Employment Rights Act 2025, from 30 October 2026, UK wide
Sexual Harassment Risk Assessments
Since 26 October 2024 employers have had a positive duty to take reasonable steps to prevent sexual harassment. On 30 October 2026 that bar rises to all reasonable steps with liability for harassment by third parties. AL23 Safety produces the risk assessment and control framework that evidences those steps, for clients UK wide.
What is a sexual harassment risk assessment?
A documented account of the steps you considered, took and rejected
A sexual harassment risk assessment identifies where in your operation harassment is more likely to occur, who is exposed, what controls already exist and what further steps are reasonable. It is a risk assessment in the ordinary health and safety sense, applied to a behavioural risk rather than a physical one.
There is no statutory template and, unlike the general risk assessment duty, no statutory obligation to write it down. Recording is evidential. It is the practical way to show a tribunal or the Equality and Human Rights Commission what you considered and why. An unrecorded assessment is very difficult to defend after an incident.
The Equality and Human Rights Commission names risk assessment as step three of its eight step approach for employers, which means the assessment is not an optional extra sitting beside the guidance. It is part of it.
Who needs one
Every employer in scope of the Equality Act, with the exposure concentrated in certain patterns
The preventative duty applies to all employers. What varies is the size of the exposure and therefore the depth the assessment needs. These patterns raise it sharply.
- Customer, client, patient and public facing work, including hospitality, retail, health and social care, transport, security and leisure
- Workplaces where alcohol is present, whether licensed premises, client entertaining, conferences, offsites or seasonal events
- Steep power imbalances, where an individual controls shifts, tips, references, progression or visa sponsorship
- Insecure work, including zero hours, agency, casual, probationary, fixed-term and sponsored migrant workers
- Lone or isolated working, home visits, night shifts, remote sites and paired travel, which is why this work often runs alongside a lone worker risk assessment
- Non-diverse teams, isolated minorities and young workers, apprentices and work experience students
- Overnight stays and work-related social events held off site and outside working hours, which still take place in the course of employment
The regulations that apply
Your legal framework, in plain terms
This is a two stage change and the difference between the stages matters commercially. The Worker Protection (Amendment of Equality Act 2010) Act 2023 received Royal Assent on 26 October 2023 and came into force on 26 October 2024. It inserted a preventative duty into the Equality Act 2010 and a compensation uplift. The Employment Rights Act 2025 then raises that duty and extends liability to third parties with effect from 30 October 2026.
Equality Act 2010 section 40A, in force since 26 October 2024
An employer must take reasonable steps to prevent sexual harassment of its employees in the course of their employment.
Equality Act 2010 section 124A
Where a tribunal upholds a sexual harassment claim under section 26(2) and finds that section 40A was breached, it must consider whether to increase the compensation award, up to a maximum uplift of 25 per cent.
The limits of the 2023 Act as enacted
The Bill originally contained an all reasonable steps test and a third party harassment liability. Both were removed during passage through the Lords. Section 40A is also not directly actionable, which means no worker can bring a stand-alone claim for breach of the preventative duty. It bites through the uplift and through regulator enforcement.
Equality Act 2006 sections 20 to 24
The Equality and Human Rights Commission may investigate, issue an unlawful act notice, require an action plan, enter a binding agreement or seek an injunction. It can act on the preventative duty without any individual having been harassed.
Employment Rights Act 2025, in force 30 October 2026
Section 40A becomes all reasonable steps. Third party harassment liability is reinstated and extended beyond sex to the other relevant protected characteristics, with a defence that the employer took all reasonable steps. The 25 per cent uplift continues to apply.
Three further dates matter to the same programme. From 6 April 2026 a disclosure about sexual harassment is a qualifying disclosure for whistleblowing purposes. The Fair Work Agency is also established on that date. From 1 October 2026 employment tribunal time limits extend from three months to six. Restrictions on non-disclosure agreements in discrimination and harassment cases are expected in 2027 and have not commenced.
One scope point. Discrimination law is devolved in Northern Ireland, which means these provisions apply in England, Wales and Scotland. We work UK wide and we flag the difference where a client operates across the Irish Sea.
What the assessment covers
Where harassment is likely and who is exposed
- Scope definition, naming the sites, teams, roles, shifts, third parties and events the assessment reaches
- Power imbalance mapping, including who controls shifts, tips, references, progression and sponsorship
- Workforce composition by team and shift, identifying isolated individuals rather than reporting headline diversity percentages
- Contract type and job security across the population, including agency, casual and sponsored workers
- Lone, isolated, night and travelling work, plus work carried out inside a customer's premises
- Alcohol exposure across trading, client entertaining, conferences, offsites and seasonal events
- Third party exposure from customers, clients, patients, service users, suppliers, contractors, delivery drivers, fans and spectators
- The physical environment, covering changing facilities, accommodation, confined workspaces, blind spots, lighting and where surveillance is and is not appropriate
- Digital channels, covering messaging apps, group chats, social media, video calls and shared drives
- Culture indicators drawn from complaint records, exit interviews, grievance data, turnover and observed tolerance of banter
- Existing controls tested honestly for whether each one works, including the policy, reporting routes, training and record keeping
- Further steps considered, with the reason recorded for every step you decide not to take
That last item is the heart of the document from 30 October 2026. Under all reasonable steps a tribunal can identify one further step you did not take and find the duty breached on that basis alone, even where you did a great deal. The window between now and October 2026 is the time to close gaps and to record rejected options with reasons.
