If you’re an SME employer, you may feel like you’ve heard a lot about sexual harassment legislation over the last couple of years.
That’s because employers already have a legal duty to take reasonable steps to prevent sexual harassment at work.
But from 30 October 2026, that duty is getting stronger.
Under changes introduced by the Employment Rights Act 2025, employers will be required to take all reasonable steps to prevent sexual harassment of their employees. New legal protection will also apply where employees are harassed by third parties, such as customers, clients, contractors or service users.
For SMEs, the important message is:
30 October isn’t the date to start preparing. It’s the date the strengthened duties take effect.
If you already introduced policies, training and risk assessments following the changes in 2024, you don’t necessarily need to start again.
But you do need to check whether what you have in place is enough.
What are employers already required to do?
Since 26 October 2024, employers have had a proactive legal duty to take reasonable steps to prevent sexual harassment of their employees in the course of their employment.
This changed the emphasis from simply responding to complaints after something happened to actively considering how sexual harassment could be prevented in the first place.
The ACAS guidance on preventing sexual harassment provides practical guidance on the steps employers can take.
These can include:
- carrying out a sexual harassment risk assessment;
- having appropriate policies and reporting procedures;
- providing employees and managers with appropriate training;
- considering risks involving customers, clients and other third parties;
- ensuring employees know how to report concerns;
- responding appropriately when concerns are raised; and
- regularly reviewing whether preventative measures are working.
So, the preventative duty itself isn’t new in October 2026.
What changes is the standard employers will be expected to meet.
What changes on 30 October 2026?
There are two particularly important changes SMEs need to understand.
1. “Reasonable steps” becomes “all reasonable steps”
From 30 October 2026, the existing requirement to take reasonable steps to prevent sexual harassment will become a requirement to take all reasonable steps.
It might sound like a very small change.
It isn’t.
Employers will need to consider whether there are any further reasonable measures they could take to prevent sexual harassment within their particular workplace.
What is reasonable will depend on your organisation, your workforce, how your people work and the risks they face.
A small office-based professional services business may have very different risks from a hospitality business, care provider, manufacturer or organisation whose employees regularly work alone with members of the public.
The question employers should increasingly be asking is:
“Is there anything else it would be reasonable for us to do to reduce this risk?”
If the answer is yes, that’s something you should be looking at.
The Government’s Employment Rights Act implementation timetable confirms the strengthened requirements take effect on 30 October 2026.
2. Third-party harassment becomes even more important
The second major change concerns people who don’t work for your organisation.
Think about who your employees come into contact with during their working day.
That could include:
- customers;
- clients;
- service users;
- patients;
- suppliers;
- contractors;
- visitors;
- delivery drivers; or
- members of the public.
From 30 October 2026, employers will have a specific statutory obligation concerning harassment of employees by third parties.
Importantly, the new third-party provisions extend beyond sexual harassment and cover harassment within the relevant Equality Act protections more broadly.
This could be particularly important for SMEs operating in hospitality, retail, care, healthcare and professional services, or anywhere employees regularly interact with customers, clients or members of the public.
But aren’t employers already supposed to consider customers and clients?
Yes – and this is where some of the headlines about the October changes can be confusing.
Employers should already be considering the risk of sexual harassment by third parties as part of their existing preventative duty.
Current ACAS guidance specifically advises employers to consider the risks of sexual harassment by third parties.
So, if your employees regularly deal with customers, clients, service users or members of the public, this isn’t something you should first start thinking about in October.
The 2026 changes strengthen the legal position further.
For SMEs, this makes now a very good time to look at what you already have in place and identify any gaps.
What should SMEs do before October 2026?
Don’t treat this as simply another policy update.
Use the time before October to look at what actually happens within your business.
Here are six practical areas we recommend reviewing.
1. Review your sexual harassment risk assessment
If you already have a sexual harassment risk assessment, get it back out and review it.
If you don’t have one, now is the time to complete one.
Your assessment should reflect your business and your workplace, rather than simply being a generic document stating that sexual harassment could happen.
Think about where the risks could realistically arise.
For example:
- Do employees work alone?
- Do they regularly deal with customers or members of the public?
- Do you hold work parties, conferences or networking events?
- Is alcohol involved at work-related events?
- Do employees travel or stay away overnight?
- Are there significant differences in seniority or power?
- Do you employ apprentices, younger workers or interns?
- Could inappropriate behaviour occur through Teams, WhatsApp, email or social media?
- Have previous incidents, complaints or concerns highlighted a particular risk?
Once you’ve identified the risks, look at the controls you already have in place.
Then ask:
Are there any further reasonable steps we could take?
Need help with your risk assessment?
We know that knowing where to start can be one of the biggest challenges for SMEs.
That’s why Craven Consultancy Services has developed a practical Sexual Harassment Risk Assessment Toolkit and Management Guidance to help employers identify workplace-specific risks, review the preventative measures already in place and identify where further action may be needed.
Contact the Craven team to get your Sexual Harassment Risk Assessment Toolkit.
2. Look specifically at third-party risks
One of the most useful exercises an SME can do is ask:
“Who interacts with our employees because of their work?”
Don’t stop at customers.
Think about clients, suppliers, contractors, service users, patients, relatives, visitors, delivery drivers, event attendees and members of the public.
Then consider where and how those interactions take place.
For example, imagine you run a hospitality business and an employee regularly experiences inappropriate sexual comments from a customer.
Or you run a care organisation and an employee is subjected to inappropriate behaviour from a service user or relative.
Perhaps an employee attends networking events or conferences where alcohol is available.
Or maybe one of your employees regularly meets clients alone.
These situations involve very different risks and may require different preventative measures.
