Crackdown on workplace harassment - is your workplace doing enough?

 A reminder of the ERA changes?

First, the preventative duty, originally introduced in 2024, now requires employers to take “all reasonable steps”, rather than “reasonable steps”, to prevent sexual harassment. It covers harassment by colleagues and third parties but remains specific to sexual harassment.

Second, workers can now bring a standalone claim against their employer for third-party harassment in the course of employment unless the employer has taken all reasonable steps to prevent it. Third parties include customers, clients, contractors, suppliers, service users and the public. Liability extends beyond sexual harassment to other unlawful harassment, including that related to race, disability or religion or belief. This means that, in respect of third parties, the “all” reasonable steps threshold applies to all forms of harassment.

In the lead up to these changes, consideration has focused on what further steps/changes must employers take to comply with this elevated obligation - what does “all” require an employer do to comply? We now have more clarity with the EHRC’s updated guidance which details what “all” now means.

What does the preventative duty cover?

The EHRC’s eight steps cover policies, staff engagement, risk assessments, reporting, training, complaints, third parties, and monitoring and evaluation. What is reasonable depends on the employer’s size, resources, working environment and third-party contact. Employers must also respond to emerging risks. Even if a risk was not initially identified, once it arises, steps to prevent recurrence will become reasonable.

The change to require “all” reasonable steps is a big deal for employers. Even where an employer has taken the duty seriously and implemented a number of measures, missing a further reasonable step will likely mean breaching the preventative duty. For example, having a policy and offering training alone are not enough, and measures must be tailored, effective and kept under review. Central to this, the technical guidance makes it clear that a crucial step for employers will be carrying out risk assessments.

The importance of risk assessments

The EHRC guidance is clear that, without a risk assessment, an employer is unlikely to comply with the preventative duty. When the “reasonable steps” requirement came in, many employers struggled on this piece, particularly the specificity and ambit of a risk assessment(s). If employers did not do this when the preventative duty was introduced in 2024, it is therefore vital that this is addressed without delay.

A meaningful assessment should reflect how the business actually operates. Where are the power imbalances? Do staff work alone, at night or at client sites? Are there insecure or casual roles? Is “banter” tolerated? Consider customer-facing work, conferences, work-related social events, alcohol and online interactions, not just what happens in the office. Third-party risks should be assessed specifically.

Even then, completing a risk assessment is not enough. Employers will want an “open” assessment to demonstrate compliance, but this can be a double-edged sword. If identified preventative actions are not followed through, the employer will have documented its own failure to take all reasonable steps. To avoid this, appoint an owner for identified actions and set deadlines. Risk assessments should also be reviewed as required, for example when working arrangements change and after an incident.

The Government is clear that the goal here is to bring about a positive change in workplace culture and the stakes are therefore significant. The EHRC has enforcement powers in relation to the preventative duty and where a worker wins compensation for sexual harassment, a tribunal can increase it by up to 25% for breach of that duty. Failure to prevent third-party harassment now also brings a separate liability risk.

What can employers do now

Use the updated EHRC guidance to stress-test your arrangements taking into account the following actions:

• Review staff engagement. Use existing surveys to identify harassment risks and involve employee bodies in developing and evaluating policies.
• Refresh your risk assessment. Create a monitored action plan with a designated lead and senior backing.
• Update and communicate policies. Cover third-party harassment, examples and consequences. Align disciplinary, whistleblowing and social media policies.
• Make reporting accessible. Offer alternatives to line managers, consider anonymous reporting and keep confidential central records with data protection safeguards.
• Train for real situations. Teach staff to recognise, report and safely respond to harassment. Act on informal concerns without waiting for grievances. Test and refresh training.
• Protect staff from third-party harassment. Consider customer notices, de-escalation training and ways to summon help. Ensure workable warning and removal procedures.
• Review commercial arrangements. Consider anti-harassment terms on training, reporting and cooperation. Agree who investigates and what action follows.
• Respond and review. Act promptly, protect complainants and witnesses from victimisation, seek feedback and track trends. Few complaints may mean staff feel unsafe speaking up, not that risk is low.
• For regulated employers, consider overlapping regulatory duties, including the new non-financial misconduct rules.

The test is not whether you have a policy or risk assessment, but whether you can show that you identified the risks and took all reasonable steps to address them.

For advice on the changes and updated EHRC guidance, contact your usual BCLP employment adviser.