Nobody has defined “all reasonable steps.” Not the government, not a lawyer, not your policy document. From 30 October 2026, an employment tribunal will start defining it for you, one case at a time.
That’s not a scare line. It’s the actual state of the law. Regulations spelling out what counts as “reasonable” aren’t expected before 2027/28, and only after a public consultation the government hasn’t even run yet. The duty to prevent sexual harassment goes live before its own definition does.
Here’s the stat that makes this personal rather than abstract: in the year ending March 2025, 5.2% of people who told the ONS they’d been sexually harassed in the last year said it was a client or member of the public they came into contact with through work. From 30 October, that stops being a customer service problem and becomes the employer’s legal exposure, whether the employer knew about it or not.
This piece covers what actually changes on 30 October, why no document can prove compliance in advance, what a tribunal will actually look at when it happens anyway, and what to do before the date lands.
The word that does the work
Since October 2024, employers have had to take reasonable steps to prevent sexual harassment. From 30 October 2026, that becomes all reasonable steps. One word, and the test underneath it changes completely.
- Old standard: point to a reasonable set of measures and stop there
- New standard: a step that existed, was available, and wasn’t taken defeats the defence on its own
GOV.UK’s own factsheet confirms the amended duty now mirrors the “all reasonable steps” defence already used elsewhere in the Equality Act, the same bar an employer has to clear to defend a discrimination claim brought against one of its own staff.
Here’s what that looks like in practice. Say your organisation offered harassment awareness training to managers last year. Half signed up. The session was affordable, genuinely useful, and easy to schedule. Nobody made attendance mandatory. Under “reasonable steps,” offering the training was probably enough. Under “all reasonable steps,” the fact that it was available, affordable, and skipped by half your managers is now the exact gap a tribunal will ask about.
What’s genuinely new about third-party liability
From 30 October 2026, employers become liable for harassment of their staff by third parties, customers, clients, patients, contractors, suppliers, visitors, anyone who isn’t the employer or a fellow employee. This isn’t a modest extension. It’s the return of a duty that was repealed in 2013, rebuilt with real teeth this time.
Four things about it are genuinely new, and worth knowing precisely rather than in outline.
There’s no three-strikes rule. The old version of this law, before 2013, required an employer to be aware of two previous incidents before liability attached. GOV.UK’s own factsheet confirms that threshold is gone. One incident is enough.
There’s no knowledge requirement. An employer doesn’t need to have known harassment was happening for liability to attach. What matters is whether the employer failed to take all reasonable steps to prevent it, not whether anyone reported it first.
It covers most protected characteristics, not just sexual harassment. The government’s factsheet specifies seven: age, disability, gender reassignment, race, religion or belief, sex, and sexual orientation. Pregnancy and maternity, and marriage and civil partnership, sit outside this specific provision.
It’s weighted toward customer-facing sectors. A retail worker dealing with an abusive customer, a nurse on the receiving end of a patient’s comments, a site worker enduring a contractor’s remark, all of these now sit squarely inside the employer’s responsibility, in a way they simply didn’t before.
The practical shift is this: a complaint that used to end with “that’s not really our issue, they don’t work here” no longer ends there. It starts a genuine legal question about what the employer did to prevent it.
The part nobody’s saying out loud
Here’s the part most coverage of this change glosses over: there is no published definition of “all reasonable steps,” and there won’t be one before 2027/28 at the earliest.
The Employment Rights Act gives government the power to make regulations specifying exactly what counts as reasonable, things like mandatory risk assessments, published policies, specific reporting procedures. But that power hasn’t been used yet. GOV.UK’s own factsheet is direct about the timetable: those regulations are expected in 2027/28, and only after a public consultation that hasn’t happened yet.
The Equality and Human Rights Commission has said it will publish updated guidance to help employers navigate the new standard. As of writing, it hasn’t. Employers are currently pointed toward the existing technical guidance and eight-step framework, published for the original 2024 standard, as the closest available indicator of what’s expected, not a finished answer for the higher bar landing this October.
What this means in practice is worth saying plainly: no document proves compliance. Not a policy, not a checklist ticked off, not a training certificate on file. The only thing that actually helps is a record that shows genuine, specific effort, built before anyone asked to see it, not assembled afterward to justify a decision already made.
