Third-Party Harassment: The New Employer Duty Coming in 2026

Last updated: April 2026

From October 2026, UK employers will be legally liable if their employees are harassed by third parties and the employer failed to take all reasonable steps to prevent it. This includes harassment by customers, clients, patients, contractors, visitors, and members of the public.

The duty comes from the Employment Rights Act 2025 (ERA 2025), which significantly extends the sexual harassment prevention duty already introduced by the Worker Protection (Amendment of Equality Act 2010) Act 2023. For employers in customer-facing sectors such as retail, hospitality, healthcare, and professional services, this is a fundamental shift.

This guide explains what the third-party harassment duty means, how it differs from the existing 2023 duty, and exactly what employers should be doing right now to prepare.

---

Third-Party Harassment Employer Duty 2026: What Is Changing?

The ERA 2025 introduces two major changes to harassment law that affect every UK employer.

1. The Standard Rises from "Reasonable Steps" to "All Reasonable Steps"

Since October 2024, the Worker Protection (Amendment of Equality Act 2010) Act 2023 has required employers to take reasonable steps to prevent sexual harassment of their employees. If an employee is sexually harassed and the employer has not met this standard, an employment tribunal can uplift compensation by up to 25%.

From October 2026, the ERA 2025 raises this bar. Employers must take all reasonable steps to prevent sexual harassment. The word "all" matters. It means tribunals will scrutinise whether there was anything more the employer could reasonably have done, not just whether they did something.

2. Third-Party Harassment Becomes a Standalone Legal Obligation

The 2023 Act did not include a specific duty on third-party harassment. The provision was removed during the Bill's passage through Parliament, although the Equality and Human Rights Commission (EHRC) made clear in its guidance that the preventive duty covered harassment by third parties.

The ERA 2025 puts this beyond doubt. A new obligation requires employers not to permit harassment of their employees by third parties. This covers all forms of harassment across all protected characteristics under the Equality Act 2010, not only sexual harassment.

Third parties include:

• Customers and clients
• Patients and service users
• Contractors and agency workers from other organisations
• Suppliers and delivery personnel
• Visitors and members of the public

If an employee is harassed by any of these people, and the employer has not taken all reasonable steps to prevent it, the employer is liable.

---

How This Builds on the Worker Protection Act 2023

Understanding the timeline is important because some obligations are already live.

Already in Force (October 2024)

The Worker Protection (Amendment of Equality Act 2010) Act 2023 introduced:

• A duty on employers to take reasonable steps to prevent sexual harassment
• A 25% compensation uplift at tribunal if the employer breaches this duty
• No standalone claim for breach of the duty, but it operates alongside existing harassment claims under the Equality Act 2010
• EHRC guidance and a statutory code of practice that employers must have regard to

If you have not already acted on this duty, you are behind. The October 2024 requirements are already enforceable.

Already in Force (April 2026)

From 6 April 2026, reporting sexual harassment became a protected disclosure under whistleblowing law. This means:

• Employees who report sexual harassment have whistleblowing protection
• They cannot be subjected to detriment for making the disclosure
• If dismissed for blowing the whistle on sexual harassment, compensation is uncapped
• This applies even if the harassment allegation is not ultimately upheld, provided the disclosure was made in good faith

Coming October 2026

The ERA 2025 changes expected in October 2026 include:

• The heightened "all reasonable steps" standard for preventing sexual harassment
• The new standalone duty not to permit third-party harassment (covering all protected characteristics)
• Government power to pass regulations specifying what counts as "all reasonable steps" (expected in 2027)
• Enforcement by the EHRC, which can investigate and take action against employers who fail to comply

---

What "All Reasonable Steps" Looks Like in Practice

Employment tribunals will assess whether the employer took all reasonable steps to prevent the harassment before it occurred. This is an anticipatory duty. You cannot wait until someone is harassed and then respond. You must have measures in place already.

What counts as "all reasonable steps" depends on the size, sector, resources, and risk profile of your organisation. A large retailer with thousands of customer-facing staff will be expected to do more than a small professional services firm. But no employer is exempt.

