Third-party harassment law from 30 October 2026: customer contact must become a work-design control

The legal change matters because customer contact is part of the operating model

**Evidence.** From **30 October 2026**, the Employment Rights Act 2025 strengthens the preventative duty on sexual harassment from taking “reasonable steps” to taking **“all reasonable steps”**. It also introduces employer liability for harassment by third parties where the employer has failed to take all reasonable steps to prevent it. Acas explains that third parties can include customers, clients, service users, contractors, event attendees and members of the public, and that harassment can occur in person or online. The changes apply in England, Scotland and Wales; Northern Ireland is outside their scope because this area is devolved. (Employment Rights Act 2025, 2025) ↗ (Acas, 2026) ↗

**Interpretation.** This is a legal reform with an operational centre of gravity. Employers cannot control whether every customer, client or visitor behaves appropriately. They can, however, control many of the conditions in which contact occurs: who works alone, who can intervene, how an unsafe call or meeting is ended, whether prior incidents are visible, and what commercial consequences follow repeat behaviour.

That makes the issue especially acute in customer-facing and community-facing work. A lone worker closing a shop, a care worker visiting a home, a junior employee attending a client dinner, a receptionist dealing with an aggressive visitor and a worker managing an abusive digital account face different risks. A generic dignity-at-work policy may set expectations, but it does not determine whether that worker has authority, support or a credible route out of the interaction.

The central thesis is therefore straightforward: third-party harassment should be managed as a **work-design risk**, not solely as a conduct-policy or post-incident HR issue. This does not transfer responsibility for harassment from the perpetrator to the employer. It recognises that employers make choices about exposure, escalation and response—and those choices will increasingly matter in assessing prevention.

‘All reasonable steps’ is a system test, not a promise of zero incidents

**Evidence.** The new standard does not make employers guarantors that harassment will never happen. The Act allows regulations to specify steps that are to be treated as reasonable, potentially including risk assessments, plans or policies, reporting arrangements and complaint handling. Government has indicated that these regulations may follow, while the wider “all reasonable steps” duty takes effect from 30 October 2026. (Employment Rights Act 2025, 2025) ↗ (Department for Business and Trade, 2026) ↗

Existing EHRC guidance is helpful in framing the management challenge. It says that policies and procedures alone are insufficient to prevent harassment, and indicates that employers may need to show that there were no further reasonable steps they could have been expected to take, taking account of a measure’s likely effect and whether an alternative would be more effective. (EHRC, 2024) ↗ (EHRC, 2024) ↗

**Interpretation.** The phrase “all reasonable steps” should not be read as an invitation to indiscriminate paperwork. It is a judgement standard: what is reasonable will differ with the organisation’s size, resources, sector, hours, role design and known pattern of risk. But proportionality is not passivity. A small café may not need a dedicated investigations function; it may nevertheless need a lone-closing protocol, a manager escalation route, a clear customer boundary and a process for responding to repeat offenders. A domiciliary-care provider may require visit allocation, check-in arrangements and a rapid process for reassessing a setting after an incident.

There is a legitimate concern that a broad duty could lead to defensive bureaucracy or make employers reluctant to place people in customer-facing roles. That would be the wrong response. The better discipline is to focus management attention on material exposure: the particular times, places, channels and counterparties where risk is most likely or most difficult to manage. A short, live exposure-to-control map is more useful than a lengthy policy that does not alter day-to-day decisions.

**Sanctuary recommendation.** For each higher-risk role or contact setting, record: the interaction; the likely third parties; known warning signs or incidents; current controls; outstanding gaps; the accountable owner; and a review date. This creates an auditable decision trail without confusing documentation with prevention.

Work design shapes exposure—even where the employer does not control the third party

**Evidence.** Acas identifies a range of measures that may be relevant to third-party harassment: regular risk assessment, incident recording, clear policies, safety and de-escalation training, customer and supplier terms, communication of consequences, and, in higher-risk settings, staffing, security support or safety equipment. It also advises employers to record why a potential measure was judged unreasonable or confined to particular roles. (Acas, 2026) ↗

Government impact-assessment material provides a useful, but limited, indication of the issue’s reach. Among people aged 16 and over who reported sexual harassment in the 12 months to March 2025, 5.2% identified a client or member of the public contacted through work as the perpetrator; the equivalent figure for non-sexual harassment was 6.2%. This is not a prevalence estimate for all workers, nor does it identify the sectors at greatest risk. It does show that third-party conduct is a material component of reported harassment experience. (Department for Business and Trade, 2026) ↗

**Interpretation.** The useful distinction is between a conduct rule and a work-design control. A conduct rule says that customers must not abuse staff. A work-design control changes the circumstances in which abuse can occur or persist: two-person closing rather than lone closing; a supervisor available during a contentious meeting; authority to end a call; a booking flag following an incident; a contractual route to challenge a client; or a process for moderating and preserving evidence from online abuse.

This distinction is commercially important for SMEs, high-street businesses and locally rooted organisations. Workers may reasonably fear that reporting a customer or service user will damage a relationship, reduce a sale or make the next shift harder. If escalation carries a hidden penalty, under-reporting becomes rational. Prevention therefore requires credible permission to pause, transfer, end or escalate contact without the worker being blamed for the lost booking, sale or relationship.