Don’t assume that because somebody isn’t your employee, their behaviour isn’t your problem.
3. Review your policies
Take a fresh look at your existing sexual harassment, equality, dignity at work, bullying and harassment or grievance policies.
Would an employee reading them today understand:
- what sexual harassment is;
- what behaviour is unacceptable;
- how to report something;
- who they can speak to;
- what happens when they raise a concern;
- what they should do if the behaviour comes from a customer or client; and
- what support is available?
If not, your policies may need updating.
ACAS also provides useful guidance on creating a sexual harassment policy.
And remember:
Having a policy isn’t the same as preventing harassment.
A beautifully written policy sitting unread in a handbook won’t, by itself, create the right workplace culture.
4. Ask whether your training actually works
When did your managers and employees last receive sexual harassment training?
And here’s the more important question:
Would they know what to do if something happened tomorrow?
Employees should understand what sexual harassment can look like, what behaviour is unacceptable, their role in creating an appropriate workplace culture and how they can report concerns.
Managers need to know more.
They should understand what to do if they:
- witness inappropriate behaviour;
- receive a complaint;
- hear something concerning informally;
- become aware of inappropriate online behaviour; or
- receive a report involving a customer, client or another third party.
Training shouldn’t simply be something you complete once and file away.
It needs to translate into awareness, confidence and appropriate action in the real workplace.
Need to train your team?
Our CPD-approved Sexual Harassment in the Workplace course is available through the Craven Learning Hub.
The online course helps employees and managers understand sexual harassment in the workplace and covers areas including complaints, policies, the role of line managers, handling incidents, the law and practical case studies.
It provides SMEs with a straightforward way of increasing awareness and supporting employees and managers to understand their responsibilities.
Explore our Sexual Harassment in the Workplace training.
5. Make it easy for employees to speak up
A reporting procedure only works if employees understand it and feel able to use it.
Ask yourself:
- Do employees know who they can speak to?
- Is there another option if their manager is involved?
- Do managers know how to escalate concerns?
- Would an employee know how to report inappropriate behaviour from a customer or client?
- Are concerns dealt with consistently?
- Are appropriate records maintained?
- Do employees have confidence that concerns will be taken seriously?
You may have a process on paper.
The real test is whether your people know about it and trust it.
6. Keep evidence of what you’re doing
Preventing sexual harassment shouldn’t become a paperwork exercise.
But employers should be able to demonstrate the preventative steps they have taken.
That could include keeping appropriate records of:
- sexual harassment risk assessments;
- reviews and actions arising from those assessments;
- policy updates;
- employee communications;
- manager and employee training;
- concerns and complaints;
- employee feedback;
- measures introduced to address third-party risks; and
- reviews of whether existing controls are effective.
Keeping appropriate evidence also helps you see whether actions have actually been completed rather than simply discussed.
“We’re only a small business – do we really need to do all of this?”
Being an SME doesn’t remove your legal responsibilities.
But it also doesn’t mean you need exactly the same systems and controls as an organisation employing thousands of people.
Your approach should reflect your organisation and the risks within it.
For one SME, preventative measures might include a workplace-specific risk assessment, updated policies, manager and employee training and a clear reporting process.
Another business with lone workers, significant customer contact, work-related events or higher-risk environments may need additional controls.
That’s why copying somebody else’s policy or downloading a generic risk assessment isn’t necessarily enough.
Start with:
Your people. Your workplace. Your risks.
Is your business ready for 30 October 2026?
Before October, ask yourself:
- Have we completed a sexual harassment risk assessment?
- Have we reviewed it recently?
- Does it consider customers, clients and other third parties?
- Have we identified where our highest risks are?
- Have we acted on the risks we’ve identified?
- Are our policies up to date?
- Have our employees and managers received appropriate training?
- Do employees understand how to report a concern?
- Would managers know what to do if something happened tomorrow?
- Have we considered whether there are any further reasonable steps we could take?
- Can we demonstrate the preventative measures we’ve put in place?
If you’ve answered “no” or “I’m not sure” to some of these questions, don’t ignore them.
There is still time to review what you have and address the gaps before the strengthened requirements take effect.
Don’t wait until October
The preventative duty isn’t starting from scratch in October.
Employers have been required to take reasonable steps to prevent sexual harassment since October 2024.
From 30 October 2026, however, the legal requirements strengthen.
The sensible approach for SMEs is to use the coming months to review, refresh and strengthen what you already have in place.
And there is a bigger reason for doing this than simply complying with employment law.
A genuinely preventative approach helps create a workplace where people understand the standards expected of them, managers have the confidence to act and employees know that concerns will be taken seriously.
How Craven can help you prepare
You don’t have to work through the changes alone.
Craven Consultancy Services can help SMEs assess, prevent, train and review.
Assess
Our Sexual Harassment Risk Assessment Toolkit and Management Guidance can help you identify workplace-specific risks, review existing controls and determine where further action may be required.
Contact us to get your toolkit.
Train
Our CPD-approved Sexual Harassment in the Workplace course is available through the Craven Learning Hub and can help employees and managers understand sexual harassment, responsibilities and how concerns should be handled.
Support
Our HR team can also support you with:
- policy and procedure reviews;
- sexual harassment risk assessments;
- third-party harassment risk reviews;
- manager guidance;
- employee relations support; and
- ongoing HR and employment law advice.
Already did the work following the 2024 changes?
Great – you don’t necessarily need to start again.
Now is the time to review what you have, identify any gaps and strengthen your arrangements ahead of 30 October 2026.
Contact the Craven team to get your Sexual Harassment Risk Assessment Toolkit, or start training your team today through the Craven Learning Hub.
People. Safety. Environment. Success.
