The duty to prevent sexual harassment: what all reasonable steps means

The duty to prevent sexual harassment requires employers to take all reasonable steps to prevent sexual harassment of their workers. Since 30 October 2026, the word "all" means an employer should be ready to explain why any step it did not take was not reasonable. Listing the steps it did take may no longer be enough.

The duty sits in section 40A of the Equality Act 2010 and applies in the course of employment. A separate duty, from the same date, covers harassment by third parties such as clients and customers. Both apply in England, Wales and Scotland. Northern Ireland has separate discrimination law and no equivalent duty.

The duty does not give a worker a standalone claim. If a sexual harassment claim succeeds, a tribunal can add up to 25 percent to the award for a breach of the duty. The Equality and Human Rights Commission (EHRC) can also enforce it without any incident having occurred.

As an illustration, suppose an account executive comes back from a hospitality box at a sports ground and tells her line manager what happened.

A client the firm has billed for six years put his hand on her leg twice. He also made a remark about her dress and asked which hotel she was staying in. She does not want to make a formal complaint, but she wants someone to know.

Under the duty that took effect on 26 October 2024, the employer had to take reasonable steps to prevent that. Since 30 October 2026, the employer is treated as having permitted it unless it took all reasonable steps to prevent the client doing it. A tribunal or the EHRC can ask to see those steps.

The 2024 version of the duty had a reasonable steps standard and no claim for harassment by third parties. The Employment Rights Act 2025 changed both on 30 October 2026. On 6 April 2026 it also made a report of sexual harassment capable of being a protected disclosure.

What the duty is now

Section 40A of the Equality Act 2010 says: "An employer (A) must take all reasonable steps to prevent sexual harassment of employees of A in the course of their employment." Sexual harassment means harassment of the kind described in section 26(2). Three dates matter.

1. On 26 October 2024, the Worker Protection (Amendment of Equality Act 2010) Act 2023 inserted the section as a duty to take reasonable steps.
2. On 30 October 2026, section 20 of the Employment Rights Act 2025 inserted the word "all", under commencement regulations SI 2026/1065.
3. In 2027 or 2028, the government expects to make regulations under the new section 40B specifying steps that count as reasonable steps.

Under section 83(2)(a), employment includes a contract personally to do work, so workers are covered as well as employees.

The government's factsheet says the amended duty mirrors the concept of the "all reasonable steps" defense in section 109(4). That is the employer's defense to liability for harassment by its own staff.

In Canniffe v East Riding of Yorkshire Council in 2000, circulating a policy was not enough on its own. Further reasonably practicable steps counted even if they would not have prevented the harassment. The test looks at what the employer did, and the fact that harassment happened anyway does not settle it.

How it is enforced

There are two routes, and the first does not need a victim. The EHRC enforces section 40A under the Equality Act 2006. It can investigate, issue an unlawful act notice and enter a binding section 23 agreement, all without any incident of harassment having occurred.

McDonald's shows what those powers look like. The EHRC signed a section 23 agreement on harassment with McDonald's Restaurants Ltd in February 2023, before the duty existed, and later extended it. In March 2025 it wrote to every McDonald's franchise restaurant in Britain, which the agreement did not cover, to say that they must comply with their legal duties or risk enforcement action. The letters show the Commission acting without waiting for a complaint.

The second route is the employment tribunal, and there is no standalone claim for breach of the duty. Section 124A applies only where a sexual harassment claim has succeeded. The tribunal "must consider whether and to what extent the respondent has also contravened section 40A(1)".

It may then increase the compensation by an amount that "must reflect the extent" of the contravention "but may be no more than 25% of the amount awarded". The uplift rides on the harassment claim and cannot be brought alone.

Third-party harassment

Section 21 of the Employment Rights Act 2025 inserted section 40(1A) into the Equality Act from 30 October 2026. It says: "An employer (A) must not permit a third party to harass a person (B) who is an employee of A." The section covers all harassment within section 26, not only sexual harassment.

The employer permits the harassment only if two conditions are met. It took place in the course of the worker's employment, and the employer "failed to take all reasonable steps to prevent the third party from doing so".

From October 2024 the EHRC's guidance said that "the preventative duty includes a duty to prevent sexual harassment by third parties". Even so, a worker harassed by a client had no standalone claim for it. Since 30 October 2026 she does.

The EHRC's 30 October 2026 update puts a limit on that. Employers are not required to stop all third-party harassment of their workers. An employer permits harassment by failing to take the steps, not by failing to prevent the outcome. Step seven of the EHRC's guide asks employers to treat an incident involving a third party as seriously as one involving a colleague.

