*/
Anu Kaura looks at the strengthened employer duty to prevent harassment – in force from October. What does it mean when third parties are in the room?
Picture the scene: a client dinner runs late, the wine flows freely, and a senior contact’s behaviour towards a junior employee crosses a line. Whose problem is it? Since October 2024, employers have been under a positive duty to take reasonable steps to prevent sexual harassment of their employees, including foreseeable harassment by third parties.
From 30 October 2026, when certain provisions in the Employment Rights Act 2025 are scheduled to come into force,* employers will be required to take all reasonable steps to prevent sexual harassment and will be liable where they permit third parties to harass employees. Separately, enhanced whistleblowing protection for qualifying disclosures about sexual harassment has applied since 6 April 2026. Together, these changes represent a significant strengthening of the current framework.
When the Equality Act 2010 was amended in October 2024 to introduce a duty on employers to take reasonable steps to prevent sexual harassment, much of the initial commentary focused on internal workplace dynamics: office conduct, policies and training. That was understandable, but it was never the full picture. The preventative duty is not confined to interactions between colleagues. Employers must also address foreseeable risks of sexual harassment by third parties, including clients, customers, suppliers and others with whom employees come into contact in the course of their work. A breach of that duty does not, by itself, give an employee a standalone claim solely because the perpetrator was a third party; that gap is addressed by the 2026 reforms. As the regime beds in, it is this external dimension that many employers are finding most difficult to navigate.
The reason is obvious. An employer can, in principle, control its own workforce. It can set standards, deliver training and enforce consequences. But when the risk of harassment comes from outside i.e. from a client at a drinks reception, a customer at a corporate dinner or a contact at an industry event, the levers of control are less direct. That does not mean there is no obligation. The statutory duty is clear: employers must take reasonable steps to prevent sexual harassment of their employees in the course of employment. The source of the harassment is immaterial.
The Employment Rights Act 2025 provides for three major changes to the legal framework.
First, the positive duty in s 40A of the Equality Act 2010 will be strengthened from a requirement to take ‘reasonable steps’ to a requirement to take ‘all reasonable steps’ to prevent sexual harassment. The change does not newly shift the burden of proof: an employer already bears the burden of establishing the separate ‘all reasonable steps’ defence to vicarious liability under s 109(4). Its significance is that the positive, preventative duty itself will become more demanding. Employers will need to identify and take every step that is reasonable in their circumstances, rather than selecting only a few reasonable measures.
Second, the Act introduces an express prohibition on an employer ‘permitting’ a third party to harass an employee. For these purposes, an employer permits the harassment only where the third party harasses the employee in the course of the employee’s employment and the employer fails to take all reasonable steps to prevent it. This creates a direct cause of action against the employer and fills an important gap in the existing law. The provision is not confined to sexual harassment: it also covers harassment related to all protected characteristics to which the Equality Act’s harassment provisions apply.
Third, from 6 April 2026, the Act expressly added sexual harassment to the categories of wrongdoing that may form the subject matter of a protected whistleblowing disclosure. The usual statutory conditions still apply: among other matters, the worker must reasonably believe that the disclosure tends to show sexual harassment and that making it is in the public interest. A qualifying worker is protected from detriment and, if an employee, from dismissal because of the protected disclosure. The reform concerns sexual harassment specifically, whether the alleged perpetrator is a colleague or a third party; it is not a general whistleblowing right covering every form of harassment.
It would be a mistake to treat this as a narrow compliance exercise. The duty signals a broader cultural expectation: that employers will not sacrifice the safety or dignity of their staff in pursuit of commercial relationships. For too long, certain behaviours by clients or senior external contacts have been tolerated with a knowing shrug, explained away as the price of doing business, or as something that simply comes with client-facing work. That tolerance is no longer tenable, and the law has finally caught up with what many employees have known all along.
This is particularly acute in sectors where social interaction with clients is embedded in working culture. The legal profession, financial services, consulting, media and hospitality all involve settings in which the line between professional engagement and social informality can blur; sometimes by design. A client dinner, a chambers reception, a conference drinks event: these are not purely social occasions. They are work. And the duty to prevent harassment applies to them.
The question, as always, is what preventative steps the circumstances require. Until 30 October 2026, s 40A requires reasonable steps to prevent sexual harassment. From that date, if commenced as scheduled, employers must take ‘all reasonable steps’, both for the positive sexual-harassment duty and to avoid liability for permitting third-party harassment. Tribunals will assess this on the facts. The following measures are not exhaustive, and what is reasonable will depend on the organisation’s size, resources, sector and work. They nevertheless provide a practical starting point for employers whose staff have regular contact with third parties.
