On that date the duty to prevent sexual harassment stops asking whether you took reasonable steps and starts asking whether you took all of them. A second duty arrives that did not exist before. Both are tested from records.
This is an evidence kit for UK employers with no in-house HR. Not what the law says — what to put in a folder so you can prove you did it.
In force. Employment Rights Act 2025, ss.21–22.
Employees before it applies to you. EHRC technical guidance, para 3.28.
Complaints needed for the EHRC to act. EHRC technical guidance, paras 3.36–3.37.
They are usually discussed together and they are not the same obligation.
Section 22 of the Employment Rights Act 2025 amends section 40A of the Equality Act 2010. The subject matter does not move — this limb is about sexual harassment. What moves is how much of the available ground you must have covered. A step you never considered is still a step you did not take.
Section 21 inserts a new section 40(1A)–(1C). You become liable where a customer, client, contractor or member of the public harasses your employee and you failed to take all reasonable steps to prevent it. This limb is not limited to sexual harassment.
The third-party duty covers harassment related to protected characteristics generally. Pregnancy and maternity, and marriage and civil partnership, are not protected under the harassment provisions at all — but harassment because of pregnancy or maternity is harassment related to sex, so it is covered by that route. A policy that treats this limb as sexual-harassment-only is drafted short.
The Act contains a power to make regulations specifying what counts as a reasonable step. Those regulations are expected in 2027/28, after consultation — which is to say, after the duty is already in force.
This is not a drafting accident you can wait out. It is the position for at least the first year, and it is exactly why a documented reasoning trail is worth more to you than any particular policy wording. You cannot point at a rulebook. You can point at what you considered and why.
An employer is unlikely to be able to comply with the preventative duty unless they carry out a risk assessment. Equality and Human Rights Commission — technical guidance on sexual harassment and harassment at work
A risk assessment is a document. It exists, dated, or it does not. Most small employers do not have one, because until recently nobody suggested they needed one.
The duty applies from your first employee. No threshold, no grace period, no lighter version for organisations without an HR function.
No minimum headcount appears in the amending provisions or the published guidance. Two employees, same day as two thousand.
England, Wales and Scotland. Northern Ireland has its own equality legislation and is not covered by this change.
Conduct with a sufficient connection to employment. Social events, client sites, offsite working. The building is not the boundary.
What size changes is the content of “reasonable”, never whether the duty applies. A nine-person business is not expected to run what a nine-thousand-person business runs. It is expected to have thought about what a nine-person business can do, and done that.
Most employers can answer this, roughly, from memory. Memory is not the format in which it will be asked.
Almost nobody can answer this, because almost nobody wrote the reasoning down at the time. Reconstructed reasoning reads as reconstructed.
This is the one that catches organisations who did good work once, in 2024, and never looked at it again.
Questions two and three are not about doing more. They are about recording thinking you already did and checking something you already built. The work is cheap. It is only expensive if you leave it until somebody asks.
Answer honestly — nothing is sent anywhere and nothing is stored.
A spreadsheet with live formulas, three adoptable policies in Word, and a 35-page guide that explains the reasoning behind each one.
24 scored questions, live percentage score, banded verdict and a gap column that tells you what to fix first. Dated output is itself evidence.
16 pre-filled role-and-situation rows, likelihood × impact scoring, colour-scaled. Third parties treated as a source of risk in their own right.
The tribunal-facing record, with the column almost nobody has: why this was reasonable for us. Four columns, three of which usually sit empty.
Attendance, policy issue dates, refresh due dates calculated. Agency workers and contractors included, because they are usually the most exposed and least briefed.
Dated backwards from 30 October in dependency order, so the risk assessment lands before the policies it is supposed to justify.
Editable Word document with the decisions only you can make highlighted, rather than left as generic text you would have to notice.
The new duty, written as its own document. Customers, clients, contractors, suppliers and the public named explicitly.
Three routes including one that works without the person identifying themselves, and what the first sixty seconds of receiving a report should sound like.
Why each artifact exists, how to fill it in, and three worked examples of what a good “why” actually sounds like. Every statutory claim carries its source inline.
I run operations. I have built compliance systems inside businesses, and I have read the guidance carefully and cited it throughout. That is not the same as legal advice and I am not going to pretend otherwise.
If you have an employment solicitor you can call, you do not need this. Call them. They will do it better and they will carry the risk, which is worth considerably more than the fee.
If what you want is a summary of the law, the EHRC and Acas both publish one free, and both are better than anything I could write. They are listed at the bottom of this page and you should read them regardless of whether you buy anything here.
This kit exists for the gap in between: you know you need to do something, and nobody has told you what the folder is supposed to contain, in what order, or how you would show it to somebody who asked.
Corrections. If something in it is wrong, tell me. I fix it and reissue to everyone who has bought it, free, for as long as the product exists.
