From 30 October, Your Harassment Duty Covers People You Do Not Employ

Your harassment policy almost certainly covers colleagues. Someone behaves badly, it gets reported, it gets investigated, and there is a disciplinary process at the end of it with real consequences.

Now picture the same complaint where the person who made the remark does not work for you. A customer. A patient. A delivery driver. A client whose account pays several salaries.

Every tool in that process has just disappeared. You cannot investigate them, you cannot discipline them, and in many cases you will never identify them. From 30 October you can still be held liable for what they did.

What actually changes on 30 October

The Employment Rights Act 2025 inserts a new provision into section 40 of the Equality Act 2010. An employer must not permit a third party to harass an employee, and the statute defines permitting narrowly. An employer permits it where the harassment happens in the course of the person's employment and the employer failed to take all reasonable steps to prevent it.

A third party means anyone other than the employer or a fellow employee. Customers, clients, patients, service users, contractors, suppliers, passengers, residents and members of the public all sit inside that definition, as Acas guidance for employers sets out.

Three details in the drafting matter more than the headline. The duty is not confined to sexual harassment, and reaches harassment related to protected characteristics generally. A customer making racist remarks to a member of your team engages it. So does a client mocking someone's disability, or a resident abusing a care worker over their religion. There is no requirement for previous incidents, so a single occasion engages it. And it creates a claim an employee can bring on its own, which is the part that does not exist today.

The harasser is someone you cannot discipline

This is the part that makes third-party harassment awkward in a way colleague harassment is not.

Internal cases follow a path everyone knows. Investigation, findings, sanction. When the person responsible is a customer or a client, the path stops at the first step. There is nobody to interview, no contract to enforce and no disciplinary outcome. The organisation has to control the risk by changing its own arrangements instead, because the only behaviour it can change is its own.

Then there is the commercial pressure sitting underneath it.

A supervisor catches you between meetings. One of her team has been on the receiving end of comments from a client's project manager, the kind that get called banter afterwards. It has happened three times. The third time he put a hand on her back while he said it.

The client is a name on your website. Your supervisor is not asking you to solve it. She is telling you because she does not know whether raising it formally is going to cost the account, and she does not know whether that is hers to decide.

What happens next in your organisation? If the answer depends on which manager she happened to tell, the arrangement is the risk.

Where the risk actually sits

The Equality and Human Rights Commission (EHRC) enforces the Equality Act 2010, and its technical guidance on harassment at work points employers toward a consistent set of conditions where third-party harassment concentrates.

• Customer-facing roles: retail floors, hospitality, reception, healthcare, call centres and anywhere staff cannot walk away from an interaction
• Lone working and home visits: care workers, engineers, delivery drivers and anyone attending a property alone
• Power imbalance: situations where the third party has commercial power over you, including key clients, funders and regulators
• Alcohol: licensed premises, corporate hospitality, client entertaining and staff events
• Unsociable hours: late shifts, night work, opening and closing, and travel involving overnight stays
• Off-site and digital contact: client premises, conferences, networking events, and interactions over messaging platforms and video calls

Sector shapes which of those bite hardest. Retail and hospitality carry frequent customer contact, often with young or temporary staff, late hours and alcohol in the same building. Healthcare and care carry close physical contact, home visits and lone working with patients and their families. Transport carries public-facing roles in remote locations on shift patterns. Construction and multi-site operations carry constant third-party presence by design, with several employers working the same site on the same day.

Every control on that list is an operational decision

Read the risk conditions again and notice what they have in common. Which of them could your HR policy change by itself?

Lone working. Shift patterns. Who covers closing. Whether a home visit is signed off and how contact is maintained during it. Whether the bar at the client event is open all evening. Whether reception has a way to summon help. Whether a supervisor knows she is allowed to escalate a complaint about a contractor without checking the commercial implications first.

Not one of those is a policy question. They are all decisions about how work is arranged, and they sit with operations, site management and the safety function. A policy states the standard. Someone else decides who is on the floor at eleven at night.

That is why the strongest guidance on this treats third-party harassment as an organisational risk rather than an HR matter. HR still owns the policy, the reporting route and the investigation. The conditions that create the exposure are set elsewhere, by people who are used to assessing risk and recording controls.

The same conduct already engages a health and safety duty

These controls belong with the safety function for a second reason, and it predates October by decades. The Health and Safety Executive defines work-related violence as any incident where a person is abused, threatened or assaulted in circumstances relating to their work. That definition covers verbal abuse and threats, face to face, online or by telephone, and HSE names members of the public, customers, patients and service users as sources. The same population the new harassment duty covers.

