The sexual harassment duty from 30 October 2026: what 'all reasonable steps' means for small employers

From 30 October 2026 UK employers must take all reasonable steps to prevent sexual harassment, including by customers and clients. What that means for a small business, in plain English.

If you run a small business, a café, a care agency, a shop or a charity, the rules on preventing sexual harassment at work changed on 30 October 2026. The change is short to describe and easy to underestimate: employers now have to take all reasonable steps to prevent sexual harassment, not just some reasonable steps. And you can now be liable when your staff are harassed by people who don't work for you.

This guide explains what that means for a small employer, using Acas guidance. It's practical guidance, not legal advice.

What changed on 30 October 2026

Since October 2024 employers have had a duty to take reasonable steps to prevent sexual harassment of their workers. The Employment Rights Act 2025 strengthened that from 30 October 2026 in two ways:

• "Reasonable steps" became "all reasonable steps". Acas explains this means taking every step that is reasonable for your organisation, not just some of them.
• Third-party harassment. Employers can now be liable for harassment of their workers by third parties, unless they took all reasonable steps to prevent it.

The duty covers harassment in person and online, and it's about prevention. Acas is clear that the focus is on stopping harassment happening, not only on how you respond once it has.

Who counts as a "third party"?

Acas describes a third party as anyone your workers come into contact with through work who doesn't work for you. For example:

• customers and clients
• service users, such as patients, residents or students
• self-employed contractors and tradespeople
• people at conferences or events
• members of the public in shared spaces

For many small employers this is the bigger change. If your team works behind a bar, on a reception desk, in people's homes or with the public, the main risk may not be colleagues at all.

What is "reasonable" for a small employer?

The good news: the law doesn't expect a ten-person business to act like a multinational. Acas says what's reasonable depends on things like your size, sector and the type of work you do, and means doing what you can with the resources you have. Larger or more complex organisations will usually need to do more.

But "small" isn't a reason to do nothing. Acas gives an example of an employer that is "very unlikely" to have taken all reasonable steps: an out-of-date policy, training for only one part of the business, and no action on a culture of tolerated "banter". Its example of an employer likely to meet the standard shares its policy at induction, requires training, makes a clear zero-tolerance statement, explains how to report, and trains managers and others who handle complaints.

Practical steps you can take this month

Based on the Acas guidance, here's a realistic list for a small employer:

1. Think through the risks. Where could your staff be harassed? Late shifts, lone working, home visits, customer-facing roles, work events, messages from clients. Write down what you'll do about each. Acas suggests assessing third-party risks regularly.
2. Update or write your policy. Keep it short and plain. Say what sexual harassment is, give examples from your kind of work, cover third parties, explain how to report and what happens next. Acas suggests considering a standalone sexual harassment policy.
3. Give people more than one way to report. If the only route is the line manager, and the line manager is the problem, nobody reports. A second named person, or the owner, is a simple fix.
4. Train everyone, and train managers to respond. Staff need to recognise harassment and know how to report it. Managers need to know how to take a report seriously, record it and act.
5. Tell customers the rules. Acas suggests making the consequences of harassing your workers clear, for example with posters, emails, booking terms or contracts.
6. Use practical protections where the risk is higher. Acas mentions extra staff, personal alarms or cameras in higher-risk settings. For home visits, that might mean a check-in system.
7. Keep records. Record incidents, what you did, who's been trained and when. If you decide a step isn't reasonable for you, Acas suggests writing down why. Records are how you show you took all reasonable steps.

A quick example

A small café has eight staff. A regular customer keeps making sexual comments to a young barista. Under the old rules, the owner might have seen it as "one of those things". Now the owner should have a policy that covers customers, staff who know they can report it, a manager who acts (a word with the customer, then a ban if it continues), and a note of what happened. None of that costs much. All of it helps protect staff, and it's the kind of evidence that shows the business took the duty seriously.

Where to start

If you do one thing this week, get your policy and reporting routes sorted, then make sure everyone has had training. Our free 8-step sexual harassment duty checklist walks through the basics, and Acas has free guidance and a helpline.

Sources

• Acas: sexual harassment law changes (Employment Rights Act 2025)
• Acas: third party harassment
• Acas: employers urged to prepare for sexual harassment law changes

This article is practical guidance, not legal advice. Check the latest official guidance for your situation. If someone is in immediate danger, call 999.