In this article, we explain how the Employment Rights Act 2025 strengthens the duty on employers in England, Wales and Scotland to prevent sexual harassment and third-party harassment, what “all reasonable steps” is likely to mean in practice, and where training – and the evidence behind it – fits in.
Two years ago, employers gained a new, proactive legal duty to prevent sexual harassment at work. From 30 October 2026, that duty becomes significantly tougher. Employers will no longer be judged on whether they took reasonable steps, but on whether they took all reasonable steps – and they can also be held liable for harassment of their staff by third parties such as customers, clients and contractors.
For HR, L&D and compliance teams, this is another case where a change in the law quickly becomes a training requirement. It also raises the bar on proof: being able to show what you did, for whom, and when.
A quick recap: the preventative duty
The Worker Protection (Amendment of Equality Act 2010) Act 2023 introduced a duty on employers, from 26 October 2024, to take reasonable steps to prevent sexual harassment of their workers. It is an anticipatory duty: employers are expected to act before anything goes wrong, rather than waiting for a complaint.
The consequences of falling short are real. According to the Equality and Human Rights Commission (EHRC), where a worker succeeds in a sexual harassment claim, an employment tribunal must consider whether the employer complied with the duty and can increase compensation by up to 25% if it did not. The EHRC also has the power to take enforcement action, and that does not depend on an incident having taken place.
What changes on 30 October 2026
The Employment Rights Act 2025 (Commencement No. 6) Regulations 2026 bring three relevant sections of the Act into force on 30 October 2026:
1. “Reasonable steps” becomes “all reasonable steps”
Section 20 inserts a single word – “all” – into the Equality Act duty. It is a small edit with a big impact. As Acas explains, it means taking all of the steps that are reasonable for your organisation rather than just some of them, focusing on prevention rather than only reacting to incidents, and applying those steps across the whole organisation – not just to people involved in a previous incident. It covers online as well as in-person harassment.
2. Liability for harassment by third parties
Employers will also be liable if a worker is harassed by a third party in the course of their work, unless they have taken all reasonable steps to prevent it. Acas guidance on third-party harassment lists the kinds of people this can include: customers, clients, service users such as patients or students, contractors and tradespeople, people at conferences or events, and members of the public. Legal commentators such as Squire Patton Boggs note that this applies to harassment related to any protected characteristic, not only sexual harassment.
3. A power to define “reasonable steps”
The Government now has the power to set out in regulations which steps count as “reasonable”. Those regulations are not here yet – the Government says it will bring them forward where they would be effective and proportionate – so for now, employers need to rely on the existing guidance from the EHRC and Acas.
Where training fits in
Training is not the whole answer, but it is one of the most visible steps an employer can take. The EHRC’s 8-step guide for employers says workers, including managers and senior staff, should be trained on:
- what sexual harassment in the workplace looks like
- what to do if they experience or witness it
- how to handle any complaints of harassment
It adds that, where harassment by customers is more likely, workers should be trained to deal with it, and that employers should review how effective their training is and run refresher sessions at regular intervals.
Acas goes further on third-party risk, suggesting steps such as training workers in staff safety and de-escalation, alongside risk assessments, clear policies and recording incidents.
Role-based, not one-size-fits-all
Acas’s own worked example shows what good looks like: a new starter is given the harassment policy at induction, enrolled on mandatory training and shown how to report concerns – while senior leaders, team leaders, managers, HR staff, fair treatment contacts and trade union representatives receive additional training in handling complaints.
In practice, that means at least three audiences:
- All workers – recognising harassment, reporting routes and the organisation’s policy
- Managers and complaint handlers – responding to disclosures, handling complaints fairly and stopping repeat behaviour
- Customer-facing teams – managing third-party harassment and de-escalating difficult situations
Training alone won’t satisfy the duty
Acas also gives an example of an employer that ran harassment training in one area after a serious incident, but did nothing about a wider culture of “banter”. It concludes that the employer was very unlikely to have taken all reasonable steps. Training needs to sit alongside risk assessment, an up-to-date policy, more than one reporting route, and regular monitoring and review.
Evidence: the part that’s easy to overlook
“All reasonable steps” is ultimately something an employer may need to demonstrate – to a tribunal, to the EHRC or to its own board. Acas even recommends recording why you have decided some steps are not reasonable for your organisation.
That makes record-keeping as important as content. Ask yourself whether you could quickly answer questions like these:
- Which workers have completed the training, and which haven’t?
- Have all managers and complaint handlers completed the additional training?
- When is each person due a refresher?
- Who has read and acknowledged the current version of the policy?
- Have new starters completed it as part of their induction?
- How have you checked whether the training is working?
If those answers are scattered across spreadsheets, inboxes and paper sign-in sheets, now is the time to bring them together.
How an LMS helps you take – and prove – all reasonable steps
A modern learning management system such as Totara Learn can turn the duty into a managed, auditable programme:
- Automatic, role-based enrolment – assign the right courses to all staff, managers, HR and customer-facing teams based on their role, location or department
- Built into onboarding – make harassment training and policy acknowledgement part of every new starter’s induction
- Recurring refreshers – set renewal periods so training doesn’t quietly lapse
- Blended delivery – combine elearning with face-to-face workshops, scenario-based sessions or specialist-led training, and record them all in one place
- Reporting and audit trails – see completion and overdue training at a glance, and produce evidence when you need it
- Feedback and evaluation – gather learner feedback to help review whether training is effective, as the EHRC recommends
You can read more about the wider benefits in our article on 10 benefits of an LMS for compliance training and why LMS analytics and reporting are critical.
Next steps
The change takes effect on 30 October 2026, so it is worth reviewing your training programme against the EHRC and Acas guidance now: who is being trained, on what, how often, and how you will prove it.
At Webanywhere, we help organisations deliver and track mandatory training with Totara-based learning platforms built around their policies and reporting needs. Find out more about our compliance training solutions, or get in touch to talk through how your LMS can support the new duty.
This article is for general information and is not legal advice. Employers should take their own legal advice on how the duty applies to them.