"All reasonable steps": how to prepare for the October 2026 sexual harassment duty

Reviewed by Dr. Audrey Fleming, Head of Culture Change and Psychosocial Safety, and Menaka Gamage, Head of HR, British Safety Council. Published 30 October 2026.

From 30 October 2026, employers in Great Britain are required to take "all reasonable steps" to prevent sexual harassment of their employees. A separate change also introduces employer liability for harassment by third parties, such as customers and clients, unless the employer can demonstrate that it has taken all reasonable steps to prevent such behaviour.

These changes build on the Worker Protection (Amendment of Equality Act 2010) Act 2023, which introduced the current duty to take "reasonable steps" towards the prevention of sexual harassment (26 October 2024). The Employment Rights Act 2025 raises that duty by adding one word, all.

The strengthened duty places greater emphasis on an anticipatory approach: considering where sexual harassment could occur, who may be affected and what further reasonable steps could reduce those risks before incidents arise. Structured risk and action plans, informed by people with appropriate expertise and by those who carry out the work, can help organisations do this systematically.

In summary: from 30 October 2026

• Employers must take all reasonable steps to prevent sexual harassment of their employees
• Employers may be liable where employees are harassed by third parties, such as customers and clients, if they've failed to take all reasonable steps to prevent it. This duty is not limited to sexual harassment; it also applies to harassment related to the protected characteristics covered by the Equality Act's harassment provisions.
• These changes apply in England, Scotland and Wales, not Northern Ireland, where equality and discrimination law is devolved

What does "all reasonable steps" mean?

There is no single statutory checklist that automatically demonstrates compliance. The Employment Rights Act's explanatory notes describe an employer as having taken all reasonable steps where there were no further steps it could reasonably have been expected to take. What's reasonable depends on the circumstances of the individual organisation. Different workplaces face different risks, and therefore different employers may need to take different steps to meet the "all reasonable steps" duty.

This is a different legal test from "reasonably practicable", the standard used in health and safety law under the Health and Safety at Work etc. Act 1974. The Equality Act's "all reasonable steps" duty is not qualified by practicability in the same way, so the two phrases aren't interchangeable even though they sound similar.

The UK Government also has power to make further regulations specifying the steps that count as reasonable, which for example, could include performing assessments, publishing policies, establishing reporting arrangements and handling complaints. Those regulations have not yet been made.

In the meantime, the Equality and Human Rights Commission's (EHRC) guidance is the clearest available reference point. Its eight-step guide asks employers to develop effective policies, engage staff, assess and reduce workplace risks, establish reporting mechanisms, provide training, respond appropriately to complaints, address third-party harassment, and monitor whether their actions are working. The EHRC has indicated that this guidance will be updated to reflect the 2026 changes.

Why sexual harassment risk assessments matter

Sexual harassment doesn't occur under the same circumstances in every workplace and can develop over a period of time. The risks facing someone working alone late at night may differ from those facing an employee at a client event, a healthcare worker dealing with patients, a junior employee working within a strongly hierarchical team, or employees who work remotely and interact with colleagues and managers primarily through online meetings and digital communication channels. Sexual harassment can take many forms, including sexualised comments, or rumours about someone's sex life, relationships, body or appearance, as well as other forms of unwanted conduct of a sexual nature.

Harassment and bullying are recognised as psychosocial hazards under ISO 45003, the international standard for managing psychological health and safety at work. The EHRC's technical guidance says that existing risk-management frameworks traditionally used in workplace health and safety can also be applied to harassment risk. It also states that an employer is unlikely to comply with the preventative duty unless it carries out a risk assessment.

Employers should consider the circumstances that may increase the likelihood of sexual harassment in their own workplace. These can include power imbalances, job insecurity, lone or night working, customer-facing roles, alcohol, external events and environments where disrespectful behaviour has become normalised.

A risk-based approach helps move beyond a generic statement that “harassment will not be tolerated”. Instead, employers can ask: Where could it happen here? Who might be exposed? What controls are already in place? And what further preventative action may be needed?

How to perform a sexual harassment risk assessment

1. Understand where exposure may arise.

Start with how people actually work, not the wording of your policy. Assess by activity, task or event rather than once for the whole organisation, because exposure differs between teams and roles. Consider customer- or public-facing roles, lone or night working, work-related social events, travel and overnight stays, significant power imbalances, insecure or junior roles, and contact with clients, contractors or other third parties. The point isn't a generic list. It's understanding your own working environment.

Also note who could be harmed and how. For example, a junior team member exposed to inappropriate comments from a senior colleague, or a lone worker vulnerable to unwanted contact from a client. Identifying who may be harmed and the potential harm makes the assessment concrete rather than abstract. Where possible, describe roles or groups rather than recording identifiable individuals in the risk assessment. Consider how working environments, reporting cultures, language barriers, power imbalances and commercial relationships may affect people’s exposure to sexual harassment or their willingness to raise concerns. For organisations operating across different countries, local cultural contexts and legal requirements should also be considered.

