From 30 October 2026, government guidance says employers will be required to take all reasonable steps to prevent sexual harassment and will be obliged not to permit harassment of employees by third parties.
For SMEs, the practical preparation is risk assessment, clear reporting routes, manager capability and evidence that prevention is active rather than just written in a policy.
What is changing?
The Worker Protection Act 2023 already introduced a preventative duty in October 2024. The Employment Rights Act 2025 strengthens those protections from 30 October 2026.
The government guidance states that employers will be expected to take all reasonable steps to prevent sexual harassment and will have an obligation concerning third-party harassment, such as harassment by customers or clients.
Policy wording is only one part
A policy is useful, but a policy nobody understands or applies is weak evidence of prevention. Consider the actual risks in the organisation: lone working, alcohol, client entertainment, customer-facing work, travel, messaging apps, remote work and power imbalances.
The steps that are reasonable for a five-person office may differ from those for a hospitality venue, but both should be able to explain what they considered.
Third parties now need more attention
Customer and client behaviour can no longer be treated as something the business simply has to tolerate. Employers should consider how staff report incidents and what managers are authorised to do when a customer crosses the line.
Contracts, site rules, escalation routes and manager training may all form part of a practical response.
Train managers on the first response
The first manager conversation often shapes what happens next. Managers should know how to listen, avoid dismissive comments, record the concern and escalate appropriately.
A poor first response can discourage reporting and make the situation harder to investigate later.
Build evidence of prevention
Keep records of risk assessments, policy reviews, training, communications and actions taken after concerns. The aim is not paperwork for its own sake — it is showing that prevention is embedded in the way the business operates.
Where patterns emerge, change the controls rather than repeating the same intervention.
What to do before 30 October
Review harassment and dignity-at-work wording. Consider third-party risks. Brief managers. Check reporting routes. Review induction and refresher training. Make sure senior leaders understand their role in setting standards.
For customer-facing SMEs, specifically discuss what staff should do if the harasser is commercially important.
The Guardian Forge view
The strongest prevention work happens before a complaint. Directors should be able to explain what risks exist in their environment and what practical steps the business has taken to reduce them.
That is more persuasive than relying on a policy drafted years ago.
Official sources & further reading
Need help applying this to your business?
A Guardian Forge consultation is designed to give you a clearer understanding of where you stand, the practical options available and what action — if any — makes sense for your business.
Check our availability now