Preventing Sexual Harassment at Work: A UK Employer's Duty

For decades, UK employers could largely treat sexual harassment as a reactive problem: something to investigate and discipline once it had already happened. That changed on 26 October 2024, when the Worker Protection (Amendment of Equality Act 2010) Act 2023 introduced a new statutory preventative duty. Employers are no longer judged only on how they respond to a complaint — they are judged on what they did, in advance, to stop harassment happening at all. With the Employment Rights Act 2025 now set to toughen this regime further, understanding exactly what the duty requires is no longer optional for anyone with staff, managers, or a duty of care to protect.

What the Preventative Duty Actually Requires

The Worker Protection Act 2023 inserted a new provision into the Equality Act 2010 requiring every employer to take reasonable steps to prevent sexual harassment of their employees in the course of their employment. This is a standalone, positive legal duty — it exists whether or not a harassment complaint has ever been raised, and the Equality and Human Rights Commission (EHRC) can act on it independently of any individual bringing a tribunal claim.

Crucially, the duty is anticipatory. The EHRC's technical guidance and its employer-facing "8-step guide", published in 2024 ahead of the law coming into force, are explicit that employers must think ahead about where and how harassment could occur in their organisation and take action before an incident happens, not simply react afterwards. That shift — from reactive to preventative — is the entire point of the legislation, and it is the lens through which every policy, training session, and reporting channel now needs to be assessed.

This duty sits alongside, and strengthens, employers' existing obligations under equality law more broadly. If your organisation hasn't recently reviewed its wider approach to fairness and inclusion at work, our guide to equality, diversity and inclusion in the workplace is a useful starting point before drilling into harassment specifically.

What "Reasonable Steps" Looks Like in Practice

The law does not hand employers a fixed checklist, and what counts as reasonable will vary with the size of the organisation, its resources, and the sectors and settings its staff work in. But the EHRC's guidance and consistent legal commentary since October 2024 point to a consistent set of practical actions that any credible compliance effort needs to include.

1. Carry out a specific harassment risk assessment

A generic health and safety risk assessment is not enough. Employers are expected to assess where sexual harassment risk is elevated in their own organisation — for example, work involving alcohol, late-night or lone working, customer-facing roles, power imbalances between senior and junior staff, or a workforce with a high proportion of casual, agency or younger workers — and to document the steps taken to mitigate each risk.

2. Have a standalone, well-communicated anti-harassment policy

A policy needs to exist, but it also needs to be current, easy to find, written in plain language, and actually read by staff — not buried in an onboarding pack nobody revisits.

3. Provide clear, accessible reporting routes

Employees need more than one way to raise a concern, including routes that don't require reporting directly to the alleged harasser's manager or to a manager who is themselves implicated. Reporting channels should be genuinely confidential where possible, and staff need to trust that raising a concern will not damage their position. Where a report does surface, it needs to be handled properly and consistently — our guide to conducting workplace investigations sets out how to run that process fairly, and our guide to handling whistleblowing disclosures is relevant where a report touches on wider misconduct or a protected disclosure.

4. Deliver regular, role-appropriate training

Training needs to go beyond a one-off e-learning module ticked off years ago. It should cover what harassment looks like, how to report it, and — critically — a separate, more detailed layer of training for managers and anyone handling complaints, since their responsibilities under the duty go further than general staff awareness.

5. Address harassment by third parties

Harassment doesn't only come from colleagues. Customers, clients, contractors, patients, and members of the public can also harass employees, and the preventative duty expects employers to consider this risk too — particularly in customer-facing, hospitality, retail, care, and healthcare settings. Steps here can include clear conduct expectations communicated to customers and clients, staff training on how to respond to and report third-party incidents, and a willingness to remove or exclude a customer or client who harasses staff.

Employers should also monitor and act on near-misses and informal complaints, not just formal ones, and should keep a written record of the steps taken — if the duty is ever tested, evidence of what was actually done will matter far more than the existence of a policy document.

