thinking behind them.

Documenting that thinking matters as much as the steps themselves. If the duty is ever tested, what protects an employer is the evidence of what it did, and why.

Does training make you compliant?

No. A course on its own is not enough. Training is one of the reasonable steps, and one most employers will need. An employer who has run no training at all will find it hard to argue they took all reasonable steps to prevent harassment. Training is also the step that reaches everyone: it is how a policy stops being a document and becomes something staff understand.

But a course is one step, not the whole duty. An employer who buys a course, records the completions, and does nothing else has taken one step, not all reasonable steps. The risk assessment, the policy, and the reporting routes still have to exist.

So be cautious of anything sold as compliance in a box. A course is a component, and the buyer’s job is to put the other steps in place around it.

An employer who buys a course, records the completions, and does nothing else has taken one step, not all reasonable steps.

What does good training cover?

Good training does three things.

  • It reflects third-party harassment, from customers and clients, not just colleague-to-colleague, because that is where the new liability sits.
  • It gives staff what they need: what harassment is, how to raise a concern, and what happens when they do. Managers need that, and also how to receive a report and act on it.
  • It produces a record of who was trained, on what, and when. That record is part of showing the step was taken.

What should employers do before October 2026?

October 2026 is not far away, and the steps the duty expects take time to do properly. Four are worth starting now.

  • Run a risk assessment. Identify where harassment is most likely in your workplace, including from customers and other third parties.
  • Review your anti-harassment policy. Check that it is current, covers third-party harassment, and is something staff have actually read.
  • Check your reporting routes. A complaints process only counts if people know about it and trust it enough to use it.
  • Arrange training. Staff and managers should understand the duty and their part in it well before the deadline.

Echo3 offers online, CPD-accredited (Continuing Professional Development) harassment-prevention awareness training built to cover the duty as it takes effect in October 2026. It is one step of several, a component to sit alongside the policy, the risk assessment, and the reporting routes, not a substitute for them. The EHRC’s published guidance sets out the fuller picture for employers who want it.