Many UK employers responded to the October 2024 prevention duty by updating a policy, sending round some sexual harassment training, and moving on. From 30 October 2026, that stops being a safe answer. This guide covers what changes, which training each group needs, how often to refresh it, and the part most guidance skips: the records that prove you acted.
General guidance, not legal advice. For specific situations, speak to an employment lawyer.
What Changes on 30 October
The preventative duty gets stricter. Section 40A of the Equality Act 2010 has required reasonable steps to prevent sexual harassment since October 2024. Section 20 of the Employment Rights Act 2025 changes that to all reasonable steps.
Third-party liability returns. Under section 21, an employer is liable if a third party harasses an employee in the course of their work and the employer failed to take all reasonable steps to prevent it. This covers harassment related to protected characteristics such as race, disability and religion, not only sexual harassment.
The stakes: tribunals can increase sexual harassment compensation by up to 25% where the duty was breached, and the EHRC can enforce the duty independently. Three related changes add to the exposure:
- Since 6 April 2026, a report of sexual harassment counts as a protected disclosure under whistleblowing law.
- For events on or after 1 October 2026, most tribunal claims can be brought within six months rather than three.
- Section 22, which also comes into force on 30 October, lets the government make regulations specifying reasonable steps (covering areas such as risk assessments, policies, reporting and complaints). It has not made them. Until it does, there is no statutory checklist.
Acas confirms the 30 October date. The formal instrument is the Employment Rights Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/1065), which brings sections 20, 21 and 22 into force that day.
What "All Reasonable Steps" Means
All reasonable steps means doing everything that is reasonable in your circumstances to prevent sexual harassment, not just a sensible amount. If a tribunal finds one further reasonable step you could have taken, the duty is likely breached.
The wording matches the existing employer defence in section 109(4) of the Equality Act, so tribunals already know how to apply it. What is reasonable still depends on your size, sector and risks, but within those, the bar is completeness. Expect questions like:
- When did you last assess the risk of harassment, including from customers?
- Can you show staff received and understood the policy?
- Was everyone trained, including managers and new starters, and how recently?
- Did the reporting route work, and how were complaints handled?
Each is answered with evidence, not intentions.
Third-Party Harassment and Who's Most Exposed
Third parties include customers, clients, patients, guests, contractors and the public. The old provisions, repealed in 2013, only applied after repeated known incidents. The new duty has no such threshold.
Highest-risk settings include hospitality (late hours, alcohol), retail (high volume, lone shifts), care and healthcare (personal care, home visits), lone and mobile workers, and client-facing roles (events, site visits, video calls).
Your risk assessment must name these situations specifically. "Customers may behave inappropriately" is not an assessment; "one manager on site for Friday late shifts with intoxicated guests" is, and it points to the controls you need. These sectors also share high turnover and multiple sites, which makes keeping everyone trained an ongoing operational job, not a one-off.
Why Sexual Harassment Training Is One Step, Not the Whole Duty
The EHRC's eight-step guide for employers sets out what prevention looks like:
- An effective anti-harassment policy
- Engaging staff
- Assessing and reducing risk
- Encouraging reporting
- Training all staff
- Handling complaints properly
- Dealing with third-party harassment
- Monitoring and evaluating
A 100% completion rate does not, on its own, show you took all reasonable steps. A stale risk assessment or a broken complaints process will still show. But good training makes the other steps work, and the platform that delivers it can also record policy acknowledgements, brief staff on reporting routes, and give leaders the data to review.
Who Needs Sexual Harassment Training, and Which Kind
- All staff: what harassment is, banter vs harassment, bystander options, and how to report using your own policy and routes.
- Managers: how to receive a disclosure, escalate, protect the reporter and act when a customer crosses the line. Most complaints land here first, so a short module plus a live session works well.
- Customer-facing and lone workers: scenario-based training on third-party harassment: what to say, when to withdraw, when to refuse service, how to report.
- Leaders: their own conduct, culture-setting, oversight of risk and complaints data, and handling allegations against senior people.
- New starters: core training at induction, before they work unsupervised in high-risk roles.
Five audiences, different content, and a workforce that changes monthly. By hand, that is spreadsheets and chasing. In an LMS, it is groups and assignments you set up once.
Give every role the right training, and prove it
TrainMeUK assigns different harassment training by role, location or department, chases completion with reminders and escalation, and records every result against the person. Try it free for 14 days, with full access and no credit card.
How Often to Refresh Sexual Harassment Training
The law sets no interval, but the case law shows why it matters. In Allay (UK) Ltd v Gehlen (EAT, 2021), a race harassment case under the same all reasonable steps wording, the employer relied on equality training staff completed in 2015. The tribunal found it "clearly stale"; refreshing it was a reasonable step not taken, so the defence failed. Training you can't show is current may be treated as worn off.
A defensible pattern: annual refreshers for all staff, more often for high-risk roles, triggered refreshers after a complaint, policy change or promotion to manager, and induction training for every new starter. The weak point is memory: someone has to notice training is about to lapse. An LMS that reassigns it automatically removes that risk. Shorter, repeated training also sticks better; see the spacing effect and why training fades so fast.
What Training Records Prove You Took All Reasonable Steps
If a claim arrives in 2027 about events in 2026, you will need to show what was in place at the time, for that person and their team. Aim for:
- Risk assessment: dated, specific (including third-party risks), with review history.
- Policy acknowledgement: a record that each person received and acknowledged it.
- Per-person training records: course, date assigned, date completed, result and refresher date, showing the right training reached the right roles on time.
