Sexual Harassment Prevention from October 2026: Third-Party Liability and Multi-Employer Sites

From October 2026, the employer duty to prevent sexual harassment in the UK changes in two material ways. First, the standard rises from taking reasonable steps to taking all reasonable steps - a deliberate uplift in the bar that affects how tribunals will assess employer conduct.

Second, the duty expands to cover harassment by third parties, including clients, customers, subcontractors, agency workers and visitors, not only by directly employed staff.

The change is part of the wider Employment Rights Act 2025 reform package and applies across all sectors. Construction is one of the sectors most exposed because the typical site has multiple employers operating simultaneously and frequent third-party contact built into the working day.

What Is Changing in October 2026

The existing duty came into force on 26 October 2024 under the Worker Protection (Amendment of Equality Act 2010) Act 2023, which inserted section 40A into the Equality Act 2010. Under that duty, employers must take reasonable steps to prevent sexual harassment of their employees. The Employment Rights Act 2025 makes two significant amendments that take effect in October 2026.

From taking reasonable steps to taking all reasonable steps. The change of a single word raises the bar substantially.

Under the current standard, an employer can defend a claim by demonstrating that it took reasonable preventative steps proportionate to its size and circumstances. From October 2026, the test becomes whether the employer took every reasonable step that was open to it.

In practice, this means that an employer with a workplace harassment claim will need to demonstrate not only what it did, but that there was nothing else it could reasonably have done.

Third-party harassment becomes actionable. Currently, an employer is generally not liable for harassment of its workers by clients, customers, or other non-employees unless very specific conditions are met.

From October 2026, employers will be directly liable for failing to take all reasonable steps to prevent third-party sexual harassment.

The protected workers are the employer's own staff. The category of potential harassers is wide and includes clients, customers, patients, service users, contractors, agency workers and site visitors.

A separate change took effect from 6 April 2026: any disclosure relating to sexual harassment now automatically qualifies as a protected disclosure under whistleblowing legislation. Employers should ensure their whistleblowing policies reflect this.

What All Reasonable Steps Looks Like in Practice

The Equality and Human Rights Commission technical guidance sets out the framework employers are expected to follow.

Secondary regulations clarifying what counts as a reasonable step are expected during 2027, but the EHRC guidance is the working benchmark in the meantime. The expected components of compliance are:

A documented sexual harassment risk assessment. The risk assessment is the foundation of the defence. An employer that has not assessed the risks specific to its workplace will struggle to show compliance, regardless of what other steps it has taken.
A clear, current anti-harassment policy covering both employee and third-party harassment, with named reporting routes and confidentiality safeguards.
Manager training on identifying, investigating and responding to harassment, including how to handle reports involving clients or contractors.
Refresher training for all staff on what constitutes harassment, how to report it, and what protection from victimisation looks like.
Communicated zero-tolerance messaging from senior leadership, including in supplier and client onboarding documents.
Reporting routes that work for the actual workforce, including anonymous channels for staff who feel unable to raise concerns through line management.
Documented evidence that reports have been investigated and that outcomes have been recorded.
Periodic review through staff surveys, near-miss reporting and senior management oversight.

Employers who fail to follow the ACAS Code of Practice in handling harassment complaints risk a tribunal uplift of up to 25% on any compensation award.

Third Parties: Who Is in Scope

The expanded duty covers harassment of employees by anyone who comes into contact with them in the course of work. The category is deliberately broad and includes:

Clients and customers - including site visitors, patients, service users and members of the public
Subcontractors and their workforces - particularly relevant where multiple firms operate on the same site
Agency workers placed by third-party suppliers, where the agency is the formal employer but the worker is integrated into the host's operation
Contractors and consultants engaged on a self-employed basis
Suppliers and delivery personnel visiting the site
Other employers' employees sharing the same workspace

The duty is to prevent harassment of your workers by these parties. It is not a vicarious liability for the third party's conduct, but a direct liability for the employer's failure to take all reasonable steps to prevent the harassment occurring.

Why Construction Sites Are Particularly Exposed

Construction is repeatedly cited by the EHRC and by employment lawyers as a sector facing distinctive risk. Several characteristics of the typical UK construction site combine to elevate exposure:

Multiple employers operating simultaneously. A site under the Construction (Design and Management) Regulations 2015 typically has a client, a principal designer, a principal contractor and multiple contractors and subcontractors all working alongside each other.

The new duty does not flow up or down the dutyholder chain automatically. Each employer is independently responsible for taking all reasonable steps to prevent harassment of its own workers, even when the harasser may be employed by a different firm on the same site.

Workforce composition. Construction remains heavily male-dominated in many trades. The Health and Safety Executive and the EHRC have both identified male-dominated environments as carrying elevated harassment risk for workers in minority groups.

Frequent and unstructured third-party contact. Site visits by clients, deliveries, inspections, and interactions with the public around the site perimeter are routine. Each is a third-party interaction within scope of the new duty.

Lone working and remote sites. Site supervisors, surveyors, and apprentices may visit unfamiliar locations alone or work in small teams without the immediate oversight typical of an office environment.