What a tribunal will actually look at
With no finalised checklist to work from, it helps to think in terms of three questions rather than a list of boxes to tick. They come from the themes running through the EHRC’s existing guidance on the preventative duty, the closest indicator available while the updated version is still being prepared.
Did you identify the risk? Not a generic policy that could apply to any workplace, but a genuine assessment of where your specific staff are actually exposed, which roles deal with the public, which sites have limited supervision, which shifts leave someone isolated.
Did you act on it? Measures that actually reach the people exposed to the risk, not just the people who happened to attend a session. Training that half the relevant staff skipped doesn’t discharge the duty just because it was offered.
Did you check it worked? A review date, a way of monitoring whether reports are actually happening or being quietly absorbed, evidence the organisation revisited its own approach rather than filing the policy and moving on.
A real case shows what happens when none of this exists. In 2025, Lidl GB entered a legally binding agreement with the EHRC after an employment tribunal found it had failed to take all reasonable steps to prevent the sexual harassment of a young employee. The tribunal’s findings were specific: managers at the store weren’t aware the company’s own anti-harassment policy existed, no risk assessment had been carried out, and the business relied entirely on staff to raise complaints before it acted. Under the higher standard landing this October, that gap is exactly what a tribunal will be looking for.
Why this lands on line managers, not HR
A policy is written once, usually by HR, then filed. The duty it’s meant to satisfy is discharged continuously, by whoever’s actually in the room when something happens.
That’s the gap most organisations haven’t closed yet. A line manager is the one who:
- Notices a pattern of comments before it escalates
- Receives the disclosure, often informally, before anything is written down
- Decides, in the moment, whether that disclosure gets taken seriously or quietly discouraged
- Documents what happened accurately enough that it means something later
- Escalates when something shouldn’t be handled alone
None of that lives in a policy document. It lives in whether a manager actually knows what to do in the moment, and whether the organisation can show that training happened, reached the right people, and was tracked, not just offered. Acas’s own guidance on the preventative duty is consistent on this point: training is only evidence of prevention if it’s genuinely delivered and genuinely reaches the people who need it, not a session that technically took place.
Untracked training isn’t evidence. It’s an assertion.
What it costs to get wrong
Three facts, no need to dress them up.
A successful sexual harassment claim that also finds a breach of the preventative duty can carry a compensation uplift of up to 25%. This isn’t a general harassment penalty, it applies specifically where a tribunal finds the preventative duty was breached alongside a successful sexual harassment claim.
From 1 October 2026, the time limit for bringing most employment tribunal claims doubles, from three months to six. Disputes stay live for longer, and so does the documentation an employer needs to still have on hand when a claim eventually lands.
And from 1 January 2027, the qualifying period for unfair dismissal protection drops to six months, and the cap on unfair dismissal compensation, currently £123,543, is scrapped entirely. None of these three changes sit in isolation. They compound.
What to do before 30 October
None of this requires waiting for the date to land, or for regulations that won’t exist for another year or two.
- Run a genuine risk assessment that covers third-party contact, not just staff-on-staff harassment, since that’s the gap the law is specifically closing.
- Write down why you chose your current measures. If a tribunal asks in eighteen months’ time, “we thought it was reasonable” needs to be backed by something dated, not reconstructed from memory.
- Check your reporting routes actually work when the harasser isn’t a colleague. Most complaint processes assume the person being reported works there too.
- Review supplier and contractor agreements for how third-party conduct on your premises or at your events is actually addressed, not assumed away.
- Train the managers who’ll hear about it first, and keep the record. Attendance, content, and date, not just that a session happened at some point.
- Set a review date. Not a policy that gets written once and never revisited.
None of this is scaremongering. It’s just what’s coming, and there’s real time left to be ready for it rather than reacting to it.
Next steps
Everything above is the argument. Building the habit that actually holds up under it is different work, and it’s exactly the ground HR Compliance for Managers covers, module by module, with employment law expert Amanda Chadwick.
Enrol in HR Compliance for Managers with Amanda Chadwick → avadolearning.com/hr-compliance-for-managers
