What if a customer harasses one of your staff? The new harassment duty from 30 October 2026

The short answer. From 30 October 2026, two things change. The duty to prevent sexual harassment of your staff becomes a duty to take all reasonable steps, not just reasonable ones. And you must not permit harassment of your staff by third parties: customers, clients, patients, parents, visitors and suppliers. If a customer harasses someone who works for you and you had not taken all reasonable steps to prevent it, that person can bring a claim against you. For a small team, the steps are not a forty-page manual. They are a short policy, a clear way to report, a quick look at where the risk is, current training and acting every time someone speaks up.

Have you got staff who deal with the public? A receptionist, a carer, someone behind the counter, a driver who goes into people's homes?

Then this one is for you. Most of the conversation about harassment is about colleagues. The part that catches small businesses out is the customer who says something every time he comes in, and everyone has learnt to laugh it off.

What changes on 30 October 2026

Since 26 October 2024, employers have had a duty to take reasonable steps to prevent sexual harassment of their staff. The Employment Rights Act 2025 changes it in two ways, and the government plans to bring both in on 30 October 2026. The regulations that switch them on had not been made when this was written, so check the date before you rely on it:

• All reasonable steps. One word is added to the Equality Act 2010, and it raises the bar. Reasonable steps meant you did a sensible amount. All reasonable steps means that if there was a reasonable step you could have taken and did not, you have not met the duty.
• Harassment by third parties. You must not permit a third party to harass one of your staff. You are only treated as permitting it if it happens in the course of their work and you failed to take all reasonable steps to prevent it. A third party is anyone who is not you or one of your staff.

This second change is the big one. Until now, a member of staff could not bring a claim for harassment by a customer on its own; it could only come up as part of another claim. From 30 October they can, if you did not take all reasonable steps to stop it.

It also goes wider than sexual harassment. It covers harassment related to age, disability, gender reassignment, race, religion or belief, sex or sexual orientation, as well as sexual harassment.

The Act also gives ministers the power to set out in regulations which steps count as reasonable for preventing sexual harassment. None have been made yet, so for now the guide to follow is the one from the Equality and Human Rights Commission.

Who counts as a third party in a small business

It depends on who your staff meet. For most of the businesses I work with, it looks like this:

• in a care business: clients, their families and visitors
• in a day care or a nursery: parents and anyone collecting
• in a clinic or salon: clients, including the regulars
• in a cafe or shop: customers, and the delivery drivers
• for anyone who works in other people's homes or offices: the people who live or work there
• for everyone: suppliers, contractors and people at events your staff attend for work

What "all reasonable steps" looks like for a small team

The law does not list the steps. The Equality and Human Rights Commission has an 8-step guide for employers. It was written for the current duty, and the Commission says it is updating it for the 2026 changes. Here is what it comes down to at 5, 15 or 40 people.

A short policy that covers third parties. One or two pages, in plain English. It says harassment will not be tolerated, gives examples that fit your workplace, explains how to report it and says what you will do when the person doing it is a customer: a warning, a ban, a call to the police where it is a crime. If your current policy only talks about colleagues, it needs a paragraph on third parties before 30 October.

One clear way to report, and a second one. Most people will not report to the person they work next to every day. Give them a named person and an alternative, for example you as the owner, or an external HR contact. Also, keep a confidential record of every concern raised, formal or informal. Patterns only show up when the notes are in one place.

A ten-minute risk check. Sit down with a notepad and ask: who works alone? Who works late, or in someone's home? Who deals with customers who have been drinking? Who has a regular who makes them uncomfortable? Write down what you find and what you will do about it. That note is your risk assessment, and it is one of the first things anyone will ask for.

Training that is current, with a record. Everyone, including managers and you. What harassment looks like and what to do if you see it or it happens to you. For managers, how to handle a report. For customer-facing staff, add what to say to a customer and when to step away. Also, keep the record of who did it and when.

Training ages. Tribunals already use the phrase "all reasonable steps" for a different defence, and in Allay (UK) Ltd v Gehlen the Employment Appeal Tribunal agreed that training which had gone stale did not count as all reasonable steps. So a course someone did three years ago is not enough on its own. Refresh it.

Act on every report, including about customers. Take it seriously the same day. Ask the person what they want to happen. Protect them from the person they have reported, which with a customer can mean someone else serves them, or they are asked to take their business elsewhere. Tell the person what you did. Warning a good customer is uncomfortable. It is still the step.

Look back once a year. What was reported, what you did and whether anything has changed: a new service, a late shift, a new site. A short note of the review is enough.

If someone tells you it has happened

Listen, and write down what they said, with the date. Do not promise to keep it completely secret, because you may need to act, but do tell them who will know and why.

Then make them safe first. Separate them from the person they have named, without moving them anywhere worse. If it could be a crime, ask whether they want to report it to the police and support them if they do. And do not decide what happened in that first conversation. That is what the investigation is for.

Also, since 6 April 2026, reporting sexual harassment can count as whistleblowing, which protects the person from being treated badly or dismissed for it. So treat the report as protected from the moment it is made, and make sure nobody treats them differently for making it.

What happens if the steps are not there

The Equality and Human Rights Commission can take enforcement action against an employer that has not met the duty. Where someone wins a sexual harassment claim and the tribunal finds you did not meet the duty, it can increase their compensation by up to 25%. Compensation for harassment has no cap to begin with.

And from 30 October, harassment by a customer can be a claim in its own right.

The Christmas party

A work party is likely to count as part of work for this. A short note to the team before the party, on expected behaviour and how to raise a concern, can be one of the reasonable steps, and it takes ten minutes to write. If you are also planning cover over the holidays, what if half the team wants the same week off at Christmas? covers the rest.

Where to start this month

1. Read your harassment policy and add a paragraph on customers, clients and visitors if it is not there.
2. Tell everyone who they can report to, and name a second person.
3. Do the ten-minute risk check and keep the note.
4. Book training for the whole team, and keep the record of who did it.
5. Put a date in the diary for next year's review.

None of this is a mountain of process. It is a few documents that get read and a habit of acting when someone speaks up.

If you want it done with you, we run training on preventing sexual harassment, in person or online, and we write the policy to fit your workplace as a single HR document.

What if the regular everyone laughs off is the one thing worth sorting before 30 October?

Send us your what-ifs.

General information for employers in Great Britain, not legal advice and not an exhaustive legal guide. Northern Ireland has its own equality law. Checked against the GOV.UK Employment Rights Act timeline (updated 25 September 2026), the Employment Rights Act 2025 sections 20 to 23 and its commencement regulations on legislation.gov.uk, the Equality and Human Rights Commission's 8-step guide and Acas, on 30 September 2026. The 30 October date is the government's plan and can still move. If you are dealing with a specific situation, speak to an employment solicitor.