All reasonable steps: the harassment duty that starts on 30 October
The Christmas party is booked. It is the function room at the hotel on the bypass, with dinner for forty and a bar tab for the first two hours. The managing director agreed to the tab in September because it had been a good year. Taxis are ordered for midnight.
The customer at the trade counter comes in every Thursday morning and has done for years. It is a good account. It also comes with remarks about how people look and a hand on a shoulder that stays a moment too long. Nobody has complained formally. The team has worked out between them who serves on a Thursday, and the newest member of staff was told about it on their second day, in the kitchen, by a colleague.
I have heard versions of this story from owners more than once. When I ask what is in place, the answer is usually a harassment policy somewhere in the handbook. The law has required reasonable steps to prevent sexual harassment, including by customers, since 2024. From Friday 30 October the bar rises to all reasonable steps, and a member of staff harassed by a customer can bring a claim of their own.
What changes on Friday 30 October
Since 26 October 2024, section 40A of the Equality Act 2010 has required employers to take reasonable steps to prevent sexual harassment of their employees. On 30 October, under commencement regulations made on 1 October, the Employment Rights Act 2025 adds one word. The duty becomes one to take all reasonable steps.
Enforcement stays as it is. An employee cannot bring a claim for a breach of the duty on its own. The Equality and Human Rights Commission can act on it without any incident having happened, through investigations, unlawful act notices, binding agreements and court injunctions. Where an employee wins a sexual harassment claim against the employer, the tribunal must consider whether the employer breached the duty. If it did, the compensation can go up by as much as 25 per cent.
The second change creates a new claim. Section 21 of the 2025 Act adds a duty not to permit a third party to harass an employee. A third party is anyone who is neither the employer nor one of its employees, which takes in customers, clients, a supplier's driver, a contractor's crew and members of the public. The employer permits the harassment only if it "failed to take all reasonable steps to prevent the third party from doing so". This duty also reaches harassment related to most protected characteristics, so a customer whose remarks are about race or disability is covered too. The employee can take that claim to a tribunal. It covers harassment from 30 October. Separately, for anything that happens from 1 October, the time limit for most tribunal claims is six months, where it used to be three.
Why "all reasonable steps" is a high bar
Tribunals already know the phrase well. It has been in the Equality Act since 2010, in section 109, as the defence an employer runs when one of its employees harasses a colleague. There is no case law on the new wording yet, and the closest guide to how it will be read is the way tribunals have applied that defence.
The case I come back to is Allay (UK) Ltd v Gehlen, decided by the Employment Appeal Tribunal in February 2021. A colleague made regular remarks about an employee's skin colour and Indian origin. The employer had given equality training about two years and eight months before Mr Gehlen, the employee on the receiving end, was dismissed. Two managers had not reported the matter to HR. The tribunal found the training "clearly stale" and said refreshing it would have been a reasonable step, so the defence failed. On appeal, the judgment said meeting the test "clearly is a high threshold".
The Commission's technical guidance sets the bar in similar terms. An employer has taken all reasonable steps when "there are no further steps that they could reasonably have been expected to take". Investigating and disciplining after the event will not be enough on its own.
Size counts for something: the same guidance says reasonable steps vary with the size and nature of the employer, and Acas describes the standard as "doing what is possible with the available resources". A firm of forty is judged on what was reasonable for it, including what it already knew about its own risks. It also has to show what it did. Without an HR department, that starts with a single page.
Start with one page that says where the risk is
The Commission's guidance says an employer is "unlikely to be able to comply" with the duty without a risk assessment. In a firm of forty, it can start on one side of A4. The managing director writes it with the people who run the teams, and it needs to name things.
The Christmas party goes on it. The guidance lists alcohol and events away from the usual workplace among the factors that raise the risk. It also says a social event closely connected with work, such as an organised party, can fall within the course of employment. The Thursday customer is named on it. So are lone working and the staff group chat. For each one, the page records what will be done about it and who is responsible, so that someone reading it months later can see the decision as well as the risk.
If a claim arrived, that page is the first thing I would expect to be asked for. In my experience it is also the document smaller businesses are least likely to have.
A sexual harassment policy for a small business that people have read
The handbooks I am shown nearly always include a harassment policy, usually adapted from a template and last opened when the handbook was written. A tribunal will want to know whether the people it covers knew what it said. The Commission's guidance says it is "not appropriate" to tell workers they can get a copy from a manager, because the person who needs it may be reluctant to ask.
So the policy goes to everyone directly, and the signature or emailed acknowledgement is kept. The policy should be short. It describes in ordinary words the behaviour it covers, including from customers and visitors. It also says what happens when a customer is the problem, and the guidance suggests anything from a warning to a ban. Acas suggests telling customers what the consequences of harassing staff will be, for example on posters or in emails. Sending that to a good account is uncomfortable. Keep a dated copy.
