From October 2026, the answer becomes far more clear, and far more serious for UK employers.
Two legal duties are changing, and together they reshape how businesses must protect their people. One relates to sexual harassment, where the bar rises to “all reasonable steps”. The other the focus of this piece introduces a brand‑new duty: employers will be directly liable for third‑party harassment.
As always, I’m writing this through a Starfish People HR lens: calm, clear, human‑first, and rooted in practical action.
What the new duty actually means
If a customer, client, contractor or member of the public harasses one of your employees, you’ll be required to show the steps you took to prevent it. Not vague intentions. Not “we would have dealt with it if…”. Actual evidence.
This applies across all protected characteristics age, disability, gender reassignment, race, religion or belief, sex and sexual orientation.
If something happens and you can’t demonstrate what you did to reduce the risk, a tribunal can hold you liable.
What “all reasonable steps” looks like in real life
You can’t control every customer interaction. But you can control your policies, your processes and how your team respond.
For third‑party risk, that means:
-
A policy that names third‑party harassment not just colleague‑to‑colleague behaviour
-
Clear briefings for client‑facing staff so they know their rights and what happens next
-
A separate escalation route for incidents involving customers or clients
-
A willingness to act against the third party including ending a relationship where appropriate
-
Accurate records of what happened and what you did
Skip any of these and you’re relying on luck, not compliance.
What your policy needs to say
A strong clause on third‑party harassment should:
-
State who it covers customers, clients, suppliers, contractors, the public
-
Confirm equal seriousness it’s not a “customer service issue”, it’s harassment
-
Provide a reporting route that fits the moment usually a line manager or duty manager, not a delayed grievance meeting
-
Commit to action against the third party warnings, withdrawing service, ending contracts
-
Remove any expectation that staff must tolerate it for the sake of keeping a client happy
This clarity protects your people and your business.
What to check before October
-
Do your team know how to report a customer‑related incident?
-
Do you have a written risk assessment covering third‑party contact?
-
Have any past incidents been properly recorded?
-
Are you confident your response would stand up to scrutiny?
Q&A
Q: What is third‑party harassment?
A: Harassment of an employee by a customer, client, supplier, contractor or member of the public.
Q: What changes in October 2026?
A: Employers will be directly liable if they cannot show they took all reasonable steps to prevent third‑party harassment.
Q: What should my harassment policy include?
A: A clear definition of third‑party harassment, a real‑time reporting route, equal seriousness, and a commitment to act against the third party.
Q: Can staff refuse to serve someone who harasses them?
A: Yes. Employees should not be expected to tolerate harassment to preserve a customer relationship.
Q: What evidence do employers need?
A: Records of incidents, actions taken, staff briefings and a risk assessment covering third‑party contact.
Getting ahead of the deadline
At Starfish People HR, we can review your policy, strengthen your processes and help you build a calm, human‑first framework that protects your people and your organisation.
If a customer or client has already caused concern or you simply want to be ready feel free to contact us and we’ll get you on the front foot.
If your stuck on this or another tricky people decision?
Don’t guess. Don’t stress.
Get focused, practical guidance that works for your business.
Book a Human‑First HR Clarity Session with me
You’ll leave with:
- Clear, actionable guidance
- A calm, experienced perspective
- Practical options without jargon
- A human‑first approach that protects your business
- No scripts and no sales pitch
