TL;DR
- Section 40A of the Equality Act 2010 now reads: "An employer (A) must take all reasonable steps to prevent sexual harassment of employees of A in the course of their employment." The word "all" was inserted on 30 October 2026 by section 20 of the Employment Rights Act 2025, commenced by S.I. 2026/1065, reg. 3(a).
- The duty is anticipatory. The EHRC technical guidance says employers "should anticipate scenarios when its workers may be subject to sexual harassment in the course of employment and take action to prevent such harassment taking place", and that an employer is "unlikely" to meet the duty without a risk assessment.
- Third party harassment is now covered twice. The duty has always reached customers and clients, and from 30 October 2026 section 40(1A) also makes it unlawful for an employer to permit a third party to harass an employee, which an employee can take to a tribunal directly.
Most employers know they have a duty to prevent sexual harassment. Fewer can say what it asks them to have done before anything happens, which is the only question a regulator or a tribunal asks. The duty is not about handling a complaint well. It is about what was in place beforehand, and whether anyone wrote it down.
This article covers the duty itself: the exact wording, what changed on 30 October 2026, the risk assessment at its centre, how third party harassment works, and what a breach costs. It describes the position in Great Britain (England, Wales and Scotland), the extent of the provisions quoted. Northern Ireland has separate equality legislation and is not covered by section 40A. This is general information and not legal advice.
The duty is evidenced by records of things that happened on dates: an assessment, a review, a policy issued, training completed, a step owned by a named person. See how New Dynamics workflows let you define stages, assign participants and build in reminders and approvals, so an annual review of your prevention steps leaves a trail rather than a memory.
What the sexual harassment prevention duty says
Section 40A of the Equality Act 2010, in the revised version shown as up to date with all changes in force on or before 7 November 2026, has three subsections.
Subsection (1): "An employer (A) must take all reasonable steps to prevent sexual harassment of employees of A in the course of their employment."
Subsection (2): "'Sexual harassment' in subsection (1) means harassment of the kind described in section 26(2) (unwanted conduct of a sexual nature)."
Subsection (3) makes a contravention "enforceable as an unlawful act under Part 1 of the Equality Act 2006", then narrows who may enforce it: "enforceable only by the Commission under that Part or by an employment tribunal in accordance with section 124A (compensation uplift in employee sexual harassment cases)".
Three things follow. The duty covers sexual harassment only, meaning unwanted conduct of a sexual nature under section 26(2), not harassment related to race, disability, religion or another protected characteristic. It bites in the course of employment. And no employee can bring a freestanding claim for breach of it, which is why employers rarely hear about their own non-compliance until something else goes wrong.
What changed on 30 October 2026
Section 40A was inserted on 26 October 2024 by the Worker Protection (Amendment of Equality Act 2010) Act 2023. On 30 October 2026 the standard rose. Section 20 of the Employment Rights Act 2025, headed "Employers to take all reasonable steps to prevent sexual harassment", inserted the word "all" before "reasonable steps". The commencement instrument is named on the face of the legislation: section 20 came "in force at 30.10.2026 by S.I. 2026/1065, reg. 3(a)", that instrument being the Employment Rights Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026.
This is in force now, not pending. Two further provisions commenced the same day under the same regulation: section 21 (harassment by third parties) at regulation 3(b), and section 22, which inserts a new section 40B giving a power for regulations to specify steps "regarded as 'reasonable'", at regulation 3(c). No regulations under section 40B are listed yet, so check before treating any list as a statutory minimum.
Acas states the practical difference on its guidance about steps for employers to prevent sexual harassment, last updated 30 October 2026: "Before 30 October 2026, employers might have chosen to take some reasonable steps to prevent sexual harassment. They will now be expected to take them all with no exceptions." Taking all reasonable steps means "taking all of the steps that are reasonable for your organisation rather than just some of the steps" and "focusing on preventing sexual harassment rather than only reacting to incidents". It "includes protecting workers from online and in-person sexual harassment".
The duty is anticipatory, which is the part policies miss
The Office for Equality and Opportunity put it in one sentence in its press release of 26 October 2024, New protections from sexual harassment come into force: "Employers now have a duty to anticipate when sexual harassment may occur and take reasonable steps to prevent it."
The Equality and Human Rights Commission says the same at paragraph 3.18 of its technical guidance on sexual harassment and harassment at work, published 30 January 2020 and shown as last updated 26 September 2024: "The preventative duty is an anticipatory duty. It is designed to transform workplace cultures by requiring employers to take positive and proactive reasonable steps to prevent sexual harassment of their workers. Employers should not wait until a complaint of sexual harassment has been raised before they take any action."
