If your harassment policy is a document that sits in a folder nobody opens until there's a complaint, you have a problem — and from 30 October 2026, it becomes a bigger one.
The Worker Protection Act already put a duty on employers, from October 2024, to take “reasonable steps” to prevent sexual harassment of staff. That was Act One. Act Two arrives this October under the Employment Rights Act 2025: the duty strengthens to “all reasonable steps”, and it stops being limited to sexual harassment — it now covers harassment linked to any protected characteristic.
At the same time, from 1 October 2026, the time limit for bringing most Employment Tribunal claims doubles from three months to six. Put those two changes together and the arithmetic gets uncomfortable for employers who haven't kept up: more grounds to claim on, and twice as long to bring the claim.
“Reasonable” vs “all reasonable” — why the gap matters
“Reasonable steps” let you argue you'd done something. “All reasonable steps” is a much higher bar — it asks what more could plausibly have been done, and expects you to have done it, or documented why you didn't. A policy that hasn't been reviewed since it was written, that nobody's been trained on, and that has no risk assessment behind it, doesn't survive that test.
This lands hardest on office-based, people-heavy businesses — recruitment, professional services, retail head offices — where the workforce and the risk are almost entirely about how people treat each other, not machinery or manual handling. If your main occupational risk is interpersonal, this is now your primary compliance exposure, not a footnote to your health and safety file.
What “all reasonable steps” looks like in practice
There's no fixed checklist in the Act, but the direction of travel from existing Equality and Human Rights Commission guidance is clear enough to act on now:
- A harassment-specific risk assessment — not a generic HR policy — covering where and how harassment could occur: client-facing roles, remote and hybrid working, work social events, and third-party contact (contractors, clients, delivery drivers).
- A reporting route that doesn't only run through the alleged harasser's manager.
- Recorded, dated training — not just a policy issued on induction and never revisited.
- A clear record that the risk assessment and its actions were actually reviewed, not filed once and forgotten.
The next eight weeks
You don't need this finished by 30 October to be in a defensible position — you need to be able to show you were actively working on it before the duty bites, not starting the day after a complaint lands. If your last harassment risk assessment predates hybrid working, or you're not sure one exists at all, that's the gap to close first.
Get in touch with NEHS if you want this built properly rather than bolted on — it's a document worth getting right, given what's now riding on it.
Add comment
Comments