- Manager sessions: attendance and content covered.
- Communications: staff briefings, customer notices and contractor terms.
- Complaints log: each report, actions taken and outcome.
- Monitoring: surveys, complaints analysis and evidence leadership reviewed the plan.
Two tests: can you produce the record for one named person quickly, and can you show who was overdue and what you did about it? If either takes a week of spreadsheet archaeology, fix that first.
A Three-Week Plan to Meet the Duty
Whether you are racing the 30 October start date or catching up after it:
Week 1: assess and decide
Update your risk assessment with third-party risks. Check the policy covers third parties and has a reporting route that bypasses line management. Pull your training records: who is untrained, overdue or waiting? Decide which groups need which training.
Week 2: deliver and communicate
Assign all-staff training and the policy acknowledgement. Schedule manager sessions. Brief customer-facing staff. Put up customer notices and start updating contractor terms.
Week 3: chase, record and review
Chase incomplete training and record reasons for any gaps. Test your reporting routes. Set refresher dates and induction rules. Record a dated leadership review of what is done and what remains.
How an LMS Helps
All reasonable steps rewards completeness and currency: everyone trained, on the right content, recently, with proof. That is exactly what a learning management system is for.
| Spreadsheets and email | A learning management system | |
|---|---|---|
| Assigning by role | Manual lists, re-checked whenever someone joins or moves | Groups by role, site or department |
| New starters | Depends on someone remembering | Built into joining, so no gap opens |
| Chasing | Reminder emails by hand | Automatic reminders and escalation |
| Refreshers | A calendar entry someone must notice | Reassigned before training lapses |
| Policy acknowledgement | "Please read" emails, no record | Recorded against each person |
| Proving understanding | Attendance, at best | Assessment results stored |
| Answering a tribunal | Days of collating | A per-person record in minutes |
When comparing platforms, check that it can assign by group, refresh before expiry, record policy acknowledgement, include live manager sessions, and produce per-person records fast. And it must be quick enough to roll out before you need it.
How TrainMeUK Helps
TrainMeUK is a training and compliance platform for UK organisations on Microsoft 365, built for exactly this: assign the right training, get it done, keep it current, and prove it.
- Ready-made courses: a dedicated Sexual Harassment at Work course plus Anti-Harassment and Bullying Prevention, each ending with an assessment. Use the course builder to add content on your own reporting routes.
- Role-based assignment: dynamic groups by role, location or department, across every site.
- Manager programmes: Learning Pathways combine e-learning, live Teams sessions created from inside TrainMeUK, and self-assessment, with optional line-manager sign-off.
- Policy acknowledgement: recorded like a course completion, with the same reminders and reporting.
- Chasing done for you: assignment, reminders, escalation, certificates and reporting in one closed loop.
- Automatic refreshers: courses with an expiry are reassigned around 14 days before the certificate lapses. That is the Allay problem solved in a setting.
- Evidence on demand: completions, results, dates and certificates held against each person.
- Fast to start: Microsoft 365 single sign-on, and core admin tasks take minutes to learn.
To be clear: TrainMeUK will not write your risk assessment or run your investigations, and no course on its own satisfies the duty. It makes the training and evidence steps, the easiest to let slip, reliable.
Frequently Asked Questions
Is sexual harassment training a legal requirement in the UK?
No law names it as mandatory in itself, but employers must take reasonable steps to prevent sexual harassment, rising to all reasonable steps from 30 October 2026. The EHRC lists training as one of its eight steps, so it is very hard to meet the duty without it. Training alone is not enough; it must sit alongside a risk assessment, policy, reporting routes and complaint handling.
What does "all reasonable steps" mean for employers?
Doing everything reasonable in your circumstances to prevent harassment, not just a sensible amount. The wording mirrors the section 109(4) Equality Act defence, where tribunals ask whether any further reasonable step was available. No regulations listing specific steps exist yet, so the EHRC guidance is the best benchmark.
Are employers liable if a customer sexually harasses a member of staff?
From 30 October 2026, yes, if it happens in the course of the employee's work and the employer failed to take all reasonable steps to prevent it. This also covers harassment related to characteristics such as race, disability and religion, with no requirement for previous incidents.
How often should sexual harassment training be refreshed?
The law sets no interval, but in Allay (UK) Ltd v Gehlen (2021) the Employment Appeal Tribunal found that stale training did not support an all reasonable steps defence. Annual refreshers are a common baseline, with more frequent training for high-risk roles and refreshers after complaints, policy changes or promotion. An LMS that reassigns training before it lapses stops refreshers slipping.
How can an LMS help employers prove they prevented sexual harassment?
It assigns the right training to each role, includes new starters at induction, chases completion, reassigns refreshers before they lapse, and records each person's completion, result and policy acknowledgement. That gives you a per-person evidence trail a tribunal can follow. It does not replace your risk assessment, reporting routes or complaint handling.
Sources: Employment Rights Act 2025; SI 2026/1065; Equality Act 2010, s.40A; Acas; EHRC eight-step guide; Allay (UK) Ltd v Gehlen (EAT, 2021).
Related Articles
Mandatory Training Requirements for UK Businesses
What UK employers must train on, by sector.
Read More →The Spacing Effect
Why short, repeated training beats one annual session.
Read More →The Ebbinghaus Effect
Why training fades so fast.
Read More →Be ready for 30 October, and able to prove it
Start a free 14-day trial with full access and no credit card. Add your team, pick the harassment courses from the ready-made library, assign them by role, and watch your records build. Prefer a walkthrough? Book a demo.