The ‘All Reasonable Steps’ Deadline: What UK Employers Must Do Before October 2026

Sexual harassment law has moved fast in Great Britain over the past two years, and it’s about to move again. From 1 October 2026, the standard employers are held to jumps from “reasonable steps” to “all reasonable steps” — a meaningfully higher bar, with a new category of liability alongside it.

A quick recap of where things stand

Since October 2024, the Worker Protection Act 2023 has required employers to take reasonable steps to prevent sexual harassment — a proactive duty, not just a defence to raise after a complaint. The Employment Rights Act 2025 now builds directly on that foundation, and by 2027 the full framework will be in force. Two changes matter most for UK SMEs right now:

• From 1 October 2026, the duty rises from “reasonable steps” to “all reasonable steps.” This is a harder standard to meet: it’s not enough to show you did something — a tribunal will ask whether there were further steps you could reasonably have taken, and if so, why you didn’t take them.
• From the same date, employers face explicit liability for third-party harassment — by clients, customers, suppliers, contractors, or members of the public — where the employer failed to take all reasonable steps to prevent it. This applies to unlawful harassment broadly, not just sexual harassment.

There’s also a quieter change already in effect: since 6 April 2026, sexual harassment disclosures can qualify for whistleblowing protection, meaning a poorly handled harassment complaint can now create overlapping harassment, victimisation, and whistleblowing risk at once.

Why “reasonable steps” isn’t enough anymore

Under the current standard, an employer can often point to some preventive measures and argue that was reasonable. Under “all reasonable steps,” the question gets more exacting: were there further, practical steps available that weren’t taken? A tribunal or the Equality and Human Rights Commission will look for evidence of a genuinely risk-based approach — not just a policy that exists, but one that’s been assessed, communicated, trained on, and reviewed.

Practical steps to take before October

1. Run (or refresh) a sexual harassment risk assessment. Look specifically at higher-risk situations: work socials, business travel, lone working, customer-facing roles, and senior-junior dynamics.
2. Review your harassment policy. It should cover third-party harassment, online and out-of-hours conduct connected to work, and make clear that victimisation won’t be tolerated.
3. Update whistleblowing procedures to reflect that harassment disclosures can now count as protected disclosures.
4. Train everyone — and train managers separately. General staff need to understand what harassment is and how to report it. Managers need specific training on handling disclosures, escalating concerns, and running fair investigations without inadvertently making things worse.
5. Make reporting routes genuinely accessible. Staff shouldn’t be limited to reporting only to a line manager, particularly where that manager might be involved or too close to the issue.
6. Put third-party controls in place where relevant — supplier codes of conduct, visitor rules, clear escalation authority for managers dealing with a difficult client or customer.
7. Keep an evidence trail. Risk assessments, policy updates, training records, and review notes all matter if your approach is ever challenged.

Where training software fits in

A generic annual harassment training session, delivered once and forgotten, is unlikely to satisfy the “all reasonable steps” standard on its own. E-learning — structured online training that’s tracked, dated, and can be tailored by role — gives you the evidence trail this standard specifically asks for: who was trained, when, on what, and whether managers received the additional training they need for handling disclosures and investigations. It also makes it far easier to refresh training when the law changes again, which — based on the pace of the last two years — it likely will.

FAQs

Does this apply to businesses in Northern Ireland?

No. The Employment Rights Act 2025 harassment provisions apply to Great Britain (England, Wales and Scotland) only. Northern Ireland operates under separate legislation, though many of the same practical measures — policies, training, clear reporting routes — remain sensible there too.

Is the Worker Protection Act 2023 still relevant?

Yes, technically it’s still the legal basis for the current “reasonable steps” duty. In practice, though, employers should now be preparing for the higher Employment Rights Act standard rather than treating the Worker Protection Act as the finish line.

What’s the single most important thing to get right first?

A proper, documented risk assessment. Without it, there’s no evidence base for arguing you identified and addressed the risks specific to your business — which is exactly what “all reasonable steps” will be judged against.