Britain Makes Employers Liable for Third‑party Harassment Under the Employment Rights Act 2025

Britain is set to make employers liable for third‑party harassment as part of the reforms introduced by the Employment Rights Act 2025, marking one of the most significant expansions of workplace equality duties in over a decade. Under amendments to the Equality Act 2010, employers may be held responsible where an employee is harassed by a customer, client, patient, contractor or member of the public, unless the employer can prove it took all reasonable steps to prevent it. The change reinstates a form of third‑party liability that was repealed in 2013, and it is intended to apply across the protected characteristics rather than a narrow subset.

A separate but closely related reform extends the time limit for most Employment Tribunal claims from three months to six months. The exact commencement dates for individual measures are being confirmed through the Government’s phased implementation across 2026 and 2027, so employers should verify the current position against official guidance. This article explains the timeline and statutory basis, defines who and what is covered, unpacks what “all reasonable steps” means in practice, sets out the evidence employers should retain, offers sector‑specific guidance, and provides a prioritised action checklist for compliance.

What is changing, timeline, statutory basis and scope

The reform arrives through the Employment Rights Act 2025, which amends the harassment framework in the Equality Act 2010. Historically, the Equality Act contained provisions making employers liable for repeated third‑party harassment, but those provisions were repealed in 2013. The 2025 Act reinstates and broadens third‑party liability, and it does so by reference to the protected characteristics in the harassment provisions of the Equality Act 2010, rather than being confined to sexual harassment alone.

The practical effect is that where a worker is harassed in the course of employment by someone who is not their colleague, a customer at a till, a patient in a ward, a passenger on a bus, the employer may be legally answerable for that conduct. The defence available to the employer is that it took all reasonable steps to prevent the harassment from occurring. The reforms in the Employment Rights Act 2025 are being brought into force on a phased basis across 2026 and 2027 through commencement regulations; employers should confirm the specific date for the third‑party harassment duty against the Government’s implementation timeline before relying on it.

Understanding when Britain will make employers liable for third‑party harassment is essential: the window for putting compliance measures in place is finite, and evidence of those measures should predate any incident.

Key dates employers must note

• Extended tribunal time limit. The time limit for bringing most Employment Tribunal claims is being extended from three months to six months during the 2026 phase of reform. In Scotland, the change to the time limit for breach of employment contract claims is scheduled for 9 November 2026. Employers should confirm the applicable commencement date for each type of claim.
• Third‑party harassment liability. This is being reinstated across the protected characteristics under the Equality Act 2010, as amended by the Employment Rights Act 2025, on a date to be set by commencement regulations.
• Before commencement. Employers should have documented risk assessments, updated policies, training records and contractual measures in place so that the “all reasonable steps” defence is evidenced from day one.

Legislative history at a glance, before 2013 versus after reform

Who and what is covered, protected characteristics and third parties

The new duty focuses on harassment by “third parties”, meaning people who are not the employer or its workers. In practice, this includes customers and clients, patients and service users, contractors and suppliers, visitors, and members of the public with whom staff interact in the course of their work. If a member of the public directs unwanted conduct related to a protected characteristic at an employee while that employee is doing their job, the employer’s potential liability is engaged.

The protected characteristics relevant to harassment under section 26 of the Equality Act 2010 are age, disability, gender reassignment, race, religion or belief, sex and sexual orientation. Harassment under the Act means unwanted conduct related to a protected characteristic that has the purpose or effect of violating a person’s dignity, or creating an intimidating, hostile, degrading, humiliating or offensive environment. The reform means that Britain will make employers liable for third‑party harassment across the breadth of these characteristics, not just sexual harassment.

Two features make this expansion demanding. First, the conduct must occur “in the course of employment”, which will capture most customer‑facing interactions and many off‑site or public‑facing scenarios. Second, liability can attach without proof of a repeated pattern of abuse. That is a marked departure from the pre‑2013 landscape, and it is why employers should treat prevention, not merely reaction, as the organising principle of compliance.

What “all reasonable steps” requires in practice

The heart of the new regime is the phrase “all reasonable steps”. This is a more searching standard than merely taking “reasonable steps”. It asks not whether an employer did something sensible, but whether it did everything reasonable that was open to it, given the resources available and the risks it faced. Acas guidance on harassment and bullying at work frames the concept around proportionality: what is realistically possible for an organisation of that size, in that sector, facing those risks. A small independent shop is not expected to deploy the security infrastructure of a national hospital, but each must be able to show it acted on the specific risks it could reasonably foresee.

Because the duty operates on an “all reasonable steps” basis, the defence is fundamentally evidential. It is not enough to hold a policy; the employer should be able to demonstrate what it assessed, what it decided, what it implemented and how it monitored the outcome. The three practical pillars are prevention, monitoring and response.

