If you employ people, 1 October 2026 is a date worth putting in the diary. It marks the next tranche of changes flowing from the Employment Rights Act, and unlike some of the reforms that have been trailed for years, these ones have practical, day-to-day consequences for a business with a handful of staff. This isn’t about box-ticking for its own sake. It’s about the policies and paperwork that protect you if something goes wrong — and, as I’ll come back to at the end, the same documents that make your business easier to hand over one day.
Third-party harassment: a single incident can be enough
From October 2026, an employer can be held liable where a worker is harassed by a third party — a customer, a client, a supplier, anyone who isn’t your employee. The point that catches people out is this: a single incident can be enough to create liability if you haven’t taken all reasonable steps to prevent it.
Think about what this means in practice. A member of staff on your reception desk, in your shop, or dealing with clients on the phone is now squarely within scope. If a customer behaves badly towards them and you’ve done nothing to prepare for that possibility, you may be exposed — even if it only happened once.
This is a change of emphasis as much as a change of law. Historically, most employers thought about harassment as something that happens between colleagues, and built their policies around that assumption. From October 2026, the person doing the harassing might never work a day for you — they might be a difficult customer at the till, a contractor’s employee on site, or a supplier’s representative at a meeting. The law now expects you to have thought about that possibility in advance, not scrambled to respond after the fact.
The practical response isn’t complicated, but it does need to be documented. You want a written policy that names third-party harassment specifically, a way for staff to report incidents without it feeling awkward, and a record that you’ve thought about where the risk sits in your business — a pub, a shop, a care setting, and an office with no public footfall all carry different levels of risk. If your business has any public-facing element at all, this is worth doing properly rather than as an afterthought.
From “reasonable steps” to “all reasonable steps”
This one is a genuine tightening, not just a rebrand. The preventative duty on sexual harassment that came in during October 2024 asked employers to take “reasonable steps”. From October 2026, the bar rises to “all reasonable steps” — a higher standard, and one where the detail is still expected to be filled in by regulations. We don’t yet know exactly how “all reasonable steps” will be defined in practice, so treat anything you read with a firm date on it as provisional until the regulations land.
What we do know is the shape of the evidence you’ll be expected to produce if anyone ever asks. That’s:
- A risk assessment that looks honestly at where harassment — including from third parties — could happen in your business.
- A clear anti-harassment policy that explicitly covers third parties, not just colleague-to-colleague conduct.
- A reporting route that staff actually know about and would use.
- Training that’s been delivered and, crucially, documented — a note of who attended, when, and what was covered.
None of this needs to be elaborate. It needs to exist, be current, and be something you could put your hand on if a claim ever arrived on your desk. A policy that was written once, five years ago, and has been sitting unread in a folder ever since is unlikely to count for much — the emphasis in “all reasonable steps” is on steps that are live and being followed, not paperwork that exists purely for show.
Worth saying plainly: none of this means every existing anti-harassment policy is wrong or out of date. Plenty of employers already have sound policies and good practice in place. What’s changing is the standard those policies will be measured against, and the fact that third parties now sit inside the frame rather than outside it. If you already have something reasonable, this is a chance to review and strengthen it, not to start from scratch in a panic.
A new duty to tell staff about union rights
Alongside the harassment changes, employers will have a new duty to inform workers of their right to join a trade union. This sits alongside strengthened rights for unions to access workplaces and new protections for union representatives carrying out their role.
For most small employers this won’t change how the business is run day to day, but it does mean a paperwork job. The right to join a union needs to appear somewhere workers will actually see it — that’s likely to mean your written statement of particulars, your induction pack, and your staff handbook if you have one. If your handbook hasn’t been touched in a few years, this is a sensible moment to update it rather than waiting until you’re asked to produce it.
It’s also worth thinking about how a union representative, if one ever asked, would be treated if they wanted access to your workplace, or if one of your own staff took on that role. The strengthened protections mean it’s better to have thought this through calmly in advance than to be working it out for the first time under pressure.
