By UK employers are facing a tougher sexual harassment prevention regime, yet only 4% are fully prepared for the obligations that will be tested from 2026, according to reporting in The HR Director. The article, published on 17 October 2026, does not itself contain that preparedness figure or the legal analysis, but the wider conversation among HR advisers points to a significant gap between regulatory expectations and employer readiness.
The core legal change is already in force. The Worker Protection (Amendment of Equality Act 2010) Act 2023 introduced a proactive duty on employers to take reasonable steps to prevent sexual harassment of workers. The duty commenced on 26 October 2024. What the 2026 framing signals is not a new statute, but the point at which enforcement, tribunal claims and regulatory scrutiny are expected to expose employers who treated the 2024 date as a paper exercise.
What the duty actually requires
The new duty shifts the legal baseline. Previously, an employer could defend a harassment claim by showing it took all reasonable steps to prevent the conduct. The 2023 Act replaces that reactive defence with a positive obligation to take reasonable steps before harassment occurs. The Equality and Human Rights Commission (EHRC) is the relevant regulator, and its technical guidance sets out what reasonable steps look like in practice.
The duty covers harassment by colleagues and, critically, third parties such as clients, customers, suppliers and members of the public. Employers in hospitality, retail, healthcare and gig economy platforms face particular exposure because workers in those sectors routinely interact with third parties outside direct managerial control.
Employment tribunals can increase compensation by up to 25% where an employer has failed to take reasonable steps. That uplift applies to successful harassment claims and creates a direct financial consequence for non-compliance.
Why the 4% figure matters
The 4% preparedness statistic, cited in the query but not substantiated in the available source material, should be treated with caution. It is unclear what methodology produced the figure or what definition of fully prepared was used. What is clear from the advisory landscape is that many HR leaders believe they are compliant because they updated a policy and delivered a training session. That confidence is often misplaced.
One training provider, Righttrack Learning, frames the issue as a gap between where most organisations are and where they need to be. The firm argues that rushed sessions and missing follow-ups undermine most training, and that a one-off compliance module does not change behaviour. Its view is that culture, leadership accountability and repeated practice matter more than policy documents.
What reasonable steps look like in practice
A compliant approach requires more than a policy refresh. Employers should start with a risk assessment that identifies where harassment is most likely to occur: client-facing roles, late shifts, isolated working, alcohol-related events, and teams with significant power imbalances.
From that assessment, specific controls should follow. Anonymous reporting channels need to be genuinely accessible, not buried in an intranet. Managers need capability training that covers how to respond to disclosures, how to spot early warning signs, and how to intervene when they witness inappropriate behaviour. Bystander training should be part of the package, not an optional extra.
Third-party harassment requires its own controls. That might mean signage in customer-facing areas, a clear process for removing abusive clients, and a commitment from senior leaders that no sale or contract is worth tolerating harassment of staff.
Monitoring is where most employers fall down. Completion rates for e-learning are not a measure of prevention. Better indicators include reporting data, investigation timelines, outcomes, repeat incidents, pulse survey results on psychological safety, and exit interview themes. Those metrics should be reviewed by a named senior leader or board member at least quarterly.
The 30, 60 and 90 day plan
In the next 30 days, HR teams should confirm the legal name of the duty in their policies, check that third-party harassment is explicitly covered, and map where risk is highest. In the next 60 days, they should run manager capability sessions and test reporting channels with real scenarios. In the 90 days after that, they should review the data those channels produce and report findings to leadership.
The distinction between reasonable steps and the old all reasonable steps defence is not academic. A tribunal will ask what the employer did before an incident, not what it could have done after. Employers who wait for a complaint before acting are already behind the standard the law now sets.
| Timeline | Action | Why it matters |
|---|---|---|
| 26 October 2024 | Duty commenced under Worker Protection Act 2023 | Legal obligation to take reasonable steps is live |
| 2025 | EHRC technical guidance and early tribunal cases emerge | Defines what reasonable steps means in practice |
| 2026 | Enforcement and claims test employer readiness | 25% compensation uplift applies for failures |
The employers most likely to face difficulty in 2026 are those that treated the 2024 duty as a compliance tick-box. The ones most likely to succeed are those that embedded prevention into how work is designed, how managers are developed, and how leaders are held accountable.
Sources: The HR Director
Photo: Palace of Westminster - Parliament Building and stars on the sky by Petronela Cretu, CC BY-SA 3.0
