What's new in UK employment law: From "reasonable" to "all reasonable" steps, a closer look at the strengthened sexual harassment duty for employers

From 30 October 2026, UK employers will be under enhanced obligations to prevent sexual harassment at work when provisions of the Employment Rights Act 2025 (ERA25) change the existing duty to take “reasonable steps” to prevent sexual harassment of employees in the course of employment to a duty to take “all reasonable steps”. The tougher standard imposed by the word “all” is significant, making it clear that UK employers must take every step it would be reasonable for them to take rather than relying on a set of reasonable preventative measures. 

These developments are part of a range of measures aimed at cracking down on inappropriate behavior at work. With increased responsibility for employers, the changes expose the ill-prepared to litigation, increased financial liability, Equality and Human Rights Commission (EHRC) scrutiny and reputational harm.

How is the preventative duty changing?

Since 26 October 2024, employers have been under a positive duty to take reasonable steps to prevent sexual harassment of employees in the course of their employment, including by third parties. The ERA25 inserts the word “all” into that duty.

The preventative duty does not change in any other way – it continues to apply to all employers, whatever their size or sector, and “in the course of employment” remains broad, encompassing off-site working, training, conferences, client meetings and work social events.

What does “all reasonable steps” mean?

There are powers within the ERA25 for the government to specify, in regulations, what steps it is reasonable for employers to take, including measures such as risk assessments, action plans, reporting channels, and complaints handling. These powers are activated on 30 October 2026, although regulations are not expected until 2027 or 2028. 

In the meantime, we have existing guidance and case law on “all reasonable steps” in the context of an employer’s statutory defence to vicarious liability for harassment. Whilst this is different to the preventative duty, we would expect consistency in the approach to interpretation. 

The statutory defence is notoriously difficult for employers to rely on. EHRC guidance says an employer has only taken all reasonable steps “if there are no further steps they could reasonably have been expected to take”, even if a particular step might not have prevented the harassment. This means employers who are already taking numerous proactive preventative steps will not necessarily establish compliance. Having strong, clear policies in place and a regular training programme is unlikely, without more, to be enough — a strong policy will not help if a known risk is left unaddressed, and equality training will be insufficient if it has become stale or irrelevant to the audience. Cost, inconvenience or uncertainty about the effectiveness of a step will also not necessarily justify leaving it untaken as a preventative measure. 

The test is one of reasonableness, not perfection. Assessed objectively, reasonableness depends on the employer's size, sector, resources and working environment. To be able to establish that they have taken every step that it is reasonable for them to take, employers will need a proper understanding of the specific risks in their organisation, which may vary across different teams, roles or locations. A risk assessment will be vital for this purpose. 

Consequences of non-compliance

There is no freestanding claim for breach of the preventative duty, but where a sexual harassment claim succeeds, compensation may be increased by up to 25 per cent. Compensation before any uplift is uncapped. Employers facing sexual harassment allegations should expect claimants to assert a breach of the preventative duty and should be prepared to disclose documents showing the steps they have taken.

In addition to litigation, the EHRC has power to intervene where the preventative duty is breached, or is suspected of being breached. It can investigate and enforce, including through unlawful act notices, action plans, binding agreements and injunctions, even where no claim has been brought. 

What should employers do?

We recommend UK employers take the following steps:

• Revisit risk assessments. These are not static documents and should be reviewed regularly, but the higher standard makes it especially important to reassess where risks exist (remembering common risk factors such as power imbalances, alcohol, offsite events, social media and remote working) and to analyse whether there are any further reasonable steps which could be taken. Consulting staff or employee groups may help with this process. Steps to be taken to address each risk should be noted, and reasons for rejecting any measure documented. 
• Review and update policies, reporting channels and third-party controls. Ensure relevant policies are not only consistent with current law and EHRC guidance but that they cover third-party harassment and have clear, accessible reporting routes including an anonymous option. Consider visitor communications, and provisions in contracts with clients and suppliers, to set conduct expectations.
• Keep training tailored and current. Training is a vital measure for reminding staff of acceptable standards of workplace behaviour and how to respond to concerns. Training must be specific to the business and its working environment and refreshed regularly; generic or out-of-date training is unlikely to be a reasonable step. Additional training on spotting issues and handling complaints may be appropriate for some.   
• Strengthen investigations and governance. Thorough internal investigations help to identify and address weaknesses, feeding into risk assessments and prevention measures. It is recommended that a designated senior lead takes ownership of the risk assessment and action plan, including a record of steps taken or rejected, and ensures it is revisited regularly.
• Think ahead. The duty is anticipatory, so careful consideration should be given to where risk could arise, as well as where issues have arisen in the past. Responding after the event will not, on its own, satisfy the duty if a preventative step has been unreasonably overlooked.