From 30 October 2026, dignity at work training stops being a nice extra and becomes part of the legal test. You must take all reasonable steps to prevent sexual harassment of your staff. You are also liable if a customer or other third party harasses them, unless you took all reasonable steps to stop it. Training your people remember is one of the clearest steps you can show.

I sat in Daniel Barnett's employment law masterclass in Birmingham on 7 October. One point landed harder than the rest. If someone is harassed after you have trained your team, a tribunal can treat that as evidence the training was not good enough. So the question is no longer "did we train them?" It is "did the training work?"

These rules apply in England, Wales and Scotland. Northern Ireland has separate law.

This guide is for owners and managers without an HR department. I will cover what changes, what "all reasonable steps" asks of you, why a quick online module is a weak defence, what a good dignity at work workshop looks like, and a 30-day plan.

What changes from 30 October 2026

Three changes take effect on 30 October 2026. All three come from the Employment Rights Act 2025, switched on by the Employment Rights Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, S.I. 2026/1065.

From "reasonable steps" to "all reasonable steps"

Since 26 October 2024, you have had a duty to take reasonable steps to prevent sexual harassment of your employees. It came from the Worker Protection (Amendment of Equality Act 2010) Act 2023 and sits in section 40A of the Equality Act 2010.

Section 20 of the 2025 Act adds one word. From 30 October 2026, the duty is to take all reasonable steps.

That word changes the question. Before, you could argue you had done a reasonable amount. Now a tribunal asks whether there was any further reasonable step you could have taken and did not. If there was, you breached the duty.

The duty is preventive. It applies before anything goes wrong, whether or not anyone has complained. The Equality and Human Rights Commission can use its enforcement powers against an employer that has not complied, even where no individual has brought a claim, and an employee cannot bring a claim for breach of this duty on its own.

Third party harassment becomes your liability

Section 21 makes you liable when a third party, such as a customer, patient, supplier or visitor, harasses one of your employees at work, unless you took all reasonable steps to prevent it. This covers harassment related to age, disability, gender reassignment, race, religion or belief, sex or sexual orientation, as well as sexual harassment.

If your staff deal with the public, this is the big one. My guide to third party harassment covers it in detail, including the sectors most exposed and what to do when a customer is the harasser.

A power to spell out the steps

Section 22 gives the government a power to make regulations listing the steps that count as reasonable to prevent sexual harassment. The Act says those steps may include carrying out assessments, publishing plans or policies, and steps on reporting sexual harassment and handling complaints.

At the time of writing, no such regulations have been made. So there is no official checklist yet. Tribunals will judge each case on its facts, and the EHRC's technical guidance on sexual harassment and harassment at work is the most detailed reference point you have.

What it can cost

If an employee wins a sexual harassment claim and the tribunal finds you breached the preventive duty, it can increase the compensation by up to 25%, under section 124A of the Equality Act 2010. That uplift has applied since October 2024. Harassment compensation has no upper cap. From 30 October, the bar for avoiding the uplift goes up.

Then there is the cost no tribunal awards. Your time. A team that has taken sides. The good employee who leaves anyway.

What "all reasonable steps" means in practice

Employment lawyers know this phrase well. It is the same wording as the defence you have long had when one employee harasses another, in section 109(4) of the Equality Act 2010. Show you took all reasonable steps to prevent it, and you are not liable for what your employee did.

So there are years of tribunal decisions on what the phrase demands. They set the bar high.

How tribunals approach the question

The Employment Appeal Tribunal set out the approach in Allay (UK) Ltd v Gehlen in February 2021. A tribunal starts with the steps you took. It asks whether they were reasonable, including how likely they were to prevent harassment. Then it asks whether there were other reasonable steps you should have taken. Cost and practicality can count. A further step does not have to be more likely than not to work, though a step with no realistic prospect of working is unlikely to count.

Try this on yourself. Imagine a tribunal asking, "What else could you reasonably have done?" Every good answer you can think of is a gap in your defence.

The steps that make up a defence

There is no official list yet. The steps below reflect the case law and the EHRC technical guidance. Together they give you something real to show.

Two of these trip up small businesses more than the rest.