2. Listen to your workforce and existing evidence.

Formal and informal complaints or concerns are only one source of information. Staff surveys, one-to-ones and exit interviews often surface things senior leaders don't otherwise see. Absence and performance data can also offer clues. Unexplained changes in attendance, engagement or performance sometimes point to issues staff haven’t yet felt able to raise directly. They are not evidence that harassment has occurred, but they are worth exploring alongside other sources such as surveys and conversations.

Information may also come from wellbeing champions, employee networks, or other trusted channels that give employees a safe way to raise concerns. Feedback gathered after work-related events, social functions, or client-facing activities may also highlight potential risks. The EHRC specifically recommends engaging workers to understand where problems lie and whether existing measures are working. Involve the people doing the work in the assessment itself, not only as a source of evidence.

Treating sexual harassment as a systemic workplace risk can help organisations move beyond individual incident response and examine how work design, organisational culture and power imbalances may contribute to risk. Worker involvement can also help organisations identify practical controls and strengthen confidence in preventative arrangements.

3. Assess priority and review the controls already in place.

Every risk you identify needs a response. The question is what to do first. Start with how serious the potential harm could be: even a single incident of sexual harassment can be very serious, so a risk is never low priority simply because it is rare or brief. Then consider how long people may be exposed to the circumstance and how often it arises, as these can raise the level of concern. Look at the controls already in place and whether you can show that they work. Use professional judgement, informed by the people who do the work, to set priorities and record your reasoning.

Look at what you already do and whether it addresses the risks you've identified: clearer behavioural expectations, alternative reporting routes, role-specific training, arrangements for lone or public-facing workers, event standards, or third-party escalation procedures. The question isn't whether a control exists, but whether it fits the actual risk and works in practice.

4. Record gaps, actions and ownership.

Where the assessment identifies further reasonable action, record what needs to happen, who's responsible, and by when. Documenting the process helps demonstrate that prevention is actively managed, not a one-off compliance exercise. Communicate appropriate findings, actions and improvements to employees while protecting confidentiality and any ongoing complaint or investigation. Closing the feedback loop can help build confidence in reporting mechanisms and reinforce a preventative culture.

5. Monitor and review.

Risks change as teams, locations and working arrangements change. Treat the assessment as a living process, not a document completed once and filed away.

Download our sexual harassment risk assessment template

To help you put this process into practice, British Safety Council has developed a Sexual Harassment Risk Assessment: Template and Action Plan.

The template is designed to help you work through the risks specific to your organisation, including:

• Where and how sexual harassment could occur in each activity, task or event
• Who you consulted for each activity, task or event
• Who may be harmed and how
• What evidence and workforce insight you already have
• The controls currently in place
• Your priority for each risk, with your reasoning
• Any gaps or further preventative actions
• Who is responsible for each action and by when
• When the assessment should be reviewed

It is designed as a practical starting point rather than a generic compliance checklist, helping you document the risks you have identified and the further steps your organisation may need to consider. It includes three worked examples (online contact, lone working and an annual away day), a guide to setting priorities without scoring, and an action plan.

Completing a risk assessment is one part of preventing sexual harassment. It is not, on its own, evidence that you have taken all reasonable steps: you also need to put preventative measures in place, check that they work, and consider what further reasonable steps may be needed.

This template focuses specifically on sexual harassment risk. Employers should also consider the broader third-party harassment obligations introduced from 30 October 2026.

Don't overlook third-party harassment

The Employment Rights Act also introduces a separate duty covering harassment by people outside the employer's workforce. From 30 October 2026, an employer may be liable where an employee is harassed by a third party, such as a customer, client, contractor or other person outside the organisation, in the course of their employment, and the employer failed to take all reasonable steps to prevent it.

This provision is broader than sexual harassment. It encompasses the forms of harassment covered by section 26 of the Equality Act 2010, including harassment related to age, disability, gender reassignment, race, religion or belief, sex and sexual orientation.

That makes it particularly relevant for organisations whose staff regularly interact with customers, patients, clients or the public.

What should employers do now?

If arrangements are already in place, the new duty is a chance to test whether they reflect what actually happens in your workplace, not just what's written down. Check that you've assessed where sexual harassment could occur, rather than relying on a policy alone. Update and communicate your policy alongside the risk assessment, so staff understand what's changed and what's expected of them. Review whether staff have safe and credible ways to raise concerns. Consider whether managers and employees need different or role-specific training. Look specifically at interactions with customers, clients and other third parties. And make sure there's clear ownership for any action identified.

The aim isn't to add the word "all" to an existing policy. It's to understand what reasonable preventative steps your organisation could still take.

Further reading

• Bullying, sexual harassment and discrimination at work: how to embed a 'prevention not cure' approach, Safety Management →
• From policy to practice: delivering 'good work' under the Employment Rights Act, Safety Management →
• Psychosocial risks at work: why they must be treated as core occupational safety and health hazards, Safety Management →
• Employer 8-step guide: preventing sexual harassment at work, EHRC →