All Reasonable Steps: Preventing Sexual and Third-Party Harassment as the Legal Duty Shifts From Response to Prevention
Download the article here:
Listen to a review of this article:
Abstract: From 30 October 2026, the UK Employment Rights Act 2025 raises employers' duty from taking reasonable steps to taking all reasonable steps to prevent sexual harassment, and makes employers liable for harassment of employees by third parties such as customers, clients, and patients. This article situates that change within a wider international shift toward preventive duties, including Australia's positive duty, ILO Convention 190, and the contrasting rescission of US federal harassment guidance. Drawing on meta-analytic and survey evidence, regulatory guidance, and enforcement actions and culture reviews across hospitality, mining, policing, fire services, healthcare, technology, manufacturing, and business associations, it argues that perceived organizational tolerance is the strongest lever on harassment and that the new standard can only be met through an integrated system. Five evidence-based responses are examined: risk assessment that includes third parties, leadership accountability, trusted reporting and fair response, behavior-focused bystander and manager training, and measurement with transparency. The article closes with guidance on building long-term prevention capability for multinational leaders.
For most of the last forty years, the legal architecture around workplace sexual harassment rewarded organizations for what they did after something went wrong. Have a policy, investigate the complaint, discipline the perpetrator, and the law would usually treat you as a responsible employer. That model is being taken apart. In the United Kingdom, employers have since 26 October 2024 carried a positive, anticipatory duty to take reasonable steps to prevent sexual harassment of their workers, and from 30 October 2026 the Employment Rights Act 2025 raises that standard to "all reasonable steps" and makes employers liable for harassment of their employees by third parties such as customers, clients, and patients (Employment Rights Act 2025; Faragher, 2026; Syder, 2026). Australia moved earlier and further, inserting a positive duty into its Sex Discrimination Act in December 2022 and handing its Human Rights Commission enforcement powers a year later (Australian HR Institute, 2023; Kavanagh & Beveridge, 2023). Internationally, ILO Convention 190 set a benchmark in 2019 that has since attracted around fifty ratifications (International Labour Organization, n.d.).
The direction of travel is not uniform. In the United States, the Equal Employment Opportunity Commission (EEOC) issued comprehensive harassment guidance in April 2024, saw parts of it vacated by a federal court in 2025, and then voted in January 2026 to rescind it entirely, while stressing that Title VII's prohibition on harassment is untouched (Maunz et al., 2026). For multinational leaders, that divergence is itself a management problem: the floor of legal obligation now differs sharply across jurisdictions, but the behavior that harms people, and the conditions that allow it, do not.
This article is written for leaders who want to treat the new UK standard as an occasion to build something that works, rather than as a compliance deadline. It draws on three decades of research on what predicts harassment and what reduces it, on regulatory guidance from the Equality and Human Rights Commission (EHRC) and its counterparts, and on the experience of organizations across hospitality, mining, policing, emergency services, healthcare, technology, manufacturing, and professional membership bodies. The central argument is simple. "All reasonable steps" is a standard that can only be met by a system: an organization that understands where its risks lie, whose leaders visibly own the issue, whose reporting routes are trusted, whose training changes behavior rather than reciting law, and which measures whether any of it is working. Each of those elements has an evidence base. Most organizations have pieces of it. Few have the whole.
The Workplace Harassment Prevention Landscape
Defining Key Terms
Under the Equality Act 2010, sexual harassment is unwanted conduct of a sexual nature that has the purpose or effect of violating a person's dignity or creating an intimidating, hostile, degrading, humiliating, or offensive environment. It sits alongside harassment related to a protected characteristic (such as sex, race, or disability) and less favorable treatment because someone rejected or submitted to sexual conduct. Researchers typically break sexual harassment into three overlapping forms: gender harassment (verbal and nonverbal behavior that conveys hostility, objectification, exclusion, or second-class status), unwanted sexual attention, and sexual coercion. The National Academies of Sciences, Engineering, and Medicine (NASEM) concluded that gender harassment is by far the most common of the three, which matters because it is also the form most easily waved away as "banter" (National Academies of Sciences, Engineering, and Medicine [NASEM], 2018).
