Worker Protection Act Reasonable Steps

Worker Protection Act reasonable steps are the preventative actions a UK employer can show it took to stop sexual harassment — including by customers and other third parties — before an incident. Annual e-learning is unlikely to be enough if behaviour never changes. This article is a practical map of the duty, the EHRC’s own steps, and what a defensible training programme looks like. It is not legal advice. Have your employment counsel read it against the current statute and guidance.

I have written the story version in all reasonable steps and the end of tick-box training, and the five conversations in October 2026. How to file the evidence is in training audit. What to put in the board file is all reasonable steps.

Worker Protection Act reasonable steps — what the duty is

What the duty is — and what it is not

The Worker Protection (Amendment of Equality Act 2010) Act 2023 inserted a preventative duty into the Equality Act 2010. From 26 October 2024, employers must take reasonable steps to prevent sexual harassment of their workers. The Equality and Human Rights Commission (EHRC) published updated technical guidance and an 8-step employer guide in the run-up to that date.

The duty is anticipatory. You do not wait for a complaint and then train. You assess how harassment might happen here — this site, this customer, this hierarchy — and you act.

A related, older doctrine still matters: the “reasonable steps” defence to vicarious liability. In Allay (UK) Ltd v Gehlen [2021] EAT, training that was brief or stale did not get the employer home. That case is about the defence. The preventative duty is a separate positive obligation. Do not collapse them in a board paper. Do take the same lesson from both: a module from a long time ago is a thin story.

Parliament has since legislated a further tightening toward all reasonable steps, with a widely briefed commencement in October 2026 (Employment Rights Act 2025, as discussed in the legal press and in our October 2026 conversations piece). Confirm commencement and wording with counsel before you rely on a date in a policy. The direction of travel is not subtle: more steps, more evaluation, less credit for a certificate.

If the duty is breached, the EHRC can enforce. In a successful tribunal claim, compensation can be uplifted (the 2023 Act provided for up to 25%). Those are counsel’s numbers to apply, not mine.

What the EHRC actually asks employers to do

The 8-step guide is not an exhaustive safe harbour. The EHRC says that implementing the steps should help you take positive action. The steps are:

1. Develop an effective anti-harassment policy.
2. Engage your staff.
3. Assess and reduce risk in your workplace.
4. Reporting.
5. Training.
6. What to do when a complaint is made.
7. Dealing with harassment by third parties.
8. Monitor and evaluate your actions.

Step 8 is the one most training files ignore. The guide is explicit that you should regularly evaluate whether the steps are working and change them if they are not. A completion rate does not evaluate effectiveness. It evaluates distribution.

On training (step 5), the technical guidance and the 8-step material sit together: training is expected, it should be relevant to the risks you found, managers need more than the all-staff version, and it should be reviewed. Our longer essay quotes the “beyond tick-box e-learning” expectation that has shaped how practitioners read that guidance. If you are writing a legal opinion, read the technical guidance yourself. Do not cite this blog as the instrument.

Why annual e-learning is a weak “reasonable step”

E-learning can do a Level 2 job: definitions, how to report, what third-party harassment is. It cannot do the job the duty is aimed at — changing what happens in the meeting when someone says “it was just banter,” or in the 1-1 when someone discloses and asks you to keep it quiet.

Three reasons, none of them rhetorical:

It does not match the risk you assessed. If your risk is customers on a night shift, a generic module about “respect in the workplace” is not a step aimed at that risk.

It decays. Gehlen is the legal hook for staleness. The educational hook is ordinary forgetting of unused material. A January click is not a September skill.

It is not evaluated. Step 8 asks whether the action worked. A 97% completion rate tells you the LMS worked. It does not tell you whether a manager can take a disclosure.

If behaviour is unchanged and you have no other steps, you do not have a training defence. You have a procurement record.

What a defensible training programme looks like

Again: not a warranty. A shape that matches the guidance.

1. Risk assessment first. Sites, customers, alcohol, nights, power, lone working, third parties. If this document does not exist, start there — not in the content library.
2. Targeted training, not one video for everyone. All staff need reporting and bystander basics. Managers and seniors need the conversations they will actually have. The EHRC’s guide treats manager training as its own problem.
3. Practice of the live moments. Scenario-based, spoken, with pushback. See scenario-based training and the leadership training scenarios — especially the banter intervention.
4. Evidence. Dated attempts, who was in scope, who has not yet passed, what you did about them. Training audit.
5. Refresh after role change, after incident, after a long gap, and when the risk assessment changes — not only on the anniversary of the LMS licence.

