Somewhere in your organisation, someone is about to be handed a spreadsheet and told to find a restaurant that can seat forty people on a Friday in December. They will compare set menus, argue over the Secret Santa limit and almost certainly give no thought to the Equality Act 2010. They should, because every party booked now will be the first of its kind under a tougher legal standard. On 30 October 2026, two changes made by the Employment Rights Act 2025 take effect together, as listed on business.gov.uk and in Acas guidance. Employers must take "all reasonable steps", not merely "reasonable steps", to prevent sexual harassment of their employees. And they become liable when a third party harasses an employee unless they can show they took all reasonable steps to prevent it. A Christmas guest list often includes exactly the people that second rule is aimed at, namely clients, suppliers and the freelancer who was invited because somebody liked them.
Two duties arriving on the same day
The first is an upgrade. Since 26 October 2024, section 40A of the Equality Act 2010 has required employers to take "reasonable steps" to prevent sexual harassment of their employees, a duty that came from the Worker Protection (Amendment of the Equality Act 2010) Act 2023. From 30 October the wording becomes "all reasonable steps", which, according to the Department for Business and Trade's factsheets, matches the "all reasonable steps" defence in section 109(4) that employers already use when sued over what an employee did. Acas puts the practical effect plainly: an employer who might previously have taken some reasonable steps is now expected to take them all, with no exceptions. What counts as reasonable still varies with size, sector and the nature of the work, and the government is explicit that no employer is exempt. An employee cannot sue over a breach of the duty on its own; if a tribunal upholds a sexual harassment claim, it examines the duty and may raise the compensation by up to 25%. The Equality and Human Rights Commission (EHRC) can also enforce the duty directly.
The second change is new. A rule in force from 2008 made an employer liable for third-party harassment only if it knew of two earlier incidents. It was repealed in 2013, and the Court of Appeal confirmed in Unite the Union v Nailard in 2018 that the repeal left the Act offering no protection in such cases. From 30 October an employer is treated as permitting third-party harassment where an employee is harassed in the course of their employment and the employer failed to take all reasonable steps to prevent it. All three forms of harassment in section 26 are covered, which means sexual harassment and harassment related to age, disability, gender reassignment, race, religion or belief, sex and sexual orientation. Employees will be able to take a claim to a tribunal.
| Question | Until 29 October | From 30 October |
|---|---|---|
| Sexual harassment duty | "Reasonable steps" (section 40A) | "All reasonable steps" |
| Harassment by customers, clients, contractors | No general protection; EHRC guidance already treats sexual harassment by third parties as within the preventative duty | Employer liable unless it took all reasonable steps, across the section 26 characteristics |
| Can the employee claim? | Not for breach of the sexual harassment duty alone | Third-party harassment claim against the employer is possible |
Who counts as a third party, and where the limits are
The factsheet's definition is short: anyone other than the employer or a fellow employee. Acas lists customers, clients, service users such as school students or patients, self-employed consultants, contractors and tradespeople, members of the public in shared spaces, and "people at conferences or events". The harassment can be online as well as in person. In an ordinary office that could mean a visitor making remarks to the receptionist, a client messaging a junior colleague late at night after a pitch, or a supplier's representative who spends the Christmas lunch targeting one member of your team.
None of this makes an employer answerable for every rude customer. The government's factsheet says trivial conduct or minor offence does not meet the definition of harassment, that a tribunal applies an objective test of whether the effect was reasonable, and that freedom of expression must be weighed in the balance. It adds that the law would not require employers "to foresee the wholly unforeseeable or police all customers' private conversations", and that the steps open to them over third parties are clearly more limited than over their own staff.
Do not read that as permission to shrug. Acas's example of an employer very unlikely to have done enough is a convenience store owner who, told by two new late-shift workers about threats and racist abuse from customers, replies that it is all part of the job and that complaining will get them fired.
What "all reasonable steps" looks like without a published list
There is no statutory checklist yet, and there will not be one on 30 October.