Risk Assessment

The starting point is a documented risk assessment that identifies where third-party harassment is most likely to occur. Consider:

• Customer-facing roles: Retail, hospitality, healthcare, reception, and call centre staff are at highest risk
• Lone working: Employees who work alone with clients or in people's homes (care workers, estate agents, delivery drivers)
• Power imbalances: Where third parties have commercial leverage (key clients, funding bodies, regulators)
• Alcohol-related environments: Pubs, bars, events, corporate hospitality
• Protected characteristics: Are certain groups of employees more likely to face harassment? Consider race, sex, disability, sexual orientation, and religion

Write the risk assessment down. Review it at least annually and after any incident.

Anti-Harassment Policy

You need a clear, accessible policy that:

• Defines harassment across all protected characteristics (not just sexual harassment)
• States that harassment by third parties will not be tolerated
• Gives specific examples relevant to your sector (a pub employer should give different examples from an accounting firm)
• Sets out the reporting procedure, including options for reporting anonymously
• Confirms that reports will be taken seriously and investigated
• States that the employer will take action against third parties where possible (banning customers, terminating contracts, adjusting working arrangements)
• Protects employees who report from retaliation

The policy must be communicated to all employees at induction and revisited regularly.

Training

Training is one of the most scrutinised "reasonable steps" at tribunal. If you have not trained your people, you will struggle to show you took all reasonable steps.

At minimum:

• All employees: What harassment is, how to recognise it, how to report it, what happens next
• Line managers: How to handle disclosures, how to escalate, how to support the employee, and their own obligations
• Customer-facing staff: Specific training on dealing with inappropriate behaviour from customers and clients, including de-escalation techniques and when to refuse service
• Senior leadership: Their role in setting culture and ensuring the policy is followed

Keep records of all training: who attended, when, and what was covered. This becomes your evidence.

Practical Measures for Customer-Facing Environments

Beyond policy and training, employers in high-risk sectors should consider:

• Signage: Display notices in customer areas stating that harassment of staff will not be tolerated
• Reporting channels: Make it easy for staff to report incidents in real time (a code word, a panic button, a dedicated WhatsApp group)
• Escalation procedures: Clear steps for removing or banning abusive customers
• Support after incidents: Check in with the employee, offer support, document the incident
• Contract clauses: Include conduct expectations in contracts with clients and suppliers
• CCTV and monitoring: Where appropriate and proportionate, use CCTV as a deterrent and evidence source

---

Sectors Most Affected

While the duty applies to all employers, some sectors face significantly higher third-party harassment risk.

Retail and Hospitality

Shop workers and hospitality staff report some of the highest rates of customer abuse in the UK. The combination of direct customer contact, alcohol (in hospitality), and high-pressure environments creates persistent risk. Employers in these sectors should assume that third-party harassment is a when, not an if.

Healthcare and Social Care

Patients, service users, and their families can be sources of harassment. Care workers visiting people's homes face particular risks. The challenge here is balancing the duty of care to patients with the duty to protect staff, but the ERA 2025 is clear that employers cannot simply accept harassment as part of the job.

Professional Services

Client-facing professionals in legal, financial, and consulting firms can face harassment from clients who hold significant commercial power. The reluctance to challenge a key client does not excuse inaction. If a partner at a client firm is harassing your employee, you have a duty to act.

Education

Teachers and support staff face harassment from parents, visitors, and in some cases older students. Schools and universities need specific policies addressing these dynamics.

---

What Happens If You Do Not Comply

The consequences of failing to meet the third-party harassment duty are both legal and commercial.

Legal Consequences

• Tribunal claims: If an employee is harassed by a third party and you have not taken all reasonable steps, you face a harassment claim under the Equality Act 2010. Compensation for harassment is uncapped.
• 25% uplift: The tribunal can increase the compensation by up to 25% for breach of the preventive duty.
• Whistleblowing claims: If an employee reports third-party harassment and suffers detriment, they have an additional whistleblowing claim with uncapped compensation.
• EHRC enforcement: The Equality and Human Rights Commission can investigate employers who fail to comply, issue compliance notices, and take enforcement action.

