If your organization updated its harassment prevention program for the Worker Protection (Amendment of Equality Act 2010) Act 2023 and considers the job done, it’s time to look again. The Employment Rights Act 2025 — with key provisions taking effect in April and October 2026 — raises the bar substantially. The standard has shifted from “reasonable steps” to “all reasonable steps,” harassment complaints are now formally protected under whistleblowing law, and employers are liable for harassment by clients, customers, and contractors, not just colleagues.
UK employers should be aware of the overarching changes, and the key dates in 2026 that certain elements of the law will go into effect. Here’s what changed, what it means in practice, and what “good” compliance looks like now.
A Quick Recap: Where Things Stood in 2024
The 2023 Worker Protection Act introduced a proactive duty for employers to take “reasonable steps” to prevent sexual harassment — a significant shift from the reactive, complaint-driven model that preceded it. The Equality and Human Rights Commission (EHRC) published an eight-step guide to help employers comply, and tribunals gained the power to increase compensation awards by up to 25% where the duty was breached.
That was the floor. The Employment Rights Act 2025 has now raised it.
What the Employment Rights Act 2025 Changes
Three changes are most significant for HR and compliance teams:
1. “Reasonable Steps” Becomes “All Reasonable Steps”
From October 2026, the standard rises from “reasonable steps” to “all reasonable steps” — a deliberate and material uplift. Under the previous standard, employers could point to proportionate measures relative to their size and circumstances. Under the new test, a tribunal will ask not just what you did, but whether there was anything else you could reasonably have done. That’s a fundamentally different question.
The government’s own factsheet acknowledges that what constitutes “all reasonable steps” will depend on employer size, sector, and working environment — but regulations specifying required steps are expected in 2027. In the meantime, the EHRC’s eight-step guide remains the primary reference point, and it is widely expected to be updated to reflect the higher standard.
Bottom line: Policies and a one-off annual training module won’t constitute “all reasonable steps.” As one employment law firm notes, this is not a tick-box exercise.
2. Liability Now Extends to Third-Party Harassment
From October 2026, employers will be liable for harassment by third parties — including clients, customers, contractors, and visitors — unless they can show they took all reasonable steps to prevent it. This applies to sexual harassment and to harassment based on any protected characteristic.
For many organizations, this is the change that requires the most rethinking. Preventive measures that focus only on colleague-to-colleague conduct will be insufficient. Risk assessments, anti-harassment policies, and training need to explicitly account for third-party interactions.
3. Sexual Harassment Reports Are Now Protected Disclosures
From 6 April 2026, any disclosure relating to sexual harassment qualifies as a protected disclosure under UK whistleblowing law. Workers who report sexual harassment — whether it happened to them or someone else — are now protected from dismissal and detriment. Employers who retaliate face claims for automatic unfair dismissal (with uncapped compensation) in addition to any underlying harassment claim.
Previously, employees had to frame harassment concerns as a criminal offence or health and safety issue to access whistleblowing protection. The new law removes that ambiguity and creates a clear, standalone route to protection.
What “All Reasonable Steps” Actually Looks Like
The shift to a higher standard changes what good compliance looks like in practice:
From reactive to documented:
- Investigate complaints after they happen → Prove you actively worked to prevent them
- Provide basic training → Deliver ongoing, role-based, measurable training
- Manage internal risk only → Assess and mitigate risk from employees and third parties
What tribunals will want to see:
- Manager-specific harassment prevention training, not just general compliance modules
- Scenario-based learning that builds judgment, not just policy awareness
- Regular refreshers, not a single annual session
- Completion and comprehension tracking
- Risk assessments that cover third-party interactions
- Clear documentation of every step taken
Training Alone Is No Longer Enough
Under the “all reasonable steps” standard, demonstrating that employees completed training is not sufficient. Organizations need to show that training influenced behavior. That means moving beyond completion rates toward evidence of culture change:
- Pulse surveys on psychological safety and trust in reporting mechanisms
- Real-time feedback loops (“would you report?”, “do you trust HR?”)
- Early identification of high-risk teams or managers, before incidents occur
Training data combined with culture data gives organizations the documentation trail they need to mount a credible defense. Neither alone is sufficient.
How Emtrain Helps Organizations Meet the New Standard
Emtrain’s platform is built around exactly this combination of training and behavioral measurement:
- Role-based harassment prevention training: Purpose-built courses for managers and employees, covering third-party harassment scenarios and scenario-based learning that builds real judgment.
- Comprehension and completion tracking: Go beyond pass/fail to document that employees engaged with and understood the material — critical for demonstrating “all reasonable steps.”
- Culture measurement and pulse surveys: Capture behavioral signals across your organization. Identify high-risk departments early and show regulators and tribunals a documented pattern of proactive action.
- Policy acknowledgment tools: Ensure 100% of employees have reviewed and acknowledged your updated harassment and whistleblowing policies — including the new protected disclosure status of harassment reports.
- Risk-based recommendations: Emtrain’s platform surfaces targeted training and management actions based on your organization’s actual culture data, not generic annual calendars.
What to Do Now
With the October 2026 deadline approaching for the “all reasonable steps” duty and third-party liability provisions, organizations should be acting now:
- Update anti-harassment, whistleblowing, and third-party conduct policies to reflect the new legal landscape
- Audit your current training program: is it role-based, scenario-driven, and regularly refreshed?
- Assess third-party interaction risks and document the steps you’re taking to manage them
- Implement culture measurement alongside training to build a documented evidence trail
- Ensure managers understand that sexual harassment disclosures are now protected under whistleblowing law
For more detail on the original 2023 Worker Protection Act and how it established the proactive duty framework, see our earlier post: Navigating the UK Worker Protection Act. To see how Emtrain can help your organization meet the new standard, visit our UK Harassment Prevention Training page or get in touch directly.
