Employment Rights Act 2025: October 2026 Harassment Changes

UK employment law is changing in October 2026, and the majority of employers have not yet started preparing.

The Employment Rights Act 2025 became law on 18 December 2025 and its terms are coming into force in phases across 2026 and 2027. Employers will need to review their existing contracts, policies and procedures to ensure they comply with the new Act before the relevant requirements come into force.

The change coming in October 2026 is not a minor technical adjustment. For any business with employees who interact with colleagues, clients, customers, or the public, it represents a fundamental shift in legal responsibility - and in what your training programme must demonstrate.

What is changing in October 2026?

The current law, in force since October 2024, requires employers to take "reasonable steps" to prevent sexual harassment in the workplace.

From October 2026, that standard rises from taking reasonable steps to taking all reasonable steps - a deliberate uplift in the bar that affects how tribunals will assess employer conduct.

One word. Significant legal difference.

If challenged by a tribunal, an employer would need to demonstrate that there were genuinely no further steps it could reasonably have taken to prevent the sexual harassment from happening.

That is a meaningfully higher standard than the current one. Under the existing duty, an annual eLearning module and a signed policy acknowledgement has been enough for many employers to satisfy the requirement. From October 2026, tribunals are likely to scrutinise not just whether policies and procedures exist, but how they are implemented, and the frequency and quality of training.

What else changes at the same time?

October 2026 brings two significant changes, not one.

From October 2026, employers will be liable for harassment from third parties, for example customers or clients, unless they have taken all reasonable steps to prevent it happening. This will apply to all types of harassment, not just sexual harassment.

This is a substantial expansion of employer liability. These protections apply across all protected characteristics under the Equality Act 2010, not just sexual harassment, and are intended to improve safety in customer and client-facing environments.

For businesses in retail, hospitality, healthcare, security, transport, and care - where staff regularly interact with members of the public - this creates new risk that did not previously exist as an actionable claim.

What does "all reasonable steps" actually mean?

The full definition will be set out in secondary regulations, which are due following public consultation in 2027. Until then, employers can refer to the existing non-statutory guidance provided by the EHRC in its technical guidance and the Employer Eight-Step Guide: Preventing Sexual Harassment at Work.

The government has indicated that it expects "all reasonable steps" to include conducting risk assessments, publishing clear and accessible policies, maintaining robust reporting lines and complaints procedures.

What constitutes "all reasonable steps" will depend on the specific circumstances of the employer, such as their size, sector, working environment, resources and other relevant facts.

In practical terms, the EHRC's eight-step guide sets out what employers should have in place. Those eight steps are:

1. Develop an effective anti-harassment policy

2. Engage with staff to assess the risk of harassment

3. Carry out a risk assessment specific to your workplace

4. Take action to reduce the risk identified

5. Report and respond to harassment effectively

6. Train staff at all levels, including managers

7. Communicate your commitment to preventing harassment

8. Monitor and evaluate the steps you have taken regularly

Step 6, training, is the one most employers currently treat as a box-ticking exercise. Under the October 2026 standard, that approach carries serious risk.

Why an annual eLearning module is no longer enough

Legal experts advising on the Act are explicit that this shift requires a fundamental redesign of compliance training, not just an annual eLearning module refresh. The focus shifts from information delivery to behaviour change.

The distinction matters. An annual awareness module tells staff what harassment is and asks them to confirm they have read a policy. It does not demonstrate that an employer has taken all reasonable steps to prevent harassment from occurring.

Training is a crucial cornerstone to ensure legal compliance, and it should be carried out regularly, be engaging, and show practical examples rather than just theoretical statements.

Scenario-based training - where staff work through realistic situations and decide how to respond - is what tribunals and the EHRC are increasingly expecting to see. The difference between a business that passes an investigation and one that does not will often come down to the quality, frequency, and specificity of its training records.

What are the consequences of non-compliance?

Employment tribunals can increase compensation awards by up to 25% where an employer has failed to take reasonable steps to prevent harassment, and the Equality and Human Rights Commission can enforce the duty directly, even before an incident has occurred.

In 2025, Lidl GB entered a legally binding agreement with the EHRC after a tribunal found it had failed to protect an employee from harassment. Managers were unaware of anti-harassment policies, no risk assessments had been done, and action was only taken once complaints were made.

That case is an illustration of exactly what October 2026 is designed to prevent. Under the new standard, waiting for a complaint before acting will not satisfy the duty.

There is no cap on compensation awards for discriminatory harassment. A 25% uplift on an uncapped award is a significant financial exposure for any employer.

Which sectors face the highest risk?

Every UK employer with staff is affected. However, certain sectors face heightened exposure because of the nature of their working environment:

Retail and hospitality - frequent public-facing interaction with customers and clients increases third-party harassment risk significantly.

Healthcare and social care - patient and service user contact introduces third-party liability, while power dynamics within care settings create additional risk.

Construction - multiple employers operating simultaneously on a single site means each employer is independently responsible for taking all reasonable steps to prevent harassment of its own workers, even when the harasser may be employed by a different firm on the same site.

Security and transport - lone working and public-facing roles create environments where harassment risk is elevated and harder to monitor.

Education - staff interactions with students, parents, and external visitors all fall within the scope of the third-party duty.

What should employers do now?

October 2026 is five months away. Given the significance of the changes ahead, businesses should begin preparing now in advance of implementation.

The practical steps to take before October are:

Review your current training programme. If your organisation's harassment training consists of an annual eLearning module and a policy sign-off, it will not satisfy the "all reasonable steps" standard. Identify whether your training is scenario-based, role-specific, and delivered at all levels including management.

Carry out a harassment risk assessment. A documented sexual harassment risk assessment is the foundation of the defence. An employer that has not assessed the risks specific to its workplace will struggle to show compliance, regardless of what other steps it has taken.

Update your policies to cover third-party harassment. From October 2026, your anti-harassment policy must address harassment by clients, customers, contractors, and members of the public, not just by colleagues.

Keep auditable records. Maintaining clear, auditable records of risk assessments, training attendance, actions taken in response to concerns, and reviews of the effectiveness of preventative measures will be essential in demonstrating compliance with the heightened preventative duty from October 2026.

Train managers specifically. The EHRC guidance is clear that training should cover all levels of seniority. Managers who are unaware of anti-harassment policies is one of the most common reasons employers fail enforcement investigations.

How Circle Academy can help

Circle Academy offers accredited online courses in equality and diversity, harassment awareness, mental health first aid, and inclusive workplace practice - all completable online, with certificates issued the same day.

Our courses are accredited by CPD, IOSH, and IIRSM, and are suitable for staff at all levels, including dedicated manager and supervisor pathways.

With October 2026 five months away, now is the time to review your programme and close any gaps before an inspection or tribunal claim forces the issue.

Not sure whether your current training programme meets the October 2026 standard? Book a free compliance review and we will assess it for you.

Sources: Employment Rights Act 2025 (legislation.gov.uk); ACAS Employment Rights Act 2025 guidance (acas.org.uk); Equality and Human Rights Commission technical guidance on sexual harassment; Mayer Brown, March 2026; Jones Day, February 2026; Pennington Manches Cooper, February 2026; Shoosmiths, March 2026; Linklaters, October 2025; Government factsheet on preventing workplace sexual harassment.

Published May 2026. Circle Academy is a trading name of Circle UK Group Ltd. This article is for information purposes only and does not constitute legal advice.