The first is contract clauses. Most standard terms ask the customer to comply with the law. That is too vague to help you. A clause that names harassment of your staff, and gives you the right to act, shows you thought about the risk before it arose. And when your best customer is the problem, you have something to point to.

The second is reporting routes. If the only route is the line manager, and the line manager is the problem or is close to the person causing it, nobody reports. Give your people at least one other way in: a named director, your HR adviser, or an outside route.

Why tick-box e-learning fails the test

I expect a lot of employers to get caught here.

The easy answer to a new duty is an online module. Send the link, collect the certificates, file the spreadsheet of green ticks. It is quick and cheap. It is also the harassment training for employees that tribunals trust least, because a tribunal is asking whether the training was likely to prevent harassment, and whether you could reasonably have done more.

What the EAT said about training

In Allay, the employer had trained staff on harassment, but some years earlier. The employment tribunal found the training had gone stale and that refreshing it was a reasonable step the employer had not taken. The EAT upheld that finding.

The EAT said brief and superficial training is unlikely to have a substantial effect in preventing harassment, and unlikely to last. Thorough and forcefully presented training is more likely to work, and to last. It said it is not enough to ask whether there has been training. What the training was, and how likely it was to work, both matter.

It went further. If employees sat through training but did not understand it, or ignored it, that counts. Harassment that happens after training can itself be evidence the training was poor, especially where several people, not only the harasser, failed to act on it.

In Allay, two managers knew about the harassment and did not report it to HR. The tribunal was entitled to treat that as a sign the training had faded from their memories.

What this means for the training you choose

Put a ten-minute click-through module next to those words. It looks a lot like "brief and superficial". If harassment then happens, the certificate may count against you. It shows you knew training mattered and picked the lightest option.

Face-to-face training does three things a module cannot.

It uses your workplace. People remember scenarios built around your customers, your shifts and your sites. They forget scenarios from someone else's industry.

It lets people ask the awkward questions. Where is the line with banter? What if it is a long-standing customer? What if I am not sure it was meant that way? Those questions are where behaviour changes. A module cannot answer them.

It shows you who did not get it. In the room, you can see who switches off and who pushes back. That is something you can act on, and acting on it is another reasonable step.

Online learning still has a place, as a refresher or for new starters between sessions. On its own, it is unlikely to show all reasonable steps.

How often to refresh

There is no fixed legal interval. Allay shows training from some years earlier can be found stale. For most small businesses, I would run a full session for everyone, induction training for every new starter, and a refresher at least once a year. Add an extra session after any incident, any change in the risks your staff face, or any sign people are not following the policy.

The comment in the lift

A few years ago I dealt with a case that shows why this training matters.

An employee made a homophobic comment in a lift. It was not aimed at anyone in particular. A colleague standing in the lift overheard it and raised a complaint.

The person who made the comment saw it as a throwaway remark. The investigation found it was harassment. They were disciplined and, in the end, dismissed.

Two things in that case catch people out. The comment did not have to be directed at the person who complained. And the speaker did not have to mean it. Harassment can be proved by its effect alone. Under section 26 of the Equality Act 2010, harassment is unwanted conduct related to a relevant protected characteristic, here sexual orientation, that has the purpose or effect of violating someone's dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment for them. In deciding whether conduct had that effect, the law looks at the person's perception, the other circumstances, and whether it was reasonable for the conduct to have that effect.

Many people assume harassment means a comment aimed at them. That gap in understanding is exactly what good training closes, and it is why I spend time on overheard comments in every workshop.

Where the risk sits in your sector

All reasonable steps depends on your risks, so the right training looks different from one business to the next. These are the patterns I see most in small and medium businesses.

Care homes, clinics and dental practices

Patients, residents and their families are third parties. Staff often cannot leave the room, and some behaviour is linked to illness, dementia or medication. That makes it harder to manage. It does not remove the duty. Train staff to respond without compromising care, and to report it so it is logged and reviewed, not shrugged off as part of the job.

Hospitality, leisure and retail

Alcohol, late finishes, young staff and tips all raise the risk. So do customers who expect staff to put up with anything. Your people need clear permission to refuse service, a line they can use in the moment, and a manager who backs them on the night. Visible notices help here more than anywhere.

Field, installation and on-site work

Your people work on someone else's premises, often alone. The customer's staff are third parties. The contract clause matters, and so does a clear rule that your employee can leave the site and call you.