Third-party harassment is harassment of a worker by someone who is neither the employer nor a fellow employee: customers, clients, patients, contractors, students, delegates, or members of the public. The new section 40(1A)–(1C) of the Equality Act, inserted by section 21 of the Employment Rights Act 2025, provides that an employer must not permit a third party to harass an employee, and that it does so if the harassment occurs in the course of employment and the employer failed to take all reasonable steps to prevent it (Employment Rights Act 2025). Unlike the 2024 preventive duty, which applies to sexual harassment specifically, the third-party provision covers harassment related to any protected characteristic (Syder, 2026).
The preventive duty is the obligation, introduced by the Worker Protection (Amendment of Equality Act 2010) Act 2023, for employers to take reasonable steps to prevent sexual harassment of employees in the course of their employment. It is anticipatory: employers are expected to foresee situations in which harassment might occur and act before it does (TLT, 2024). Workers cannot bring a freestanding claim for breach of the duty, but where a tribunal upholds a sexual harassment claim and finds the duty breached, it can increase compensation by up to 25 percent. The EHRC can also enforce the duty directly, through investigations, unlawful act notices, legally binding agreements, or injunctions, even where no harassment has yet occurred (TLT, 2024; Wren & Steele, 2024).
Finally, "all reasonable steps" is a phrase that will carry most of the legal weight from October 2026. Section 20 of the Employment Rights Act 2025 substitutes it for the existing standard, and section 22 gives ministers power to specify, by regulation, steps that will be treated as reasonable, including carrying out assessments, publishing plans or policies, and steps relating to reporting and complaint handling (Employment Rights Act 2025). Those regulations are not expected before 2027 and will be consulted on (Davies, 2026). In practice, then, leaders face a stricter standard before its detailed content is fixed. The EHRC's existing technical guidance, published in September 2024, and its eight-step guide for employers are the best available indication of what tribunals and the regulator will expect (TLT, 2024; Wren & Steele, 2024).
Prevalence, Drivers, and Distribution
The numbers are uncomfortable, and they have proven stubborn. The Government Equalities Office's 2020 Sexual Harassment Survey, which collected more than 12,000 responses, found that 29 percent of people in employment had experienced at least one form of workplace sexual harassment in the previous twelve months, with similar rates for women (30 percent) and men (27 percent) when a broad behavioral list was used. Only 15 percent of those harassed at work reported it formally, internally or externally (Adams et al., 2021). Unwelcome sexual jokes or comments were the most common behavior, and harassment happened not only in the physical workplace but while socializing with colleagues and on visits to clients or customers.
Union polling points in the same direction. A 2023 Trades Union Congress (TUC) survey of just over 1,000 working women found that 58 percent had experienced sexual harassment, bullying, or verbal abuse at work, and that only 30 percent of those who experienced sexual harassment told their employer. The most commonly cited reasons for staying silent were fear of not being believed (39 percent) and fear of damaging working relationships (37 percent). Strikingly for the new legal regime, the TUC reported that in about two in five of the most recent incidents women described, the perpetrator was a third party such as a customer, client, patient, or member of the public (Trades Union Congress, 2023).
International evidence shows a consistent pattern. The EEOC's Select Task Force, co-chaired by Commissioners Chai Feldblum and Victoria Lipnic, reviewed decades of US survey research and reported estimates ranging from 25 to 85 percent of women, depending largely on how questions were asked: around a quarter when respondents were asked whether they had experienced "sexual harassment," and around 60 percent when they were asked about specific behaviors. The task force estimated that only 6 to 13 percent of people who experience harassment file a formal complaint, and that roughly nine in ten take no formal action at all (Feldblum & Lipnic, 2016). Writing in Harvard Business Review, Dobbin and Kalev (2020) put the share of US women reporting workplace sexual harassment at around 40 percent, a figure they note has barely moved since the 1980s.