First, risk assessment. Employers should consider, in advance, which roles or situations carry a heightened risk of third-party harassment. Client-facing roles involving social hospitality, travel, or one-to-one contact with senior external figures are obvious candidates. The assessment need not be elaborate, but it must be genuine. A tick-box exercise will not satisfy the duty.
Second, clear expectations and communication. Employees should know that they are not expected to tolerate inappropriate conduct from clients or contacts, regardless of the commercial significance of the relationship. This message must come from the top. If senior leadership signals, even implicitly, that maintaining a client relationship takes priority over an employee’s complaint, the organisation will struggle to demonstrate compliance.
Third, practical safeguards at events. Where employers host or attend social functions involving external parties, thought should be given to the environment: the role of alcohol, the seniority dynamics at play, and whether staff feel able to remove themselves from uncomfortable situations without professional consequence. These considerations are not onerous. They are simply good management.
Fourth, accessible reporting mechanisms. Employees must have a clear route to raise concerns about third-party conduct, and confidence that doing so will not damage their career. This is an area where many organisations still fall short. The fear of being seen as difficult, or of jeopardising a client relationship, remains a powerful deterrent to reporting.
Fifth, training that addresses third-party risks specifically. Many organisations deliver harassment training that focuses primarily on colleague-to-colleague conduct. Training should be updated to address the risks arising from client and external contact, including practical guidance on how to respond to inappropriate behaviour and confidence that doing so will be supported.
Sixth, review of client and supplier relationships. Where particular individuals or organisations have a history of inappropriate conduct, employers should consider whether continued engagement is appropriate, or whether additional safeguards are needed. This may be commercially uncomfortable, but the duty to prevent harassment does not contain an exception for valuable clients.
The third-party dimension brings with it a particular difficulty: the imbalance of power. When harassment is perpetrated by someone who holds the keys to a deal, a client relationship, or career advancement, the victim’s options narrow sharply. Recent tribunal decisions have demonstrated an increasingly realistic understanding of how harassment is experienced when there is a significant disparity of seniority, age, or professional influence between the perpetrator and the victim.
In Obiagwu v Greystoke and Pantheon International Advisors Ltd [2025] UKET 2201555/2024, the tribunal found that a 29-year-old corporate projects executive was sexually harassed by an 83-year-old senior lawyer and director during a work trip. The harassment occurred after a client dinner, in a hotel room, following a proposed business debrief. The tribunal emphasised the significant age and power imbalance and accepted that the claimant’s reaction, freezing in shock, was entirely consistent with the experience of harassment. It did not treat her failure to raise a formal grievance, or the fact that she outwardly carried on as normal, as undermining her account.
The principles apply with equal force to third-party harassment. Where a junior employee is placed in a social setting with a powerful client, the dynamics of deference and professional vulnerability are much the same. The duty to prevent harassment requires employers to recognise this and to take it into account.
How will tribunals approach the strengthened ‘all reasonable steps’ standard? Case law on the existing s 109(4) defence shows that tribunals are willing to look beyond paper policies to examine the measures actually taken, their timing and their practical reach, rather than treating the existence of a policy as conclusive.
In Campbell v Sheffield Teaching Hospitals NHS Foundation Trust and Hammond [2025] EAT 42, the Employment Appeal Tribunal upheld the tribunal’s conclusion that the Trust had taken all reasonable steps to prevent the discriminatory conduct in question. The evidence included an induction emphasising dignity, trust and respect, annual appraisal against organisational values, visible reinforcement of those values, and mandatory equality and diversity training completed shortly before the incident. The case does not establish that training will always suffice. It illustrates instead that a tribunal will consider the combined, practical effect of the employer’s preventative measures in their specific context.
From 30 October 2026, if commenced as scheduled, the positive sexual-harassment duty will itself require ‘all reasonable steps’. Employers should therefore assess their existing measures and be able to explain the reasoning behind them. Good records of risk assessments, policy reviews, training and decisions about additional safeguards will help. Whether a particular omitted step was reasonable will remain a fact-sensitive question; the statute does not require measures that are impossible or disproportionate in the employer’s circumstances.
The law on vicarious liability also reinforces the need to look beyond the office door. In AB v Grafters Group Ltd (t/a CSI Catering Services International) [2025] EAT 126, the Employment Appeal Tribunal held that the tribunal had applied the wrong approach when deciding whether sexual harassment found by the tribunal during a car journey occurred in the course of employment. The EAT did not finally decide that question; it remitted the case for reconsideration. Its judgment confirms that the correct inquiry is whether there is a sufficient work-related connection, taking account of the whole context, rather than whether the employer knew of or formally authorised the arrangement. Social events, client hospitality, travel and other informal interactions may therefore fall within scope, but the conclusion is fact-sensitive.
