All reasonable steps: the October 2026 duty

All reasonable steps is the test that lands on 30 October 2026. The Employment Rights Act 2025 amends the preventative duty in the Equality Act so employers must take all reasonable steps to prevent sexual harassment of their workers — not a sample of the convenient ones.

If you own people, culture, or conduct risk, this is the question you will be asked: not whether you bought training, but whether you can show it worked. The comparison, the 25% uplift, the EHRC eight steps, and what changes when the 2027 regulations land are below. For the human story, read the tick-box essay. For the five conversations a tribunal will actually replay, start with October 2026.

What changes on 30 October 2026

Two things land on the same day. Treat them as one programme, not two memos.

The preventative duty tightens. From 26 October 2024, section 40A of the Equality Act 2010 has required employers to take reasonable steps to prevent sexual harassment of workers. From 30 October 2026 that wording becomes all reasonable steps. The extra word is the whole argument. Tribunals already treat stale or brief training as a weak defence — see Allay (UK) Ltd v Gehlen [2021] EAT. “All” asks whether there was a further step you could reasonably have taken and did not.

Third-party harassment becomes a standalone claim. From the same date, an employer is liable where a worker is harassed by a customer, client, contractor, patient, or member of the public in the course of employment, unless the employer took all reasonable steps to prevent it. There is no “three strikes” rule and no requirement that it has happened before. The detail lives on third-party harassment.

Neither change invents a new moral standard. Sexual harassment was already unlawful. What changes is what you can put in the file when someone asks what you did before the incident — and whether a frontline worker on a phone line was actually equipped to shut a customer down.

Acas summarises the October 2026 harassment changes here. Confirm the live wording with counsel. The direction is not subtle.

Reasonable vs all reasonable steps

The 2024 duty already asked you to act in advance. The 2026 duty asks whether you left anything reasonable on the table. Law firms have described the bar as “notoriously high.” In practice: a tribunal will not be impressed that you chose a module. It will ask what else a comparable employer, looking at your risks, would have done.

“All” does not mean infinite. It means you cannot defend a gap you could see if you looked. A night-time hospitality site with cash, alcohol, and customers is not the same workplace as a twelve-person daylight office. The steps should not be the same video with a different logo.

If your file is a policy, an annual e-learn, and a poster, you have taken some steps. You have not taken all of the reasonable ones. The missing step, almost every time, is that nobody checked whether a manager can actually have the conversation.

The 25% compensation uplift

The 25% uplift is not new in October 2026. The Worker Protection Act 2023 already lets a tribunal increase compensation by up to 25% where the preventative duty was breached. It sits on top of the harassment award. It is not a substitute for getting the conversation right; it is what happens when you cannot show you tried.

Two things to keep straight in a board paper:

1. The uplift is about the preventative duty, not only the original act. You can have a harassment finding and an extra slice because you did not take the steps a reasonable employer would have taken to stop it happening.
2. EHRC enforcement is separate. The Commission can enforce the duty without waiting for a worker to bring a claim. Binding agreements with large employers already exist. A tribunal is not the only audience for this file.

Do not treat 25% as the cost of getting it wrong. The cost is the original harm, the claim, the culture that follows, and the question you cannot answer: show me they could do it.

The EHRC eight steps — as a programme, not a poster

The EHRC 8-step employer guide is not a safe harbour. Implementing the steps should help you take positive action. It does not mean a tribunal has to agree you took all reasonable ones. Use it as the delivery list, not the defence.

1. Policy. Written, findable, specific about third parties and reporting. A policy that nobody can quote in a 1-1 is decoration.
2. Engage staff. Not a launch email. Ask people where it actually happens — the Christmas party, the client dinner, the late queue, the WhatsApp group.
3. Assess and reduce risk. Environments and conversations. The template is here: sexual harassment risk assessment.
4. Reporting. More than one route. Named people. A path that still works if the accused is the line manager.
5. Training. Relevant to the risks you found. Managers need more than the all-staff version. See sexual harassment training for managers.
6. What to do when a complaint is made. The first conversation is where most files die. Handling a sexual harassment complaint.
7. Third parties. Customers, clients, contractors. Third-party harassment.
8. Monitor and evaluate. A 97% completion rate evaluates the LMS. It does not evaluate whether anyone can take a disclosure.

