UK employers review harassment risks ahead of tougher October duty

Workplace harassment laws are set to become significantly tougher from 30 October. Under the Employment Rights Act, the existing duty on employers to take reasonable steps to prevent sexual harassment will be strengthened, requiring them to take all reasonable steps. At the same time, employers will face new liability for harassment of their employees by third parties unless they have taken all reasonable steps to prevent it.

For employers, the changes put renewed focus on prevention and, crucially, whether they have properly identified where the risks lie within their organisation. So, with the deadline approaching, what should HR teams be doing now to make sure their approach is sufficiently robust? We’ll speak to discrimination expert Susi Donaldson about that.

The changes build on the preventative duty introduced two years ago, but from 30 October employers will have to meet a higher standard. What amounts to “all reasonable steps” will depend on the particular organisation and the risks it faces.

Further regulations will eventually set out some of the steps employers must take to prevent sexual harassment, potentially including risk assessments, policies, reporting arrangements and the handling of complaints. But those regulations will come later, at some point in 2027 probably, and in the meantime employers must be ready to meet the new higher standard from 30 October.

So what difference will this change make to employers in practice? Earlier Susi Donaldson joined me by phone from Glasgow and I put that question to her: 

Susi Donaldson: “The change very much raises the bar. So, from 30th October, employers will need to take all reasonable steps to prevent sexual harassment. They'll need to be able to show that they have properly identified the risks in their particular workplace and have taken appropriate steps to address them. It's worth bearing in mind that the preventative duty is underpinned by EHRC guidance, which comprises eight key steps that employers should be taking to prevent sexual harassment in the workplace. So, developing an effective anti-harassment policy, engaging with staff, assessing, and taking steps to reduce risk, ensuring effective reporting mechanisms are in place, rolling out training, handling complaints, dealing with third-party harassment, and monitoring and evaluating actions. The EHRC has stressed that these are not exhaustive steps, but they are the key practical measures that it expects employers to consider when discharging the preventative duty and, given the bar is going to be set even higher as of October, the reality is that an employer will struggle to evidence that they have discharged the duty if they have not implemented steps under each of these pillars. Another point, which I think is particularly interesting, is that the EHRC appears to attach particular importance to risk assessment. So it expressly states in the guidance that an employer is unlikely to be able to comply with the preventative duty unless they carry out a proper risk assessment. So it does make sense as all the other actions flow from that, and it means that carrying out a proper risk assessment is your essential starting point. We recommend that you look beyond generic policies and consider where, when, and how, harassment might arise in in your organisation, which employees or roles may be particularly exposed, and what preventative measures are appropriate to those particular risks. You also need to be able to demonstrate your reasoning. So, if a problem arises, you need to be able to explain what risks you've identified, what steps you've considered, and why you've decided on the measures that you've taken and, as I say, the stronger duty does make a generic or tick box approach increasingly difficult to defend.”

Joe Glavina: “When employers review their harassment risk assessments, how can they make sure they reflect what is actually happening on the ground, including risks that may never have been formally reported?

Susi Donaldson: “You need to look at your organisation's actual experience rather than starting with assumptions. So, you should consider what employees themselves are experiencing, and be alert to particular departments, locations, or working arrangements where risks might be higher including, of course, the known secrets that may be understood within a workforce but are often never formally reported. So consider the circumstances that can increase risk and those can include sector-specific risks, online risks, lone working, power imbalances, regular interaction with contractors, clients, customers, or other third parties and make sure you treat the risk assessment as a live document because it’s not a ‘one and done’ exercise. Risks can, of course, change, and employers need to keep their assessments under review using employee engagement,, and what they learn within the organisation to ensure that the assessment continues to reflect what is actually happening on the ground.”

Joe Glavina: “At the EDI Conference we held for clients back in May, close to 40% of clients said they thought third party harassment was potentially their biggest risk. What should employers be doing to identify and manage that risk?”

Susi Donaldson: “You need to map where your employees interact with third parties and identify where the greatest exposure lies. The risks will obviously differ between roles and sectors so you need to consider when and where third-party harassment could occur, and which employees may be particularly exposed. So put measures in place that reflect the actual risks identified, rather than adopting a one-size-fits-all response. These could include setting behavioural standards, ensuring policies address third-party harassment specifically, establishing reciprocal expectations and contractual safeguards with client suppliers and other third parties and, of course, empowering employees and managers to act as active bystanders. The new third-party provisions, which are coming in October, do make this particularly important. Employers, as of October, may be liable where a third-party harasses an employee in the course of their employment and the employer has failed to take all reasonable steps to prevent that. It’s also worth noting that the protection extends beyond sexual harassment, so employers should be extending their existing risk assessments to consider third-party harassment across all the protected characteristics.”

So, as you heard there, a proper risk assessment is the starting point so you can understand where harassment risks actually lie within your business. Susi and the team are currently helping a number of clients with that exercise, helping to prepare for the new duty in advance of that 30 October deadline. If you would like help with this please do contact Susi – her details are on screen for you.