For employers whose staff regularly socialise or travel with clients or other work contacts, this has real consequences. Such occasions should not automatically be treated as outside the sphere of employer responsibility. Where an event or journey has a sufficient connection with work, the preventative duty may be engaged and, from 30 October 2026 if commenced as scheduled, the third-party provision may also apply.
None of this requires employers to cancel client events or retreat from professional social life. The law does not demand the elimination of all risk. It demands foresight, proportionality and evidence of genuine preventative effort. Tribunals are well aware that workplaces involve human interaction and that social occasions cannot be entirely sanitised. The question is always whether the employer did enough in the circumstances.
What is changing is the level of scrutiny. Employers who assume that the duty is limited to internal policies and colleague-to-colleague conduct will find themselves exposed. The statutory framework is clear, and the direction of travel is unmistakable: prevention means thinking about where the risks actually lie, and in many organisations, a significant proportion of that risk comes from outside.
The most effective response is cultural rather than purely procedural. It lies in clear messaging from leadership, genuine engagement with the realities of client-facing work, and a willingness to prioritise employee safety over commercial convenience. That is not a radical proposition. It is simply what the law increasingly requires, and what employees have always deserved.
* The reforms discussed here apply in England, Wales and Scotland, but not Northern Ireland. The government’s published implementation timetable identifies 30 October 2026 for the strengthened sexual-harassment duty and the third-party harassment provisions. At the date of writing, those provisions have not yet been brought into force by a commencement instrument; future dates remain subject to parliamentary processes and may change.
Anu Kaura joined Trinity Chambers as a barrister in February 2025, bringing over 20 years of extensive legal expertise spanning in-house legal leadership, private practice and consultancy. Anu specialises in employment law, corporate governance, commercial law, data protection, property law, immigration and dispute resolution.
Picture the scene: a client dinner runs late, the wine flows freely, and a senior contact’s behaviour towards a junior employee crosses a line. Whose problem is it? Since October 2024, employers have been under a positive duty to take reasonable steps to prevent sexual harassment of their employees, including foreseeable harassment by third parties.
From 30 October 2026, when certain provisions in the Employment Rights Act 2025 are scheduled to come into force,* employers will be required to take all reasonable steps to prevent sexual harassment and will be liable where they permit third parties to harass employees. Separately, enhanced whistleblowing protection for qualifying disclosures about sexual harassment has applied since 6 April 2026. Together, these changes represent a significant strengthening of the current framework.
When the Equality Act 2010 was amended in October 2024 to introduce a duty on employers to take reasonable steps to prevent sexual harassment, much of the initial commentary focused on internal workplace dynamics: office conduct, policies and training. That was understandable, but it was never the full picture. The preventative duty is not confined to interactions between colleagues. Employers must also address foreseeable risks of sexual harassment by third parties, including clients, customers, suppliers and others with whom employees come into contact in the course of their work. A breach of that duty does not, by itself, give an employee a standalone claim solely because the perpetrator was a third party; that gap is addressed by the 2026 reforms. As the regime beds in, it is this external dimension that many employers are finding most difficult to navigate.
The reason is obvious. An employer can, in principle, control its own workforce. It can set standards, deliver training and enforce consequences. But when the risk of harassment comes from outside i.e. from a client at a drinks reception, a customer at a corporate dinner or a contact at an industry event, the levers of control are less direct. That does not mean there is no obligation. The statutory duty is clear: employers must take reasonable steps to prevent sexual harassment of their employees in the course of employment. The source of the harassment is immaterial.
The Employment Rights Act 2025 provides for three major changes to the legal framework.
First, the positive duty in s 40A of the Equality Act 2010 will be strengthened from a requirement to take ‘reasonable steps’ to a requirement to take ‘all reasonable steps’ to prevent sexual harassment. The change does not newly shift the burden of proof: an employer already bears the burden of establishing the separate ‘all reasonable steps’ defence to vicarious liability under s 109(4). Its significance is that the positive, preventative duty itself will become more demanding. Employers will need to identify and take every step that is reasonable in their circumstances, rather than selecting only a few reasonable measures.
Second, the Act introduces an express prohibition on an employer ‘permitting’ a third party to harass an employee. For these purposes, an employer permits the harassment only where the third party harasses the employee in the course of the employee’s employment and the employer fails to take all reasonable steps to prevent it. This creates a direct cause of action against the employer and fills an important gap in the existing law. The provision is not confined to sexual harassment: it also covers harassment related to all protected characteristics to which the Equality Act’s harassment provisions apply.
