From 30 October, employers must take "all" reasonable steps to prevent sexual harassment, and will be liable for harassment of their staff by clients, customers and contractors. Here is what is changing, why it matters, and why law firms are not exempt.

Some legal changes arrive with a big bang. This one arrives with a single word. On 30 October 2026, the duty on employers to take "reasonable steps" to prevent sexual harassment becomes a duty to take "all reasonable steps". On the same date, a brand new duty arrives covering harassment of employees by people outside the organisation.

It sounds like a small edit. It is not. If you want a live example of how one word in a statute can reshape how every employer in the country operates, this is it.

To understand the change, you need to know what it is changing. Since October 2024, under the Worker Protection Act 2023, employers have been under a proactive duty to take reasonable steps to prevent sexual harassment of their employees. The key word there is proactive. Waiting for a complaint and then responding properly is no longer enough. Employers are expected to anticipate the risk and act before anything happens.

If an employer breaches that duty and a sexual harassment claim succeeds, a tribunal can increase the compensation by up to 25%. The Equality and Human Rights Commission can also take enforcement action. Notably, an employee cannot bring a standalone claim for breach of the duty alone. It works as an uplift on a successful harassment claim rather than as a claim in its own right.

From 30 October, the Employment Rights Act 2025 raises the standard. The duty becomes one to take "all reasonable steps" to prevent sexual harassment, mirroring the wording of the existing statutory defence in section 109(4) of the Equality Act 2010.

That wording matters because of how courts have historically treated it. To show you took all reasonable steps, an employer must be able to show there were no further steps it could reasonably have taken. It is not enough to point to a policy and a training session and say the job is done. If there was one more sensible thing the employer could have done, and it did not do it, the duty is breached.

The government has indicated that regulations may later set out what steps employers must take, though those are not expected until 2027, after the new rules are in force. In practice, most commentators expect them to formalise what the EHRC's existing technical guidance already recommends: clear and up to date policies, regular training, proactive risk assessments, accessible reporting routes and properly handled complaints.

This is the bigger shift in real terms. From the same date, employers will be liable if their employees are harassed by third parties in the course of their employment, unless the employer can show it took all reasonable steps to prevent it.

A third party here means anyone who is not the employer or a fellow employee. That covers clients, customers, contractors, suppliers, patients, service users and members of the public. Crucially, the duty is not limited to sexual harassment. It covers harassment related to any of the relevant protected characteristics: age, disability, gender reassignment, race, religion or belief, sex and sexual orientation.

There is a piece of history worth knowing. Express legal protection against third party harassment existed briefly between 2010 and 2013, before it was repealed by the coalition government of the time. The old version also had a much higher bar for claimants: an employee had to show there had been at least two prior incidents by a third party before the employer could be liable.

The new protection has no such requirement. A single incident is enough. And the employer's defence is not whether it responded well after the fact, but whether it took all reasonable steps beforehand. That is a very different test.

It would be easy to read this as an issue for retail, hospitality and healthcare, where staff deal with the public all day. But law firms are not exempt, and anyone working in a client facing role should understand why.

Solicitors, paralegals and support staff deal with clients constantly, often in emotionally charged situations. Divorce, disputes, house moves that are collapsing: people are stressed, and some behave badly as a result. Under the new duty, a firm that knows a particular client has behaved inappropriately towards a member of staff, and does nothing to address it, is exposing itself to a claim.

For a paralegal on a busy caseload, that changes what a good supervisor is expected to do. Reporting a client's conduct is no longer just a matter of personal comfort. It is a step that helps the firm show it took all reasonable steps, and firms have a real incentive to want to know.

There is a related change worth noting. Since 6 April 2026, reporting sexual harassment has been treated as a protected disclosure for whistleblowing purposes. Combined with the strengthened duty in October, commentators expect more employees to feel able to come forward, and more claims to follow as a result.

The most useful way to understand this change is that it moves employers from compliance to evidence. Having a policy in a drawer used to feel like enough. Under an "all reasonable steps" standard, the question a tribunal will ask is what the employer actually did, and whether it can prove it.

That means documented risk assessments, training records, records of how complaints were handled, and evidence that concerns were acted on rather than filed away. Employers who cannot produce that paper trail may find themselves unable to defend a claim they could otherwise have resisted.

If you are asked what employment law developments are coming up, or how firms should prepare for regulatory change, this is a genuinely strong answer, because it has a firm date, a clear before and after, and a practical consequence.

A weak answer says the law on harassment is getting stricter. A strong answer explains that the standard is moving from reasonable steps to all reasonable steps, that a new duty covering third parties arrives on the same date, that a single incident is enough to trigger it, and that the practical effect is a shift from having a policy to being able to prove you acted. Then it connects that to the firm in front of you: what a firm with many client facing staff should be doing now.

Most legal change is slow and hard to see coming. This one has a date, a mechanism and a very clear message: reacting to harassment after it happens is no longer a defence, and neither is ignoring the risk when it comes from outside your own workforce. For employers, the work has to happen before 30 October. For anyone entering the profession, it is a neat lesson in how much can hang on a single word in a statute.

Do you know someone who would benefit from this? Share it with your friends, colleagues and family. Knowledge is better shared.