Policy, reporting, and complaint-handling (steps 1, 4, 6) are not this article. If those are missing, better training will not save the file.

The duty is discharged in live moments

The legal standard will be argued in documents. The human standard is a sentence in a room.

A senior person makes a sexualised joke about a colleague who is not there. Two people laugh. One goes still. The agenda moves on. That is the moment. If your managers cannot intervene — calmly, in front of someone more senior — the preventative duty is not a policy problem. It is a rehearsal problem.

We built that meeting as a team scenario. The 1-1 that follows a disclosure is here:

A dated attempt at the live moment — not a completion certificate.

Practise a harassment disclosure

The wider library is the workplace roleplay scenarios. The product view of evidence is competence, confidence, compliance.

What “reasonable” is not

It is not a brand of e-learning.

It is not a poster in the kitchen.

It is not a single all-hands.

It is not “we take this seriously” in a statement after the claim.

Reasonable, in this context, is closer to proportionate to the risk you can see if you look. A night-time hospitality site with cash, alcohol, and customers is not the same workplace as a twelve-person daylight office. The steps should not be the same module with a different logo. The EHRC’s risk-assessment step is doing that work. Training that ignores the assessment is decoration.

Third-party harassment (step 7) is where a lot of UK files are still thin. A customer who crosses a line is not “an awkward guest.” From the 2024 preventative duty onward, employers are expected to think about that risk in advance. October 2026’s further tightening, as briefed, does not make that less true. Confirm the live wording with counsel.

Who this article is for

HR directors, employment lawyers, and compliance leads who will forward a page to each other. If you wanted the human story, the tick-box essay is better. If you wanted the five conversations, use October 2026. This page exists so the search “worker protection act reasonable steps” lands on something you can put next to the EHRC guide without wincing.

If you are an employment lawyer reading this for a client: the training paragraph in your letter should ask what was practised, when, by whom, and what changed when people failed — not only whether a module existed. If you are an HR director, that is the question to ask L&D before the board asks you.

If you are buying software to “do Worker Protection Act training,” you are already slightly off. Buy a programme: risk, policy, reporting, practised conversations, and an evaluation loop. Software can hold the practice and the dates. It cannot be the only step.

What to put in the legal file

Counsel will want paper, not a vibe. A file that matches the EHRC shape usually contains:

• The risk assessment (this site, these customers, this hierarchy) and the date it was last reviewed.
• The syllabus: who was in scope, what they were trained on, when.
• Level 2 for the facts that must be known (what counts, how to report).
• Level 3 for the moments that must be done — a sample, dated. See Kirkpatrick Level 3 examples.
• Exceptions: who has not practised yet, and what you did about their queue or their line management.
• The refresh rule, and one example of a change you made after you evaluated.

If that list is empty except for LMS completions, you have an attendance record. You do not yet have Worker Protection Act reasonable steps you can show.

Read the EHRC 8-step guide · Try a practice conversation

FAQ

Frequently asked questions

01What are Worker Protection Act reasonable steps?

Preventative actions a UK employer takes to stop sexual harassment of workers, including by third parties. The EHRC’s 8-step guide is the practical starting list. It is not an exhaustive legal safe harbour.

02What are the Worker Protection Act training requirements?

There is no single statutory module. Training is one of the EHRC’s recommended steps. It should follow your risk assessment, go beyond a generic click-through for managers, and be evaluated for effectiveness.

03Does e-learning satisfy the duty to prevent sexual harassment?

Unlikely on its own if you have not assessed risk, practised the live moments, or checked whether behaviour changed. Completions prove distribution.

04What harassment training evidence should we keep?

The risk assessment, the syllabus, dates, audience, knowledge checks, and Level 3 evidence that people can do the conversations — plus what you changed when they could not. See training audit.

05Is this legal advice?

No. It is practical commentary for HR and L&D, citing the Act, EHRC guidance, and Gehlen. Have qualified UK employment counsel apply it to your facts.