Commercial Consequences

• Difficulty recruiting and retaining staff, particularly in sectors where harassment is known to be prevalent
• Reputational damage if cases become public
• Increased insurance premiums
• Loss of contracts where clients require evidence of harassment policies (increasingly common in public sector procurement)

---

What Employers Should Do Now

You have until October 2026. Here is a practical timeline.

By June 2026

1. Conduct a risk assessment covering third-party harassment across your organisation
2. Review your anti-harassment policy to ensure it covers third-party harassment, all protected characteristics, and references the new "all reasonable steps" standard
3. Check your contracts with clients, suppliers, and contractors for conduct expectations

By August 2026

4. Roll out training for all employees, with specific modules for managers and customer-facing staff
5. Implement reporting channels that are accessible and confidential
6. Brief senior leadership on the new duty and their responsibilities

By October 2026

7. Audit your readiness against the EHRC guidance and the new legislation
8. Document everything. Keep records of your risk assessment, policy, training attendance, and any incidents and responses
9. Communicate to staff that the new protections are in place and how to use them

If you already have strong policies from the October 2024 Worker Protection Act duty, much of this will be updating and extending rather than starting from scratch. If you have done nothing since 2024, start now. You are already non-compliant with the existing duty.

---

Is your harassment policy up to date for the new employer duty? The EmployerKit Audit checks your handbook and policies against current requirements. From 49 pounds. Visit employerkit.com/tools/employerkit-audit.

---

Frequently Asked Questions

Q: Does the third-party harassment duty apply to all types of harassment, or just sexual harassment?

A: The ERA 2025 third-party harassment duty applies to all forms of harassment across all protected characteristics under the Equality Act 2010. This includes harassment related to race, sex, disability, sexual orientation, religion or belief, age, gender reassignment, marriage and civil partnership, and pregnancy and maternity. The "all reasonable steps" standard for sexual harassment specifically is also strengthened, but the third-party liability extends to all characteristics.

Q: Can an employer be liable for the actions of a customer they have no control over?

A: Yes, but liability depends on whether you took all reasonable steps to prevent the harassment. You are not expected to control every customer's behaviour. You are expected to have policies, training, reporting channels, and escalation procedures in place, and to act when incidents are reported. If an employer receives repeated complaints about a specific customer and does nothing, they are very likely to be found liable. If they have strong measures in place and respond appropriately to incidents, they are much better protected.

Q: What is the difference between the Worker Protection Act 2023 duty and the ERA 2025 duty?

A: The Worker Protection (Amendment of Equality Act 2010) Act 2023 introduced a duty to take "reasonable steps" to prevent sexual harassment, enforceable from October 2024, with a 25% compensation uplift for breach. The ERA 2025 raises this to "all reasonable steps" (a higher bar), adds a standalone duty on third-party harassment covering all protected characteristics, and gives the government power to specify what counts as "all reasonable steps" through regulations. The 2023 Act also originally included a third-party harassment provision, but it was removed during passage through Parliament. The ERA 2025 reinstates and extends it.

Q: What should I do if a key client is harassing one of my employees?

A: You must act regardless of the commercial relationship. Document the complaint, investigate it, and take appropriate steps. This might include raising the issue with the client organisation, requesting a different point of contact, adjusting working arrangements so your employee does not have to interact with the individual, or in serious cases, ending the client relationship. Failing to act because of commercial pressure is exactly the scenario the legislation is designed to address. Your duty to your employee takes priority over your commercial interests.

Q: Will the EHRC enforce the third-party harassment duty?

A: Yes. The EHRC has enforcement powers in relation to the preventive duty. It can conduct investigations, issue compliance notices, and take legal action against employers who fail to meet the standard. The EHRC has already published guidance on the existing duty under the Worker Protection Act 2023, and updated guidance for the ERA 2025 changes is expected before October 2026. Employers should monitor the EHRC website for updates.

Q: Does this apply to small businesses?

A: Yes, the duty applies to all UK employers regardless of size. However, what counts as "all reasonable steps" is proportionate to the size and resources of the employer. A small employer is not expected to do the same as a multinational, but they are expected to have a policy, basic training, and a reporting mechanism. Size is not an exemption, but it is relevant to what is reasonable.