Offices, professional services, manufacturing and logistics

Here the risk is more often colleague to colleague, and sometimes from senior people. Socials, conferences, travel and after-work drinks are where many complaints start. On the shop floor, a long-standing culture of banter and supervisors promoted for technical skill rather than people skills are the common gaps. Train supervisors to receive a complaint, not only to avoid causing one.

If your workforce is young, if staff fear that reporting will cost them shifts, or if they cannot get away from a difficult customer, your steps need to be stronger than average.

How to choose a dignity at work training provider

If you buy training in, ask these questions. They separate training that helps your defence from training that only produces a certificate.

• Will it be built around our workplace, with scenarios from our sector, customers and shifts?
• Is it face to face, or at least live and interactive, in small groups with time for questions?
• Does it cover third party harassment, not only colleague-to-colleague conduct?
• Is there a separate session for managers?
• Does it walk through our own policy and reporting routes, not a template?
• What records will we get: attendance by name and role, date, content, trainer?
• What happens afterwards: a refresher date, and feedback on anything the trainer saw in the room?

What a dignity at work workshop covers

Good harassment training in the workplace starts with the format. A dignity at work workshop is a short, face-to-face session on respect, bullying, harassment and sexual harassment, built around your workplace. Here is what a good one looks like for a small or medium business.

Who attends

Everyone, directors and owners included. Senior people are sometimes the problem, and they are always the people others watch. If the owner sits out, the team hears that the rules are for other people.

Keep groups to ten or fewer. People talk in small groups, and talking is where the learning happens. For a business of 30 staff, that might mean three sessions on the same day.

How long it takes

Sixty to ninety minutes for staff. Add a separate session for managers, because they receive the complaints and decide what happens next.

What it covers

The session covers what harassment and sexual harassment mean under section 26 of the Equality Act 2010, in workplace language. Unwanted conduct related to a protected characteristic. Unwanted conduct of a sexual nature. Why the effect on the person matters, not only what was intended. The lift story above usually starts the best conversation of the session.

It covers banter and where the line sits. Most teams need this conversation and few have had it. We use real examples from your sector, and talk about why "it was only a joke" is not a defence.

It covers third party harassment: what to do when a customer, patient, supplier or visitor crosses the line, the words staff can use, when they can walk away, who they call, and why they will be backed.

It covers bystanders. What colleagues can do when they see or hear something. In Allay, the people who knew and said nothing were part of why the defence failed.

It covers reporting. Every route, including the one that does not go through the line manager. What happens after a report. Protection from victimisation for anyone who raises a concern, unless the allegation is false and made in bad faith. Since 6 April 2026, reporting sexual harassment can also count as a protected whistleblowing disclosure.

And it covers your policy, walked through line by line, so it stops being a document nobody has read. My guide to dignity at work policies covers what that policy needs to contain.

The manager session

Managers need all of that, plus:

• how to receive a complaint, including the first conversation and what not to say
• what to do in the first 48 hours
• how to record what happened
• when to involve HR or take advice
• how to deal with a complaint about a valued customer
• the early signs, such as changes in behaviour, absence or someone avoiding a shift

What you keep afterwards

Training is only evidence if you can show it happened and what it covered. Keep the attendance list with names and roles, the date, the content, who delivered it, and any follow-up. Keep it for as long as a claim could be brought. For events on or after 1 October 2026, most tribunal time limits run for six months, and early conciliation can extend that, so keep records well beyond a year.

What a defensible position looks like

No tribunal hands out certificates for good practice, and every case turns on its facts. But a strong position has a shape. It comes from layering steps, never from one.

The employers best placed to show all reasonable steps can point to most of these:

• every new starter trained on harassment at induction, with a record
• written values, with behaviour measured against them at appraisal
• clear standards visible around the workplace, not only in the handbook
• recent training, including for the person who went on to harass
• a policy people know about, and reporting routes people use
• incidents logged and acted on, including the small ones
• a senior person who owns the programme and can explain it

Each of those exists in practice and can be shown. A tribunal will look past the policy document to what happened on your shop floor.

When your biggest customer is the problem

This is the one owners find hardest. The person harassing your employee is a customer you cannot afford to lose.

