From 30 October 2026, a customer who racially abuses a member of your bar staff stops being an unpleasant entry in the shift log and becomes your legal problem. Section 21 of the Employment Rights Act 2025 makes an employer liable where a third party harasses one of its employees in the course of employment and the employer failed to take all reasonable steps to prevent it. The same date lifts the existing preventative duty on sexual harassment from reasonable steps to all reasonable steps. Most staff handbooks were written for a world where harassment came from inside the organisation. Third-party harassment is a different risk with different controls, and the policy sitting in your handbook almost certainly does not address it. This guide covers what changes, what the statutory wording actually demands, and which sections need rewriting.
What third-party harassment covers under the new duty
A third party, in the words of the new provision, is anyone other than the employer or one of the employer's own employees. That sweeps in customers, clients, patients, pupils and parents, suppliers, delivery drivers, contractors on site, tenants, and members of the public who walk through the door. It also catches the people at the other end of a phone line or a support inbox, because the test turns on whether the harassment happened in the course of the employee's employment rather than on where the harasser was standing.
The conduct itself is defined exactly as it always has been under the Equality Act 2010. Harassment means unwanted conduct related to a protected characteristic which has the purpose or effect of violating someone's dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment. That covers race, disability, sex, religion or belief, age, sexual orientation and gender reassignment, alongside conduct of a sexual nature. The new liability is not confined to sexual harassment, which is the assumption most employers are working under and the one that will cost them.
Two features of the drafting matter more than anything else. There is no requirement that the employer knew of previous incidents, so a single episode is enough. And the government declined to include any carve-out for opinions expressed in conversations the employee merely overheard, despite being pressed on the point during the Bill's passage. A first offence by a customer nobody had complained about before can now found a claim.
The legal framework behind the 30 October 2026 changes
The Employment Rights Act 2025 received Royal Assent on 18 December 2025 and is being commenced in tranches. Section 20 makes a one word amendment to section 40A of the Equality Act 2010, inserting "all" before "reasonable steps" in the preventative duty that has applied to sexual harassment since 26 October 2024 under the Worker Protection (Amendment of Equality Act 2010) Act 2023. Section 21 inserts new subsections into section 40 of the Equality Act 2010, providing that an employer must not permit a third party to harass its employee, and that the employer permits it only where the harassment occurred in the course of employment and the employer failed to take all reasonable steps to prevent it. Section 22 adds a power for ministers to make regulations specifying which steps count as reasonable, and that power sits in the 2027 tranche rather than this one.
Employers should read "employee" broadly here. The Equality Act 2010 uses a wider definition than the Employment Rights Act 1996, covering anyone working under a contract personally to do work, so workers and apprentices are inside the protection even though they sit outside some other statutory rights.
This is also where an important asymmetry lives. The preventative duty in section 40A is not directly actionable by an individual. It is enforced by the Equality and Human Rights Commission, and section 124A of the Equality Act 2010 allows a tribunal to increase compensation in a successful sexual harassment claim by up to 25 per cent where the duty has been breached. The new third-party provision works differently: it creates a route for the employee to claim against the employer for the third party's conduct. Compensation for discriminatory harassment is uncapped and includes injury to feelings. Around the same time, the time limit for bringing most tribunal claims is scheduled to rise from three months to six months, doubling the window in which complaints can surface. The Department for Business and Trade timeline for implementing the Employment Rights Act records the commencement dates, which take effect through commencement regulations and have already moved once.
What "all reasonable steps" actually demands
The phrase is not new. It mirrors the employer's defence in section 109(4) of the Equality Act 2010, and tribunals have been interpreting it for years. The bar is that there was nothing further the employer could reasonably have been expected to do, which is a different question from whether the employer did something sensible. Allay (UK) Ltd v Gehlen [2021] UKEAT/0031/20 is the case employers should read before touching their handbook. Training had been delivered, but it was brief and had faded from memory by the time the harassment happened, and the defence failed. Stale training is treated as no training.
