From 30 October 2026, employers must not permit their staff to be harassed by customers, clients and other third parties. On the same day, the existing duty to prevent sexual harassment becomes a duty to take all reasonable steps. This article sets out what the law will require, what a growing business can sensibly do before the date, and the part its customer contracts can play.
What changes on 30 October 2026?
Two harassment measures in the Employment Rights Act 2025 come into force on 30 October 2026, according to the government's implementation timeline, last updated on 14 October. Both apply in England, Wales and Scotland.
The first extends an employer's liability. Section 21 of the Act inserts a new provision into section 40 of the Equality Act 2010: an employer must not permit a third party to harass one of its employees. The government's guidance for employers gives customers and clients as its examples.
The second raises an existing standard. Since October 2024, employers have had a duty to take reasonable steps to prevent sexual harassment of their staff, and that duty already extended to harassment by third parties. From 30 October it becomes a duty to take all reasonable steps. A business that has done something, but not everything that was reasonable, will fall short.
The change has had less attention than the extension of employment tribunal time limits from three months to six, which took effect on 1 October. For a business whose staff spend much of their working week with other people's employees, it is likely to matter more.
When is an employer liable for harassment by a client?
Not every time it happens. Under the new section 40(1B), an employer is treated as permitting harassment by a third party only if two conditions are met: the harassment took place in the course of the employee's employment, and the employer failed to take all reasonable steps to prevent it. The same standard therefore governs both measures, and the question in any claim will be what the employer had done beforehand, and whether there was anything further it could reasonably have done.
Two points follow. First, a single incident is enough. A similar provision existed until 2013, but it applied only where the employer knew the employee had already been harassed by a third party on at least two occasions. The new provision contains no such condition. Second, the steps open to an employer against a client are narrower than those available against its own staff. It cannot discipline a customer. The law does not expect it to control people it does not employ, only to take the steps that were reasonable for it to take.
The consequences differ between the two measures. Where a sexual harassment claim succeeds and the tribunal finds that the employer breached its preventive duty, it may increase compensation by up to 25 per cent under section 124A of the Equality Act.
Who counts as a third party, and what is covered?
The Act defines a third party as anyone other than the employer or one of its employees. In practice that means customers, clients, suppliers' staff, contractors and visitors. For most growing businesses the exposure sits in ordinary commercial contact, much of it away from the office: client meetings and site visits, calls and messages, conferences, dinners and hospitality.
The new duty is not limited to sexual harassment. It covers harassment related to any of the protected characteristics to which harassment law applies under the Equality Act 2010: age, disability, gender reassignment, race, religion or belief, sex and sexual orientation. Pregnancy and maternity, and marriage and civil partnership, fall outside it, as they do for harassment under the Equality Act generally.
What does "all reasonable steps" mean for a growing business?
The law does not list required actions. The Act gives a minister power to set out evidence-based steps for preventing sexual harassment in regulations, but none have yet been made, and the government has said they will complement the wider duty rather than replace it. The test remains the steps that are reasonable for the particular organisation, having regard to its size, its resources and the risks its staff face.
The clearest current statement of what is expected is the Equality and Human Rights Commission's 8-step guide for employers. It covers a policy, engaging staff, risk assessment, reporting, training, handling complaints, dealing with third-party harassment, and monitoring, and it asks employers to treat harassment by customers and clients just as seriously as harassment by colleagues. The EHRC is updating its guidance to reflect the 2026 changes, so it is worth checking again once the revised version is published.
For a business of between 20 and 200 people, that guidance comes down to five pieces of work.
-
The harassment policy should name customers and clients, and say what the business will do when one of them is the problem: a warning to the client, changing who handles the account with the employee’s agreement, or ending the relationship. A policy that covers only colleagues will not show that third-party risk was considered.
-
The risk assessment should include client-facing work. The EHRC's own prompts ask whether staff have customer-facing duties, work alone, work where alcohol is served, or attend external events. Client dinners, site visits and conferences are where most of this risk sits.
-
Staff need a reporting route that works away from the office, with a named person to contact. The business should record informal concerns as well as formal complaints, so that a pattern with one client can be seen before it becomes a claim.
-
Training should reach account managers and directors, not only junior staff. They are the people who will have to act on a report about a client, often one they have spent years winning.
-
Finally, the arrangements should be reviewed after the first case, and whenever the business or its client base changes. A policy in the staff handbook that nobody has read is unlikely to be enough on its own.
What can your customer contracts do?
The duty sits with the business as employer, but much of what it can do about a client depends on the contract between them. Most standard terms of business say a great deal about payment and liability and nothing about how the customer's people treat the supplier's. That leaves a business choosing between tolerating the behaviour and stopping work under a contract that does not entitle it to stop.
A short conduct clause closes that gap. It would typically oblige the customer to ensure that its personnel treat the supplier's staff with courtesy and respect, and give the supplier the right to:
- require that a particular individual no longer deals with its team;
- suspend the affected work without being in breach, with relief from service levels and deadlines while it is suspended; and
- terminate if the conduct continues or is serious.
Adding the clause to your own standard terms is the easy part. On a large customer's paper it becomes a negotiating point, and in our experience it lands better framed as a mutual commitment that protects both sides' people than as a new termination right. It is far easier to agree at the start of a relationship than after something has happened. A clause gives the business options, but it does not discharge the statutory duty by itself. A tribunal will look at what was done, not at what the contract allowed.
There is a commercial point no clause solves. The larger the share of revenue a client represents, the harder it is to act against them. Knowing that figure, and deciding in advance who makes the call, matters as much as the drafting.
What should you do before 30 October?
With less than two weeks to go, the realistic aim is a position the business can explain, not a finished programme:
- Agree at leadership level who decides when a client has crossed the line, ideally someone who is not paid on that account.
- Update the harassment policy to cover third parties.
- Tell client-facing staff how to raise a concern and with whom.
- Add a conduct clause to your standard terms, and put it on the list of points to raise the next time a large customer sends its own contract.
The risk assessment, training and monitoring will take longer. Start them now, and keep a dated record of what has been done and what is planned. If a complaint is made, the question will be what steps the business had taken by then, and a record made at the time is far more persuasive than one assembled afterwards. Claims for harassment now have six months to be brought, and early conciliation can extend that, so a claim may arrive long after the event.
Lawyerly's solicitors can update a harassment policy to cover third-party risk and add a conduct clause to your standard terms, on a fixed fee or within a subscription. See our employment and HR support.