HSE says plainly that it is not the primary authority for bullying and harassment, which sits with the EHRC. What it does say is that employers have a legal duty to assess the risk of violence and reduce it so far as is reasonably practicable, and that serious or persistent verbal abuse damages a worker's mental health.

So a customer shouting racial abuse at one of your team engages two duties at once. One arrives on 30 October and belongs to the EHRC. The other has been a health and safety obligation for years. The controls are the same either way.

What you have to be able to evidence

Here is the uncomfortable practical position. The government has power to make regulations defining what all reasonable steps means, and none have been made. There is no statutory definition to measure yourself against.

What that means is that tribunals will judge on evidence. How the risk was identified, what was put in place, whether anyone reviewed it, and whether it changed when the circumstances did. The EHRC has been clear in its eight-step guide for employers that an employer is unlikely to demonstrate compliance without a risk assessment, and the government has indicated it expects all reasonable steps to include risk assessments, accessible policies and robust reporting routes.

A one-size-fits-all assessment will not survive that. The expectation is a tailored one, covering roles, sites and working patterns, identifying where the risk arises, who is most exposed, what controls already operate and what else is needed.

Training belongs in that picture as one step. Our training partner The Knights of Safety Academy runs a free course on sexual harassment in the workplace built on a RESPECT framework, covering behavioural expectations, reporting routes, manager escalation, power dynamics and alcohol. A single module completed once will not discharge the duty on its own. Training that is refreshed, targeted at the people who need it and recorded against names is one of the steps a tribunal can actually see.

Where this has to live once it is written

An assessment that sits in a folder proves very little. The duty is anticipatory. A tribunal asks what you knew and acted on before the incident. Anything written afterwards is answering a different question.

There is a fair question about why a company known for chemical compliance is writing about harassment. The answer is that the controls described above are the ones we have always worked with. Lone working, shift arrangements, site access, contractor presence, incident records and review cycles are the substance of workplace risk assessment, whatever the hazard happens to be, and violence and aggression have been assessed that way for decades. A safer workplace means safer chemical handling and better managed buildings. It means work that does not make people ill. It also means people who can do their job without being abused by somebody who walked through the door.

Our risk management module holds the register, tracks controls against named owners and schedules reviews so they happen on time rather than in hindsight. Where the same third party or the same shift keeps appearing in incident and near-miss records, that pattern is visible before it becomes evidence someone else uses. It is the practical end of the Accelerated Compliance approach, taking a team from trained and capable through to genuinely audit-ready.

What arrives on 30 October raises the standard on something employers were already expected to manage. The organisations that struggle will be the ones that kept treating harassment as a document to hold rather than a risk to manage.

Frequently Asked Questions

Does the duty apply if the third party cannot be identified?

Yes. The duty is on the employer to take all reasonable steps to prevent the harassment, and that obligation does not depend on tracing the person responsible. This is a genuine area of uncertainty for situations like an anonymous customer in a shop, and it reinforces why the assessment and the controls matter more than the investigation.

We have never had a complaint. Does that mean we are compliant?

No. The duty is anticipatory, so it asks what you did to prevent harassment rather than how you responded once someone raised it. An absence of complaints can equally mean people do not believe reporting is safe or worth the trouble, which is itself something a risk assessment should be testing for.

Does it only cover sexual harassment?

No. The third-party duty covers harassment related to protected characteristics under the Equality Act 2010. The separate change on the same date, raising the standard from reasonable steps to all reasonable steps, applies specifically to the sexual harassment preventative duty.

Do small employers have to comply?

Yes. What is reasonable is judged against the size, sector and resources of the organisation, so a small employer is not expected to do what a national operator does. Proportionality shapes which steps are expected of you. The duty itself applies either way.

What can a tribunal award?

For claims presented from 6 April 2026, the Presidential Guidance for employment tribunals sets injury to feelings awards at £1,300 to £12,600 for less serious cases, rising to £37,700 to £62,900 for the most serious, with exceptional cases capable of exceeding that. Where a tribunal finds sexual harassment and the employer also breached its preventative duty, compensation can be increased by up to 25%, and serious breaches with aggravating features can attract a further penalty of up to £20,000.

---

The duty arrives on 30 October whether or not anyone has assessed for it. If your register does not yet reach the people who walk through your door, speak to our team.