What counts as sexual harassment

Section 26(2) of the Equality Act says a person harasses another if they engage "in unwanted conduct of a sexual nature" with a particular purpose or effect. That is violating the other person's dignity, or "creating an intimidating, hostile, degrading, humiliating or offensive environment" for them. Section 26(3) adds less favorable treatment because the person rejected or submitted to such conduct. Acas's definition is shorter: "Sexual harassment is unwanted behaviour of a sexual nature."

Conduct can be harassment without any intention to harass. Under section 26(4), the tribunal takes into account the perception of the person on the receiving end and the other circumstances. It also asks whether it is reasonable for the conduct to have had that effect.

Bullying is different. Acas is plain: "There is no specific law against bullying." Under the Equality Act, bullying becomes harassment only if it is related to a protected characteristic or is sexual in nature, and the records should show which was which.

The eight EHRC steps

The EHRC's technical guidance, "Sexual harassment and harassment at work", was first published in January 2020, updated on 26 September 2024 for the new duty and again on 30 October 2026. It is not legally binding, but tribunals and the EHRC are likely to look to it, and to its eight-step guide, when deciding whether all reasonable steps were taken.

1. Develop an effective anti-harassment policy. Write down what sexual harassment is and what happens when it is reported.
2. Engage staff. Ask workers what they have seen and what stops them reporting.
3. Assess and take steps to reduce risk in the workplace. Assess where harassment is likely and what will be done about it.
4. Reporting. Give workers a route they know about and can use anonymously or in name.
5. Training. Train all workers and the managers who handle complaints, and refresh it before it goes stale.
6. What to do if a harassment complaint is made. Act on every complaint, protect the complainant and record the outcome.
7. Dealing with harassment by third parties. Treat incidents involving customers and clients as seriously as harassment by a colleague.
8. Monitor and evaluate action plans. Check regularly whether the steps you have taken are working.

The risk assessment

The guidance says at paragraph 3.31 that an employer is unlikely to comply with the preventative duty without a risk assessment. It adds that a one-off, light-touch exercise will not be enough.

The assessment should look at where power imbalances sit, where alcohol and travel are involved and which workers are alone with third parties. It should be dated and revisited. The 2026 update describes compliance as ongoing.

Training that does not go stale

The Employment Appeal Tribunal said what it thought of old training in Allay (UK) Ltd v Gehlen on 4 February 2021. The training "delivered was several years before the events in question and was clearly stale", and "the less effective training is, the more quickly it becomes stale". Refresher training was a further reasonable step the employer could have taken and did not.

A dated training record is necessary evidence. It is sufficient only if the date is recent and the content was good.

The reporting system

Step four is the thing employers actually build. The guidance suggests considering a reporting system that lets workers raise an issue anonymously or in their own name.

Section 40B lists four subjects the regulations may cover, among them "steps relating to the reporting of sexual harassment" and "steps relating to the handling of complaints". Workers can also take concerns about the duty straight to the EHRC. That is a reason to give them a route inside the organization that they trust more.

What the numbers say

The Government Equalities Office published its 2020 Sexual Harassment Survey on 12 July 2021. It found that 29 percent of people in employment had experienced sexual harassment at work or in a work-related environment in the previous twelve months. Only 15 percent reported it formally. The top reasons for not reporting were that it was not serious enough (32 percent), their career (23 percent) and an uncomfortable work situation (21 percent).

The Trades Union Congress (TUC) polled more than 1,000 women and published the results on 12 May 2023. Three in five had experienced sexual harassment, bullying or verbal abuse at work, and only 30 percent told their employer. In 39 percent of the most recent incidents, the person responsible was a third party.

Sex discrimination complaints to the employment tribunal, which cover more than harassment, rose from 907 in January to March 2025 to 1,353 a year later, up 49 percent. Those figures come from the Ministry of Justice's management information for single claims on its new case system. The ministry warns that year-on-year comparisons of these counts mean little until case numbers settle.

The duty, before and after 30 October 2026

When a harassment report is also a protected disclosure

Since 6 April 2026, the Employment Rights Act 1996 has covered sexual harassment at section 43B(1)(da). It lists a disclosure "that sexual harassment has occurred, is occurring or is likely to occur" as a qualifying disclosure. If the worker reasonably believes the report is made in the public interest, it is protected.

Protection has three parts. The worker has the right not to suffer any detriment for making the disclosure. Dismissal for making it is automatically unfair, and the usual cap on unfair dismissal compensation does not apply. The claim window is limited, so the weeks after the report matter.

For HR this changes how a complaint is logged. Record when it was received, who was told and who had access to it. Record every later change to the complainant's duties, shifts or reporting line too. All of these are now facts in a potential whistleblowing claim as well as a harassment one.

