All Reasonable Steps to Prevent Sexual Harassment: 10 Questions UK Employers Are Asking

From 30 October 2026, the Employment Rights Act 2025 raises the bar for every UK employer. You must now take all reasonable steps to prevent sexual harassment at work, not just reasonable steps. You can also be liable if you fail to protect staff from harassment by third parties such as customers, clients and contractors.

Below are practical answers to the questions employers are asking most, plus a checklist you can work through this week.

Key terms explained

• The preventative duty: introduced by the Worker Protection Act 2023 from 26 October 2024. Employers must take proactive steps to prevent sexual harassment, rather than only responding after a complaint.
• All reasonable steps: the higher standard that applies from 30 October 2026. Identify every step that would reasonably reduce the risk in your organisation, then take all of them.
• Third-party harassment: harassment of your staff by people who do not work for you, such as customers, clients, patients, suppliers or contractors.

Why this matters

If a tribunal finds an employer breached the preventative duty, it can increase sexual harassment compensation by up to 25%. The Equality and Human Rights Commission (EHRC) can also take enforcement action.

Many employers are not ready. VinciWorks research published in 2026 found that one in five UK managers had received no sexual harassment training.

10 questions UK employers are asking

1. Do we need a separate sexual harassment policy?

Yes, a standalone policy is strongly preferable. A few paragraphs inside a Code of Conduct are unlikely to show the focus the new standard expects.

Your policy should cover:

• What sexual harassment is, with examples
• Harassment by third parties
• How to report a concern
• How complaints are investigated
• Protection from retaliation
• What managers are expected to do
• The consequences of misconduct

2. What should a sexual harassment risk assessment cover?

Think about where harassment could realistically happen in your organisation. Common risk areas include:

• Client-facing and customer-facing roles
• Lone working and night shifts
• Business travel and client entertainment
• Work events, especially where alcohol is involved
• Power imbalances between senior and junior staff

For each risk, record the controls you have in place. Without a documented assessment, it is very hard to show a tribunal that you took all reasonable steps.

3. How often should we review the risk assessment?

Annually as a minimum, and sooner after a complaint, a significant organisational change or a new risk. You do not need to start from scratch each time. Review complaints, informal concerns, exit feedback, staff surveys and whether your controls worked. Then record the date, the evidence considered, what changed and who owns each action.

4. Do employees need to see the risk assessment?

There is no requirement to give every employee the full document. What matters is that staff understand the risks relevant to them, what behaviour is expected, how to report concerns and what will happen next. Good practice is to involve employees or their representatives in the assessment and share the resulting action plan.

5. We are fully remote. What should our risk assessment include?

Focus on work-related interactions rather than the home itself. Risks include:

• Inappropriate messages on Teams, Slack or email
• One-to-one video calls with managers or clients
• Misuse of personal phone numbers or social media
• Work-related visitors, such as an engineer installing company equipment

Also check that remote staff know how to report concerns and that managers can spot problems they cannot see in person.

6. Are agency workers covered by the third-party harassment rules?

The legal position depends on the contractual arrangements, so it is not automatic. In practice, the safest approach is to include agency staff working on your premises in your risk assessment, reporting routes and preventative controls. Leaving them out creates an unnecessary gap.

7. Why do we need more than one reporting route?

Because the person someone would normally report to may be involved, or may be close to the person involved. Offer at least two routes, for example HR, a second manager or an independent whistleblowing channel. Accessible reporting helps concerns surface early and shows your system works.

8. What about work parties and overnight stays?

Treat them as higher-risk and cover them in a specific event risk assessment. Practical steps include:

• Avoiding compulsory room-sharing, and letting staff request separate rooms without embarrassment
• Taking particular care with senior and junior colleagues and with alcohol
• Making clear that workplace conduct standards still apply at the venue and hotel
• Giving staff a way to report a problem out of hours

Harassment can occur between people of any sex, so same-sex room-sharing does not remove the risk.

9. “Banter” is still common despite training. What now?

If behaviour has not changed after training, the issue is culture, not awareness. Use complaints, feedback and your risk assessment to find where it is most entrenched, then add targeted measures:

• Manager-specific training
• Realistic, scenario-based learning
• Bystander intervention training
• Clear, consistently applied consequences

“Nobody has complained” is not evidence that a culture is safe. You need to show your controls are changing behaviour, not just that training was delivered.

10. Staff are tired of repeating the same training. Can we stop?

Do not stop, but do vary it. Use shorter refreshers, new scenarios, role-specific modules and separate manager training based on your risk assessment. Training fatigue carries far less risk than being unable to show that your training was current and appropriate when a complaint arrives.

Your all reasonable steps checklist

• [ ] Standalone sexual harassment policy that covers third parties
• [ ] Documented risk assessment, reviewed at least annually
• [ ] At least two reporting routes, one independent of line management
• [ ] Training for all staff, plus dedicated training for managers on handling disclosures
• [ ] Training records you can produce quickly
• [ ] Risk controls for events, travel and client entertainment
• [ ] Conduct expectations communicated to clients and customers where relevant
• [ ] Action plan shared with staff

How Astute LMS helps you evidence all reasonable steps

Training is only part of the duty, but it is the part tribunals ask for evidence of first. Astute LMS, with VinciWorks course content, helps UK SMEs:

• Assign sexual harassment and bystander training by role
• Give managers separate, scenario-based training on handling disclosures
• Schedule varied refreshers automatically, so training stays current without becoming repetitive
• Produce completion reports in minutes if you ever need to show what you did

PeopleFirstHR Limited helps UK employers set up and support Astute LMS.

Next step

Book a free 30-minute Astute LMS demo and see how quickly you can roll out sexual harassment training and track completion across your workforce.