A grievance procedure that works well is therefore not compliance, and neither is a policy nobody has read. Acas is blunt about the starting assumption: "Sexual harassment can happen in any organisation. You must not assume that it will not happen." Training is one of the steps and has its own failure modes; our post on sensitivity training covers designing a programme that changes behaviour rather than one that fills a register.
Third party harassment, and how it differs from the duty
Customers, clients, patients, suppliers and the public sit inside the duty. The EHRC guidance at paragraph 3.26 says it "includes prevention of sexual harassment by third parties", so "if an employer does not take reasonable steps to prevent sexual harassment of their workers by third parties, the preventative duty will be breached".
Until 30 October 2026 that was the whole of it, and the gap was real. The EHRC guidance records at paragraph 3.22 that "a worker cannot bring a stand alone claim in the employment tribunal for third party harassment", and at paragraph 3.67 that following Unite the Union v Nailard [2018] EWCA Civ 1203 "the Act does not make employers liable for failing to protect workers against third party harassment".
That has changed. Section 21 of the Employment Rights Act 2025 inserted new subsections into section 40 of the Equality Act 2010, in force 30 October 2026 by S.I. 2026/1065, reg. 3(b). Section 40(1A): "An employer (A) must not permit a third party to harass a person (B) who is an employee of A." Section 40(1B) defines permitting: A permits it "only if" the third party harasses B "in the course of B's employment by A" and "A failed to take all reasonable steps to prevent the third party from doing so".
Three provisions are now in play and they are not the same thing.
- Section 40A is a preventive duty, covering sexual harassment only, enforceable by the EHRC and by a tribunal only through the compensation uplift. Section 120 confirms there is no standalone claim by excluding section 40A(1) at subsection (8), while subsection (9) preserves the uplift route.
- Section 40(1A) makes permitting third party harassment unlawful in itself. Sitting in section 40, it reaches harassment under section 26 generally, so conduct related to race, disability, age, religion or belief, sex, sexual orientation or gender reassignment as well as conduct of a sexual nature. An employee can take it to a tribunal directly.
- Section 109(4) is a defence, not a duty. Where an employer is fixed with an employee's act under section 109(1), it is "a defence for B to show that B took all reasonable steps to prevent A" from doing it. The EHRC separates the two at paragraph 3.57: "The sexual harassment preventative duty is different from the reasonable steps defence."
The same evidence serves all three. What you did in advance is what you will be asked for.
The risk assessment is the step you cannot skip
The EHRC guidance is as close to prescriptive as it gets at paragraph 4.13: "Employers are unlikely to be able to meet the requirement of the preventative duty to take reasonable steps to prevent sexual harassment of their workers, if they do not carry out a risk assessment."
Both regulators publish the factors to weigh. Acas names higher risk factors including "meeting clients or service users alone", "an environment where people are drinking alcohol", "work-related social events", "power imbalances between workers" and "travelling for work, including overnight stays", and says younger workers, including apprentices and interns, may be at higher risk. The EHRC list at paragraphs 4.10 and 4.11 adds job insecurity, lone and night working, customer-facing duties, social media contact between workers, a lack of diversity at senior level and "a failure to respond appropriately to previous reports of sexual harassment".
The EHRC also says what the assessment should produce. Paragraph 4.14: "Employers should produce an action plan that sets out what preventative steps they will take to address any identified risks and how that will be monitored." Paragraph 4.15 suggests "appointing a designated lead to take responsibility for implementation of the action plan and compliance with the preventative duty".
Acas sets out the sequence in four moves: consider the risks, consider the steps that would reduce them, consider which of those steps are reasonable for you, then take them. It also states the limit on any checklist, including this one: "What is reasonable depends on the situation. There's no set list of steps that all employers must take."
The EHRC's eight practical steps
The EHRC publishes an employer 8-step guide on preventing sexual harassment at work, published and last updated 26 September 2024 and drawn from the technical guidance. Its headings are: develop an effective anti-harassment policy; engage your staff; assess and take steps to reduce risk; reporting; training; what to do when a complaint is made; dealing with harassment by third parties; and monitor and evaluate your actions.
Two are more specific than they look. On reporting, it asks employers to "keep centralised, confidential records of all concerns raised, formal and informal", because "this enables trends to be identified". On third parties, harassment by "a customer, client, patient, or supplier, should be treated just as seriously as that by a colleague". Our anti-harassment policy guide covers the policy those steps sit inside.
What a breach costs
Two consequences, and they work independently.
