Harassment law changes: is your organisation ready for 30 October?
Two important changes to harassment law take effect on 30 October 2026, and both require employers to think proactively about where harassment risks arise.
From ‘reasonable’ to ‘all reasonable’ steps
Since October 2024, employers have been under a positive duty to take reasonable steps to prevent sexual harassment of employees. From 30 October, that becomes a duty to take all reasonable steps.
That small change in wording raises the bar. Employers should be asking whether there are further reasonable measures they could take, rather than simply whether the measures already in place are adequate.
For HR, that means revisiting sexual harassment risk assessments. Are the particular risks within your organisation identified? Are policies backed up by effective training? Do employees know how to report concerns? Are managers equipped to respond?
Third party harassment returns
The second change concerns harassment by people outside the workforce, including customers, clients, suppliers and visitors.
Employers will be liable where an employee is harassed by a third party in the course of employment and the employer failed to take all reasonable steps to prevent it.
That makes third-party risk an important part of the October review. A hotel may need to consider guest behaviour towards staff; a retailer, abusive customers; and a professional services business, interactions with clients.
Possible measures might include clear customer conduct standards, reporting arrangements, instructions to managers, warnings or bans for abusive customers and additional safeguards for higher-risk roles.
What should you do now?
Review your harassment risk assessment with both changes specifically in mind. Identify where employees interact with third parties and what could reasonably be done to reduce those risks.
From 30 October, a policy and periodic training may be only the starting point. The focus will increasingly be on whether the employer has identified its actual risks (including third party risk) and taken all reasonable preventative steps available to it.