A reporting route that avoids the person complained about
In a small firm, the obvious person to report to is often the wrong one, because everyone works closely with everyone else. The line manager may be the person the complaint is about, or may play golf with the customer every other Sunday. Acas advises giving workers more than one way to report. The Commission's guidance suggests letting people complain with their name on it or anonymously.
In practice that means two named people outside the usual reporting line, so nobody has to take a complaint to the person it concerns. It also means somewhere to go when the complaint involves a director or the largest customer, because those are the cases a small business struggles to handle from the inside. A complaint nobody in the business is sure how to handle needs someone independent of it, named in the policy with a way to reach them.
Training that managers attend, with a date on it
The training in Allay had reached two managers who then failed to report matters to HR. That failure is what training in a small business has to prevent. In a firm this size, supervisors and team leaders usually hear first, often third-hand over a cup of tea. They need to know what to do that day.
The Commission's guidance says employers should keep records of who has been trained and refresh it at regular intervals. For a firm this size, that means managers and supervisors trained before the party, everyone else briefed, a register signed and a refresher in the diary. Our online course, Sexual Harassment in the Workplace for Managers, gives every manager the same grounding and a dated certificate for the register. The party and the Thursday customer still need talking through in the room, with the people who will be there. The guidance also names the office party. It recommends a reminder to staff before events like it. One email from the managing director the week before, saying what is expected and who to go to on the night, covers that.
Third-party harassment: the conversation with the customer
Owners put this off longest. The account matters, and there is no formal complaint to act on. The government's factsheet on the new duty says it will not require employers "to foresee the wholly unforeseeable or police all customers' private conversations". The business has already foreseen this one: it rearranged the rota around it.
The managing director has this short conversation in private, so that the counter staff never have to. It describes the behaviour without dramatising it and says what happens if it happens again. If the customer is a rep for another company, a letter to that company's managing director is often the quicker route. Then it goes in the log, the same day. A line in that log might read like this:
Thursday 5 November. Spoke to the customer in the office after this morning's visit about remarks made to counter staff over several weeks. Set out the standard we expect. Any repeat means orders by phone and collection from the yard. Considered refusing service now; decided on a warning first, after asking the staff affected, with a review on 10 December.
The last line of that entry matters as much as the first. Acas advises employers to "record why you have not taken steps you've decided are not reasonable." A claim can now arrive six months after the event, later once early conciliation is added, so the entry is written on the day.
What is still moving
The government has taken a power to specify in regulations which steps will count as reasonable, and its factsheet expects those in 2027/28, after consultation. The Commission is updating its guidance, and parts of the current version, including what it says about claims for harassment by third parties, will be out of date from 30 October. Until either arrives, the standard is the one in the Act, read with the current guidance. The next major change after this one is unfair dismissal protection after six months' service, for dismissals from 1 January.
Before the party
For the business in the opening scene, the list before the party is short: the risk assessment with both items on it, the policy sent round and acknowledged, a short session for the managers, the reminder email, and a decision about the customer with a date beside it. The party goes ahead either way, and what can be shown about it afterwards is decided in the weeks before.
If you run a business of up to around 150 people and could not show today what has been done about your own version of the party or the Thursday customer, send me a short note on what is currently in place. I will tell you which steps are missing for a business of your size and which to deal with first. The reply comes from me, usually the same day.
Common questions
Does the all reasonable steps duty apply to small businesses?
Yes. Section 40A of the Equality Act applies to every employer, whatever its size. What counts as reasonable depends on the size and resources of the business, so a firm of forty is judged on what was reasonable for it, including the risks it already knew about. It also needs to be able to show what it did.
Are we liable if a customer harasses one of our staff?
From 30 October 2026, an employer is liable if a third party, such as a customer, client, contractor or member of the public, harasses one of its employees in the course of their work and the employer failed to take all reasonable steps to prevent it. This covers sexual harassment and harassment related to age, disability, gender reassignment, race, religion or belief, sex or sexual orientation. The employee can bring the claim to an employment tribunal.
Is the work Christmas party covered?
Usually. The Equality and Human Rights Commission's guidance says it depends on how closely an event is connected with work, and treats an organised work party as closely connected. It also lists alcohol and events outside the usual workplace among the factors that increase the risk of harassment. It recommends reminding staff of the standards expected before events such as an office party. Put the party on your risk assessment and keep a record of what you did about it.
Can an employee take us to a tribunal for not taking all reasonable steps?
Only through a harassment claim. A breach of the preventative duty in section 40A is enforced by the Equality and Human Rights Commission. If an employee wins a sexual harassment claim against you, the tribunal must consider whether you breached the duty and can increase the compensation by up to 25 per cent. A claim for harassment by a third party is itself a claim that you failed to take all reasonable steps, and from 30 October an employee can bring it directly.