Sector-specific studies reveal how sharply exposure varies with context. A national study of the UK surgical workforce, weighted to the NHS England population, found that 63.3 percent of women and 23.7 percent of men had been targets of sexual harassment by colleagues in the previous five years, and that 29.9 percent of women had been sexually assaulted by a colleague (Begeny et al., 2023). Rio Tinto's independent culture review found that 28.2 percent of women and 6.7 percent of men had experienced sexual harassment at work in the previous five years (Rio Tinto, 2022). Figure 1 sets these figures side by side.
Customer-facing work brings its own exposure. NHS England reported that in 2023, 8.67 percent of staff responding to the NHS Staff Survey, equivalent to about 58,000 people, experienced unwanted sexual behavior from patients, their relatives, or members of the public, compared with 3.84 percent from colleagues; just under a quarter of ambulance staff reported such behavior from the public (NHS England, 2024). An Australian union survey of hospitality workers found that around nine in ten respondents had experienced sexual harassment at work (SmartCompany, 2017), and University of Sydney research on retail found one in five retail workers had been sexually harassed in the past five years, most commonly by a senior colleague or a customer (University of Sydney, 2023).
What drives these patterns? The research is more consistent than the prevalence estimates. Fitzgerald and colleagues' integrated model identified two primary antecedents: the organization's perceived tolerance of harassment and the gendered nature of the job context (Fitzgerald et al., 1997). A meta-analysis by Willness, Steel, and Lee (2007), drawing on 41 studies and nearly 70,000 respondents, found that organizational climate for sexual harassment "figured prominently" in facilitating it. NASEM (2018) went further, describing perceived organizational tolerance as the most potent predictor of harassment. The EEOC task force added a practical list of risk factors that many leaders will recognize: significant power disparities, homogeneous workforces, many young workers, "high value" employees whose misconduct is overlooked, isolated or decentralized workspaces, cultures that tolerate alcohol, and, directly relevant here, workplaces that depend on customer service or client satisfaction (Feldblum & Lipnic, 2016).
Customer harassment has its own dynamics. Gettman and Gelfand (2007) showed in two field studies that client power and the gender composition of the client base predicted levels of harassment by clients and customers, and that this harassment was associated with lower job satisfaction among nonprofessional women over and above harassment from inside the organization. Third-party harassment is not simply internal harassment with a different perpetrator. It is shaped by commercial dependency, by norms such as "the customer is always right," and by the fact that the employer has less direct control over the harasser.
Organizational and Individual Consequences
Organizational Performance Impacts
Harassment is often discussed as a legal risk. The larger cost is operational. Willness et al. (2007) found that harassment experiences are associated with lower job satisfaction, lower organizational commitment, and withdrawal from work, all of which translate into absence, turnover, and reduced effort. McLaughlin, Uggen, and Blackstone (2017), using longitudinal data and interviews, found that sexual harassment increases women's financial stress, largely by precipitating job change, and can significantly alter career attainment. Every one of those exits is a recruitment and training cost, and in sectors with skill shortages, such as surgery, firefighting, and engineering, a capability loss.
The most comprehensive attempt to price the problem was commissioned by the Australian Treasury to inform the Respect@Work inquiry. Deloitte Access Economics (2019) estimated that workplace sexual harassment cost the Australian economy around A$2.6 billion in lost productivity and A$0.9 billion in other financial costs in 2018, plus around A$250 million in lost wellbeing for victims, with employers bearing 70 percent of the financial costs. Whatever the precise figure in other economies, the shape of the burden is instructive: most of the cost lands on employers, and most of it is invisible in any single budget line.
Then there are the direct costs of enforcement and litigation. The EEOC task force recorded that in fiscal year 2015 alone, the agency recovered $125.5 million for workers alleging harassment through its pre-litigation process, and that nearly a third of all charges filed included a harassment allegation (Feldblum & Lipnic, 2016). Settlements in individual high-profile cases discussed below, such as Activision Blizzard's $18 million consent decree and Ford's $10.1 million conciliation agreement, are visible markers of a much wider exposure (HR Dive, 2022; U.S. Equal Employment Opportunity Commission [EEOC], 2017). In the UK, the 25 percent uplift on compensation for breach of the preventive duty, the extension of the tribunal time limit from three to six months for events from 1 October 2026, and the EHRC's power to act before harm occurs all increase the expected cost of getting this wrong (Faragher, 2026; TLT, 2024).
