On 30 October 2026 two things change at once. The duty to prevent sexual harassment rises from "reasonable steps" to "all reasonable steps". And employers become liable for harassment of their staff by third parties — customers, clients, contractors, suppliers, patients, passengers, members of the public.
If your people deal with the public, this is the most significant change in the Employment Rights Act for your business.
What third-party liability actually means
A version of this existed before 2013 and was repealed. What arrives in October is materially harder than what was removed.
Under the old provision, an employee had to show harassment by a third party on at least two previous occasions, and that the employer knew about it. Neither requirement survives. One incident is enough. You do not need to have known it was coming.
It also covers every relevant protected characteristic — age, disability, gender reassignment, race, religion or belief, sex and sexual orientation — not sexual harassment alone.
Harassment awards are uncapped. Where a claim succeeds and the harassment was sexual, a tribunal may add a compensation uplift of up to 25% if the preventative duty has been breached (s.124A Equality Act 2010). Because third-party liability sits inside s.40, that uplift is available on third-party sexual harassment as readily as on harassment by a colleague. It does not extend to harassment on any other protected characteristic. A 25% uplift on an uncapped award is not a fixed, budgetable number.
"All reasonable steps" is a different standard
The word "all" moves this from a policy question to an evidence question. The existing case law on the "all reasonable steps" defence under the Equality Act is the guide, and it consistently rewards the same three things: an effective policy that staff actually know about, training that is timely and repeated rather than ticked off at induction, and complaints handled properly when they arrive.
Waiting for a complaint before acting will not meet the duty. The duty is preventative — it bites before anything happens.
What to do before 30 October
Start with a risk assessment covering third-party contact. Which roles deal with the public? Where, when, and alone or in pairs? Late shifts, lone working, alcohol on the premises, and home visits are the obvious pressure points. Write down what you assessed and what you decided — an undocumented assessment is worth very little in a tribunal.
Then look at your contracts with third parties. Where you have a commercial relationship with the source of the risk, terms addressing conduct and apportioning liability are worth putting in place now rather than after an incident.
Finally, reporting. Staff need a route to raise third-party harassment that does not require them to confront a customer, and managers need to know what to do when it is used.
The 30 October date comes from the government's implementation timeline of 16 July 2026. Commencement regulations confirming it have not yet been made, and this date has already moved once — these measures were originally set for 1 October. Plan for 30 October and watch for the regulations.
Secondary regulations defining "all reasonable steps" are expected to follow consultation in 2027. The EHRC has confirmed its technical guidance is being updated. Neither is a reason to wait.
Scotland
The Equality Act applies across Great Britain and these provisions are not devolved. There is no divergence here.