The harassment rules change on 30 October — what a small employer actually has to do

There is a date coming that most owners of small, customer-facing businesses have not heard about, and it is 30 October 2026. From that day two things change in how UK harassment law works, and both of them point squarely at employers who have no HR department and have never thought any of this applied to them.

The first change tightens a duty that already exists. The second creates a liability for something you do not directly control: how your customers behave towards your staff.

What is already the law

Since 26 October 2024, section 40A of the Equality Act 2010 has placed a positive duty on every employer to take reasonable steps to prevent sexual harassment of its workers in the course of their employment. The word doing the work there is positive. This is not a duty to handle a complaint well once one arrives. It is anticipatory: the law expects you to have thought about where the risk sits in your business and to have acted on it before anything happens.

There is no small-employer exemption and never has been. A three-person salon carries the duty in the same terms as a hospital trust. What counts as reasonable is judged objectively and varies with your size and resources — but the duty itself does not switch off below a headcount.

Two things happen if you ignore it. The Equality and Human Rights Commission can take enforcement action against an employer that has not complied, entirely separately from anyone bringing a claim. And where a tribunal upholds a sexual harassment claim and finds the employer breached the duty, it can increase the compensation awarded by up to 25%.

What changes on 30 October 2026

Reasonable steps becomes all reasonable steps. One word, and it moves the bar meaningfully. Under the current test you can point to the sensible things you did. Under the new one the question becomes whether there was anything further you reasonably could have done and did not. That is a harder question to answer from memory, which is why the practical response is documentation rather than good intentions.

Third-party harassment becomes your problem. Employers become liable where their workers are harassed by third parties — customers, clients, suppliers, contractors, patients, members of the public — unless the employer can show it took all reasonable steps to prevent it. This is a standalone claim rather than an uplift on somebody else's, and it is not confined to sexual harassment: it covers harassment related to the other protected characteristics too, with the exceptions of marriage and civil partnership, and pregnancy and maternity.

There is no three-strikes rule buried in it. The first incident can found a claim. The defence is what you had in place beforehand.

One further date belongs in the same diary entry. From 1 October 2026 the time limit for bringing most employment tribunal claims doubles from three months to six. A grievance you thought had gone quiet has twice as long to come back.

The businesses this actually catches

Read the third-party change again and think about who it describes. Pubs, restaurants and cafés. Shops and salons. Care and domiciliary care. Taxi and delivery work. Trades working alone in customers' homes. Reception desks, letting agents, veterinary practices, anywhere a lone worker deals with the public at nine in the evening.

In all of those, the person most likely to harass a member of your staff is the person paying the bill. That is precisely the situation the change is aimed at, because it is the situation where staff have historically been told to laugh it off and get on with the shift.

The defence is not going to be that nothing happened. The defence is the paperwork you generated before it did.

What all reasonable steps looks like in a five-person business

None of this needs a consultant. It needs an afternoon and a folder.

Write a risk assessment. One page. Where in this business could harassment plausibly happen — lone working, late shifts, alcohol, home visits, one particular regular customer everybody already knows about? What have we done about each? Date it and sign it. The single most common failure is having done sensible things and having no record that you did them.

Have a policy that names third parties. Most small-firm policies, where they exist at all, cover colleague-on-colleague conduct and stop there. Yours needs to say explicitly that harassment by customers, suppliers and contractors is covered, that staff are expected to report it, and what the business will do when they do.

Train everyone, and keep the register. Short, practical, and repeated — what harassment is, what to do in the moment, how to report. Record who attended and when. An untrained team and no register is the easiest possible case for a claimant to make.

Give people a route that is not their own manager. If the manager is the problem, a policy that says report it to your manager is worth nothing. Name a second person — a director, the owner, an external HR line.

Tell staff what they may do in the moment. This is the step small employers skip and it is the one staff care about most. Are they allowed to refuse service, walk away from the table, end the call, leave a customer's house? Say so, in writing, and back them when they do it.

Act on what you hear, and write down what you did. Including the informal reports. Especially the informal reports.

Review it once a year and after any incident. Put a recurring reminder in the calendar so the review actually happens.

What getting it wrong costs

Compensation in discrimination claims is not capped in the way unfair dismissal awards are, and it includes an award for injury to feelings on top of any lost earnings. Putting illustrative numbers on it: if a tribunal awarded £15,000 for injury to feelings and found the prevention duty had been breached, a full 25% uplift adds £3,750, taking it to £18,750 — before your own legal fees, before the management days spent on the case, and before whatever the story does to your ability to recruit locally.

Against that, the mitigation is a written risk assessment, a policy that mentions customers, a training register and a reporting route. It is genuinely a morning's work, and it is the same morning's work whether you have four staff or forty.

If you are building the wider file at the same time, the employee handbook nobody reads covers what else belongs in it, how to give an employee a written warning covers the process end of conduct, and what actually happens in an employment tribunal claim sets out where all of this ends up if it goes wrong.

Common questions

Does this apply to a business with only three or four employees?

Yes. There is no small-employer exemption from the prevention duty and there is no exemption from the third-party harassment liability arriving on 30 October 2026. What changes with size is what counts as reasonable, because the test is objective and takes account of your resources — nobody expects a four-person firm to run the compliance programme a bank runs. What is expected is that you have identified the obvious risks in your own business, written something down, told your staff what to do and given them somebody to tell. Those steps are proportionate at any size, which is exactly why a tribunal will ask why they were not taken.

Can we really be liable if a customer harasses one of our staff?

From 30 October 2026, yes. Employers become liable for harassment of their workers by third parties — customers, clients, suppliers, contractors and members of the public — unless they can show they took all reasonable steps to prevent it. It is a standalone claim rather than an add-on to a claim against a colleague, and it covers harassment related to protected characteristics generally, not only sexual harassment. The first incident can be enough, so waiting to see whether a pattern develops is not a defence. What protects you is the preparation: a risk assessment, a policy that names third parties, training, a reporting route, and evidence that you acted when something was reported.

Is a written policy enough on its own?

No, and a policy nobody has read is close to worthless as evidence. The duty is about steps actually taken, so a tribunal will look for the policy plus the things around it: a documented risk assessment for your specific business, training that people attended with a register to prove it, a reporting route that does not dead-end at the person complained about, records of what you did when something was raised, and a review after any incident. Think of the policy as the index rather than the answer. The strongest position for a small employer is a thin folder with dates in it, not a thick document nobody can find.

How much time do we have, and what should we do first?

The changes take effect on 30 October 2026, so there is a clear run at it. In practical order: write a one-page risk assessment naming where harassment could realistically occur in your business; update or create a policy that expressly covers customers and other third parties; book short training and keep the attendance register; name a second reporting contact who is not every employee's line manager; and tell customer-facing staff in writing what they are permitted to do in the moment, including refusing service or leaving. Date everything. If you only do one thing this week, do the risk assessment, because every other step follows from it.