Reputational and franchise risks may be the most severe of all. Organizations whose harassment problems become public can lose customers, members, partners, and licenses to operate in a matter of days. The Confederation of British Industry (CBI) saw dozens of major members cut ties within days in 2023, as later sections describe. Rio Tinto's chief executive called his own company's review findings "deeply disturbing" and committed to implementing all 26 recommendations (Rio Tinto, 2022). For organizations whose licence to operate depends on public trust, including police forces, health systems, and consumer brands, harassment is not a human resources matter. It is a strategic one.
Individual Wellbeing and Stakeholder Impacts
For the people harassed, the effects are serious and well documented. The Willness et al. (2007) meta-analysis linked harassment to poorer physical and mental health and, in some cases, symptoms consistent with post-traumatic stress disorder. NASEM (2018) urged institutions to address gender harassment explicitly, precisely because it is the most common form; a policy that focuses only on egregious incidents is likely to miss much of the everyday damage.
Harassment also changes how people work. Women in the London Fire Brigade described to an independent reviewer a daily gauntlet of sexist abuse, with many saying they doubted colleagues would protect them in dangerous situations (Fire Protection Association, 2022). That is a safety problem, not only a dignity problem. In surgery, Begeny et al. (2023) found that women rated the adequacy of the bodies responsible for addressing sexual misconduct far lower than men did: only 15.1 percent of women rated the General Medical Council's handling as adequate, against 48.6 percent of men. When people stop believing that institutions will act, they stop reporting, and the organization loses its main source of information.
Third-party harassment spreads harm beyond the immediate target. It shapes who is willing to take frontline roles, which shifts patterns are avoided, and whether younger and more junior workers stay in an industry at all. McDonald's UK, for instance, says it employs around 148,000 people across company and franchised restaurants, many of them young (Restaurant Online, 2025); the safeguarding implications of harassment in such a workforce extend to families and communities. Customers and patients are stakeholders too. Health services, hospitality venues, and retailers that allow harassment of staff are, in effect, making a statement about the conduct they will tolerate in their public spaces.
Finally, harassment corrodes the trust that collective work depends on. Feldblum and Lipnic (2016) estimated that roughly 70 percent of people who experience harassment never speak to a supervisor, manager, or union representative about it. Dobbin and Kalev (2020) found that roughly one in ten victims makes a formal complaint and that retaliation against complainants is common. An organization in which most harm goes unreported is one in which leaders are making decisions on badly incomplete information.
Evidence-Based Organizational Responses
If perceived tolerance is the strongest predictor of harassment, then prevention has to change what people believe the organization will and will not tolerate, and it has to do so through actions people can see. The responses below align closely with the EHRC's eight steps (policy, staff engagement, risk assessment, reporting, training, complaint handling, third-party harassment, and monitoring) and with the seven standards the Australian Human Rights Commission set for its positive duty (leadership, culture, knowledge, risk management, support, reporting and response, and monitoring, evaluation, and transparency), but they are organized around the mechanisms the research suggests matter most (Australian HR Institute, 2023; Wren & Steele, 2024). Table 1 summarizes them.
