From October 2026, employers will be under a strengthened duty to take all reasonable steps to prevent sexual harassment, including harassment by third parties such as clients, customers and service users.
Many organisations feel reasonably comfortable. Training is delivered. Policies exist. Completion rates are high.
But comfort is not the same as compliance. And compliance is not the same as prevention.
If a tribunal asked whether your training was genuinely capable of preventing foreseeable harm in your organisation, would you feel confident in the answer?
The new duty changes the conversation. It moves the focus from generic awareness to real world capability. From internal culture alone to the full ecosystem in which your people operate.
What Is Unlikely to Be Enough
Annual e learning will not protect you on its own.
A policy attached to a slide deck will not protect you.
Completion data will not protect you.
The strengthened preventative duty raises a harder standard. The following approaches are unlikely to satisfy “all reasonable steps”:
- Training focused only on colleague behaviour
- No explicit reference to third party harassment
- Generic scenarios unrelated to your environment
- No distinct training for managers
- No refresh in response to incidents
- No clear link between risk assessment and content design
Tribunals already scrutinise superficial training under the Equality Act 2010 framework. The bar is not lowering.
The real question will be this:
Did your training address the risks that were foreseeable in your workplace?
If junior team members routinely deal with intoxicated customers, was that addressed?
If senior leaders manage powerful commercial relationships where boundaries can blur, was that addressed?
If your organisation operates across digital platforms and hybrid environments, was that addressed?
If the answer is no, the existence of a module will not carry much weight.
What Is Likely to Be Expected Instead
The direction of travel is clear. Employers will be expected to show that they have thought seriously about where risk sits and how behaviour actually manifests in their organisation.
1. Tailored to Setting, Seniority and Power
Risk is not evenly distributed.
A graduate facing a high value client carries different exposure to a peer to peer interaction. A partner negotiating revenue may feel commercial pressure that complicates intervention. Power dynamics matter.
Training must:
- Address how seniority affects confidence to challenge behaviour
- Equip leaders to act even where commercial relationships are involved
- Make clear that revenue, status or reputation do not dilute standards
If the most powerful people are the least challenged, your framework will unravel quickly.
2. Clear Boundaries in Physical Spaces
Harassment rarely happens in neat, controlled environments. It happens where formality drops:
- Conferences
- Networking events
- Client hospitality
- Late evening functions
- Site visits
Training should be explicit about:
- What immediate protective steps look like
- When withdrawal is appropriate
- When escalation is mandatory
- How concerns are recorded
“Informal” is not outside organisational expectations. If that message is not clear, risk increases.
3. Clear Boundaries in Virtual Spaces
The digital workplace has expanded risk, not reduced it.
Behaviour now surfaces through:
- Inappropriate chat messages
- Repeated direct messages outside working hours
- Appearance based comments on video calls
- Sexualised humour in digital channels
- Boundary crossing through professional networking platforms
Virtual environments blur professional and personal boundaries quickly. They also create records.
Training must help people understand the difference between social awkwardness and sustained boundary crossing. It must explain reporting routes and the importance of preserving evidence.
Ignoring the virtual dimension would be a serious oversight.
4. Technology Is Now Part of the Risk Landscape
Technology does not simply host behaviour. It amplifies it.
AI tools, messaging platforms and personal devices are reshaping how harm occurs.
Examples now include:
- Non consensual sharing of images
- Deepfake imagery
- Blurred communication channels between personal and professional spaces
- Informal digital subcultures that normalise inappropriate behaviour
If training does not address how technology intersects with conduct, it will feel outdated before it is delivered.
“All reasonable steps” in 2026 must reflect the workplace as it exists now.
5. Manager Response Will Be the Deciding Factor
In investigations, the critical failure point is almost always response.
Managers must know:
- How to receive a concern without minimising
- When to implement protective measures immediately
- How to escalate appropriately
- How to avoid subtle forms of detriment
If someone raises a concern and is told “that is just how clients are”, the damage is done.
Prevention and investigation should inform one another. Patterns revealed in investigations should shape future training. That feedback loop is part of what makes a framework credible.
For a broader overview of how concerns are addressed when formal processes are required, see our Disciplinary Investigations guidance.
3. Practical Takeaways
If you are reviewing your harassment training, pressure test it properly.
Ask:
- Have we explicitly addressed third party risk?
- Is our training tailored to our power structures and exposure points?
- Have we defined boundaries clearly in both physical and digital spaces?
- Do leaders receive distinct, scenario based response training?
- Do we review and adapt content when incidents occur?
Do:
- Use scenarios drawn from your own environment
- Equip leaders with clear intervention frameworks
- Align training with documented risk assessment
- Treat technology as part of behavioural risk
Do not:
- Rely solely on annual generic modules
- Assume virtual misconduct carries less weight
- Allow commercial pressure to dilute standards
- Treat prevention and investigation as separate conversations
Training should give people confidence to act, not just awareness of policy.
The strengthened third party harassment duty is a signal.
The expectation is no longer that employers react well. It is that they design systems that reduce harm before it happens.
If you are not entirely confident your current training would withstand scrutiny, that is the right moment to review it.
We work with organisations to build prevention frameworks that are proportionate, practical and able to stand up when it matters.
Visit Tell Jane to learn more about our training services to create a safe workplace environment for employees, employers and third parties.