Our process
Gather evidence, engage staff, record what you reject
- 01
Evidence gathering
We review the anti-harassment policy, the reporting routes, training records, complaint data, exit interviews and any previous grievances, then benchmark them against the Equality and Human Rights Commission eight step guide published on 26 September 2024.
- 02
Engagement
We run confidential staff engagement, which may be a survey, focus groups or one-to-one conversations depending on size and sensitivity. Step two of the eight step guide requires engagement, which means a desk exercise alone will not do.
- 03
Risk assessment
We assess exposure by group, by location and by third party interaction, with the evidence base recorded against each finding.
- 04
Control framework
We set out further reasonable steps, cost and effort them, then record what you adopt and what you reject with the reason for each rejection.
- 05
Action plan and review
We issue the plan with named owners and dates, then set review triggers, meaning an incident, an organisational change or a new site or contract, with an annual review as the minimum.
What you get
The rejected steps register that carries the weight
- A written sexual harassment risk assessment with the evidence base recorded against every finding
- A findings report mapped to all eight steps of the Equality and Human Rights Commission guide, showing where you meet each step and where you do not
- A rejected steps register, recording each option considered, the decision and the reason, which is the document that carries the most weight after October 2026
- An anonymised engagement report giving themes without identifying individuals
- A control framework covering third party harassment, including customer facing signage, contractual terms with suppliers and venues, plus the escalation route for staff
- An action plan with owners and dates, plus a review schedule and the triggers that force an early review
What we need from you
Your policies, your complaint data, a senior sponsor
- Your current anti-harassment policy, grievance procedure, staff handbook and any code of conduct
- Complaint, grievance, turnover and exit interview data for the past two to three years, anonymised
- Training records showing who has been trained, on what and when
- A list of sites, shifts, third party relationships and regular work-related events
- A senior sponsor able to authorise the further steps the assessment identifies
Why AL23 Safety
We assess the risk but stay in our lane
Accountable
When something is non-compliant, we say so clearly and set out the fix. If your policy does not address third party harassment or your reporting route runs through the person people are complaining about, the report says so.
Clear about our lane
We provide the risk assessment and the control framework as safety and risk professionals. We do not give employment law advice. Contract drafting, disciplinary decisions, settlement and tribunal strategy are matters for your employment lawyers or HR advisers. We work alongside them rather than around them.
Practical, not just compliant
The output is a document your managers can use, not a legal essay. Every further step is costed and owned.
UK wide
We assess single sites, national estates and multi-venue operations across the UK from our Manchester base.
Talk to us before October 2026
The gap closing window is now
The duty already exists. What changes on 30 October 2026 is how hard it is to satisfy. A short call will tell you whether your current position is closer to reasonable steps or to all reasonable steps.
Common questions
Answers, up front
Cannot see your question? Get in touch and we will answer it directly.
Contact usSection 40A contains no recording requirement, which means strictly no. In practice yes. The duty is judged on the steps you took. An undocumented step is extremely hard to evidence to a tribunal or to the Equality and Human Rights Commission months or years later. Treat recording as the point of the exercise.
Under the current test you can point to a proportionate package of measures and argue that it was reasonable. Under all reasonable steps, from 30 October 2026, a tribunal can ask whether any further step was reasonable and available. If one was, the duty is breached even though you did a great deal. That is why recording rejected options and the reasons for rejecting them becomes the most valuable part of the file.
Not as a stand-alone claim. Section 40A is not directly actionable by an individual. It bites in two ways. The Equality and Human Rights Commission can enforce it without any individual having been harassed. Where a section 26(2) sexual harassment claim succeeds the tribunal must consider an uplift of up to 25 per cent on the compensation because of the breach.
Not under a free-standing liability today, since third party harassment liability was removed from the 2023 Act during its passage. From 30 October 2026 you will be, across the relevant protected characteristics rather than sex alone, unless you can show you took all reasonable steps to prevent it. Customer facing operations should be building that evidence now.
A single site assessment is usually four to six weeks including the engagement window. Multi-site work depends on how many locations need direct engagement rather than sampling. Cost is driven by headcount, site count, the depth of engagement and whether we facilitate focus groups. Tell us your headcount, sites and third party exposure and we will quote against that.
Yes, deliberately. The Relationships area of the HSE Management Standards covers unacceptable behaviour, which means a stress risk assessment and a harassment risk assessment draw on much of the same evidence. Running them together avoids surveying the same people twice. Both feed the same health and safety audit cycle.
Related services