Tighter rules on tipping
If you run a business where tips come in — hospitality most obviously, but anywhere tipping happens — the rules on how a tipping policy is set and how tips are allocated are being tightened further. If you already have a written tipping policy from the earlier round of tipping reforms, this is the point to check it still reflects how tips are actually being shared out in practice, not just what the policy says on paper.
The gap between the policy on paper and what actually happens on a Saturday night is exactly where problems tend to surface. If your rota, your till system, or the way a supervisor divides the tip jar at the end of a shift doesn’t quite match your written policy, this is worth sorting out before the tightened rules apply, not after a member of staff raises it.
What to actually do before 1 October 2026
Treat this as a short, practical checklist rather than a project:
- Update or write an anti-harassment policy that names third parties specifically.
- Do a simple, honest risk assessment of where harassment could arise in your particular business.
- Make sure staff have a clear, comfortable way to report a concern.
- Deliver — and document — some training, even if it’s brief.
- Add the right to join a union to your written statement of particulars, induction materials and handbook.
- Review your tipping policy if tips form part of how staff are paid.
- Keep an eye out for the regulations that will define “all reasonable steps” — the detail will matter.
None of this needs specialist HR software or an expensive consultant. It needs an afternoon, a decent template, and a habit of keeping the paperwork current rather than writing it once and forgetting it. If you already have most of these things in place, this is simply a prompt to dust them off and check they still fit the business as it is today, not as it was when you first wrote them.
A worked example: one afternoon, six staff, five documents
To make this concrete, picture a business with six employees — a small café with a couple of part-time staff, a manager and an owner who still does a shift most weeks. No HR department, no in-house lawyer. Here’s how the owner worked through the checklist in a single afternoon.
First came the risk assessment, which took less time than expected because it was really an honest conversation with the manager. Where does the public interact with staff — the till, the tables, the phone for bookings? Are there moments where a member of staff is alone with a customer, or dealing with someone who’s had a drink or is upset about an order? Writing this down as a short list — location, who’s exposed, what’s already in place — was the whole task.
Next was the policy itself. Rather than starting from a blank page, the owner took the existing disciplinary and grievance wording and added two paragraphs naming third-party harassment specifically — customers, delivery drivers, contractors — and stating the same standards apply to them as to colleagues. That went into the handbook as a new, dated page.
The reporting route was the part that had never been written down, even though everyone knew “just tell the manager” was the practice. A sentence or two — who to speak to, that there’s no penalty for raising something minor — turned an informal habit into something a member of staff could point to.
Training took the form of a fifteen-minute conversation with the whole team at the end of the shift, covering the policy, the reporting route and a couple of realistic examples. The training note was simply a dated record of who attended, kept with the handbook.
By the end of the afternoon there were five things in place: a risk assessment, an updated policy, a reporting route, a training note, and a new handbook page. None of it was polished — it needed to exist and be true to how the business runs.
What not to panic about
None of this calls for new software or a compliance consultant. If you already have a handbook, a disciplinary process, and a habit of talking to your team, most of what’s needed is an addition, not a rewrite. A business with one or two staff and little public contact has a lighter job than a shop or hospitality business with constant customer contact — the risk assessment should reflect that honestly rather than copying a generic template.
It’s also worth saying plainly that the exact meaning of “all reasonable steps” is still to be set out in regulations. Nobody can say today, with certainty, precisely what would be considered sufficient in every case, because that detail hasn’t been published yet. The sensible approach is to do the practical things now, and adjust once the regulations land, rather than wait for perfect certainty before starting.
Why this matters beyond the law
Here’s the part I always come back to. The policies, the handbook, the documented training records, the written processes — these aren’t just protection against a claim. They’re also exactly what makes a business easier to value, easier to hand over to a family member or a buyer, and easier for someone else to run if you’re not there, whether that’s for a holiday, an illness, or the day your estate has to deal with probate. A business that runs on documented systems rather than what’s in the owner’s head is worth more and causes far less stress for whoever has to pick it up. Employment compliance and succession planning aren’t really two separate jobs — they’re the same discipline of writing things down properly, once, and keeping them up to date.
If you’d like to talk through how your business’s paperwork — employment or otherwise — fits into your wider plans for the future, book a Discovery Call and we’ll go through it together.