Third, from 6 April 2026, the Act expressly added sexual harassment to the categories of wrongdoing that may form the subject matter of a protected whistleblowing disclosure. The usual statutory conditions still apply: among other matters, the worker must reasonably believe that the disclosure tends to show sexual harassment and that making it is in the public interest. A qualifying worker is protected from detriment and, if an employee, from dismissal because of the protected disclosure. The reform concerns sexual harassment specifically, whether the alleged perpetrator is a colleague or a third party; it is not a general whistleblowing right covering every form of harassment.
It would be a mistake to treat this as a narrow compliance exercise. The duty signals a broader cultural expectation: that employers will not sacrifice the safety or dignity of their staff in pursuit of commercial relationships. For too long, certain behaviours by clients or senior external contacts have been tolerated with a knowing shrug, explained away as the price of doing business, or as something that simply comes with client-facing work. That tolerance is no longer tenable, and the law has finally caught up with what many employees have known all along.
This is particularly acute in sectors where social interaction with clients is embedded in working culture. The legal profession, financial services, consulting, media and hospitality all involve settings in which the line between professional engagement and social informality can blur; sometimes by design. A client dinner, a chambers reception, a conference drinks event: these are not purely social occasions. They are work. And the duty to prevent harassment applies to them.
The question, as always, is what preventative steps the circumstances require. Until 30 October 2026, s 40A requires reasonable steps to prevent sexual harassment. From that date, if commenced as scheduled, employers must take ‘all reasonable steps’, both for the positive sexual-harassment duty and to avoid liability for permitting third-party harassment. Tribunals will assess this on the facts. The following measures are not exhaustive, and what is reasonable will depend on the organisation’s size, resources, sector and work. They nevertheless provide a practical starting point for employers whose staff have regular contact with third parties.
First, risk assessment. Employers should consider, in advance, which roles or situations carry a heightened risk of third-party harassment. Client-facing roles involving social hospitality, travel, or one-to-one contact with senior external figures are obvious candidates. The assessment need not be elaborate, but it must be genuine. A tick-box exercise will not satisfy the duty.
Second, clear expectations and communication. Employees should know that they are not expected to tolerate inappropriate conduct from clients or contacts, regardless of the commercial significance of the relationship. This message must come from the top. If senior leadership signals, even implicitly, that maintaining a client relationship takes priority over an employee’s complaint, the organisation will struggle to demonstrate compliance.
Third, practical safeguards at events. Where employers host or attend social functions involving external parties, thought should be given to the environment: the role of alcohol, the seniority dynamics at play, and whether staff feel able to remove themselves from uncomfortable situations without professional consequence. These considerations are not onerous. They are simply good management.
Fourth, accessible reporting mechanisms. Employees must have a clear route to raise concerns about third-party conduct, and confidence that doing so will not damage their career. This is an area where many organisations still fall short. The fear of being seen as difficult, or of jeopardising a client relationship, remains a powerful deterrent to reporting.
Fifth, training that addresses third-party risks specifically. Many organisations deliver harassment training that focuses primarily on colleague-to-colleague conduct. Training should be updated to address the risks arising from client and external contact, including practical guidance on how to respond to inappropriate behaviour and confidence that doing so will be supported.
Sixth, review of client and supplier relationships. Where particular individuals or organisations have a history of inappropriate conduct, employers should consider whether continued engagement is appropriate, or whether additional safeguards are needed. This may be commercially uncomfortable, but the duty to prevent harassment does not contain an exception for valuable clients.
The third-party dimension brings with it a particular difficulty: the imbalance of power. When harassment is perpetrated by someone who holds the keys to a deal, a client relationship, or career advancement, the victim’s options narrow sharply. Recent tribunal decisions have demonstrated an increasingly realistic understanding of how harassment is experienced when there is a significant disparity of seniority, age, or professional influence between the perpetrator and the victim.
In Obiagwu v Greystoke and Pantheon International Advisors Ltd [2025] UKET 2201555/2024, the tribunal found that a 29-year-old corporate projects executive was sexually harassed by an 83-year-old senior lawyer and director during a work trip. The harassment occurred after a client dinner, in a hotel room, following a proposed business debrief. The tribunal emphasised the significant age and power imbalance and accepted that the claimant’s reaction, freezing in shock, was entirely consistent with the experience of harassment. It did not treat her failure to raise a formal grievance, or the fact that she outwardly carried on as normal, as undermining her account.
The principles apply with equal force to third-party harassment. Where a junior employee is placed in a social setting with a powerful client, the dynamics of deference and professional vulnerability are much the same. The duty to prevent harassment requires employers to recognise this and to take it into account.
