In October 2026, two separate legal duties around harassment will change.
First, the standard for sexual harassment will upgrade from reasonable steps to “all” reasonable steps. This means that, if an employee of yours goes to tribunal over a sexual harassment claim, you need to be able to demonstrate that there were no further steps you could have reasonably taken to prevent the harassment from happening.
The second duty is new and will hold employers directly liable for third-party harassment.
This new third-party harassment duty is the focus of this article.
What is the new third-party harassment duty all about?
Once the new duty is in force, as an employer you will have a defined obligation to take “all reasonable steps” to prevent your employees from being harassed by customers, clients, contractors and members of the public.
This will apply across all relevant protected characteristics:
- Age
- Disability
- Gender reassignment
- Race
- Religion or belief
- Sex
- Sexual orientation
If an incident happens and you can’t evidence what you did to stop it, a tribunal can find you liable.
What “all reasonable steps” actually means
You can never control how a customer behaves, but you have full control over your own policies and how you respond when something happens.
For third-party risk specifically, that means:
- A policy that names third-party harassment directly, not just harassment between colleagues
- Briefing client-facing staff on their right to report an incident and what happens next
- An escalation route built for incidents involving a customer or client, separate from your internal grievance process
- A willingness to act against the customer or client themselves, including ending the relationship where it’s warranted
- If harassment happens, you need a record of what took place and what you did about it
Skip any of this and you’re relying on luck rather than evidence.
What your harassment policy should include
A policy clause covering third-party harassment needs to do a few specific things:
- State who it covers.
Most policies default to colleague-to-colleague behaviour. The clause needs to explicitly list who counts as a third party: customers, clients, suppliers, contractors and members of the public.
If it just says “harassment”, a tribunal can’t tell whether the employer ever turned their mind to this risk.
- Confirm it’s treated the same way.
The policy should say that harassment from a third party is treated with the same seriousness as harassment from a colleague or manager, not as a lesser “customer service issue”.
- Give a reporting route that fits the situation.
Internal grievance processes assume that the perpetrator is another employee.
A third-party incident needs its own route, usually reporting to a line manager or duty manager in the moment, not waiting for a formal grievance meeting days later.
- Commit to action against the third party, not just the employee.
Most policies miss this bit entirely.
It should state that the business will take appropriate action, which can include warning a client, refusing service, ending a contract with a supplier or contractor or barring a customer.
- Remove the expectation that staff tolerate it for the relationship.
Explicitly state that employees aren’t expected to “smooth things over” or keep serving someone who’s harassed them for the sake of keeping the customer or client happy.
An actual clause might read something like:
“This policy applies to harassment by anyone an employee comes into contact with through their work, including customers, clients, suppliers, contractors and members of the public. Reports of harassment by a third party will be investigated and treated with the same seriousness as harassment involving a colleague. Action may include speaking to the individual involved, withdrawing service or ending a contract or relationship where necessary.”
What else to check before October
Beyond going through your harassment policy, check that your team actually know how to report an incident involving a customer and who they’d tell.
If anything has already happened, write down what occurred and how you handled it, even if it feels resolved.
If something has already happened and you’re not sure whether your response holds up, get advice before the new duty takes effect, not after.
Also check that you have a written risk assessment that covers third-party contact situations specific to your business.
Get this right before the deadline
As independent HR consultants, we can review your harassment policy and put a simple, practical process in place for managing third-party incidents.
If a customer or client has already caused a problem for one of your staff or you want to be covered before the deadline, get in touch now.