The instinct is to smooth it over. Move the employee quietly, say nothing, hope it stops. From 30 October 2026, that carries real legal risk. If you did not take all reasonable steps to prevent it, you face a claim with uncapped compensation and, for sexual harassment, a possible 25% uplift. You would be carrying an open-ended liability to protect one account.

There is a better route, and it often protects the relationship too.

Raise it with a senior contact at the customer, calmly and in writing. Point to your contract clause if you have one. Agree what will change, such as a different contact or no one-to-one meetings. Offer your employee the choice of moving off the account, but do not move them against their wishes. That can look like punishing the person who complained. Record each step.

Many customer businesses will deal with it once it is raised properly. They have the same duty to their own staff. If a customer will not, you have a decision to make. At least you will make it with your eyes open, and with a record that shows you tried.

Your 30-day plan

If you are starting from a low base, here is a realistic first month.

Week 1, find out where you stand.

1. Read your current harassment or dignity at work policy. Does it cover third parties? Does it give a reporting route outside the line manager?
2. List every role where staff deal with customers, patients, suppliers or visitors.
3. Check when staff last had harassment training, and what it was.

Week 2, assess and decide.

1. Write a short risk assessment for each customer-facing role.
2. Name a senior lead.
3. Decide the training, who attends, and book it.

Week 3, fix the paperwork.

1. Update the policy, including third parties and at least two reporting routes.
2. Add a harassment clause to your standard customer and supplier terms.
3. Put up notices where customers and visitors will see them.
4. Set up an incident log.

Week 4, train and brief people.

1. Run the workshops, directors included, with a separate manager session.
2. Share the updated policy and reporting routes with every employee, and record that you did.
3. Diary the next review and the next refresher.

If that looks like a lot to carry alongside running the business, the free HR Health Check takes under a minute and lets you know which of these areas to tackle first.

How The HR Doctor helps

I run dignity at work workshops for small and medium businesses, in person on your site, for everyone from team members to directors. We build the sessions around your workplace and your customers, run a separate session for managers, and leave you with the attendance and content records a tribunal would expect to see.

The workshops sit inside our wider support on harassment prevention: the risk assessment, the dignity at work policy, reporting routes, contract wording and the incident log. That way the training is backed by everything else that makes up all reasonable steps. It is part of our HR packages, alongside day-to-day HR advice.

If you want to talk through where your business stands, or what your team needs, book a free 30-minute discovery call.

Frequently asked questions

Is sexual harassment training a legal requirement in the UK?

No law names training as compulsory. But from 30 October 2026 employers must take all reasonable steps to prevent sexual harassment, and tribunals treat effective, up-to-date training as one of the main steps. An employer that has not trained staff will find it very hard to show it took all reasonable steps.

What counts as "all reasonable steps" to prevent sexual harassment?

There is no official list yet. Tribunals ask what steps the employer took, whether they were likely to work, and whether there were other reasonable steps it should have taken. Risk assessment, a clear policy, reporting routes, visible standards, an incident log, a senior lead and regular face-to-face training are the steps most often expected.

Is online harassment training enough?

On its own, probably not. The Employment Appeal Tribunal has said brief and superficial training is unlikely to prevent harassment, and that the nature and likely effect of training matter, not only whether it happened. Online modules can support face-to-face sessions, for example for new starters or refreshers, but are a weak defence by themselves.

Can an overheard comment count as harassment?

Yes. Harassment does not have to be aimed at the person who complains. A comment related to a relevant protected characteristic, such as sexual orientation, can be harassment of someone who overhears it if it has the effect of violating their dignity or creating an offensive environment for them, and it is reasonable for it to have that effect.

How often should dignity at work training be repeated?

There is no fixed legal interval, but a tribunal has found training given some years earlier to be stale. A sensible pattern is training for every new starter at induction, a refresher for everyone at least once a year, and extra sessions after any incident or any change in the risks your staff face.

What should a dignity at work workshop cover?

A good workshop covers what harassment and sexual harassment mean in law and in your workplace, where banter crosses the line, overheard comments, third party harassment by customers or visitors, what bystanders can do, every route for reporting, protection from victimisation, and your own dignity at work policy. Scenarios should come from your own business.