Manager Responsibilities

Managers carry a disproportionate share of the risk and the responsibility under this duty. Because harassment is often reported informally, in a corridor conversation or a quiet word rather than a formal grievance, managers are frequently the organisation's first and only line of defence. That means they need to know how to recognise harassment (including conduct that might not seem serious to them but has a clear effect on the recipient), how to respond appropriately in the moment, when and how to escalate, and how to avoid the common mistake of trying to informally "sort it out" in a way that leaves no record and no accountability. Managers who set the tone in team meetings, on socials, and in day-to-day banter also have a direct influence on whether harassment risk is rising or falling in their part of the business — making manager training one of the single highest-value investments an employer can make against this duty.

What Happens If an Employer Fails to Comply

The consequences of falling short sit in two separate places, and employers need to understand both.

First, the EHRC itself has independent enforcement powers under the Equality Act 2006, separate from any individual bringing a claim. It can investigate employers, issue unlawful act notices requiring an action plan, and enter into legally binding agreements — and it has publicly stated that it will use these powers against employers who fail to meet the preventative duty. This means an employer can face regulatory scrutiny even where no individual employee has brought a tribunal claim.

Second, where an employee does bring — and wins — a sexual harassment claim at an employment tribunal, the tribunal can increase the compensation awarded by up to 25% if it finds the employer failed to take reasonable steps to prevent the harassment. This uplift applies on top of whatever compensation the tribunal would otherwise have awarded, and because harassment awards for injury to feelings are already uncapped, a 25% uplift can represent a very significant additional sum. Employers should treat this uplift as the sharpest immediate financial incentive to take the duty seriously, since it converts "we didn't have good preventative measures" from a reputational problem into a quantifiable cost.

How This Differs From Simply Having an Anti-Harassment Policy

This is the point that catches out the most organisations. Before October 2024, many employers reasonably believed that having an anti-harassment policy in the staff handbook, covered briefly at induction, was sufficient. Under the new duty, it is not. A policy alone is passive: it sits in a drawer until someone complains. The preventative duty demands an active, evidenced, and ongoing programme — a documented risk assessment specific to the organisation, live reporting routes people actually trust, recurring training rather than a single session years ago, active consideration of third-party harassment, and a demonstrable record that all of this is kept under review.

The Employment Rights Act 2025 raises the bar again. It strengthens the standard from "reasonable steps" to "all reasonable steps" and reintroduces employer liability for harassment of staff by third parties such as customers and clients — changes due to take effect from October 2026. In practice, that means the evidential bar for demonstrating compliance is rising just as the current duty is bedding in, and employers who treated October 2024 as a one-off compliance exercise rather than an ongoing programme will need to revisit their approach again.

Frequently Asked Questions

Does the preventative duty apply to all employers, regardless of size?

Yes. The duty applies to all employers with employees, whatever the size of the organisation. What counts as "reasonable" will scale with the employer's size and resources, but small and medium-sized employers are not exempt from having a risk assessment, policy, reporting routes, and training in place.

Do I need a separate policy just for sexual harassment, or is a general dignity-at-work policy enough?

A general dignity-at-work or bullying and harassment policy can form part of the picture, but the EHRC's guidance expects sexual harassment to be clearly and specifically addressed within it — not folded in so generally that staff can't identify what conduct is covered or how to report it.

Can an employee bring a tribunal claim just for breach of the preventative duty on its own?

No. An individual cannot currently bring a standalone tribunal claim purely for an employer's breach of the preventative duty. The duty is enforced by the EHRC in its own right, and it also feeds into individual claims as the basis for the up-to-25% compensation uplift where a harassment claim succeeds.

What is the single most important step for a smaller employer to take first?

Start with a written, organisation-specific risk assessment and make sure staff have a reporting route they actually trust. Policies and training matter, but without an honest assessment of where the real risks sit in your business, and a route people will genuinely use, the rest of the compliance effort is built on guesswork.

Getting Your Organisation Ready

The preventative duty rewards employers who can show their work: a documented risk assessment, a policy that's actually read, reporting routes staff trust, and training that's kept current for both general staff and managers. With the Employment Rights Act 2025 raising the bar again from October 2026, now is the moment to move from a policy sitting in a drawer to a genuinely preventative programme. Learnsignal's CPD courses include workplace conduct and harassment prevention training designed to help employers evidence exactly these reasonable steps — a practical way to get staff and managers up to speed before the next stage of the law arrives.