New Law Makes Employers Liable for Third-Party Harassment from October 2026

From 30 October 2026, the law is changing in a way that will reach into almost every workplace where staff meet the public. Under the Employment Rights Act 2025, employers can be held liable when a worker is harassed by a third party — a customer, a client, a patient, a contractor or a member of the public — unless they can show they took all reasonable steps to prevent it. In nearly forty years working in and around health and safety enforcement, I've watched “duty of care” slowly widen from the machinery on the shop floor to the wellbeing of the person standing beside it. This is the next step in that journey, and it deserves your attention now, not in October.

Here's the honest position: if your people serve customers, treat patients, teach students or visit clients in their homes, this change lands on your desk. The good news is that the steps that protect your workers are, in the main, the steps a well-run safety culture takes anyway.

Key Takeaways

• From 30 October 2026, employers can be liable for harassment of their workers by third parties, not just by colleagues.
• The change sits in the Employment Rights Act 2025, which amends the Equality Act 2010 — so a worker brings a claim through an employment tribunal.
• It covers harassment linked to any protected characteristic, not only sexual harassment.
• The defence is “all reasonable steps” — a deliberately higher bar than the current “reasonable steps” test.
• Compensation under the Equality Act is uncapped and can include injury to feelings.
• Customer-facing sectors — retail, hospitality, healthcare, transport, care — carry the highest exposure.

What Is Changing on 30 October 2026?

Today, if one of your workers harasses another, you can be held responsible unless you took all reasonable steps to prevent it. What you are generally not liable for, under current discrimination law, is harassment of your worker by someone outside your organisation. That gap is what the Employment Rights Act 2025 closes.

From 30 October 2026, the Act inserts a new liability into the Equality Act 2010. If a worker is harassed by a third party in the course of their work, and you failed to take all reasonable steps to prevent it, the worker can bring a claim against you through an employment tribunal. Two details matter here. First, this is not limited to sexual harassment — it applies to harassment related to any of the protected characteristics the Equality Act recognises, including age, disability, race, religion or belief, sex and sexual orientation. Second, Equality Act compensation is uncapped and can include an award for injury to feelings, so the financial stakes are real.

Alongside this, the same date raises the sexual harassment duty from taking “reasonable steps” to taking “all reasonable steps.” That single word does a lot of work, and I'll come back to it.

Who Counts as a Third Party?

A third party is anyone your worker comes into contact with through their work who is not you and is not one of your workers. If you've ever thought “we don't really have that problem here,” it's worth pausing on how wide this net is:

• Customers and clients.
• Service users — for example, school students or healthcare patients.
• Self-employed consultants, contractors and tradespeople.
• People at conferences and events.
• Other members of the public in shared spaces.

The harassment can happen in person or online, and it doesn't need to be repeated to count. A single incident, handled badly, is enough to expose you.

Why Does This Matter for Your Sector?

Because the scale of third-party abuse is far larger than most risk registers admit. A 2025 survey by the Institute of Customer Service found that 42% of public-facing workers in retail, transport and hospitality had experienced abuse at work; more than a third of those who were abused considered leaving their jobs, and over a quarter took sick leave as a result. In retail specifically, Usdaw's 2025 survey of more than 8,900 staff found that 78% had been verbally abused and 54% threatened during the year — with physical assault more than doubling since 2019.

Read those figures as a safety professional rather than an HR one and the pattern is familiar: a known hazard, a foreseeable outcome, and organisations that have often normalised the risk rather than controlled it. That normalisation — “it's just part of the job” — is exactly what the new duty is designed to end. From October 2026, a documented habit of accepting abuse is not a record that will help you at tribunal.

What Does “All Reasonable Steps” Actually Mean?

This is the heart of it. “All reasonable steps” is a higher standard than “reasonable steps.” It's not enough to show you did something sensible; you need to be able to show there was nothing further you could reasonably have done. What's reasonable depends on your organisation — its size, its sector, and the kind of work your people do — so this is a proportionate duty, not a one-size-fits-all checklist.

For most organisations, the foundational steps look like this:

• Regularly assess the risk of third-party harassment and act to remove or reduce it.
• Monitor and record incidents, and the actions you took in response.
• Put a clear policy in place that sets out how third-party harassment is handled — for many, that means updating an existing bullying and harassment policy.

In higher-risk environments, reasonable steps are likely to reach further — appropriate staffing levels including security where needed, personal safety equipment such as alarms, and, for some teams or areas, body-worn or security cameras. The test is always what's possible with the resources you have. A national retailer with thousands of frontline staff will rightly be expected to do more than a small professional-services firm, and the guidance is explicit that not every step is possible for every organisation.

How Should Employers Prepare Before October 2026?

My advice, as with any regulatory change, is to treat the lead time as the gift it is. Don't wait for the date. Here's where I'd start:

1. Review and update existing policies — including lone-working policies, which often carry the most relevant controls already.
2. Map which third parties your workers actually come into contact with, sector by sector and role by role.
3. Make sure every worker knows who to contact and how to raise a concern — quietly tolerated abuse is usually a reporting failure first.
4. Assess honestly whether all reasonable steps are being taken, and write down both the assessment and the gaps.

If that list looks like a risk assessment, that's because it is one. The organisations that will find October 2026 straightforward are the ones already treating psychological safety with the same rigour they bring to physical safety. The two were never really separate.

Frequently Asked Questions

When Does the Third-Party Harassment Law Come Into Force?

The change takes effect on 30 October 2026 under the Employment Rights Act 2025. Employers are advised to prepare in advance rather than waiting for the date.

Does This Only Apply to Sexual Harassment?

No. Third-party liability covers harassment related to any protected characteristic under the Equality Act 2010 — including age, disability, race, religion or belief, sex and sexual orientation. Separately, the standard for preventing sexual harassment also rises to “all reasonable steps” on the same date.

What If We're a Small Organisation With Limited Resources?

“All reasonable steps” is proportionate. It means doing what is possible with the resources you have, so some steps expected of a large employer won't be expected of a small one. The key is to assess the risk honestly, act on it, and document what you did.

Can a Single Incident Lead to Liability?

Yes. Unlike some earlier arrangements, the new duty does not require repeated incidents. A single act of third-party harassment can expose an employer that failed to take all reasonable steps to prevent it. 

The rules are changing fast. Get clear, practical health and safety analysis delivered straight to your inbox and never miss a change that affects your duty of care. Sign up for the Astutis Quarterly Newsletter, or This Week in Health and Safety to stay ahead of the curve.