You Already Sorted Harassment in 2024. The Bar Just Moved Again.

Most employers think the harassment duty is a 2024 job they've already done. In October 2026 the standard rises from "reasonable steps" to "all reasonable steps", and harassment by customers and clients becomes something an employee can take you to a tribunal over. One word changes what you have to prove. Here's what actually changes, and what your handbook needs before October.

If you updated your anti-harassment policy in late 2024, you did the right thing at the time. Since 26 October 2024, every UK employer has been under a positive duty to take reasonable steps to prevent sexual harassment of their staff. Most businesses wrote a policy, ran a round of training, and ticked the box.

The problem is that the box has moved. From October 2026, two changes under the Employment Rights Act 2025 raise the bar — and a 2024 policy that was perfectly adequate eighteen months ago may no longer get you off the hook.

This isn't a new duty. It's the same duty, made considerably harder to meet. That's exactly the kind of change that catches good employers out, because nothing prompts them to look again.

What changes in October 2026

Two things, and they compound.

The standard rises from "reasonable steps" to "all reasonable steps". Today, you can defend a claim by showing you took reasonable, proportionate steps for a business of your size. From October 2026, the test becomes whether you took every reasonable step open to you. In practice that means showing not just what you did, but that there was nothing else you could sensibly have done. It's a deliberate uplift, and it aligns the preventative duty with the high bar that already applies to the "all reasonable steps" defence elsewhere in the Equality Act 2010.

Third-party harassment becomes actionable. Right now, if a customer, client, contractor or visitor harasses one of your staff, there's no standalone claim your employee can bring against you for it. From October 2026 there is. You'll be liable for harassment of your staff by third parties unless you can show you took all reasonable steps to prevent it. For anyone running a public-facing business — hospitality, retail, healthcare, anywhere staff deal with the public — this is the bigger change of the two.

There's a related shift worth noting from April 2026: a disclosure about sexual harassment now automatically counts as a "protected disclosure" for whistleblowing purposes. So an employee who reports harassment gains whistleblower protection from the moment they speak up.

Why "all" is doing so much work

It's one word, and it's easy to wave away. Here's why you shouldn't.

Under the current test, a small employer can reasonably say: we wrote a policy, we trained our managers, we have a way for people to complain — that's proportionate for our size. Under the new test, a tribunal will ask whether there was anything further you could reasonably have done and didn't. A risk assessment you never carried out. Refresher training you skipped. A reporting route you knew was underused and left as it was.

The defence stops being "we did enough" and becomes "we did everything reasonable". That's a much harder thing to evidence after the fact — which is why the work has to happen before an incident, not after.

The stakes are real. Where a tribunal finds sexual harassment and the employer hasn't met the preventative duty, it can increase the compensation award by up to 25%. And sex discrimination claims have already climbed sharply — from 457 in 2023/24 to 1,375 in 2024/25 — as the duty and wider awareness embolden people to come forward. The direction of travel is not subtle.

What your handbook and processes need before October

The duty is "anticipatory" — the regulator's own word. You're expected to have looked for risks and acted on them in advance, not to respond once something's gone wrong. That shapes what good looks like:

• A documented risk assessment. This is the step most SMEs skip, and it's the one that increasingly carries the defence. Identify where harassment could plausibly occur — including from third parties — and record what you've done about each risk. The document is the evidence.
• An anti-harassment policy that names third parties explicitly. A 2024 policy almost certainly focuses on staff-on-staff conduct. It needs to cover harassment by customers, clients, contractors and visitors, and set out how staff report it and what you'll do in response.
• Training that's current and refreshed. A one-off session in 2024 isn't enough for an "all reasonable steps" standard. Managers in particular need to know their responsibilities and how to handle a complaint.
• A reporting route people actually trust. Half of affected workers don't report, citing fear of victimisation or no confidence in the process. A route that exists on paper but goes unused is a weak point in your defence, not a strength.
• Clear signals to third parties. For public-facing businesses, this can mean visible notices that harassment of staff won't be tolerated, and steps like avoiding lone working in higher-risk situations.

None of this is exotic. It's the difference between a policy written once and a set of measures you can show you're actively maintaining.

Where Bounda fits

Bounda checks your anti-harassment policy against the current duty and flags exactly where it falls short of the October 2026 standard — including whether it covers third-party harassment, which most older policies don't. It generates a compliant redraft you can accept or edit, and the risk-assessment and supporting documents that go with it, all referenced against your other policies so nothing contradicts.

If you updated your handbook in 2024 and haven't looked since, that's the gap to close now — well before October, while there's time to do it properly.

Common questions about the 2026 harassment duty

Does the harassment duty apply to small businesses?

Yes. The preventative duty applies to every employer regardless of headcount. What counts as "all reasonable steps" is judged in proportion to your size and resources, but there is no small-business exemption — and the third-party harassment change hits public-facing SMEs hardest.

What is the difference between "reasonable steps" and "all reasonable steps"?

Under the duty in force since October 2024 you must take reasonable steps to prevent sexual harassment. From October 2026 you must take all reasonable steps, meaning a tribunal will ask whether there was anything further you could reasonably have done and didn't. It is a higher standard and much harder to evidence after an incident.

Can an employee claim if a customer or client harasses them?

From October 2026, yes. Employees will be able to bring a claim where a third party — a customer, client, contractor or visitor — harasses them and the employer failed to take all reasonable steps to prevent it. Today there is no standalone claim for third-party harassment.

What should an anti-harassment policy include for 2026?

At minimum: explicit coverage of third-party harassment, a documented risk assessment, current and refreshed training (especially for managers), a reporting route staff actually trust, and clear signals to third parties for public-facing roles.