Table 1: Five evidence-based responses to the "all reasonable steps" standard
Response | Evidence Base | Key Practices | Illustrative Examples |
Risk assessment that includes third parties | EHRC guidance as summarized by TLT (2024); Feldblum & Lipnic (2016) risk factors; Gettman & Gelfand (2007) | Map exposure by role, site, shift, and customer type; set customer conduct rules; protect lone and young workers | McDonald's UK; NHS England Sexual Safety Charter; Presidents Club dinner |
Leadership accountability and culture | Willness et al. (2007); NASEM (2018); Fitzgerald et al. (1997) | Board oversight, leader metrics, consequences regardless of seniority | Rio Tinto; CBI; Uber |
Trusted reporting and fair response | Feldblum & Lipnic (2016); Dobbin & Kalev (2020); Trades Union Congress (2023) | Multiple channels, anonymous options, anti-retaliation, timely independent investigation | Metropolitan Police; London Fire Brigade |
Behavior-focused, bystander and manager training | Roehling & Huang (2018); Kettrey et al. (2019); Dobbin & Kalev (2020) | Skills practice, bystander intervention, manager response training, tailored scenarios | Ford Chicago plants; McDonald's UK refresher training |
Measurement, monitoring, and transparency | NASEM (2018); AHRC standards (Australian HR Institute, 2023); EHRC step 8 (Wren & Steele, 2024) | Climate surveys, audits, published progress, external review | Activision Blizzard; Rio Tinto |
Figure 2 shows how these responses reinforce one another. None of them on its own is likely to satisfy a tribunal that the employer took all reasonable steps; together, and adapted to the organization's specific risks, they are the closest thing to a defensible standard that the evidence currently supports.
Risk Assessment That Includes Third Parties
The EHRC's guidance is blunt on this point: legal commentators reading it have concluded that an employer is unlikely to be able to comply with the preventive duty without carrying out a risk assessment (TLT, 2024). The guidance asks employers to consider the risks of harassment, identify steps to reduce them, decide which are reasonable, implement them, and review them regularly, and it explicitly expects third-party risks such as customers, clients, contractors, and members of the public to be part of that assessment (TLT, 2024; Wren & Steele, 2024). The Employment Rights Act's power to specify "assessments" as reasonable steps signals that formal risk assessment may soon be close to mandatory (Employment Rights Act 2025).
The research tells leaders what to look for. The EEOC task force's risk factors, including power disparities, young workforces, isolated work, alcohol, and dependence on customer satisfaction, translate directly into assessment questions (Feldblum & Lipnic, 2016). Gettman and Gelfand (2007) add that the power of clients and the gender mix of the customer base shape exposure to customer harassment. ILO Convention 190 likewise expects employers, so far as is reasonably practicable, to identify hazards and assess risks of violence and harassment with worker participation, and to account for them in occupational safety and health management (International Labour Organization, 2019). Treating harassment as a health and safety hazard, rather than as a conduct issue that appears only when someone complains, is the conceptual shift that "all reasonable steps" requires.
Effective approaches:
Role-level mapping: Assess exposure by role, location, shift pattern, and customer type rather than producing a single organization-wide document.
Worker participation: Involve frontline staff, unions, or employee representatives in identifying risks, as both ILO Convention 190 and the EHRC guidance expect.
Customer conduct standards: Publish clear expectations for customers, patients, and clients, with consequences such as refusal of service, removal, or banning.
Protective design: Address lone working, late shifts, alcohol-serving environments, home visits, and events with practical controls such as pairing, panic alarms, and supervisor presence.
Contracting terms: Build harassment standards into contracts with clients, venues, agencies, and franchisees.
Regular review: Revisit the assessment after incidents, organizational changes, and survey results.
McDonald's UK illustrates both the necessity and the difficulty of this work in a young, high-turnover, customer-facing workforce. The company signed a legally binding agreement with the EHRC in February 2023 over its handling of sexual harassment complaints. A BBC investigation later that year gathered more than 100 allegations of sexual and racial abuse, harassment, and bullying, and further allegations followed in January 2025 (Restaurant Online, 2025). In March 2025 the EHRC wrote to every McDonald's franchisee in Britain, reminding them that franchisees, not only the corporate entity, are responsible for complying with the preventive duty and warning of enforcement action (Equality and Human Rights Commission [EHRC], 2025a). In November 2025 the regulator extended its agreement with the company to monitor a strengthened action plan, including a new safeguarding policy and a plan for vulnerable workers developed with external experts, strengthened risk assessments reviewed during restaurant inspections, and a request that all franchisees commit to appropriate policies and culture measures (EHRC, 2025b).
