Soundbite: Third-party harassment, new duties for employers from October 2026

Third-party harassment, new duties for employers from October 2026

From October 2026, employers will face a significant shift in their responsibilities around harassment in the workplace. The Employment Rights Act 2025 will reintroduce liability for third-party harassment, meaning employers can be held responsible for harassment of their staff by customers, clients, suppliers or other third parties.

This is a notable change which will undoubtedly impact employers. Previous attempts to impose liability were widely seen as ineffective, particularly the old “three strikes” rule, which required repeated incidents before employers were exposed to any risk. The new provisions remove that threshold entirely and instead focus on whether the employer has taken all reasonable steps to prevent harassment.

Under the new law, an employer may be liable where an employee is harassed by a third party in the course of their employment and the employer failed to take all reasonable steps to prevent that harassment. This creates a much more proactive obligation on employers. It is no longer about reacting to repeated incidents, but about anticipating risk and putting appropriate safeguards in place from the outset.

This change is particularly relevant for sectors where staff interact regularly with the public, for example hospitality, retail, healthcare and customer-facing roles more generally. However, the risk is not limited to those sectors, as third-party interactions arise in most workplaces in some form.

The key challenge for employers will be demonstrating that they have taken “all reasonable steps”. This is likely to be scrutinised closely in tribunal claims, and there is a clear expectation that employers will go beyond having a policy on paper.

What should employers be doing now?

Although October may feel some way off, there is a clear expectation that employers will start preparing now. In practical terms, we recommend:

1. Review and update policies

• Ensure your anti-harassment policy expressly covers third-party harassment
• Set out clear expectations of behaviour for customers and third parties
• Include guidance on how employees should report concerns

2. Carry out risk assessments

• Identify roles or environments where employees are more exposed to third parties
• Consider what could reasonably be done to reduce those risks
• Document your assessment and any mitigating steps

3. Refresh training

• Provide training to managers and staff on recognising and responding to third-party harassment
• Ensure managers understand when and how to intervene
• Consider how frequently training should be refreshed

4. Strengthen reporting processes

• Make it easy for employees to raise concerns
• Ensure complaints are taken seriously and handled promptly
• Keep clear records of complaints and action taken

5. Consider your commercial arrangements

• Review contracts with clients, suppliers or contractors
• Consider whether additional protections are needed, such as expectations around behaviour

The reintroduction of third-party harassment liability is likely to increase both risk and scrutiny for employers. The key defence will be whether you can show you have taken all reasonable steps to prevent the behaviour. Employers who take proactive, practical steps now will be in a much stronger position to manage risk and respond effectively if issues arise.

If you would like to discuss the above with us or require our assistance in preparing for the above changes including delivery of in-house workplace training, amending policies or drafting risk assessments, please do get in touch with a member of our team and we would be happy to assist.