October 2026 · Deadline piece

Your Customers Can Now Cost You a Tribunal Claim: The 30 October Harassment Duty

Last verified: 7 October 2026

From 30 October 2026, the legal bar for preventing sexual harassment at work rises from taking "reasonable steps" to taking all reasonable steps — and for the first time, your business can be held liable when a customer, client or contractor harasses your staff. Here is what that means for a small employer, and exactly what to put in place before the 30th.

You might remember October 2024, when the Worker Protection Act introduced a duty to take reasonable steps to prevent sexual harassment. Plenty of small businesses responded with a paragraph in the handbook and a one-off toolbox talk. That version of the duty was always a warm-up act. The Employment Rights Act 2025, which received Royal Assent on 18 December 2025, sharpens it into something far harder to satisfy — and pairs it with a brand-new liability that most small employers haven't heard of yet.

The 30 October harassment duty is the nearest-term deadline that actually requires you to do something. The tribunal time-limit change (1 October) is already live and needs no action from you; the January 2027 dismissal reforms are still three months off. This one lands in a matter of weeks, and it requires documents, decisions and a team briefing. This article walks through the lot.

The 30 October harassment duty: what changes

Three things arrive together under the 30 October harassment duty:

1. The duty gets tougher: "all reasonable steps". Since October 2024, employers have had to take reasonable steps to prevent sexual harassment. From 30 October 2026, the standard becomes all reasonable steps. That one word matters. Employment lawyers are treating it as a materially higher bar: it is no longer enough to show you did some sensible things. A tribunal will be asking whether there were further reasonable steps you could have taken and didn't. A policy gathering dust and a single training session two years ago will be hard to defend.

2. New liability for third-party harassment. This is the part that changes life for pubs, shops, salons and care providers. From 30 October, your business can be liable if a third party — a customer, client, contractor or supplier — harasses one of your employees, where the harassment is related to a protected characteristic or is sexual harassment, and you haven't taken all reasonable steps to prevent it. Previously, an employer could largely say "the customer did it, not us." That answer stops working.

3. Trade-union measures arrive at the same time. The Act also brings union-related changes on 30 October, including a requirement to give new joiners a written statement of their trade-union rights. Smaller employers should at least know it exists; the detailed piece on it sits in our master checklist.

One more thing to know: Acas reported that calls to its helpline about sexual harassment rose 39% in 2025 compared with 2024. Awareness is rising, and so is the likelihood that an incident reaches a tribunal.

What "all reasonable steps" means in practice

The law doesn't hand you a checklist — which is precisely why small employers find it stressful. But the employment-law consensus on what tribunals will look for has settled around five things:

1. A risk assessment specific to your workplace. Not a generic template — an assessment that considers your staff, your premises, your working hours, lone working, alcohol, customer contact and power dynamics. In a ten-person business this can be two pages. It just has to be yours.
2. An up-to-date written anti-harassment policy. Reviewed recently (October 2026 counts as recent), naming who staff should report to, what happens when they report, and how third-party incidents are handled. "Tell your line manager" is not enough if the line manager is part of the problem — you need a second route.
3. Documented, repeated training. Not a one-off slide deck in 2024. "All reasonable steps" points strongly at training that is refreshed and repeated, with records of who attended. For managers, it means training on how to receive a report and what to do next.
4. A reporting route staff genuinely use. A policy nobody reads is decoration. Tribunals will ask whether employees felt able to report. In a very small business, that might mean naming a second person (or an external contact) so nobody has to report to the person they sit next to every day.
5. Regular review. Not just after something goes wrong. Review the policy, the training and the risk assessment on a schedule — annually at a minimum, and sooner if your business changes (new premises, late-night opening, new client-facing roles).

The honest version: nobody can promise that doing these five things makes a claim impossible. What they do is give you the strongest available defence — the ability to show, document in hand, that you took the steps the law asks for.

The new third-party liability: your customers, your problem

This is the genuinely new bit, and the one small-business owners are least prepared for. Under the old position, harassment by a third party was the employee's misfortune but rarely the employer's legal problem. From 30 October 2026, if a customer, client, contractor or supplier harasses your employee — and you can't show you took all reasonable steps to prevent it — the tribunal claim comes to you.

Crucially, there's no "three strikes" rule here: a single incident can be enough to establish liability, because the law doesn't require a pattern or any earlier incident before the duty bites. That makes prevention — and the evidence that you did it — the whole game.

