From 30 October 2026, employers will be directly liable if an employee is harassed by a third party, and the employer has not taken all reasonable steps to prevent it. The duty covers harassment related to age, disability, gender reassignment, race, religion, sex, sexual orientation and sexual harassment.

This must happen “in the course of employment”.

If a tribunal can identify even one reasonable step that was not taken, the employer may be liable, even if that step would not have prevented the incident in question.

Dealing with a complaint after the event will not be enough on its own, as the duty is about prevention. The starting point is a risk assessment aimed specifically at third parties and your harassment policy should be updated to deal expressly with third parties and third parties should also be told what is expected from them.

When something does happen, take every report seriously, act promptly and keep a dated record of risk assessment, incidents and training. If you have not yet started, as a minimum before 30 October you should appoint someone to lead on compliance, review your highest-risk roles, tell staff how to report concerns, and brief the team on handling complaints about customers.