Applied to third parties, the practical content shifts. You cannot discipline a customer, so the reasonable steps are different in kind: risk assessing which roles carry public contact and what exposure comes with it, posting visible statements about acceptable behaviour towards staff, briefing managers on when to intervene or remove someone from a shift, writing behaviour standards into supplier and contractor terms, and recording incidents so that patterns become visible. The EHRC technical guidance on sexual harassment and harassment at work, together with its eight-step guide, remains the most useful benchmark until the regulations under the new power arrive.
One caution worth stating plainly. The steps an employer can take against a third party are more limited than those it can take against its own staff, and tribunals are expected to recognise that. Nobody has to guarantee that harassment never occurs. What will sink an employer is having done nothing specific about third parties at all, because a generic anti-harassment paragraph aimed at colleagues does not evidence any consideration of customer or client risk.
Rewriting the handbook: the sections that actually change
Start with scope. Most anti-harassment policies open by saying the organisation will not tolerate harassment between colleagues, and stop there. That opening now needs to name third parties expressly and define them, because the definition in the amended statute is wider than most managers assume. A staff handbook drafted to the ACAS Code and the Equality Act 2010 gives you the structure to slot this in without rewriting the whole document.
Reporting comes next, and it is the section where handbooks fail hardest. If the only reporting route runs through the line manager, a worker being harassed by a client the manager is trying to keep will not use it. Add an alternative route, say how quickly reports are acknowledged, and commit to recording every report whether or not the employee wants action taken. That record is your evidence later. Pair it with a written grievance procedure and matching response letters so that a complaint about a customer follows the same disciplined process as a complaint about a colleague.
Then the response section, which most handbooks skip entirely. Set out what a manager is authorised to do in the moment: warn the individual, end the interaction, ask them to leave, refuse further service, escalate to security, call the police. Managers who do not know they have authority to remove a customer will not remove one. Where the harasser turns out to be a colleague rather than an outsider, the disciplinary procedure and warning letter pack provides the fair process a tribunal expects to see.
Finally, look outside the handbook. Behaviour standards belong in your commercial documents too, and the contractor agreement governing suppliers working on your site is the natural place to state what happens when a contractor's operative harasses your staff. Where an employee asks to change duties or shift patterns to avoid a repeat, handle it through a statutory flexible working request so the adjustment is documented rather than informal.
Producing the documents with Captain.Legal
Captain.Legal builds UK employment documents through a guided questionnaire rather than a blank template, and the wording is drafted for England and Wales with the relevant statutory references built in. For a handbook, you work through the organisation's details, headcount, sector and working patterns, then select the policy modules you need, including anti-harassment, grievance, disciplinary, absence, equal opportunities and data protection. The output arrives as a complete document with consistent cross-references rather than a stack of policies that contradict one another.
The grievance and disciplinary packs work the same way, generating the procedure alongside the letters that go with it: acknowledgement, invitation to meeting, right to be accompanied under section 10 of the Employment Relations Act 1999, outcome and appeal. Following the ACAS Code matters financially as well as procedurally, since section 207A of the Trade Union and Labour Relations (Consolidation) Act 1992 lets a tribunal adjust compensation by up to 25 per cent where a party unreasonably failed to follow it.
Everything downloads in both Word and PDF. Take the Word version, because handbooks always need local detail that no template can anticipate, whether that is a site layout, a shift pattern or a named escalation contact. Circulate the PDF and keep a dated record of who received it, since acknowledgement of receipt is part of what turns a policy into a reasonable step.
Mistakes employers are making ahead of the deadline
The most common is treating this as a sexual harassment issue. The preventative duty in section 40A is confined to sexual harassment, but the new third-party liability is not, and a policy that only names sexual harassment leaves race, disability and religion or belief unaddressed. The second is relying on a policy alone. A document nobody has been trained on, sitting on an intranet page last opened two years ago, is the exact fact pattern that lost Allay. The third is failing to risk assess. The EHRC has been clear that a risk assessment is expected, and an employer who cannot show it identified which roles carry public contact will struggle to argue it took all reasonable steps in relation to those roles.