Preventive measures, policy, training, contracts, risk assessment

Prevention starts with a documented, sector‑specific risk assessment that identifies where and how third‑party harassment is most likely to arise. From that assessment flow the concrete controls:

• Policy. A bullying and harassment policy that expressly addresses third‑party harassment, states that it will not be tolerated, and explains the sanctions available against third parties (such as refusal of service or exclusion).
• Contracts and codes of conduct. Express terms in contracts with clients, suppliers and operators, plus visible customer codes of conduct, so that the employer has a contractual and behavioural basis for intervention.
• Training. Staff training in recognising harassment, de‑escalation and reporting, with attendance recorded and materials retained.
• Communication. Clear signage and accessible, well‑publicised reporting channels so employees know how to raise incidents quickly.

Monitoring and incident response, reporting, investigation, discipline, data retention

Preventive controls must be matched by systems that detect, record and respond to incidents. Employers should maintain an incident logging system that captures dates, times, descriptions and the actions taken. Where CCTV or body‑worn cameras are used, they can provide valuable evidence, but their deployment must comply with data protection law; the ICO’s guide to data protection sets out expectations for lawful, proportionate workplace monitoring and retention. Investigations should follow a consistent process, and where a third party is contractually connected, a supplier’s staff, for example, the employer should be prepared to enforce contractual terms, including escalation and, where warranted, termination of the relationship.

Proportional security measures for high‑risk settings

In higher‑risk environments, “all reasonable steps” is likely to extend to proportionate physical and personal safety measures: security staff, personal alarms or lone‑worker devices, escorts, and controlled access or screening. Proportionality remains the touchstone, the expected measures scale with the assessed risk. A busy late‑night venue or an emergency care setting will be expected to do considerably more than a low‑footfall office.

How liability attaches, law and tribunal practice

Harassment under the Equality Act 2010 does not require repetition. A single act of unwanted conduct related to a protected characteristic can meet the statutory threshold if it has the purpose or effect described in section 26, violating dignity or creating a hostile, degrading, humiliating or offensive environment. Whether the “effect” limb is satisfied depends on the perception of the recipient, the other circumstances of the case, and whether it is reasonable for the conduct to have that effect. The consequence for the new regime is significant: because the reform makes employers liable for third‑party harassment on this basis, a single serious incident perpetrated by a customer or member of the public can potentially found a claim against the employer.

Two illustrative scenarios show how this plays out. A retail worker is subjected to racially abusive language by a customer at the checkout. A care worker in a residential setting is targeted with hostile abuse related to a protected characteristic by a service user. In each case, the question a tribunal will ultimately weigh is not simply whether the harassment occurred, but whether the employer took all reasonable steps to prevent it. Foreseeability and the adequacy of the employer’s controls will be central. Where an employer had assessed the risk, trained its staff, published a customer code of conduct, and had clear escalation and support procedures, it is far better placed to resist liability than one that had done nothing.

Where an incident does occur, the employer’s immediate response matters both to the affected employee and to any subsequent defence. Supporting the employee, recording the event contemporaneously, taking action against the third party in line with policy, and reviewing whether controls need to be strengthened are all steps that demonstrate the seriousness with which the duty is treated.

Evidence employers need to defend a claim

The “all reasonable steps” defence stands or falls on documentation. In a tribunal, assertions unsupported by contemporaneous records carry little weight. Employers should build and maintain an evidence base that can be produced and stood behind. Because employers may be liable for third‑party harassment unless the defence is made out, the quality of this evidence is often decisive.

• Risk assessments. Dated, sector‑specific assessments showing what risks were identified and what controls were adopted.
• Training records. Attendance lists, dates, syllabus content and refresher schedules.
• Incident logs. Timestamped records of reports, investigations and outcomes.
• CCTV and access logs. Retained in accordance with a data protection‑compliant retention policy.
• Contracts and codes of conduct. Signed contractual terms with third parties and published customer codes, together with evidence of enforcement.
• HR correspondence and disciplinary records. Contemporaneous emails and records showing how concerns were handled.

How to collate and present evidence in tribunal proceedings

Evidence should be organised into a clear bundle, cross‑referenced to witness statements from managers and, where appropriate, the affected employee. Data retention policies should be defensible and consistently applied, and any CCTV or monitoring footage produced must be handled with attention to privacy and redaction of uninvolved individuals. The aim is to present a coherent narrative: the employer identified the risk, put proportionate controls in place, monitored them, and responded appropriately when an incident arose.

Sector‑specific guidance, what “all reasonable steps” looks like by sector

Because proportionality is central, “all reasonable steps” will look different across industries. The following sector notes set out practical, proportionate measures. Employers in each sector should tailor them to their own risk assessment rather than treating them as a fixed checklist.

Healthcare and social care

Patient and service‑user aggression is a recognised and often high risk. Reasonable measures may include documented anti‑aggression protocols, lone‑worker devices for community and domiciliary staff, controlled access to clinical areas, and clear policies allowing staff to be shielded from repeat offenders. A worked example: where a service user repeatedly directs abuse related to a protected characteristic at a care worker, the employer should log incidents, adjust care arrangements where safe to do so, and escalate through its safeguarding and management channels.

