Your Customers Are Now Your Compliance Problem: The Third-Party Harassment Duty

From 30 October 2026, you can be liable for the behaviour of people you do not employ.

If a customer harasses a member of your staff and you cannot show you took all reasonable steps to prevent it, that is your liability. And unlike the duty that came before it, this one covers every protected characteristic.

Two Changes, One Date

On 30 October 2026, the Employment Rights Act 2025 makes two changes to harassment law.

The bar rises. The preventative duty introduced in October 2024 — requiring employers to take reasonable steps to prevent sexual harassment of their employees — becomes a duty to take all reasonable steps. One word, and a materially higher standard. “Reasonable” invites a judgement about what was proportionate. “All reasonable” invites a tribunal to ask what else you could have done, and why you did not.

The scope widens. Employers become liable where a worker is harassed by a third party in the course of their employment and the employer has not taken all reasonable steps to prevent it. “Third party” is drawn widely: customers, clients, patients, suppliers, contractors, visitors to site, and members of the public.

Note carefully that the third-party protection is not limited to sexual harassment. It extends to harassment related to any protected characteristic — race, disability, age, religion or belief, sexual orientation, gender reassignment, and sex.

For a business whose staff deal with the public all day, that second change is the significant one.

Why This Is Not a Big-Company Problem

The duty applies to all employers regardless of size. There is no small-business exemption, no headcount threshold, no grace period for firms without an HR function.

And the sectors most exposed are precisely the ones dominated by SMEs: hospitality, retail, care, leisure, transport, hairdressing and beauty, veterinary practice, estate agency — any business where staff deal directly with the public.

The scale of the underlying problem is well documented. TUC polling of more than 1,000 working women found that 58% had experienced sexual harassment, bullying or verbal abuse at work, and that in around two in five of the most recent incidents the perpetrator was a third party rather than a colleague. A Unite survey published in 2025 found that around three-quarters of those who had experienced harassment at work did not report it.

That last figure is the one to sit with. Low reporting does not mean low incidence. It means you may already have a problem you cannot see — and after 30 October, not knowing will not help you.

What “All Reasonable Steps” Actually Requires

Regulations specifying particular steps are not expected until 2027, so for now the standard is judged on the facts of each case. But the direction is clear enough from the existing preventative duty and from how the Equality and Human Rights Commission has approached enforcement: the test is preventative, evidenced, and proportionate to your business.

In practice, “all reasonable steps” is likely to mean:

• A documented risk assessment that specifically considers third-party harassment — where it could happen, to whom, and in what circumstances.
• An anti-harassment policy that expressly covers harassment by customers and other third parties, and explains how staff report it.
• Communicating your standards outward: signage, website terms, booking conditions, and clauses in client, supplier and contractor agreements.
• Training for staff and managers on recognising, responding to and escalating third-party incidents — with attendance records retained.
• A reporting route staff will actually use, and evidence that reports are acted on.
• A review of physical arrangements: lone working, late shifts, security, escalation support.
• Periodic review of all of the above, with the paper trail kept.

The common thread is evidence. A policy you cannot prove you communicated, or training you cannot prove people attended, is close to worthless at tribunal.

The Financial Exposure

There is no standalone claim for breaching the preventative duty — a worker cannot sue you simply for failing to prepare. But where a harassment claim succeeds, a tribunal can uplift the compensation awarded by up to 25% if it finds the duty was breached. Harassment and discrimination awards are uncapped.

Layer on the related changes and the risk profile shifts further:

• Since 6 April 2026, a disclosure about sexual harassment is a qualifying disclosure under whistleblowing law, meaning a worker who reports it has protection from detriment and dismissal.
• From 1 October 2026, claimants have six months rather than three to bring a claim.
• In 2027, restrictions on non-disclosure agreements will limit your ability to settle these matters quietly.

Businesses in regulated sectors face a parallel obligation: the FCA’s rules extending non-financial misconduct reporting to a much wider population of regulated firms take effect in September 2026.

Read together, these changes point the same way. More time to bring claims, more protection for the people who raise them, larger awards where employers were unprepared, and less scope to make the problem disappear with a settlement.

The Hard Conversation

The uncomfortable part of this reform is that it sometimes requires you to side with your staff against a paying customer.

Consider a member of staff harassed by a regular client, whose manager responds by moving them onto a different shift rather than addressing the client’s behaviour. That is a compliance failure and a retention problem in the same moment. The “customer is always right” reflex is now, in a narrow but important sense, unlawful.

The businesses that handle this well will decide their position in advance: what behaviour ends a booking, who has authority to ask someone to leave, and what support a member of staff gets afterwards. That is a management decision rather than an HR document — but it needs to be written down before it is needed. Nobody makes a good judgement call about a valuable client at 9pm on a Friday with a distressed employee in front of them.

Where to Start

• Complete or refresh a harassment risk assessment before 30 October, covering third parties explicitly.
• Update your anti-harassment policy and reporting route, and tell staff about both.
• Add harassment provisions to third-party contracts and terms as they come up for renewal.
• Run refresher training and keep the register.
• Give managers a clear, pre-agreed script and escalation path for third-party incidents.

None of this is expensive. Almost all of it is quicker than the first tribunal claim it prevents. The only genuinely scarce resource is the time between now and 30 October.