Support from an HR consultant in Milton Keynes to prepare your business for the new third-party harassment duty arriving in October 2026.
From October 2026, the law around workplace harassment is shifting in a way that directly affects you as an employer.
A new legal duty will make you liable if a customer, client or member of the public harasses one of your employees and you haven't done enough to prevent it.
That's a significant change. Until now, your harassment obligations have mostly focused on behaviour between colleagues.
Under the new rules, the spotlight turns outward, onto people you can't directly control.
Here's what you need to know and what to do about it before the deadline.
What's actually changing in October 2026
Two separate shifts are happening at the same time.
The first is an upgrade to the existing duty around sexual harassment. The standard is moving from "reasonable steps" to "all reasonable steps." If a sexual harassment claim reaches a tribunal, you'll need to show there was genuinely nothing more you could have done to prevent it.
The second change is entirely new. It creates a standalone duty that holds you responsible for harassment carried out by third parties. Customers, clients, contractors, suppliers, members of the public. Anyone your employees interact with through their work.
This duty covers all the relevant protected characteristics, including age, disability, gender reassignment, race, religion or belief, sex and sexual orientation.
If an incident occurs and you can't demonstrate the steps you took to stop it, a tribunal can hold you liable.
Why your current harassment policy probably isn't enough
Most harassment policies are written with internal behaviour in mind. They deal with how colleagues and managers treat each other. That's fine as far as it goes, but it doesn't address the new duty.
A tribunal will want to see that you turned your mind to third-party risk specifically. If your policy simply refers to "harassment" without mentioning customers, clients or other external parties, there's no evidence you ever considered this area.
You'll need to update your policy so that it does several things clearly.
First, it should name the people it covers. Spell out that the policy applies to harassment by customers, clients, suppliers, contractors and members of the public. Don't leave it vague.
Second, your policy needs to confirm that harassment from a third party carries the same weight as harassment from a colleague. Too many businesses treat external incidents as customer service problems rather than harassment. That distinction won't hold up under the new rules.
Reporting routes need to work differently
Your internal grievance process is designed for situations where the person causing the problem is another employee. That process doesn't fit when the perpetrator is a customer standing in front of your staff member right now.
Third-party incidents need a separate reporting route. Usually, that means your employee can report directly to their line manager or a duty manager in the moment. Waiting days for a formal grievance meeting isn't practical and it isn't protective.
Make sure your team actually know who to tell and how. If you asked your client-facing staff today what they'd do if a customer made a racist remark or a sexual comment, would they have a clear answer? If not, that's a gap you need to close.
Being willing to act against the customer
Here's where a lot of businesses will struggle.
Your policy should commit to taking action against the third party, not just supporting the employee after the fact. That might mean warning a client about their behaviour, refusing to serve a customer, ending a contract with a supplier, or barring someone from your premises.
Most policies miss this entirely. They focus on what happens to the employee who reports it, but say nothing about consequences for the person who caused the problem.
Equally important is making it clear that your staff aren't expected to tolerate harassment for the sake of a commercial relationship. If someone has behaved inappropriately, your employees shouldn't feel pressured to smooth things over or continue serving that person to keep the account happy.
As part of our HR consultancy services in Milton Keynes and South East, I regularly see policies that are silent on both of these points. That silence is a risk.
What a good policy clause looks like
You don't need pages and pages. A well-drafted clause might read along these lines:
"This policy covers harassment by anyone an employee encounters through their work, including customers, clients, suppliers, contractors and members of the public. Third-party harassment will be investigated and treated with the same seriousness as harassment from a colleague. Where appropriate, the business will take action including speaking to the individual, withdrawing service or ending a commercial relationship."
Short. Clear. Covers the ground a tribunal would expect to see.
Other things to check before October
Updating your policy is the starting point, but it's not the whole picture.
You should also check whether you have a written risk assessment that covers situations where your employees come into contact with third parties. Think about the specific scenarios in your business. Do your staff visit client sites? Work in retail? Take calls from the public? Each of those situations carries a different level of risk and your assessment should reflect that.
If something has already happened involving a customer or client, write down what occurred and how you responded. Even if you feel it's been dealt with, having a written record matters. Under the new duty, evidence of what you did is everything.
And if you've had an incident and you're not confident your response would stand up to scrutiny, get advice now. Sorting it out before the new duty comes into force is far better than trying to explain it afterwards.
Questions to ask yourself
Before October, it's worth sitting down and honestly considering where you stand:
🟢Does your current harassment policy mention customers, clients, suppliers or members of the public by name?
🟢Do your client-facing staff know exactly who to report to if a third party behaves inappropriately?
🟢Have you ever ended or adjusted a commercial relationship because of how a client or customer treated your employee?
🟢If a tribunal asked you to show evidence of the steps you've taken to prevent third-party harassment, could you produce it today?
If you're answering no to any of those, you've got work to do before October.
I can review your existing harassment policy and help you put a straightforward process in place for handling third-party incidents.
Whether you've already had a situation with a customer or client that you're unsure about, or you simply want to make sure you're covered before the new duty takes effect, it's worth having a conversation now.
As an outsourced HR consultant in Milton Keynes, I work with small and medium-sized businesses throughout the UK to get these things sorted properly, without overcomplicating it.
Get in touch and let's book a discovery call to look at where you stand and what needs to happen next. 📱 0781 3084152 or email 📧 daxa@hrresultsltd.co.uk Taking your HR from 'to do' to 'done'.
Share this post: