Back in 2010, when the Equality Act was passed, there was a provision within it concerning third-party harassment. Under Sections 40(2)-(4) employers became liable for harassment of their employees by third parties (such as clients or customers) but only where the employer knew the harassment had occurred on at least two previous occasions and had failed to take reasonable steps to prevent it from happening again. Those provisions were repealed on October 1st, 2013 by the Enterprise and Regulatory Reform Act 2013 after concerns were expressed that the duty imposed excessive liability on employers. As a result, for over a decade, workers had limited recourse where harassment came from customers or other non-employees.
Now the government has decided to have another go. From October 2026, Section 21 of the ERA comes into force, representing one of the most significant changes to workplace harassment law in over a decade. Employers will now face direct liability where their workers are harassed by third parties – such as customers, clients, contractors or members of the public – if they fail to take all reasonable steps to prevent it.
Although Section 21 applies to all employers, it will have a particular effect on employers in customer-facing sectors.
What is changing under the Act?
The reintroduction – and significant strengthening – of employer liability for third-party harassment includes the following key features:
- Direct employer liability if workers are harassed by third parties during the course of their work.
- The duty applies to all forms of unlawful harassment linked to the nine protected characteristics under the Equality Act 2010 – not just sexual harassment.
- The expanded duty of prevention means employers must take “all reasonable steps” to prevent harassment, raising the bar from the current “reasonable steps” standard.
- A wide definition of third parties includes customers, clients, service users, contractors, agency workers and visitors.
Crucially, this is a proactive duty, which means that employers must be able to demonstrate that they took comprehensive preventative measures, not simply that they responded appropriately after an incident.
A shift in legal risk
The introduction of third-party harassment liability means employers need to fundamentally change the way they understand and manage workplace risk.
1. The return of liability – but stronger than before
Unlike the pre-2013 system where, as we have noted, there was a “three strikes” style approach applied, now there is no requirement for repeated incidents and the duty is a positive, preventative duty rather than a reactive one.
This means that a single incident could trigger liability if an employer cannot demonstrate that all reasonable preventative steps were taken.
2. Increased exposure in frontline roles
Sectors such as retail, hospitality, healthcare, transport and construction are particularly exposed due to frequent interaction with customers and the public.
It is also important to note that risk does not arise solely from serious incidents. Low-level behaviours – if left unaddressed – can escalate and affect employee wellbeing and organisational culture, leading eventually to a claim.
3. A higher evidential threshold
The shift from “reasonable steps” to “all reasonable steps” is legally significant. Employers must show not only what they did, but that there were no further reasonable measures they could have taken.
In practice, this means they will need to document and regularly review their preventative strategies so that if a claim does arise, the evidence is there to hand.
The implications for employers
Responsibility for harassment prevention will now extend to the behaviour of anyone with whom workers interact in the course of their job and this has practical implications for employers.
A broader duty of care
Employers will need to anticipate risks arising from:
- Customer interactions
- Supplier and contractor relationships
- Public-facing environments
- Multi-employer worksites
This requires a more holistic view of workplace safety, including external behaviours as well as internal culture.
Greater emphasis on prevention over response
Proactivity is paramount. Employers who rely on complaint-handling processes alone – the “after the event” approach – will find themselves exposed. Instead, organisations must show what active steps they are taking to identify and mitigate risks before incidents occur.
Increased governance and accountability
Since this issue touches so many other areas of the organisation, such as risk management, ESG and employee wellbeing, many businesses are moving it up to board level. It is important for the board to be involved since this will show that the business takes the matter seriously and means that resources will be available for measures to tackle the issue.
Action points: how employers can prepare now
The implementation date may seem a long way off but it is getting closer and preparing early will help organisations build an effective approach to the issue.
1. Conduct a risk assessment
Look at where third-party interactions might occur and assess the associated risk. Think about:
- Customer-facing roles
- Lone working environments
- High-pressure or conflict-prone settings
- Multi-employer or public-access sites
The risk assessment will form the basis of any preventative strategy.
2. Update policies and procedures
Policies should explicitly address third-party harassment, including a clear statement that it will not be tolerated, guidance on how employees should respond, how to escalate the issue if it happens and the procedures in place for reporting it. Policies and procedures that will need to be revisited and updated will include dignity at work, grievance and whistleblowing.
3. Strengthen training and awareness
General awareness training, although good, will not be enough once the new duty comes in. Any training provision that is fit for purpose after October will need to include how to recognise third-party harassment, how to challenge inappropriate behaviour safely and when and how to escalate incidents.
Since they will likely be the first port of call in the event of an incident, managers will need training so that they are equipped to handle these situations confidently and consistently.
4. Engage with clients, customers and contractors
Employers should take steps to influence behaviour beyond the organisation by including anti-harassment clauses in contracts, communicating expected standards of conduct and displaying visible messaging in public-facing environments. These actions can then be cited as evidence of proactivity in the event of an incident and any subsequent claim.
5. Implement reporting and monitoring systems
An incident that is not reported is one that cannot be analysed and learned from. Therefore, employers should encourage reporting of all incidents – including low-level or informal concerns – so patterns can be identified early. Incidents and trends can then be tracked, reviewed and risk controls adjusted to take this into account. Such a system of reporting and monitoring can go a long way towards demonstrating that the employer is taking “all reasonable steps.”
6. Review disciplinary and response frameworks
Without consequences for harassment, it is less likely that third parties will take their responsibilities seriously and the harassment is likely to continue. Therefore, employers need to make sure that there are clear outcomes for those third parties who engage in harassment, such as refusing service, removing individuals from premises and terminating contracts where appropriate. Those consequences need to be documented and this includes instances where they have had to be applied.
7. Embed a preventative culture
A culture where the employer only pays lip service to their duty under the Act will not lead to preventative measures being taken seriously or trusted to deliver. Organisations, therefore, should aim to build a culture where employees feel safe to speak up without the fear of consequences, leadership visibly supports zero tolerance and prevention is part of everyday operations, keeping it visible and reinforcing by regularity.
Addressing the “Banter Ban” concerns
One of the more controversial aspects of the new third-party harassment provisions, flagged up in the media, is the suggestion that they could lead to a so-called “banter ban”, with employers being forced to police everyday conversations or restrict free expression in the workplace. However, closer examination of the subject shows that these concerns are likely to be overstated.
The government has consistently maintained that the legislation is intended to protect workers from unlawful harassment, not to prevent legitimate discussion, humour or the expression of differing views. The legal threshold for harassment remains unchanged. For conduct to amount to harassment under the Equality Act 2010, it must be “unwanted behaviour related to a protected characteristic that has the purpose or effect of violating a person’s dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment”. The provisions do not create a new definition of harassment; they simply extend employer responsibility for preventing it in certain circumstances.
Concerns have also been raised about employers being held liable for overheard conversations or comments made by customers in public-facing environments. During the passage of the legislation, the government indicated that employers would only be expected to take proportionate and reasonable preventative measures, rather than eliminate every possibility of offensive or contentious remarks being made. Tribunals will continue to assess each case on its facts, taking account of context, the reasonableness of the employer’s actions and the rights of all parties involved, including freedom of expression.
In practice, employers are unlikely to be expected to police ordinary workplace “banter” unless it crosses the line into unlawful harassment. The focus of the legislation is on creating workplaces where employees are protected from discriminatory and abusive behaviour, particularly where employers are aware of risks and fail to act. Organisations that foster respectful cultures, provide appropriate training and respond effectively to concerns should be well placed to comply with the new requirements without suppressing legitimate workplace interaction or debate.