**Sanctuary recommendation.** Start with the highest-exposure teams, not with a universal communication. Ask managers three practical questions: what contact may a colleague stop; who takes over; and what happens to the customer, booking or contract after a report? Where answers vary by manager, the control is not yet reliable.

Training belongs in the control stack, not at its top

**Evidence.** The evidence for sexual-harassment prevention training is more limited than many compliance programmes imply. A 2026 Cochrane review of education and training interventions for healthcare workers found only two eligible studies, involving 170 nurses in Taiwan. Training probably improved prevention knowledge slightly and may have improved some management skills, but the review found no evidence on incidence, burnout, sickness absence, turnover or organisational climate. Certainty varied from moderate to low by outcome. (Dalsbø et al., 2026) ↗

A broader 2022 systematic review similarly found that workplace policies and interventions were more commonly evaluated through awareness and attitude outcomes than through demonstrable effects on wider workplace outcomes. (Diez-Canseco et al., 2022) ↗

**Interpretation.** These findings do not mean that training is unhelpful. They mean that training completion is weak evidence of prevention when it is detached from the risks staff actually face. Generic learning can explain definitions, boundaries and reporting routes. It is less likely to answer context-specific questions such as whether a worker can leave a client meeting, block an abusive online account or decline repeat contact with a commercially important customer.

Training is most useful when it rehearses decisions that arise in the relevant work setting, is backed by clear managerial authority, and is paired with changes to staffing, escalation and customer-management arrangements. The limited evidence base is itself a reason to evaluate controls in use rather than assume that awareness has translated into safety.

**Sanctuary recommendation.** Replace the single metric of “percentage trained” with a small assurance set: high-risk roles risk-assessed; time from report to immediate safety action; repeat incidents involving the same third party; worker confidence in escalation; and the control changes made after reports. A short-term rise in reporting after improvements may reflect greater trust rather than worsening behaviour, so it should be read alongside severity, recurrence and response quality.

A proportionate readiness model for SMEs

**Sanctuary recommendation.** Employers that have not completed a full review by 30 October should not imply that the work is complete. They should establish a credible minimum operating position, then run a dated improvement cycle.

1. **Set accountable ownership.** Name a senior owner and an operational lead. Define how serious reports reach a decision-maker outside standard office hours.

2. **Map contact exposure.** Identify public, client, contractor, service-user, event, lone-working and digital-contact roles. Draw on incident records, staff input, exit feedback and absence patterns, rather than formal grievances alone.

3. **Give workers immediate authority.** State when staff may end calls, leave an unsafe setting, request a colleague, transfer an account or decline repeat contact. The authority must be usable in practice, not conditional on a manager being immediately available.

4. **Set external boundaries.** Incorporate expectations and consequences into booking confirmations, visitor rules, customer terms, supplier arrangements and digital-channel rules. These messages should be visible and operational, rather than buried in legal boilerplate.

5. **Build a live response route.** A retrospective HR inbox is not enough. Specify who responds, what immediate safety actions are possible and how repeat third parties are managed.

6. **Record decisions and exceptions.** Where a measure is not feasible, record why, what alternative control is in place and when the decision will be revisited. This is particularly important where resources are constrained.

7. **Review trends monthly at first.** Examine patterns by location, shift, channel, customer type and recurrence, while protecting confidentiality. The purpose is to change controls, not merely produce a dashboard.

The trade-off is real: stronger controls can require more supervisory capacity, altered rostering or firmer customer consequences. But these costs should be assessed against the cost of normalising abuse: poorer job quality, avoidable management time, disrupted service and the loss of experienced staff. The most proportionate system is one that concentrates effort where exposure is highest and can show why its decisions were made.

The strategic test is whether prevention protects workforce capacity

**Evidence.** The UK had 691,000 vacancies in July to September 2026. The ONS also reported survey feedback suggesting that smaller businesses may be holding back recruitment amid higher labour costs. This does not establish that harassment prevention improves retention or recruitment; it does, however, underline the value of reducing avoidable strain in roles that are already difficult to staff. (ONS, 2026) ↗

**Interpretation.** In that context, treating customer abuse as “part of the job” is not a neutral commercial decision. It can weaken the attractiveness and sustainability of public-facing work, particularly where local employers compete for a limited pool of experienced people. A credible prevention system can protect service continuity as well as reduce legal exposure—but employers should not overclaim its effects.

The appropriate objective is not zero complaints or a promise of incident-free customer contact. It is a demonstrable management cycle: foreseeable exposure is identified; workers know what happens if they raise a concern; managers can act quickly; and incidents lead to learning that changes the operating environment. That is more demanding than a policy refresh, but more realistic than a slogan of zero tolerance unsupported by delivery capability.

The law’s practical boundaries will continue to develop through guidance, organisational practice and case law. The prudent response is not to wait for a definitive checklist. It is to make proportionate, reasoned decisions now—and retain evidence that those decisions were implemented, tested and improved.