The government says regulations setting out specific steps are expected in 2027/28, after consultation, and even then complying with them will not replace the broader duty. Until then the best guide is what Acas and the EHRC have already published. Acas says taking all reasonable steps means taking all the steps that are reasonable for your organisation rather than just some, concentrating on prevention instead of reacting to incidents, and applying measures across the whole organisation rather than only to the people involved in a previous incident. The EHRC's eight-step guide, which the commission says it is updating, runs through a policy, staff engagement, risk assessment, reporting, training, complaint handling, third-party harassment and monitoring. For a business that has never written any of this down, a handful of documents and habits does most of the work:
- A policy that names customers and clients. The EHRC says it should state that third-party harassment will not be tolerated and explain what happens next, for example a warning to a customer, a ban, a report to the police or information shared with other branches.
- A short risk assessment. The EHRC's prompts include whether staff work alone or at night, whether they are customer-facing, whether customers or staff are drinking, and whether staff are expected to attend external events.
- More than one way to report a problem, which Acas says workers should have.
- Training pitched at your own sector, with refreshers at regular intervals.
- A written record of incidents and of any step you considered and rejected, among other things; Acas calls recording why you did not take a step a good idea.
What a small employer can leave out
Acas says taking all reasonable steps means doing what is possible with the available resources, and that some steps will not be possible for every organisation. Extra security staff, personal alarms and body cameras sit on its list for higher-risk environments, and a six-person design studio does not need any of them. It does need a policy that mentions clients, a named person staff can go to and a note on file explaining why cameras were not thought reasonable. Acas's example of an employer likely to have done enough is a nightclub owner who asked the team what would make them feel safer, spoke to a trade association and then wrote a policy covering door supervisors, alarms, cameras, code words, safe areas and incident tracking. Copy the method before the equipment list: ask the people doing the job, then write down what you did about their answers.
The Christmas party is the first real test
Responsibility does not stop at the venue door. Acas says an employer can be held responsible for discrimination "in the course of employment", meaning something linked to work, and its examples include a work party. The law firm Bates Wells adds after-work drinks, shared cabs home and WhatsApp messages to the settings that may be treated as work-related. Because the third-party rule starts on the same day, the clients and suppliers on your guest list are covered too.
Keep the party. Cancelling it is not a compliance strategy, and a booked event with a proper briefing does more for staff than an empty diary. Send the conduct reminder with the invitation rather than on the night, point to the policy, and say who people can speak to at the event and the following week. Bates Wells suggests asking particular managers to look after their own teams and stay until the end so that everyone leaves safely, which is cheap and sensible. If clients are coming, tell the colleagues hosting them that a client's behaviour is handled in the same way as a colleague's.
The tax side is the easy part: GOV.UK says a party is exempt when it is open to all employees, annual and £150 or less per person. Nothing in that test mentions conduct, so the budget and the briefing are separate jobs.
If you are the one dealing with it
The duty sits with your employer, but the evidence is yours to keep. Write down what happened on the same day, with dates, times, places and anyone who saw it, and save screenshots of any messages. Then report it in writing through the route in the policy, because an email is a record and a conversation by the coffee machine is not. The government lists stronger whistleblowing protections for workers who report sexual harassment among the changes in force since April 2026. This is general information, not legal advice, and for a live incident it is worth speaking to Acas or an employment solicitor.
If the report goes nowhere, the Acas helpline on 0300 123 1100, open 8am to 6pm Monday to Friday according to the EHRC, is the next call. For acts on or after 1 October, most employment tribunal claims now have a six-month time limit instead of three, and starting Acas early conciliation pauses the clock. Check dates carefully, since the third-party rule begins on 30 October and the date of each incident affects which rules apply.
A 45-minute job before the 30th
An afternoon is enough to do a useful amount before the 30th. Read the harassment policy and check that it mentions customers, clients and suppliers by name. Confirm that staff have at least two ways to report a problem, and put the party briefing in the diary now rather than the week before. Then write a dated note of what you decided against and why. A dated policy, a dated briefing and that note are the documents you would want to be able to produce if a claim arrived, and none of them is expensive to create.