From October 2026, employers will face new responsibilities to protect employees from harassment by customers, clients, contractors, service users and other third parties. What do the changes mean in practice, and what should employers be doing now?
What is changing?
The Employment Rights Act 2025 is being implemented in stages during 2026 and 2027. As part of those reforms, employers will face a new legal duty from 30 October 2026 requiring them to take all reasonable steps to prevent harassment of employees by third parties. Importantly, this is not limited to sexual harassment. The duty extends to harassment related to the protected characteristics recognised under the Equality Act 2010, including race, disability, religion or belief, sex and sexual orientation.
This means employers can no longer focus solely on harassment between colleagues. They will also be expected to assess and manage the risks posed by customers, clients, contractors, suppliers, service users, patients and members of the public, and may be held responsible where they fail to take reasonable preventative action.
The reforms reflect growing recognition that workplace harassment is not always carried out by colleagues or managers. For many organisations, particularly those with customer-facing, client-facing or public-facing workforces, the greatest risks may arise from interactions with third parties during the course of employment.
Employers should also be aware that, from 30 October 2026, they will be subject to a separate duty to take all reasonable steps to prevent sexual harassment. You can read more about those changes and how employers can prepare here.
Who counts as a third party?
One of the challenges for employers is that the concept of a “third party” is much broader than many people initially assume. In this context, a third party is anyone other than the employer or one of its employees who may come into contact with workers during the course of their employment. For many organisations, interactions with third parties occur every day and form a normal part of working life. The new duty is therefore likely to have practical implications for a wide range of employers.
Third parties may include:
- Customers;
- Clients;
- Contractors;
- Freelancers;
- Suppliers;
- Agency workers;
- Service users;
- Patients;
- Students;
- Conference delegates;
- Visitors; and
- Members of the public.
Why should employers care?
Workplace harassment is not always carried out by colleagues or managers. For many organisations, interactions with third parties occur every day and form a normal part of working life. This means the new duty is not a theoretical risk. Employers will need to consider how they protect employees who regularly interact with customers, clients, contractors, service users, patients or members of the public as part of their role.
A receptionist dealing with clients, a care worker undertaking a home visit, a retail employee serving customers, a nurse dealing with patients and visitors, a hospitality worker working late into the evening, or a lawyer attending client events may all encounter inappropriate conduct from third parties during the course of their work.
In many sectors, employees may have regular contact with people over whom the employer has only limited control. That does not, however, mean employers can ignore the risk.
The consequences of getting this wrong can be significant. Compensation awarded in successful claims may be increased by up to 25% where an employer has failed to comply with the preventative duty. Employers may also face enforcement action by the Equality and Human Rights Commission (EHRC), which has powers to investigate employers and require organisations to take action where it considers workplace protections are not being met. Employers should therefore take a proactive approach to identifying and managing third-party harassment risks.
Which sectors are likely to be most affected?
All employers should consider these changes, but some sectors may face particular challenges.
- Hospitality and retail employers often have frequent interaction with customers, young or temporary workforces, late-night working and, in some settings, alcohol consumption.
- Healthcare and care providers may have to consider risks associated with close physical contact, lone working, home visits and interactions with patients, service users and visitors.
- Transport employers may need to assess risks arising from public-facing roles, remote locations, shift work and interactions with members of the public.
- Professional services businesses should not assume they are immune. Lawyers, consultants and advisers regularly attend client meetings, networking events, conferences and social functions where inappropriate conduct can arise.
What might “all reasonable steps” look like in practice?
From 30 October 2026, employers will be required to take all reasonable steps to prevent harassment of employees by third parties. This is a high bar. Whilst we do not yet have a definitive checklist of what this will require in every workplace, employers should assume that they will need to do more than simply have a policy in place or react to complaints when they arise. Employers will be expected to think proactively about the risks faced by their workforce and the steps they can reasonably take to reduce those risks.
The position is made slightly more complicated by the fact that the detailed regulations intended to provide further clarity on what may constitute reasonable steps are not currently expected until 2027/28, after the new duty comes into force. Employers should not treat that uncertainty as a reason for delay. The enhanced duty applies from October 2026 and organisations should already be considering how they will identify, assess and manage third-party harassment risks.
For most employers, the starting point should be a risk assessment. The Equality and Human Rights Commission’s (EHRC) Technical Guidance indicates that employers are unlikely to comply with the preventative duty unless they have properly assessed the risks within their organisation. Without understanding where employees come into contact with customers, clients, contractors, service users, patients or members of the public, it is difficult to assess what preventative measures are reasonable and proportionate in the circumstances. Risk assessments should be supported by a practical action plan setting out how identified risks will be addressed, monitored and reviewed.
Importantly, employers are not starting from scratch. The EHRC’s Technical Guidance and Employer 8-Step Guide already provide a strong framework for employers. The guidance encourages organisations to identify where employees may be exposed to third-party harassment, assess those risks, take practical steps to reduce them, and respond appropriately when concerns arise. It also emphasises the importance of effective reporting mechanisms, supportive workplace cultures and regular review of preventative measures.
The Government has acknowledged that employers have less control over the actions of third parties than they do over their own workforce. As a result, expectations are likely to be lower than those that apply to employee-to-employee harassment. However, employers will still be expected to take reasonable and proportionate steps to protect staff where foreseeable risks exist.
What about contractors and suppliers?
One area that is likely to receive increasing attention is the role of contractors, freelancers and other third parties who regularly work alongside employees.
The EHRC’s Technical Guidance suggests that employers consider making it clear that third parties are expected to comply with the organisation’s workplace harassment standards. Depending on the nature of the relationship, this may include incorporating appropriate provisions into contracts, terms of engagement or supplier arrangements.
For many organisations, the practical focus is likely to be on ensuring that contractors, consultants, agency workers and other third parties understand the standards of behaviour expected of them and how concerns can be raised and addressed. Employers may therefore wish to review policies, supplier terms, onboarding processes and other communications to ensure that those expectations are clearly communicated and consistently applied.
What should employers be doing now?
Employers should not wait until October 2026.
The starting point for most organisations should be understanding where employees may be exposed to third-party harassment and what practical measures can be taken to reduce those risks. This is likely to involve carrying out a risk assessment and developing an action plan to address any issues identified.
Practical steps may include:
- Reviewing workplace harassment policies and ensuring they address third-party harassment;
- Updating risk assessments to identify third-party risks;
- Developing an action plan to address any risks identified;
- Identifying higher-risk roles, activities and working environments;
- Refreshing manager and employee training;
- Reviewing reporting and investigation procedures;
- Communicating behavioural expectations to customers, clients, contractors and other third parties;
- Reviewing supplier, contractor and other third-party arrangements where appropriate; and
- Monitoring complaints, incidents and trends to identify recurring risks and assess whether preventative measures are working.
How can Stephens Scown help?
Stephens Scown’s Employment team advises employers on all aspects of workplace harassment prevention, including risk assessments, action plans, policy reviews, investigations, training and preparing for the October 2026 reforms.
Whether you are looking to assess the risks within your organisation, review your approach to third-party harassment, update policies and procedures, or deliver training for managers and employees, we can help. Our Workplace Harassment Prevention Package is designed to help employers identify and manage workplace harassment risks, develop practical action plans and prepare for both the strengthened duty to prevent sexual harassment and the new obligations relating to third-party harassment.