Since 26 October 2024 every employer has had a duty to take reasonable steps to prevent sexual harassment of its employees. On 30 October 2026 two changes in the Employment Rights Act 2025 make that duty heavier, and they apply to a five-person café exactly as they apply to a supermarket.
What changes on 30 October 2026
“All” reasonable steps. Section 20 inserts one word into section 40A(1) of the Equality Act 2010: employers must take “all reasonable steps” to prevent sexual harassment of employees in the course of their employment. It matches the wording of the defence employers already rely on when sued for harassment by a colleague, so “we did some things” is no longer enough.
Third-party harassment. Section 21 makes employers liable for harassment of their employees by third parties — customers, clients, patients, contractors, suppliers — unless they took all reasonable steps to prevent it. For hospitality, retail, care and trades working in people’s homes, this is the bigger change.
A power to define reasonable steps. Section 22 lets ministers set out, in regulations, steps that are to be treated as reasonable. None had been made by 25 October 2026.
Both duties were brought into force by S.I. 2026/1065, made on 1 October 2026.
What is already law
The Worker Protection (Amendment of Equality Act 2010) Act 2023 created the preventative duty from 26 October 2024. If a tribunal upholds a sexual harassment claim and finds the employer breached the duty, it can increase compensation by up to 25% (section 124A). The Equality and Human Rights Commission can enforce the duty even when no harassment has happened.
What “reasonable” means for a small firm
The EHRC’s technical guidance says there is no fixed list of steps; what is reasonable depends on the employer’s size, resources and the risks in its work. It also says an employer is unlikely to comply without a risk assessment, and should not wait for a complaint before acting.
For a business with under 50 staff, a proportionate set of steps looks like this:
| Step | What it looks like in a small firm | Time |
|---|---|---|
| Risk assessment | One page: where, when and by whom harassment could happen, and what you will do about each | 1–2 hours |
| Policy | Two pages covering colleagues and third parties, reporting routes, investigation and outcomes | 2–3 hours |
| Reporting route | A named second person, or an external contact, for when the problem is the manager | 30 minutes |
| Training | A short session for everyone, with examples from your own work; record attendance | 1 hour |
| Customer-facing measures | A line in terms, a notice, a rule on refusing service, a buddy system for late shifts | Varies |
| Review | Revisit after any report and at least once a year | 1 hour |
None of this needs a consultant. It does need to be written down and dated, so you can show what you did.
Third parties: practical steps
- Tell customers, in writing where you can, that harassment of staff is not tolerated and what will happen.
- Decide in advance what staff can do — refuse service, end a visit, call a manager — and back them when they do it.
- Pair up or check in on staff working alone or late, or in customers’ homes.
- Log every report, including ones that seem minor, and what you did about it.
Example risk assessment entries
A risk assessment for a small business can be a simple table. Three illustrative rows for a restaurant:
| Risk | Who | What we will do | Owner | By |
|---|---|---|---|---|
| Customers harassing waiting staff late at night | Front-of-house, especially under-21s | Duty manager on every late shift; staff can refuse service; incidents logged | Owner | 30 Oct 2026 |
| Staff socials with alcohol | Everyone | Clear standards before events; a named person to report to on the night | Owner | Before Christmas party |
| Delivery drivers’ messages to staff | Kitchen staff | Drivers contact the manager’s phone only; report route for messages | Manager | 30 Oct 2026 |
Handling a report
When someone reports harassment — by a colleague or a customer — a proportionate process for a small firm is:
- Listen and record. Write down what was said, when and by whom, with dates. Ask what the person wants to happen.
- Protect. Separate shifts, change who serves a customer, or ban a customer while you look into it. Make sure the person who reported is not disadvantaged.
- Investigate promptly. Speak to the people involved and any witnesses, and keep notes. If the alleged harasser is the owner or the only manager, bring in someone independent.
- Decide and act. Apply your disciplinary procedure for staff; for customers, apply the consequences you set out in advance.
- Follow up. Check in with the person who reported, and update the risk assessment.
Acas has guidance on handling complaints and running investigations that a small firm can follow without specialist help.
How this connects to other changes
- Whistleblowing (since 6 April 2026). A report that sexual harassment has happened or is likely can be a protected disclosure. Dismissing someone mainly for making one is automatically unfair from day one.
- Tribunal time limits (since 1 October 2026). Most claims now have six months instead of three.
- NDAs (planned 2027). Clauses that stop staff speaking about harassment are set to become void.
Checklist
- Risk assessment written and dated.
- Anti-harassment policy covering third parties, shared with staff.
- A reporting route that does not depend on one manager.
- Training delivered and recorded.
- Customer-facing measures in place where staff deal with the public.
- Review date in the diary.
The business plan tab includes these documents with a review-by date of 2 October 2026 — four weeks before the duty starts — and can export reminders to your calendar. For the wider picture see the Employment Rights Act 2025 timeline.