The fourth is silent record keeping. Incidents get handled verbally, the shift moves on, and nothing is written down, so when a claim arrives there is no evidence of any response and no pattern the employer could have acted on. The fifth is assuming small employers are outside the scope. Size affects what is reasonable, not whether the duty applies, and a five person café with a difficult regular is squarely within it. Waiting for the regulations that will define "reasonable" steps is not a strategy either, since the timeline places those in 2027, well after the duty itself takes effect.
Frequently asked questions
What counts as third-party harassment at work?
It is unwanted conduct related to a protected characteristic, directed at your employee by someone who neither works for you nor is your agent, occurring in the course of that employee's employment. A customer making racist remarks to a shop assistant, a client repeatedly commenting on a consultant's body, a patient using homophobic language towards a nurse, a contractor mocking a colleague's disability on site: all of these fall within the amended section 40 of the Equality Act 2010. The location does not have to be your premises. Harassment during a client meeting, at a trade show, on a delivery round or over the phone is still in the course of employment.
Does the new duty cover all protected characteristics or only sexual harassment?
Both duties change on the same date but they have different scopes, and confusing them is the mistake to avoid. The strengthened preventative duty in section 40A applies to sexual harassment only, and the change there is from reasonable steps to all reasonable steps. The new third-party liability inserted into section 40 applies to harassment related to any relevant protected characteristic, which means race, disability, sex, age, religion or belief, sexual orientation and gender reassignment, as well as conduct of a sexual nature. A handbook that addresses only sexual harassment covers roughly one strand of the exposure.
Can an employee bring a tribunal claim if a customer harasses them?
Once the provision is in force, yes, against the employer. That is the substantive change. The previous third-party provisions in the Equality Act 2010 were repealed in 2013 and required the employer to have known of at least two earlier incidents, which made claims almost impossible to run. The new wording drops that requirement entirely, so a single incident is enough where the employer failed to take all reasonable steps to prevent it. The claim is against the employer, not the customer, and compensation for discriminatory harassment is uncapped and includes an award for injury to feelings.
How long does an employee have to bring a harassment claim?
The current limit is three months less one day from the act complained of, extended by the ACAS early conciliation period, and the Employment Rights Act 2025 raises it to six months for most claims from around the same point in autumn 2026 that the harassment duties commence. Where harassment forms a continuing course of conduct, time runs from the last incident rather than the first, which can pull much older events into a claim. For employers the practical effect is a longer tail of exposure, so incident records need to be kept and retrievable for considerably longer than a single leave year.
Can we still use confidentiality clauses when settling a harassment complaint?
For now, yes, subject to the usual limits: no clause can prevent a protected disclosure, a report to the police or a regulator, or the giving of evidence. That position is changing. The Employment Rights Act 2025 contains provision for regulations preventing the misuse of confidentiality agreements in cases of workplace harassment or discrimination, and the government's timeline places those regulations in 2027. Any confidentiality agreement drafted now should carry explicit carve-outs, both because it is good practice and because a clause that reads as a gag will not survive the coming rules.
Can we edit the handbook and download it in Word and PDF?
Yes, both formats come with every document. Word is the one that matters for a handbook, because the policy needs your site names, your escalation contacts, your shift arrangements and your sector detail written in. The PDF is what you circulate and archive. Keep the dated version you issued, along with a record of who acknowledged it, because when a tribunal asks what steps you took, the answer needs a document and a distribution record behind it rather than an assertion.
Is having a policy enough to satisfy the duty?
No, and that has been the position since the preventative duty first arrived. A policy is the starting point, not the answer. What tribunals look for is whether it was communicated, whether staff and managers were trained on it recently enough for the training to have any effect, whether a risk assessment identified the exposures particular to your operation, whether reports were recorded and acted on, and whether the employer reviewed its approach after incidents. Allay (UK) Ltd v Gehlen is the illustration: a policy existed, training had happened, and the defence still failed because both had gone stale.