How will tribunals approach the strengthened ‘all reasonable steps’ standard? Case law on the existing s 109(4) defence shows that tribunals are willing to look beyond paper policies to examine the measures actually taken, their timing and their practical reach, rather than treating the existence of a policy as conclusive.
In Campbell v Sheffield Teaching Hospitals NHS Foundation Trust and Hammond [2025] EAT 42, the Employment Appeal Tribunal upheld the tribunal’s conclusion that the Trust had taken all reasonable steps to prevent the discriminatory conduct in question. The evidence included an induction emphasising dignity, trust and respect, annual appraisal against organisational values, visible reinforcement of those values, and mandatory equality and diversity training completed shortly before the incident. The case does not establish that training will always suffice. It illustrates instead that a tribunal will consider the combined, practical effect of the employer’s preventative measures in their specific context.
From 30 October 2026, if commenced as scheduled, the positive sexual-harassment duty will itself require ‘all reasonable steps’. Employers should therefore assess their existing measures and be able to explain the reasoning behind them. Good records of risk assessments, policy reviews, training and decisions about additional safeguards will help. Whether a particular omitted step was reasonable will remain a fact-sensitive question; the statute does not require measures that are impossible or disproportionate in the employer’s circumstances.
The law on vicarious liability also reinforces the need to look beyond the office door. In AB v Grafters Group Ltd (t/a CSI Catering Services International) [2025] EAT 126, the Employment Appeal Tribunal held that the tribunal had applied the wrong approach when deciding whether sexual harassment found by the tribunal during a car journey occurred in the course of employment. The EAT did not finally decide that question; it remitted the case for reconsideration. Its judgment confirms that the correct inquiry is whether there is a sufficient work-related connection, taking account of the whole context, rather than whether the employer knew of or formally authorised the arrangement. Social events, client hospitality, travel and other informal interactions may therefore fall within scope, but the conclusion is fact-sensitive.
For employers whose staff regularly socialise or travel with clients or other work contacts, this has real consequences. Such occasions should not automatically be treated as outside the sphere of employer responsibility. Where an event or journey has a sufficient connection with work, the preventative duty may be engaged and, from 30 October 2026 if commenced as scheduled, the third-party provision may also apply.
None of this requires employers to cancel client events or retreat from professional social life. The law does not demand the elimination of all risk. It demands foresight, proportionality and evidence of genuine preventative effort. Tribunals are well aware that workplaces involve human interaction and that social occasions cannot be entirely sanitised. The question is always whether the employer did enough in the circumstances.
What is changing is the level of scrutiny. Employers who assume that the duty is limited to internal policies and colleague-to-colleague conduct will find themselves exposed. The statutory framework is clear, and the direction of travel is unmistakable: prevention means thinking about where the risks actually lie, and in many organisations, a significant proportion of that risk comes from outside.
The most effective response is cultural rather than purely procedural. It lies in clear messaging from leadership, genuine engagement with the realities of client-facing work, and a willingness to prioritise employee safety over commercial convenience. That is not a radical proposition. It is simply what the law increasingly requires, and what employees have always deserved.
* The reforms discussed here apply in England, Wales and Scotland, but not Northern Ireland. The government’s published implementation timetable identifies 30 October 2026 for the strengthened sexual-harassment duty and the third-party harassment provisions. At the date of writing, those provisions have not yet been brought into force by a commencement instrument; future dates remain subject to parliamentary processes and may change.
Anu Kaura looks at the strengthened employer duty to prevent harassment – in force from October. What does it mean when third parties are in the room?
The Chair of the Bar reports back
By Kem Kemal, CEO, Henry Dannell
By BSK Financial Planning
Mário Barroso, Head of R&D and Method Development at AlphaBiolabs
Susie Griffin on the admin that keeps barristers from billable work
Clement Cowley, Partner at The Penny Group, explains how global events can influence the performance of pensions and ISAs, and why taking a long-term approach to investing is often the most effective strategy
Kick off your career at the Bar Council’s Pupillage Fair this October – it’s one of the most valuable opportunities for aspiring barristers, says Amelia Clegg
The golden age of advocacy? David Langwallner pays homage to the filmic if contentious barrister Sir Edward Carson and some of his contemporaries
Henry Fingerhut outlines what the Bar Standards Board AI guidance means for early career barristers
The Ministry of Justice will match-fund up to 100 criminal pupillages, with grants available to criminal chambers across England and Wales. Similar to the COIC scheme, the grants will match-fund pupillages additional to those otherwise offered without government funding
Not yet, says Jacob Turner. Regulation, unlike the technology itself, is a domain the legal profession can still control