Existing site culture. The EHRC has acknowledged that some sites have established cultures of crude language and behaviour that may not have been challenged historically. The October 2026 standard does not allow site culture as a defence.

The CDM 2015 Connection

The CDM 2015 framework gives construction firms an existing structure for managing site-wide risk. The October 2026 harassment duty does not replace CDM duties, but it sits naturally alongside them. Specifically:

The principal contractor's duty to plan, manage and monitor the construction phase under CDM Regulation 13 already requires controls covering site induction, site rules, contractor competence and safe working procedures. Harassment risk should now be incorporated into each of these.
The Construction Phase Plan can include a section on respectful conduct, reporting routes and the principal contractor's expectations of all firms working on site, even though those firms remain independent employers.
Site induction is the practical point at which the message reaches every worker on site, regardless of which firm employs them. A site-wide induction segment on harassment, reporting routes and expected conduct is one of the most effective single steps a principal contractor can take.
Contractor onboarding can include a contractual expectation that firms working on the site have their own harassment policies and reporting procedures.
Risk assessments already required under the Management of Health and Safety at Work Regulations 1999 can be extended to cover psychosocial risks including harassment.

A principal contractor that integrates harassment prevention into its existing CDM-driven processes will be better placed to demonstrate that all reasonable steps have been taken than one that runs harassment as a separate, parallel programme.

Reasonable Steps for Multi-Employer Sites

The following are the steps employers operating on or running multi-employer sites should be considering before October 2026. None of them is a complete answer in isolation. The defence under the new duty depends on the combination.

Site-wide induction with a harassment segment. Every worker on site - regardless of employer - hears the same message at induction. Covers what harassment is, what reporting routes exist, who to contact in each firm, and what protection from victimisation looks like.

Visible signage and shared site rules. Posters in welfare facilities and site notice boards reinforce the induction message. Free-text reporting via QR codes or anonymous reporting apps removes the friction of having to ask a stranger.

Contractor and supplier onboarding requirements. Firms appointed to work on the site contractually commit to their own anti-harassment policy and reporting procedure. The principal contractor should keep evidence of these commitments.

Client and visitor briefing. Site visit protocols include a short briefing on expected conduct. Where female surveyors, junior staff or apprentices visit client sites alone, the firm should consider whether a buddy system or escort arrangement reduces exposure to risk that has been identified as foreseeable.

Documented risk assessment. Each employer with workers on site completes a sexual harassment risk assessment specific to its workforce, the site environment, and the third parties its workers will encounter. The risk assessment is updated when site conditions change or where incidents have been reported.

Reporting routes that do not require talking to a stranger. Multi-employer sites complicate reporting because the natural line manager may not be on site. Employers should provide a reporting route that does not require the worker to find a manager from their own firm in person - typically a phone line, email, or app-based channel.

Quarterly review. Reports, near-misses and survey responses are reviewed at site management level, with patterns escalated to senior leadership and contract owners.

Manager training that covers cross-employer scenarios. Managers need to know how to handle a report where the alleged harasser works for a different firm on the same site - including escalation routes, evidence preservation and the limits of their own authority.

What to Do Before October 2026

Audit your current harassment documentation. Confirm that the policy reflects the post-October 2024 duty and is being updated to reflect the October 2026 expansion. Cross-reference your harassment and bullying policy with your whistleblowing policy to confirm alignment with the April 2026 protected disclosure change.
Commission or refresh the sexual harassment risk assessment. The risk assessment is the single most important piece of evidence for the all reasonable steps defence. It should be specific to your workforce, your sites and the third parties your workers encounter.
Train managers on third-party scenarios. Most existing manager training was designed for employee-on-employee harassment. Manager training needs an explicit module on responding to client, contractor and visitor harassment, including the limits of the manager's authority over a third party.
Refresh staff training. All staff need to know what reporting routes exist and that protection from victimisation now includes whistleblowing protection on disclosures relating to sexual harassment.
Update contractor and supplier paperwork. Contractor onboarding and supplier agreements should include a harassment expectation clause and require evidence of the third party's own policy.
For construction firms, integrate with CDM 2015 processes. Update the Construction Phase Plan, site induction and site rules to incorporate harassment prevention. The principal contractor's existing CDM machinery is the most effective vehicle for site-wide reach.

How Policy Pros Can Help

Policy Pros writes the documentation employers need to demonstrate that all reasonable steps have been taken. This includes sexual harassment risk assessments tailored to your workforce and sites, anti-harassment policies covering both employee and third-party scenarios, manager guidance documents, contractor onboarding clauses and Construction Phase Plan supplements for principal contractors.

We work with construction firms, contractors and multi-site employers across the UK, and our documentation aligns with the EHRC technical guidance, the ACAS Code of Practice and CDM 2015 dutyholder responsibilities. If you operate a construction business and need site-ready documentation, see our construction policies and procedures service. For broader employer documentation, our HR policies and procedures service covers the full Employment Rights Act 2025 readiness pack, and our policy review service can audit your existing documentation against the October 2026 standard on a fixed-price basis.