The addition of the word 'all' in the strengthened preventative duty may appear minor, but it reflects a higher expectation that employers will proactively identify, assess and address risks before harassment occurs. Acas has suggested that where employers may previously have chosen to take some reasonable preventative measures, from October 2026 they will be expected to take all of the preventative measures that are reasonable in the circumstances.
Although the Government will gain the power to introduce regulations specifying steps that will be treated as "reasonable" from 30 October 2026, consultation on those regulations is not expected until after the enhanced duty comes into force, with commencement not expected until 2027/28 (1). This means that, for now, the EHRC's existing technical guidance, together with its eight-step framework for preventing sexual harassment at work, remain the most useful indicators of what good practice looks like.
The Equality and Human Rights Commission (EHRC) technical guidance confirms that taking “all reasonable steps” means there are no further steps that the employer could reasonably have been expected to take to prevent harassment. What is reasonable will vary from employer to employer, taking into account the size of the organisation, the nature of its operations, the resources available and the risks faced by its workforce.
Tribunals are likely to ask whether identified risks were properly addressed, whether training programmes were refreshed and adapted over time and whether lessons were learned from complaints and workforce feedback. They may probe whether preventative measures were reviewed following incidents and whether managers were adequately trained and held accountable for implementation.
In short, employers will need to show not only that preventative measures were in place, but that they were actively monitoring whether those measures were working and responding appropriately where improvements were required.
(1) GOV.UK Factsheet Preventing Workplace Sexual Harassment
1. Reassess whether existing controls remain fit for purpose
Many employers introduced new risk assessments, policies and training when the preventative duty came into force in 2024. The question now is whether those measures remain sufficient.
Employers should review anti-harassment policies, reporting procedures, training programmes and risk assessments to ensure they reflect current workplace risks and adequately address both sexual harassment and third-party harassment. Pay attention to whether identified risks have been mitigated and whether preventative measures have been updated in response to complaints, workforce feedback or emerging trends.
2. Strengthen monitoring, reporting and accountability
The addition of the word "all" suggests tribunals will examine whether employers have actively monitored the effectiveness of their arrangements and responded appropriately when concerns arise.
Review whether employees have clear and accessible routes for raising concerns, whether managers are equipped to identify and address inappropriate behaviour and whether complaints, grievances, exit interview feedback and employee surveys are being used to identify patterns and areas of risk. Keep records of preventative measures and actions taken in response to concerns to demonstrate compliance.
Also consider whether reporting arrangements are sufficiently independent where complaints involve clients, customers or other commercially important third parties. Employees may be reluctant to raise concerns if they believe that the manager receiving the complaint has a vested interest in preserving the underlying commercial relationship. Providing an alternative escalation route, such as HR or another contact, may help to ensure that concerns are raised and addressed.
3. Address third-party harassment risks directly
For many employers, this is likely to be the area requiring the most attention. Although likely to have been considered fairly recently when the duty to take reasonable steps to prevent sexual harassment of workers came into effect in October 2024, it is a good opportunity to review what measures have been taken so far and whether they remain adequate, especially in relation to other protected characteristics.
Start by identifying where interactions take place and whether particular roles, locations or activities present heightened risks. Customer-facing employees, staff working at client sites, those attending industry events and employees dealing with members of the public will require particular attention.
Next, set clear behavioural expectations. This might include incorporating standards of behaviour and anti-harassment provisions into supplier and contractor agreements, including appropriate wording in client engagement terms, displaying notices in customer-facing environments stating that harassment of staff will not be tolerated, and /or setting expectations in visitor guidance, conference materials and codes of conduct.
Finally, consider what will happen when an incident occurs. A policy stating that third-party harassment will not be tolerated is unlikely to carry much weight if the organisation routinely ignores complaints involving important clients or customers. A robust response is likely to include investigating reports promptly, documenting the steps taken, speaking directly to the offending individual or organisation, requiring assurances that the behaviour will not be repeated, changing account teams, removing employees from situations where they feel unsafe, restricting an individual's access to premises or events, or, in serious cases, ending the relationship altogether. Managers should understand that commercial considerations cannot compromise employee safety.
