The 30 October 2026 harassment reforms under the Employment Rights Act reforms have largely been discussed in terms of the new requirement for employers to take all ‘reasonable steps’ to prevent sexual harassment. However this focus risks obscuring another significant change coming into force on the same day.
From 30 October 2026, employers can be liable when an employee is harassed by a third party, such as a customer, client, patient, service user, contractor or member of the public, where the employer failed to take all reasonable steps to prevent it. The Employment Rights Act 2025 inserts this new liability directly into the Equality Act 2010.
The scope of the harassment changes is considerably wider than sexual harassment. It covers the forms of harassment recognised by section 26 of the Equality Act. These are harassment related to age, disability, gender reassignment, race, religion or belief, sex and sexual orientation.
If an employer fails to take all reasonable steps to prevent third-party harassment and an employee is harassed in the course of their work, the employee can bring an Equality Act claim through an employment tribunal. Compensation for discrimination is uncapped and can include financial loss and injury to feelings. Tribunals can also make recommendations requiring the employer to address discriminatory practices, while particularly serious breaches may attract an additional financial penalty of up to £20,000. Where the conduct amounts to sexual harassment, compensation can also be increased by up to 25% if the employer has breached its separate preventative duty.
For more on how to prepare, join our webinar on Are you prepared for third-party harassment? What to do before 30 October
What is third-party harassment?
A third party is essentially someone who is neither the employer nor another employee of that employer. The category can therefore be very broad.
It can include customers in a shop, guests in a hotel, clients dealing with a professional services firm, patients and their relatives in healthcare, students in education, suppliers and contractors, attendees at an event, and members of the public encountered by employees doing their jobs. Third-party harassment can happen online as well as face to face.
The legal change is significant because the current position is much more limited. Since October 2024, employers have had a preventative duty to take reasonable steps to protect workers from sexual harassment, including sexual harassment committed by third parties. However, an employee cannot currently bring a standalone Equality Act claim simply because a customer or other third party sexually harassed them.
From 30 October 2026, the Employment Rights Act changes that position by creating direct employer liability for third-party harassment where the legal test is met. There is also no requirement to wait for several incidents before the new protection applies. The previous third-party harassment regime that existed before 2013 contained what became known as a “three strikes” approach. The new legislation does not. A sufficiently serious single incident can potentially amount to harassment.
What actually counts as harassment?
It’s important to note there is a legal definition of harassment. The Employment Rights Act does not make an employer legally responsible under the Equality Act for every unpleasant interaction an employee has with a member of the public.
For harassment related to a protected characteristic, there must be unwanted conduct related to age, disability, gender reassignment, race, religion or belief, sex or sexual orientation. The conduct must have the purpose or effect of violating the person’s dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment.
Sexual harassment is separately covered and involves unwanted conduct of a sexual nature. It does not need to be connected to the employee’s sex or any other protected characteristic.
The behaviour can include words, jokes, gestures, imagery, mimicry or physical behaviour, and a serious one-off incident can be enough. Intent is relevant to the circumstances, although it is not essential. Conduct can amount to harassment because of its effect even where the person responsible did not intend to harass anyone.
Tribunals do not simply accept that someone felt offended and stop there. They consider the circumstances, the employee’s perception and whether it was reasonable for the conduct to have the effect claimed.
Example: harassment covered by the new law
A customer becomes angry while being served by a Black employee and uses a racial slur towards them. That could clearly amount to unwanted conduct related to race. A single serious incident can be sufficient.
From 30 October, the employer’s exposure would then turn to another question: had it taken all reasonable steps to prevent this kind of harassment?
A retailer with repeated incidents of racial abuse towards employees that has never assessed the risk, trained managers, provided a reporting process or established a system for dealing with abusive customers could find that question difficult to answer.
Example: abuse that may not be Equality Act harassment
A customer is furious about a delayed order and calls an employee a “useless idiot”, swears at them and storms out.
The behaviour is abusive and the employer should take it seriously. If there is no connection with a protected characteristic and nothing sexual about the conduct, it would not ordinarily fall within the Equality Act definition of harassment covered by the new third-party provisions.
“Harassment” is frequently used in workplaces to describe bullying, aggression and abusive behaviour generally. Equality Act harassment has a specific legal meaning. This expressly distinguishes harassment under discrimination law from other forms of bullying. Separate legislation, including the Protection from Harassment Act 1997, can apply to some conduct outside the Equality Act definition.
An employer should therefore avoid concluding that abusive behaviour is acceptable simply because it falls outside section 26. Health and safety obligations, the employer’s duty of care, contractual obligations and internal conduct policies may still require action.
You do not have to possess the characteristic yourself
Another area employers need to understand is that harassment is wider than abuse directed at somebody because of their own protected characteristic.
An employee can potentially experience unlawful harassment because they are perceived to have a particular characteristic, because of their association with someone who does, or because they witness harassment that creates an intimidating, hostile, degrading, humiliating or offensive environment for them.
For example, a customer repeatedly making racist jokes in front of employees could potentially create a harassment issue even where the employee who complains is not personally from the ethnic group being discussed. This is one reason that businesses should avoid drafting their third-party harassment procedures too narrowly around direct abuse aimed at a particular member of staff.
