Background

On 30 October 2026, two important changes to the Equality Act 2010 come into force. They are made by sections 20 and 21 of the Employment Rights Act 2025, and they were brought into force by the Employment Rights Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026.

1. The existing duty on employers to take “reasonable steps” to prevent sexual harassment of their employees becomes a duty to take “all reasonable steps”.
2. Employers will be liable if they “permit” a third party, such as a customer, client, contractor or member of the public, to harass their employees.

These changes arrive just weeks after another one. Since 1 October 2026, the time limit for bringing most employment tribunal claims, including harassment claims, has doubled from three months to six months. Taken together, these changes widen the range of people whose conduct an employer can be held responsible for and lengthen the time in which a claim can be brought.

“All reasonable steps”

Section 40A(1) of the Equality Act 2010 will read (with our bold emphasis):

“An employer (A) must take all reasonable steps to prevent sexual harassment of employees of A in the course of their employment.”

One word may not seem much. However, the phrase “all reasonable steps” is well known to employment lawyers. It is the same test an employer must meet to defend itself when one of its employees harasses another (section 109(4) of the Equality Act 2010). In that context, tribunals have set the bar high. In Canniffe v East Riding of Yorkshire Council [2000] IRLR 555 the Employment Appeal Tribunal said that a tribunal should identify what steps the employer took, and then consider whether there were further steps it could reasonably have taken. In Allay (UK) Ltd v Gehlen [2021] ICR 645 the Employment Appeal Tribunal held that harassment training which had become “stale” was not enough, even though training had been given.

In practical terms, once a tribunal has identified a reasonable step that the employer did not take, the employer is likely to have breached the duty.

The Act also gives the government power to set out in regulations what counts as a “reasonable step”. These may include carrying out assessments, publishing plans or policies, and taking steps on reporting and complaint handling. No such regulations have been made yet.

Harassment by third parties

In summary:

• an employer must not permit a third party to harass one of its employees;
• an employer is only treated as permitting the harassment if: (a) it happens in the course of the employee’s employment, and (b) the employer failed to take all reasonable steps to prevent it; and
• a “third party” is anyone other than the employer or one of the employer’s own employees.

Readers with long memories will recall that third-party harassment was briefly part of the Equality Act before. It required the employer to know that the employee had been harassed by a third party on at least two previous occasions (the so-called “three strikes” rule). It was repealed in October 2013. The new version has no “three strikes” requirement. A single incident can be enough if the employer has not taken all reasonable steps to prevent it.

It is also important to note that the third-party duty is not limited to sexual harassment. It applies to harassment related to any of the relevant protected characteristics, such as race, disability, religion or belief, sex, sexual orientation or age, as well as sexual harassment and gender reassignment. Marriage/civil partnership and pregnancy or maternity are not covered. Employers should also be aware that, because there is no carve-out for overheard conversations or expressions of opinion on political, moral, religious or social matters, such remarks by customers, clients or other third parties could in principle amount to harassment. The employer’s defence would then turn on whether it took all reasonable steps to prevent them, assessed with regard to the third party’s Article 10 ECHR rights.

Reflections on what this means for labour supply chains

Many of our readers supply, or engage, workers through a chain: an agency, an umbrella company or a payroll provider at one end and an end hirer at the other. The new third-party duty raises a point that we expect will need careful thought.

For these purposes “employee” is defined widely in the Equality Act 2010. It includes anyone working under a contract personally to do work, so it will often include workers as well as employees in the traditional sense. Where a worker is employed by an agency or umbrella company and placed with an end hirer, the end hirer’s staff, its customers and its other contractors are not employees of the agency or umbrella company. On our reading of the new provisions, they are therefore “third parties” from the employing business’s point of view. That has two consequences:

• The employing business (agency, umbrella or payroll provider) may be liable if a placed worker is harassed at the end hirer’s site and it has not taken all reasonable steps to prevent it. The difficulty is that many of the practical steps that could be taken, such as supervision, the working environment and how complaints are dealt with on the ground, are in the end hirer’s hands.
• The end hirer already has its own obligations under the Equality Act towards contract workers supplied to it. It is also likely to find that agencies and umbrella companies want contractual assurances about the steps it takes to protect placed workers.

As with the other supply chain risks we have reported on this year, it is no longer safe to assume that someone else in the chain has it covered!

Six months to bring a claim

From 1 October 2026, the time limit for bringing most employment tribunal claims increased from three months to six months. This includes discrimination and harassment claims. This includes discrimination and harassment claims. The new limit applies only where the “relevant date” falls on or after 1 October 2026. For discrimination and harassment claims, that is the date of the act complained about; where there is conduct extending over a period, the end of that period; or, for a failure to do something, the date on which the person decided on it. Claims where the relevant date falls before 1 October 2026 remain subject to the three-month limit. The tribunal’s power to extend time, where it is just and equitable to do so, is unaffected, and ACAS early conciliation remains mandatory and continues to extend time.

The clock still stops while the parties are in ACAS early conciliation, which can be up to 12 weeks. This means that a claim arising from a single incident at a client’s premises could be brought many months after the event. To illustrate the distance, a person allegedly harassed on 15^th October 2026 could have a final submission deadline of 7^th August 2027. By then, witnesses may have moved on, the placement may have ended, and the relevant emails may no longer be easy to find.

Harassment claims often turn on what the employer knew, when it knew it and what it did about it. Under the new rules, an employer will also need to show what it did beforehand to prevent the harassment. Good, contemporaneous records are therefore more important than ever.

Practical steps before 30 October

There is no single checklist that guarantees compliance. What counts as “all reasonable steps” will depend on the size and resources of the business and the risks its workforce faces. However, we would suggest employers consider the following:

• Revisit your risk assessment. Does it cover contact with customers, clients, members of the public and, for those in a labour supply chain, end hirer sites? Does it cover all forms of harassment, not only sexual harassment?
• Update your policies. Make it clear that harassment by third parties is covered, how it can be reported and what the business will do about it.
• Refresh training. Training that was delivered once and then forgotten is unlikely to be enough.
• Check your contracts. Agencies and umbrella companies should review their terms with end hirers. These should cover reporting of incidents, co-operation with investigations and the steps the end hirer will take to protect placed workers. End hirers should expect to be asked about this.
• Act on complaints, and record what you do. Keep a clear record of the steps taken before and after any incident. Make sure records are kept for long enough to cover the longer six-month time limit and the conciliation period, in line with your data protection obligations.
• Review regularly. Treat the duty as an ongoing obligation, not a one-off exercise.

What we can do for you

We can review your harassment policies and risk assessments, deliver training to managers and staff, and review the contractual terms in your labour supply chain so that responsibilities for preventing harassment are clearly allocated. To discuss your business’s position, please get in touch.

—————————————————————————————–
The changes described above apply in England, Wales and Scotland. Northern Ireland has its own equality legislation and is not covered by the Equality Act 2010, so different rules apply there.

This newsletter is for general information only and does not constitute legal advice. The law is stated as at 15 October 2026, and some of the changes described are newly in force or yet to come into force. Specific advice should be sought for any particular situation.