Instant download. Excel and Word, editable, no account required. Free corrections and updates for the life of the product — including when the reasonable-steps regulations land in 2027/28.
Sold by Kalpantar. UK employment law, England, Wales and Scotland only.
Answers first, sources named. If you only came here for the law and not the kit, these are free and so are the sources they cite.
Two things. The duty to prevent sexual harassment of employees rises from taking reasonable steps to taking all reasonable steps. Separately, a new duty makes employers liable where a third party — a customer, client, contractor or member of the public — harasses their employee and the employer failed to take all reasonable steps to prevent it.
Employment Rights Act 2025, sections 21 and 22, amending the Equality Act 2010 sections 40 and 40A. In force 30 October 2026.
Nobody knows precisely yet, and that is the honest answer. The Act contains a power to make regulations specifying what counts as a reasonable step, but those regulations are expected in 2027/28, after consultation — after the duty is already in force.
What is clear is the direction of the test. “Reasonable steps” asked whether what you did was defensible. “All reasonable steps” asks whether anything reasonable was left undone. In practice that means being able to show the range of measures you considered, not only the ones you adopted.
GOV.UK factsheet, Preventing workplace sexual harassment: power to make provision about “reasonable steps”.
Yes. The EHRC holds enforcement powers under the Equality Act 2006 and can act where it suspects the preventative duty has not been complied with. Its technical guidance states that the duty “does not depend upon an incident of sexual harassment taking place to be enforceable by us”.
This is the part employers most often miss. You do not need an aggrieved employee, a claim or a tribunal for the duty to bite.
EHRC, technical guidance, paragraphs 3.36–3.37.
Yes. It applies from your first employee. There is no minimum headcount, no exemption for small businesses and no grace period for organisations without an HR function.
What size changes is the content of “reasonable”, not whether the duty applies. A nine-person business is not expected to run what a nine-thousand-person business runs. It is expected to have considered what a business of its size and risk can do, and to have done that.
business.gov.uk, Workplace sexual harassment and third-party harassment.
All of them, and it is not confined to sexual harassment — a customer’s racial abuse of your staff falls inside it.
Pregnancy and maternity, and marriage and civil partnership, are not protected under the Equality Act’s harassment provisions at all. But the EHRC is explicit that harassing someone because of pregnancy or maternity is harassment related to sex, which is protected. So the practical gap is narrower than the exclusion list suggests, and a summary that stops at “those two are excluded” is misleading.
Equality Act 2010 section 40(1A)–(1C), inserted by Employment Rights Act 2025 section 21; scope per business.gov.uk.
In practice, yes. The EHRC's technical guidance states that an employer is unlikely to be able to comply with the preventative duty unless they carry out a risk assessment. It is the document every other decision is justified by, and it is the one most small employers do not have.
A generic assessment is close to worthless. The test is whether a competitor in a different sector could use your document unchanged. If they could, it is a statement of values with a table on it.
EHRC, technical guidance on sexual harassment and harassment at work; EHRC employer 8-step guide, step 3.
Four columns. What you did, stated concretely enough that somebody could check it happened. Why it was reasonable for you, in your circumstances and at your size. When — the date decided and the date effective. What you found on review.
The second column is the one that does the work and the one that is usually blank. Entries recording a measure you considered and rejected, with the reason, are often the strongest evidence in the file.
More than one, and at least one that works without the person identifying themselves. The reason is not redundancy — it is that the most serious cases are the ones where the obvious route is blocked, because the line manager is the problem or is close to it.
Three routes are achievable in a team of nine at no cost: two named people in different reporting lines, somebody external you already pay, and a monitored form with no name field.
EHRC employer 8-step guide, step 4; Acas, preventing sexual harassment.
No. The change extends to England, Wales and Scotland. Northern Ireland has its own equality legislation. If you employ people there, take separate advice.
Yes, it is a report. It does not have to be in writing, it does not have to use the word harassment, and the person does not have to want a process for you to be on notice.
Record the date, what you were told, what you did, and if you did nothing, the reason — including where the reason was that they asked you not to. Recording it is not a betrayal of their confidence; it is the only way you ever notice that three people have said the same thing about the same customer.
EHRC employer 8-step guide, step 8 — reviewing informal and formal complaints data.
It is a question, not a result. It might mean nothing is happening. It might equally mean the routes are not trusted, not known, or not monitored.
The defensible position is not “we had no reports”. It is “we had no reports, and here is what we did to check the absence was real”. One anonymous question in a staff survey converts the first into the second.
They are free, they are the actual authority, and this kit does not replace reading them.
Done in dependency order, the work fits the time that is left. Starting in the third week of October is not enough for all of it — but it is enough for the three things that matter, which the guide tells you how to pick.
Get the kit — £39 foundingEnter your email so we have a record of the purchase and can send your receipt.
Prefer not to use this? Buy on Gumroad instead.