The duty has changed. Your e-learning probably has not.

Since October 2024, UK employers have had a legal duty to take reasonable steps to prevent sexual harassment of their staff, introduced by the Worker Protection (Amendment of Equality Act 2010) Act 2023. It was a significant shift at the time, because it made the obligation proactive rather than something that only mattered once a complaint arrived.

From October 2026, under the Employment Rights Act 2025, that duty rises to taking all reasonable steps. Employers also become liable for harassment of their staff by third parties, such as customers, clients and contractors.

One word has changed, and it changes the test entirely.

What "all" actually means in practice

Under the old wording, an employer could point at some reasonable steps and argue they had done enough. Under the new wording, the question becomes whether there was anything further you could reasonably have done and did not.

That is a much harder question to answer well, and it tends to expose organisations that treated the duty as a documentation exercise. It expects proactive risk assessment, systematic planning and evidence of preventative action, rather than a policy and a completion report.

Why the annual module is the weak point

Most organisations responded to the 2024 duty by buying an e-learning module. That made sense at the time. It is quick, cheap, and produces a tidy record of who completed it.

But look at what that product was designed to do. It was built to demonstrate, after an incident, that the employer had told people what the rules were. That is a defence artefact. It was never designed to change what happens in a bar at eleven at night, or in a team where one person has significantly more power than another.

The evidence on awareness-only training is consistent and not especially flattering: it can shift what people know, and it rarely shifts what people do. A duty to prevent asks about the second thing.

So the uncomfortable question for most HR teams is not whether they have training. It is whether the training they have would satisfy someone asking what else they could reasonably have done.

Third parties are the gap nobody has closed

Liability for third-party harassment is the change most likely to catch organisations out, because very few have any process for it at all.

If a customer harasses a member of your bar staff, a patient harasses a care worker, or a contractor harasses someone on site, that is now your responsibility to have taken steps to prevent. Practically, that means thinking about lone working, late shifts, whether staff know they are permitted to refuse service or walk away, whether managers will back them when they do, and whether anyone has ever told them what to do.

Most staff handbooks are silent on all of it.

Five things worth doing

Do a risk assessment. Not a policy review, a genuine look at where in your organisation harassment is most likely: which shifts, which sites, which power dynamics, which points of customer contact. Write it down. This is the step most organisations skip and the one that most clearly evidences intent.

Check your reporting route actually works. Ask yourself who a junior member of staff would tell if the person concerned was their manager. If the answer is "their manager", you do not have a reporting route.

Brief your managers on the first hour. Most cases are shaped by what happens immediately after someone speaks up. Managers need to know what to do, what not to promise, and what to record.

Cover third parties explicitly. Tell staff what they are permitted to do when a customer behaves badly, and make sure managers will support it.

Keep a record of what you did and why. Not to tick a box, but because "all reasonable steps" is a question about your reasoning, and reasoning that was never written down is very hard to demonstrate later.

A note on tone

There is a version of this conversation that is entirely about liability, and it tends to produce defensive, joyless training that staff resent and that changes very little.

The organisations that handle this well treat it as what it actually is: a question about whether people are safe at work, whether they would be believed, and whether anything would happen if they spoke up. Get that right and the compliance follows. Get it the other way round and you usually end up with neither.

This article is a good-faith summary and is not legal advice. For the legal detail, the EHRC has published technical guidance for employers, and your own legal advisers will know your circumstances.

Get in touch →