On 30 October 2026, “reasonable steps” became “all reasonable steps”. It’s only one extra word, but for most small businesses it opens a very large gap, and sexual harassment training sits right in the middle of it.
Picture Sarah. She runs a 25-person events company. At a drinks reception, a long-standing client makes an innuendo to one of her team. It lands about as well as you’d expect.
Until 30 October, that was largely the client’s problem. Now, under the Employment Rights Act 2025, Sarah can be liable when her staff are harassed by a client, customer or supplier. Her only defence is to show she took all reasonable steps to prevent it.
Her policy dates from 2019. Her training plan is “everyone knows how to behave”. A tribunal will want to see a lot more than that.
The short answer: since 30 October 2026, employers must take all reasonable steps to prevent sexual harassment, and they can be liable for harassment by third parties such as clients. Training that every employee has completed, with a record to prove it, is one of the clearest steps you can show.
What has changed in sexual harassment law?
Employers have been under a legal duty to take reasonable steps to prevent sexual harassment since October 2024. The Employment Rights Act 2025 strengthened that duty from 30 October 2026. Three things matter most:
1. “Reasonable steps” is now “all reasonable steps”. You have to prevent harassment before it happens. Dealing with a complaint well afterwards isn’t enough on its own.
2. You’re responsible for third parties. If a client, customer, supplier or member of the public harasses your staff, you can be liable unless you took all reasonable steps to prevent it. This covers harassment related to other protected characteristics, such as race or age, as well as sexual harassment.
3. Getting it wrong costs more. Where an employer has breached the duty to prevent sexual harassment, a tribunal can increase compensation by up to 25%. That's on top of the award itself.
This applies to every employer in England, Scotland and Wales, whatever its size. “We’ve never had a problem” isn’t a defence.
What do “all reasonable steps” look like for a small business?
Most of our clients are small businesses without an HR team, so here’s what a sensible defence looks like in practice:
1. An up-to-date policy. It should name third parties, cover online and out-of-hours behaviour, and set out how to report a concern.
2. A risk assessment. Where are your people exposed? Think about client sites, events, lone working, late shifts and team chats.
3. Clear ways to report. People need more than one route, so they're never forced to go through the person involved.
4. Training that everyone has completed, with records to prove it. That includes managers, part-timers and the night shift.
5. A line you hold with clients. For example: “We expect everyone who works with our team to treat them with respect. Where that doesn’t happen, we’ll step in.” Put it in your terms of business or your welcome pack for client events.
Training is usually the gap. Few SMEs have the time or the in-house expertise to write and deliver it themselves.
If you’re the HR person: the course you meant to write
You knew 30 October was coming. It was on the list, somewhere between the grievance that won’t end and the policy review you started in spring.
Now your MD is asking whether “we’ve done the training”, and you’d quite like the answer to be yes.
Writing a course from scratch means researching the changes, building the content, getting it checked and getting it in front of everyone. That includes the night shift and the people who are never at their desks.
Or you could skip straight to the end.
What we see in practice
The incidents that end up at tribunal rarely happen in the office at 10am. They happen at the Christmas party, in the WhatsApp group, on a client site and in the bar after the conference. Employees often don’t realise these count as “work”. Good training spends most of its time there.
Sexual harassment training your whole team can watch today
Our recorded Sexual Harassment Prevention session was written by CIPD-qualified HR consultants. It’s built for every employee, not just managers.
• Covers the new law in plain English, including third-party harassment
• Shows what harassment looks like in person and online, and where the line sits between banter and harassment
• Four realistic scenarios, from a team group chat to a client site visit and drinks after a conference
• Five safe ways to step in for bystanders, and how to report a concern
• Around 30 minutes, self-paced. Staff watch whenever it suits them and can pause at any point
• No limit on licences, so you can roll it out across your whole organisation (and, for HR consultants, to your own clients)
It’s normally £199. For a limited time it’s £179. Buy now and use it any time.
If you’d like help with your policy or risk assessment as well, we support businesses across Hampshire, West Sussex and the UK. Get in touch for a no-obligation chat.
Frequently asked questions
Is sexual harassment training a legal requirement? No law says “you must train” in those words. But employers must take all reasonable steps to prevent sexual harassment, and it’s hard to show you’ve done that if your staff haven’t been trained. In practice, training with completion records is one of the first things a tribunal will look for.
Does the new duty apply to small businesses? Yes. It applies to every employer in England, Scotland and Wales, whatever its size. What counts as “reasonable” can depend on your size and resources. But “all reasonable steps” still means doing everything that’s reasonable for you, not just the minimum.
Am I really responsible if a client harasses my staff? You can be. Since 30 October 2026, employers can be liable for harassment of their employees by third parties such as clients, customers and suppliers. Your defence is to show you took all reasonable steps to prevent it, so think about how your policy, training and client terms deal with third parties.
Who should do the training? Everyone, not just managers. Colleagues are usually the first to see harassment happen, and they need to know how to step in safely and how to report it. Managers also need to know how to respond when someone raises a concern with them.
How often should we repeat it? There’s no fixed rule. Many employers refresh training every year or two, and give it to new starters as part of their induction. Repeat it sooner if the law changes, if you have an incident, or if your risk assessment shows a new risk.
For a limited time it’s £179. Buy now and use it any time.