Think about what this looks like in real small businesses:

• Hospitality: A regular at the bar makes repeated sexualised comments to a 19-year-old member of bar staff. She mentions it to her shift supervisor, who laughs it off as "he's harmless." After 30 October, that laugh-off is exactly the kind of failure a tribunal will examine. A written rule about what staff should do when a customer crosses the line — including permission to refuse service, backed up by management — is what "all reasonable steps" looks like here.
• Retail: A delivery driver from a regular supplier makes unwanted physical contact with a shop assistant during drops. Your prevention steps include telling the supplier in writing that your business has a zero-tolerance policy for conduct toward your staff, and briefing staff that incidents involving contractors get reported the same way as any other.
• Salon: A client repeatedly asks a therapist personal sexual questions during appointments. Salons live on repeat custom, which is exactly what makes this hard: the economic pressure to keep the client is real, and the law now sits on the other side of it. A policy that says the appointment ends if the behaviour continues — with the owner's explicit backing — is a reasonable step a tribunal would recognise.
• Care: Domiciliary carers visiting clients' homes are the hardest case of all — the "workplace" is someone else's living room, and staff work alone. A risk assessment that acknowledges lone working, a check-in system, a protocol for reassigning a carer after a reported incident, and clear instructions to clients or families about expected conduct toward staff are the steps to have on record.

The pattern across all four: write down what staff should do when a third party crosses the line, give them visible backing to do it, and keep a record of the incidents and your responses. That is the evidence base the new liability turns on.

Your 23-day playbook: what an 8–20 person business should do before 30 October

You don't need a consultancy project. A business of your size can get the core of this done in a few focused hours. Here is the minimum viable compliance kit:

1. Write (or rewrite) your risk assessment — 1 hour. Sit down with your senior person or shift lead and answer, on one page: where do our staff interact with third parties? When are they alone? Is alcohol involved? Which staff are youngest or newest? What has already happened in the last two years? Date it, sign it, and schedule a review in twelve months. Keep it somewhere you can find it — a tribunal will want to see it.

2. Update the anti-harassment policy — 1 hour. It needs: a statement that sexual harassment and third-party harassment won't be tolerated; what counts as harassment (keep it plain); how to report (two named routes, not one); what happens after a report; and a specific section on third parties — customers, clients, contractors — making clear that staff have your backing to shut down unacceptable behaviour, including ending an interaction. If your handbook already has a policy, don't start from scratch: amend it and date the amendment.

3. Brief the whole team — 30 minutes. Gather everyone (or do it across two shifts) and walk through the policy. Keep it human: explain what the new duty is, give two or three concrete examples from your own setting, and say out loud that no one loses shifts, tips or favour for reporting. Then get signatures on an attendance list and file it with the policy.

4. Brief managers separately — 20 minutes. The person who receives a report decides whether it becomes a tribunal case. Managers need to know: take it seriously, write it down, escalate it, don't promise outcomes you can't deliver, and never punish the person who reported. In a ten-person business, "managers" might be you and one supervisor — brief them anyway, and write down that you did.

5. Start an incident log — 15 minutes. A simple spreadsheet: date, who reported, what happened, who was involved (including whether they were a third party), what you did, when it was reviewed. Even entries that say "customer complained at, spoken to, no recurrence" build the picture of an employer that takes reports seriously. Store it securely and keep it separate from the general HR file.

6. Tell your regular third parties — an email. You don't need to lecture every customer. But regular suppliers, contractors and agencies should get a short written note: your business has a zero-tolerance approach to harassment of your staff, and you expect the same standards from anyone working with you. That email is a "reasonable step" with a timestamp on it.

What if you've done none of this?

Don't panic, but don't drift either. The duty doesn't have a grace period, and "we're only small" has never been a defence under equality law. Start with the risk assessment this week — it takes an hour and it frames everything else. The policy and the team briefing follow naturally from it. If you do nothing else, those three things put you visibly ahead of employers who have a 2024-vintage policy and nothing since.

And keep this in proportion alongside the other October changes. The tribunal time limit has doubled to six months — already live since 1 October — which means harassment-related claims, like every other claim, now have twice as long to surface. Good records and early, documented responses are worth more than ever. The full sequence of what hits when is in our master checklist.