Which protected characteristics are covered?
The relevant characteristics for harassment are:
- age
- disability
- gender reassignment
- race
- religion or belief
- sex
- sexual orientation
Sexual harassment is also covered, as is the Equality Act protection concerning less favourable treatment following submission to or rejection of certain harassment. The third-party provisions encompass all three forms of harassment under section 26.
Two protected characteristics are conspicuously absent from the ordinary harassment provisions: pregnancy and maternity, and marriage and civil partnership. The Equality Act does not create harassment claims specifically related to those characteristics, although the conduct may sometimes fall within another form of discrimination. For example, offensive treatment of a pregnant employee could in some circumstances amount to harassment related to sex.
Disability and neurodivergence could create particularly difficult cases
Disability is expressly covered by the new third-party harassment provisions, which makes neurodivergence an important area for employers to consider.
A customer mocking an autistic employee’s communication style, making degrading comments about an employee with ADHD, or repeatedly mimicking an employee’s tic could potentially amount to disability-related harassment where the Equality Act definition is satisfied.
There is another, much more difficult scenario: what happens when the third party accused of harassment is themselves disabled or neurodivergent?
Consider a customer with Tourette syndrome who involuntarily vocalises a racial slur in front of an employee. Or a neurodivergent service user whose disability affects inhibition or communication and who makes a deeply offensive remark.
The effect on the employee cannot simply be disregarded because the behaviour was connected to a disability. Intent is not an absolute requirement for Equality Act harassment. Whether the conduct actually meets the harassment threshold would depend on all the circumstances, including its effect and the reasonableness of viewing it as having that effect.
At the same time, an employer should be very careful about responding as though deliberate discriminatory abuse and disability-related behaviour are necessarily equivalent.
There is a useful case of this collision of equality issues in Borg-Neal v Lloyds Banking Group. The case concerned an employee rather than a third party, so it does not decide how the new third-party provisions will operate. But it nevertheless illustrates the danger of ignoring disability when responding to offensive conduct.
Borg-Neal used a highly offensive racial term during race awareness training. The tribunal accepted medical evidence that his dyslexia affected his ability to formulate questions and contributed to what he said. His dismissal was found to be unfair and to amount to discrimination arising from disability.
The case demonstrates the importance of context. An employer may simultaneously need to support an employee who has been subjected to deeply offensive language and consider whether disability played a role in the behaviour of the person responsible.
Where the third party is a disabled customer or service user, the organisation may also have separate Equality Act obligations towards that individual. An automatic policy of permanently banning anyone who uses certain language could therefore create its own problems.
A better response may involve investigating what happened, separating the individuals where appropriate, understanding whether disability contributed to the behaviour, considering adjustments or alternative ways of delivering the service, supporting the affected employee and deciding on a proportionate response.
There will be cases where exclusion or termination of a customer relationship is appropriate. However there will also be cases where a more nuanced intervention is required. A response and a policy must consider the variety of circumstances.
What happens if an employer gets it wrong?
There is no automatic fine on 30 October for failing to update a harassment policy or carry out a third-party risk assessment. The legal risk arises when an employee is actually harassed by a third party in the course of their employment and the employer cannot show that it took all reasonable steps to prevent it.
The employee can bring an Equality Act claim against their employer through an employment tribunal. They do not need to have left their job or been dismissed to do so. If the harassment is followed by further detrimental treatment, victimisation, dismissal or resignation, additional employment law claims may also arise. If successful, compensation can include lost earnings and injury to feelings, with no overall statutory cap on discrimination compensation. For claims brought from April 2026, injury to feelings awards alone can range from £1,300 for less serious cases to more than £62,900 in exceptional cases.
Where the third-party conduct is sexual harassment, the stakes can be higher again. A tribunal that finds sexual harassment can increase compensation by up to 25% where the employer has also breached its preventative sexual harassment duty.
Tribunals can also make recommendations requiring employers to address discriminatory practices, and particularly serious breaches with aggravating features can attract a separate financial penalty of up to £20,000.
This means the employer’s evidence is critical to defend against such a claim. A business facing a claim will need to show what it did before the incident: the risks it identified, policies and contractual protections it introduced, training it provided, previous incidents it monitored and the practical controls it put in place. The new defence is based on having taken all reasonable steps, not simply responding well once somebody has been harassed.
“All reasonable steps” is where the employer’s liability comes in
Section 21 of the Employment Rights Act does not expect employers to guarantee that no customer, patient or member of the public will ever behave unlawfully. The statutory mechanism is that an employer is treated as having permitted the third-party harassment where the employee was harassed in the course of employment and the employer failed to take all reasonable steps to prevent it.
However what is reasonable will depend on factors including the size of the organisation, its sector and the work employees perform. Employers can only take steps that are reasonably available to them, and the level of control over a member of the public will clearly differ from the control an employer has over its own workforce.
There is still a high bar. “All reasonable steps” requires an employer to think beyond a policy sitting on an intranet. It should undertake a risk assessment, assess the steps which could prevent or mitigate such risks, and then implement all those which are reasonable to do.
