Bad behaviour at work is no longer something employers can deal with reactively. Dealing with sexual harassment is now firmly an organisational responsibility. Employers must show they took “reasonable” steps to prevent it – and from October, “all reasonable” steps.

The UK’s approach to workplace sexual harassment has shifted significantly. Employers can no longer focus solely on handling complaints after the event. There is now a clear, proactive obligation to prevent harassment from occurring – reinforced by the Employment Rights Act 2025, which strengthens expectations on employers and sits alongside the existing framework.

That risk extends beyond your own employees to workers, agency staff, contractors and third parties, including clients, customers, suppliers and event guests. From October, employers face a higher legal bar. The gap between intention and evidence is where most organisations are exposed.

The legal framework: the “all reasonable steps” defence

At the centre of the legal framework is the “all reasonable steps” defence. Employers will be vicariously liable for acts of harassment carried out by their employees in the course of employment unless they can show that they took all reasonable steps to prevent such conduct.

This is a demanding test. Taking some steps – or even reasonable steps – isn’t enough. A tribunal will ask whether any further reasonable steps could have been taken. If the answer is yes, the defence may fail. The test is inherently fact-specific, and employers cannot rely on standardised or static compliance measures. The defence requires an ongoing and evolving approach.

Employer risk will increase significantly with the introduction of a proactive duty under the Employment Rights Act 2025, and the potential for compensation uplifts of up to 25% where that duty is breached.

Third party harassment: a material change in liability

A key development under the Employment Rights Act 2025 is the introduction of employer liability for third party harassment. “Third party” is defined broadly and includes clients, customers, contractors and members of the public.

Previously, employers were generally not liable for harassment by people outside their organisation. Now, employers are liable when a third party harasses an employee in the course of their employment – unless they can show they took all reasonable steps to prevent it.

This change is particularly relevant in sectors where employees regularly interact with the public, attend external events, work in client environments, or operate in alcohol led or informal settings.

When sexual harassment claims succeed: where the exposure really sits

Sexual harassment claims regularly succeed not because employers were culpable in the obvious sense, but because they cannot demonstrate what they did to prevent the behaviour in the first place.

The most common gaps are out-of-date policies that no longer reflect how people work; training delivered once, years ago, with no evidence it was effective; no clear standards for third parties at events or onsite; and a chronic lack of documentation.

From October, the standard moves from what was done to what more could realistically have been done. Employers need to be ready to answer that question.

Case example: “all reasonable steps” defence in practice

The case of Campbell v Sheffield Teaching Hospitals NHS Foundation Trust [2025] EAT 42 is notable because the employer succeeded in establishing the “all reasonable steps” defence. Although the claim related to racial harassment, the principles apply equally to sexual harassment.

The tribunal accepted that the Trust had taken all reasonable steps, relying on a combination of measures rather than any single initiative. These included structured induction training emphasising dignity and respect, regular equality and diversity training, visible reinforcement of workplace values, and embedding those values into performance management processes.

Crucially, the actions formed part of a broader, consistent and genuinely embedded approach to culture and behaviour. This is a helpful illustration of what tribunals expect to see in practice.

Building a credible sexual harassment prevention framework

A robust “all reasonable steps” defence is a connected set of practices, each reinforcing the others. Gaps between them are where risk crystallises.

Policies and behaviour standards

Historically, many employers have relied heavily on policies as evidence of compliance. While policies remain essential, tribunals are increasingly sceptical of ‘paper compliance’.

An anti harassment policy that does not address third party harassment, or that is rarely accessed or understood by staff, will carry limited weight. Behaviour standards need to apply to everyone – employees, workers and third parties – and expectations for suppliers, clients and event attendees should be stated explicitly and upfront, including the consequences of breach.

Training that is demonstrably effective

Training delivered once at induction and never revisited is unlikely to be sufficient. Effective training is role appropriate – managers, HR teams and event organisers have different responsibilities – reflects real scenarios, including social events and power dynamics, and is reinforced regularly.

From October, scrutiny will extend beyond whether training happened to whether it was likely to have been effective.

Anticipating and assessing risk

A defining feature of the current regime is the emphasis on anticipation. Employers are expected to consider where risks of harassment may arise and take steps to reduce those risks.

High risk environments are not difficult to identify: external events, client entertainment, alcohol led social settings, isolated working and roles with significant seniority imbalances. A risk assessment should identify those risks in advance, document which controls are in place, and assign clear ownership. Tribunals will want to see foresight, not hindsight.

Managing behaviour in the moment

Policies and training only matter if managers and event hosts feel confident to act when behaviour crosses a line. They need to know how to challenge inappropriate conduct early, how to escalate concerns, and that they will be supported when they intervene.

Failure to intervene when incidents unfold is often how organisational liability gets established.

Documentation: turning intention into evidence

Without records of policy reviews, training attendance, risk assessments, event briefings and decision making rationale, none of the above is demonstrable.

Comprehensive recordkeeping turns good intentions into a defensible position.

Next steps for employers under the Employment Rights Act 2025

The Employment Rights Act 2025 reinforces a clear shift towards prevention and accountability, including third-party conduct. The “all reasonable steps” defence remains a high bar, but Campbell v Sheffield Teaching Hospitals NHS Foundation Trust shows that it is achievable where employers take a genuinely proactive, structured and evidenced approach.

For employers, having the right documents is only one part of the strategy. Now, the focus needs to be on making sure the organisation has done everything that could reasonably be expected to prevent harassment.

Key takeaways

• Prevention is now a live system, not a document. Policies, training, risk assessment and record keeping must operate together.
• The move to “all reasonable steps” raises the bar. Employers should be asking what more could realistically be done.
• Third party harassment is a material risk. Clients, guests and contractors must be covered by explicit standards and clear enforcement mechanisms.
• Documentation is critical. Without evidence, even good practice cannot support a legal defence.
• Act now. Review policies, refresh training, assess risk and test whether your approach would stand up to tribunal scrutiny.

If you’d like to discuss how defensible your current approach is and where pressure might surface, please get in touch with Sharon Broughton or your usual RSM contact.

Latest related insights