Retail and hospitality

Customer‑facing environments call for visible customer codes of conduct, signage stating that abuse of staff will not be tolerated, staff training in de‑escalation, and customer exclusion policies with a clear process for banning offenders. CCTV, deployed lawfully, supports both prevention and evidence, and staff should know how to preserve footage and log incidents promptly.

Transport (bus, rail and taxis)

Lone and mobile workers face particular exposure. Proportionate measures include driver protection screens, panic alarms, reporting apps that allow rapid escalation, and contractual terms with operators setting out expectations and enforcement routes. Where operators are contracting parties, the contract should give the employer a lever to require action against abusive users.

Education and childcare

Harassment can come from parents, carers or visitors. Reasonable steps include clear parental and visitor behaviour policies, links to safeguarding procedures, and exclusion protocols for individuals who abuse staff. Recording incidents and communicating expected standards of conduct to families forms part of a defensible approach.

Practical action list for employers and advisers

Because the reform will make employers liable for third‑party harassment once in force, the safest position is to act now so that controls and evidence are in place before the duty takes effect. A phased plan works well: immediate priorities in the first 45 to 60 days, medium‑term consolidation over three to six months, and a longer‑term review of policies and culture. The Government’s business‑facing guidance on employment changes is a useful starting point for orientation, but the substantive work is organisation‑specific.

Immediate action checklist:

• Conduct a sector‑specific risk assessment and document it, dating each version.
• Update the bullying and harassment policy to include third‑party harassment and the sanctions available against third parties.
• Add express contractual terms and publish customer or client codes of conduct where feasible.
• Record and retain training attendance and materials, and deploy de‑escalation training for customer‑facing staff.
• Implement an incident logging system and preserve CCTV and other data in line with a compliant retention policy.
• Review insurance wording with your provider regarding third‑party harassment claims.
• Prepare HR investigation templates and clear disciplinary and escalation pathways.

Medium‑term steps should include rolling out training organisation‑wide, embedding incident review into management meetings, and testing whether reporting channels are genuinely accessible. Longer‑term, employers should treat the duty as a standing feature of governance, refreshing risk assessments, updating training, and reviewing the effectiveness of controls after any incident.

Extended limitation period, from three to six months

As part of the reform package, the time limit for bringing most Employment Tribunal claims is being extended from three months to six months, as confirmed in the Government’s implementation timeline. This has direct strategic consequences for employers. Claimants will have a longer window in which to commence proceedings, which means employers may face claims months after an incident. The practical implication is that evidence must be retained for longer, and monitoring systems must be robust enough to reconstruct what happened well after the event.

Combined with the third‑party harassment reform, the extended limitation period reinforces the case for disciplined record‑keeping. Where employers are both liable for third‑party harassment and facing a longer period in which claims can be brought, the volume of documentation an employer must be able to produce, and for how long, increases. Aligning data retention policies with the extended limitation period, and building in a margin for early conciliation and procedural steps, is a sensible response.

International and comparative perspective

The United Kingdom is not alone in placing positive duties on employers to protect staff from harassment by third parties. A number of jurisdictions have developed comparable frameworks, whether through statutory workplace safety regimes, equality legislation or a combination of both, and in several the emphasis falls on proactive prevention rather than after‑the‑fact remedy. The direction of travel internationally is broadly towards holding employers accountable for the environments they create and control, including interactions with customers and the public.

Viewed in that context, the reinstatement and expansion of third‑party liability in Great Britain aligns with a wider trend. For multinational employers, the practical takeaway is that a preventive, evidence‑led approach to harassment travels well across borders, even where the precise statutory tests differ. Regulator guidance from the Equality and Human Rights Commission underlines the expectation that employers take active, documented steps to protect workers.

Conclusion and next steps

The Employment Rights Act 2025 will make employers liable for third‑party harassment, and the reform package extends the tribunal limitation period from three months to six months. The precise commencement dates are being confirmed through phased implementation across 2026 and 2027, so employers should track the Government’s official timeline. Together these reforms raise both the substantive standard employers must meet and the practical importance of contemporaneous evidence. The “all reasonable steps” defence is achievable, but only for organisations that assess their risks, implement proportionate controls, train and support their staff, and document everything they do.

Employers and advisers should run the immediate action checklist without delay, tailor sector‑specific measures to their own risk profile, and align data retention with the longer claim window. Where the stakes or the risk profile are high, bespoke legal advice on policies, contracts and tribunal defence strategy will repay the investment.

Sources

1. Gov.uk, Implementing the Plan to Make Work Pay and Employment Rights Act: timeline update
2. Equality Act 2010, section 26 (harassment)
3. Equality Act 2010 (legislation.gov.uk)
4. Acas, Harassment and bullying at work
5. Equality and Human Rights Commission, Harassment and bullying guidance
6. Business.gov.uk, New employment rights: guidance for businesses
7. Information Commissioner’s Office, Guide to data protection