The person named in the complaint should not be involved in handling it. Confide's guide to whistleblower retaliation sets out the forms it takes and the controls that prevent it.

Sector notes

The Financial Conduct Authority's final rules of 2 July 2025 extended the Code of Conduct to non-bank firms for serious bullying, harassment and violence, at COCON 1.1.7FR. Guidance followed in PS25/23 of 12 December 2025, in force from 1 September 2026. An FCA-regulated firm therefore faces a conduct rule question about the individual as well as the section 40A question.

For law firms, the Solicitors Regulation Authority's sexual misconduct guidance of 1 September 2022 applies. It expects firms to "foster a culture of zero tolerance of sexual misconduct" and to report serious breaches promptly.

What to do before the regulations arrive

1. Carry out the risk assessment the EHRC describes. Identify where sexual harassment is likely, including by third parties, write down what will be done about each risk, and date it.
2. Rewrite the policy for the current law. Cover third-party harassment and the protected disclosure status of a report, and publish it where workers can find it.
3. Train everyone, then set the date for the next session. Teach workers what harassment is and how to report it, and teach managers what to do when a report lands.
4. Give workers a reporting system they can use anonymously or in name. Keep it independent of the line manager and open to agency and casual workers.
5. Fix the complaints process so that you can show it working. Decide who receives a complaint, who is locked out, what the complainant is told and where the record lives.
6. Treat third-party incidents as seriously as a colleague's. Tell clients what conduct will end the relationship, and act on the first report.
7. Review on a schedule and keep the evidence. Date each review of what is working, in a form you could hand to the EHRC or a tribunal.

How Confide fits

Steps four and six are where an employer needs a system as well as a policy. Confide's Grievances module gives workers a branded form for raising a concern, in their own name or anonymously, depending on how you configure the channel. If you switch on Echo, Confide's AI agent, it asks the worker about anything the report leaves out before the team sees it.

A complaint about the worker's own manager or HR can go down an alternative handling route. If a user is named in a report, Confide automatically revokes their access to that case, and each access and action is logged. Messages to the worker are kept apart from internal case notes.

Dashboards and exports show workload, recorded outcomes and outstanding actions, which is the material a step-eight review needs. The people handling the complaint review what Echo collected and make every decision, including what the evidence shows and what action follows.

Duty to prevent sexual harassment FAQ

What is the duty to prevent sexual harassment?

It is a duty on employers to take all reasonable steps to prevent sexual harassment of their workers in the course of their employment. It is in section 40A of the Equality Act 2010. It came into force on 26 October 2024 as a duty to take reasonable steps, under the Worker Protection (Amendment of Equality Act 2010) Act 2023. The Employment Rights Act 2025 raised it to all reasonable steps on 30 October 2026.

What changed on 30 October 2026?

Three things. The word "all" was inserted into section 40A, so the duty is now to take all reasonable steps, mirroring the section 109(4) defense. A new section 40(1A) made employers liable for permitting harassment by third parties such as customers and clients, where they failed to take all reasonable steps to prevent it. And the section 40B power to make regulations specifying the steps came into force, with regulations expected in 2027 or 2028.

Can an employee claim for a breach of the duty on its own?

No. There is no standalone tribunal claim for breach of section 40A. It bites in the tribunal only through section 124A, once a sexual harassment claim has succeeded. The tribunal must then consider whether the employer also breached the duty, and may increase compensation by up to 25 percent. Separately, the EHRC can investigate and take enforcement action without any claim or incident at all.

Is an employer liable for harassment by customers or clients?

Since 30 October 2026, yes, if it permitted the harassment. Under section 40(1A) of the Equality Act an employer must not permit a third party to harass a worker. It permits the harassment if it happened in the course of employment and the employer failed to take all reasonable steps to prevent it. The EHRC says the law does not require employers to stop all third-party harassment, only to take the steps.

Is reporting sexual harassment whistleblowing?

Since 6 April 2026 it can be. Section 43B(1)(da) of the Employment Rights Act 1996 makes a disclosure that sexual harassment has occurred, is occurring or is likely to occur a qualifying disclosure. If the worker reasonably believes it is made in the public interest, it is protected. The worker cannot be subjected to a detriment for making it, dismissal for it is automatically unfair and compensation is uncapped.

The evidence a tribunal will ask for

When the complaint about the client reaches a tribunal or the EHRC, the employer will have to show what all the reasonable steps were. It will also need evidence that each was taken. That means the dated risk assessment, the dated training and the policy the client was shown. It also means the reporting route the account executive knew about, and the log of what happened to her complaint and to her afterwards.

Check that you could produce each of those today. A policy on its own shows what you intended, not what you did. Confide's Grievances module keeps a record of each step of a complaint from the moment the report is made.