Step 8 is the one most training files ignore. The guide is explicit: regularly evaluate whether the steps are working, and change them if they are not. If you have never failed anyone, you have not evaluated anything. You have distributed content.

The printable mapping of each step to evidence is the reasonable steps checklist.

What the 2027 regulations will (and will not) do

The Employment Rights Act 2025 includes a power to make regulations specifying steps that are to be regarded as “reasonable” for the preventative duty. The government has said those regulations will follow consultation — expected in 2027 — and that they will set out a non-exhaustive list.

That sentence is doing a lot of work. Read it twice.

• Non-exhaustive means ticking the future list will not be the whole duty. You still have to take the further steps that are reasonable in your workplace. A contact centre that only does what a professional-services firm does has not read its own risk assessment.
• 2027 is after 30 October 2026. You will be under the higher duty before the regulations exist. Waiting for the statutory list is not a step. It is a gap.
• The EHRC eight steps remain the practical starting point until something more specific is published. When the regulations land, this page will be updated.

Do not build a programme that can only survive if the 2027 list is kind to e-learning. Build one that would still look serious if the list named risk assessment, manager skill, third-party response, and evaluation — because that is already what the Commission asks for.

The status quo that will fail

The traditional approach to sexual harassment at work is a knowledge problem. Define it. Show a video. Quiz the definition. File the certificate. Repeat annually.

That approach survives because it is procurable, comparable, and easy to report. It fails because harassment is not a knowledge problem. It is a conversation under pressure.

Most harassment never becomes a formal complaint. It is a comment in a meeting, a customer on a Friday night, a private message, a “don’t make this a thing.” The person who has to act is usually a line manager or a frontline agent who completed a module nine months ago and has never said the sentence out loud.

Gehlen already told employers that stale training is not a defence. “All reasonable steps” asks the next question: if you knew the live moment was the risk, why was the only step a video?

An annual e-learn can still do a job — definitions, how to report, what third-party harassment is. It cannot be the step that proves a manager can sit with someone who is shaking and not make it worse. That is a different step. Most organisations have never taken it, because until recently the only way to practise was to put two colleagues in a room and hope nobody laughed.

What you actually have to be able to show

Counsel will want paper. A file that matches the duty usually contains:

• A risk assessment dated, local, and reviewed — sites, customers, nights, hierarchy, and which roles have to handle a disclosure, a complaint, or an abusive caller.
• A syllabus: who was in scope, what they were trained on, when. All-staff knowledge is not the same as manager skill.
• Dated attempts at the live conversations, not only completions. How to evidence all reasonable steps.
• Exceptions: who has not practised yet, and what you did about their queue or their line management.
• An evaluation loop — one example of a change you made after you looked.

If that list is empty except for LMS completions, you have an attendance record. You do not yet have all reasonable steps you can show.

The conversations that belong in the programme are not theoretical:

• Shutting a customer down and escalating — third-party harassment
• The private follow-up after inappropriate banter — manager training
• The first conversation with a complainant, and the interview with the accused — handling a complaint

How Real Talk Studio closes the gap

We built conduct-risk practice for the moment the module cannot reach. People rehearse the live conversation with an AI partner who pushes back. Every attempt is scored against the conduct you define. Every person holds a dated record of demonstrated competence — evidence, not a log.

The conversation most organisations cannot currently evidence is a private follow-up after inappropriate banter, when nothing has become a formal complaint yet. That is the conversation the annual module never writes. Practise it now — no login.

The disclosure that asks you to keep it quiet is here: Please don’t tell anyone. Contact-centre teams who will carry third-party risk on the phones start from customer service. The artefact a legal team can actually open is on evidence and analytics.