A step change: new EHRC guidance on harassment prevention

The Equality and Human Rights Commission (EHRC) has now updated both its technical guidance on sexual harassment and harassment at work and its eight-step guide for employers to reflect the new regime.

The guidance makes it clear that employers are expected to do a lot more than simply have a policy in place and provide training - they need to assess risks proactively and put in place tailored prevention measures.

“All” reasonable steps 

Under section 40A of the Equality Act 2010, employers must now take all reasonable steps to prevent sexual harassment. The EHRC says that if there is another reasonable step that an employer could have taken, but decided not to take, it is likely to have failed to comply with the preventative duty. 

That does not mean that every employer must take every conceivable precaution. What is reasonable remains fact-specific and will depend on matters such as the organisation's size and resources, working environment, sector and dealings with third parties.

However, the key for employers is demonstrating that they properly considered the risks and whether there were further reasonable measures available to address them.

Risk assessments 

The EHRC guidance emphasises that an employer is unlikely to comply with the preventative duty without carrying out a risk assessment. It also recommends separate consideration of third-party harassment risks and consultation with trade unions or employee representatives when assessing risks. 

Employers which carried out a sexual harassment risk assessment when the original preventative duty came into force in 2024 should now revisit it, and employers which didn't carry out a risk assessment should do so now. 

Areas to focus on include:

• client, customer, contractor and supplier interactions;
• work-related social events and alcohol;
• lone or isolated working;
• particular roles, locations or working arrangements where risks are greater;
• risks affecting particular protected groups, including intersectional risks; and
• what the employer has learned from complaints, grievances, staff surveys and exit interviews.

The EHRC guidance also highlights the importance of keeping records of steps taken following the risk assessment,  including action plans, consultation with staff and unions, training records, surveys, awareness initiatives, evaluation of preventative measures and complaints and their outcomes. 

Harassment by third parties

An employer can now be liable for harassment of an employee in the course of employment by a third party unless it can establish that it took all reasonable steps to prevent it. Third parties can include customers, clients, contractors, suppliers, patients, service users and members of the public.

The preventative steps required will vary from business to business. The EHRC gives examples ranging from signs and communications setting behavioural expectations, avoiding lone working and providing staff with practical de-escalation training, to security measures and mechanisms enabling employees to obtain assistance or remove themselves from an unsafe situation.

Third party contracts 

The EHRC suggests employers consider including contractual provisions which make clear that harassment will not be tolerated, establish responsibility for investigating allegations, require cooperation with investigations, set out warranties relating to anti-harassment training and allow an organisation to require the removal of an individual from an assignment.

Training

Training also features heavily in the revised guidance. 

The EHRC's position is that an employer is unlikely to have taken all reasonable steps where its training is inadequate or managers have not properly understood it, even where it has an anti-harassment policy and has provided training. The updated guidance recommends more practical training, including training on underlying causes of harassment, bystander intervention and dealing with third parties. 

Employers should therefore look critically at both the content and effectiveness of existing training, e.g. by reviewing what impact it has had on the number of complaints and employee confidence in coming forward.

An annual online module which employees can click through in ten minutes may be considerably harder to defend if complaints, survey results or other warning signs indicate that the underlying risk has not been addressed.

Whistleblowing

The ERA 2025 makes it clear that disclosures of sexual harassment may amount to protected disclosures under whistleblowing law and the EHRC's updated guidance reflects this. 

The guidance recommends that employers' policies explain that a harassment complaint may potentially be raised under either the anti-harassment or whistleblowing procedure, explain how the appropriate route should be determined, and recognise that some harassment complaints may amount to whistleblowing. 

If a concern has been raised through the “wrong” route, the EHRC says that it should still be investigated promptly under the appropriate procedure without adverse repercussions for the complainant.  It also states that choosing not to investigate a potential whistleblowing concern relating to sexual harassment may itself mean that the employer has failed to comply with the preventative duty.

Employers reviewing their harassment policies should therefore review their whistleblowing arrangements at the same time.

Conflicts of views and freedom of expression 

Employers in customer-facing businesses such as retail and hospitality were concerned about the possibility of harassment claims based on customers expressing views that staff found offensive.  It's obviously difficult to police what people say in a public venue - and not feasible (or reasonable) to ban, say, customers in a pub from discussing controversial subjects. 

Drawing on the caselaw in this area, the guidance makes clear that conduct is not harassment simply because somebody finds an opinion offensive. Employers should consider how a belief or opinion was expressed and whether it was objectively reasonable for the employee to experience the conduct as harassment in the circumstances.   Employers' focus should be on preventing offensive conduct rather than policing opinions. 

Where should employers start?

Many employers will have some of these measures in place already, others will be starting more or less from scratch.  Either way, employers need to review their current preventative measures urgently and ensure that they follow the EHRC's recommended framework. 

We suggest that employers focus on the following priorities:

1. Refresh the harassment risk assessment, specifically addressing third-party harassment, and ensure that mitigation measures are put in place.
2. Review anti-harassment and whistleblowing policies together, including how complaints which could fall under either regime will be handled.
3. Review and update training, particularly for managers and employees who regularly deal with clients, customers or other third parties.
4. Look at third-party contracts, including supplier, contractor and consultancy arrangements, to see whether appropriate harassment provisions should be included.
5. Check reporting and record-keeping, so the risk assessment and preventative measures reflect what's happening in practice .
6. Put ownership at senior level. The revised guidance repeatedly emphasises the role of senior leaders and managers in setting expectations and taking responsibility for action. 

The key point is that the preventative duty is anticipatory and ongoing.  Compliance isn't a “one and done” issue for HR but an ongoing project across the whole business, including senior leadership.