The first is the tribunal uplift. Section 124A of the Equality Act 2010, inserted on 26 October 2024, applies where a tribunal has found a contravention of section 40 involving sexual harassment and ordered compensation under section 124(2)(b). The tribunal then "must consider whether and to what extent the respondent has also contravened section 40A(1)". If satisfied that it has, it may order a "compensation uplift", which "must reflect the extent to which, in the tribunal's opinion, the respondent has contravened section 40A(1)" but "may be no more than 25% of the amount awarded under section 124(2)(b)". The GOV.UK press release describes the sequence: "An individual must first bring a claim against their employer for sexual harassment. If the claimant is successful, a breach of the employment duty will automatically be examined."
The second is EHRC enforcement, and it does not wait for an incident. The guidance states it at paragraph 3.37: "The preventative duty does not depend upon an incident of sexual harassment taking place to be enforceable by us." The powers come from the Equality Act 2006, and the Commission lists four: investigate an employer under section 20; issue an unlawful act notice under section 21, which "may require the person to whom the notice is given to prepare an action plan for the purpose of avoiding repetition or continuation of the unlawful act"; enter a legally binding agreement under section 23; and seek an injunction under section 24 where the Commission "thinks that a person is likely to commit an unlawful act". A notice may be appealed within six weeks, and section 21(8) routes an appeal about section 40A(1) to an employment tribunal.
Where the official guidance has not caught up
The two main sources read differently right now, and it matters which governs.
Acas updated its sexual harassment pages on 30 October 2026 and states the current standard: "By law, all employers must take all reasonable steps to prevent sexual harassment of their workers." The EHRC technical guidance and the 8-step guide are both shown as last updated 26 September 2024, so they describe the earlier "reasonable steps" standard, and the 8-step guide carries a notice that changes to the law "will come into force in April and October 2026" and that the Commission is "currently working to update this guidance". The technical guidance's third party section also still rests on Nailard, which section 40(1A) has overtaken.
Where guidance and statute differ, the statute governs. The EHRC guidance remains the most detailed official account of what reasonable steps look like, so use it for the method and read the standard off section 40A. Check both for an update before relying on either, including this article. For wider workplace figures, see the HR statistics hub.
Frequently asked questions
What is the sexual harassment prevention duty?
It is the duty in section 40A of the Equality Act 2010 requiring an employer to take all reasonable steps to prevent sexual harassment of its employees in the course of their employment. It was inserted on 26 October 2024 by the Worker Protection (Amendment of Equality Act 2010) Act 2023, and the standard rose from "reasonable steps" to "all reasonable steps" on 30 October 2026.
Is "all reasonable steps" in force yet?
Yes. The word "all" was inserted into section 40A(1) on 30 October 2026 by section 20 of the Employment Rights Act 2025, commenced by S.I. 2026/1065, regulation 3(a). Acas says employers "will now be expected to take them all with no exceptions".
Can an employee sue for breach of the prevention duty?
Not on its own. Section 120(8) of the Equality Act 2010 excludes section 40A(1) from the ordinary tribunal jurisdiction, so an employee must first win a sexual harassment claim. The tribunal then considers the duty and may add a compensation uplift of up to 25% under section 124A.
Does the duty cover harassment by customers and clients?
Yes. The EHRC guidance says the duty includes prevention of sexual harassment by third parties, and Acas names customers, clients, service users, members of the public and self-employed consultants. Since 30 October 2026, section 40(1A) also makes it unlawful for an employer to permit a third party to harass an employee, and that is directly actionable.
Do we have to do a sexual harassment risk assessment?
No provision names it as a requirement, but the EHRC guidance says employers are "unlikely to be able to meet the requirement of the preventative duty" without one, and Acas says you should assess any possible risks. Treat it as the first step and keep the dated record.
Your next step: assess, plan, record, review
- Run a sexual harassment risk assessment using the factors Acas and the EHRC publish, and date it.
- Write the action plan: each risk, the step that addresses it, a named owner and a review date.
- Check the policy separates sexual harassment from other harassment, names third parties and sets out reporting routes, including one that is not the person's manager.
- Put the review in the calendar now, and keep centralised, confidential records of concerns raised, formal and informal, so trends are visible.
- Read the standard off section 40A rather than a summary, and take legal advice on your own facts.
For the policy those steps sit inside, read and download our anti-harassment policy guide. The guide is free to read, and the PDF uses our short download form.
Want the assessment, the action plan and the annual review to leave a dated record instead of a memory? Book a New Dynamics demo and bring your current policy. You can also email contact@new-dynamics.com.