NHS England took a different route to the same insight. After its staff survey showed that staff were more than twice as likely to experience unwanted sexual behavior from patients and the public as from colleagues, it launched its first Sexual Safety Charter at the end of 2023, committing signatory trusts to improve reporting of unacceptable behavior (NHS England, 2024). Health care is a setting in which the third party is often vulnerable, unwell, or distressed, which makes simple "ban the customer" responses unworkable and puts more weight on risk assessment, staffing, and support for staff.
The Presidents Club charity dinner shows what happens when the risk assessment is never done at all. In January 2018, undercover Financial Times reporters revealed that hostesses at a men-only fundraising dinner at The Dorchester hotel in London had been groped and harassed by guests; staff had been instructed to wear revealing outfits, and some were harassed again at an after-party. Within days the charity announced it would host no further events and would close, and children's hospitals said they would return its donations (ITV News, 2018). For hospitality and events businesses, the case is a reminder that the employer of agency and casual staff remains responsible for foreseeable risks created by the client, the venue, and the format of the event.
A common pitfall: treating the risk assessment as a document rather than a process. A template completed once by HR, without input from the people who face customers, will miss the risks that matter and will not persuade a tribunal or the EHRC that the employer genuinely anticipated harm.
Leadership Accountability and Culture
If climate is the strongest predictor of harassment, then leaders are the strongest levers on climate. Willness et al. (2007) and Fitzgerald et al. (1997) both found that organizational climate, and in particular perceived tolerance (employees' beliefs about whether complaints will be taken seriously, whether perpetrators will face consequences, and whether reporting is risky), is a central predictor of harassment. NASEM (2018) recommended that reducing harassment be an explicit goal of institutional leaders and that organizations move beyond legal compliance to address culture and climate. The Australian positive duty puts leadership first among its seven standards (Australian HR Institute, 2023).
What leaders do matters more than what they say. The EEOC task force emphasized that effective prevention starts at the top and that it requires holding "high value" employees, the star performers and senior figures whose misconduct is often excused, to the same standards as everyone else (Feldblum & Lipnic, 2016). Accountability systems that are visible, consistent, and applied regardless of seniority are the practical expression of a climate that does not tolerate harassment.
Effective approaches:
Board oversight: Make harassment prevention a standing governance item with regular reporting on incidents, reports, outcomes, and survey data.
Leader metrics: Include prevention and response measures in managers' performance reviews and promotion decisions.
No exemptions: Apply consequences consistently regardless of seniority or commercial value, and be seen to do so.
Visible sponsorship: Have senior leaders personally communicate standards and the reasons for them, including standards for customers.
Diversity in leadership: Address homogeneous leadership teams and power imbalances that the research links to higher risk.
Rio Tinto chose to commission and publish an external review of its own culture. Led by Elizabeth Broderick, a former Australian Sex Discrimination Commissioner, the review heard from more than 10,000 people through surveys, listening sessions, and written submissions. It found that almost half of respondents had experienced bullying, that 28.2 percent of women had experienced sexual harassment in the past five years, and that 21 women reported actual or attempted rape or sexual assault (Rio Tinto, 2022). Chief executive Jakob Stausholm apologized publicly and committed to all 26 recommendations, focusing on leadership commitment, making camp and village accommodation safe, and making it easier and safer to report (Rio Tinto, 2022). The decision to publish was itself a leadership act: it made the problem undeniable inside the company and created external accountability for progress.
The CBI shows the opposite trajectory. After The Guardian published allegations of misconduct against its director general in March 2023, further women came forward, including one who said she had been raped at a staff party. The board dismissed the director general after a law firm's investigation and suspended other staff (ITV News, 2023b). Major members including Aviva, John Lewis, and EY cut ties, others paused membership, and the CBI's president acknowledged that the organization had been complacent, had failed to screen out harmful hires, and that senior leaders should have removed offenders rather than resolving cases internally (City A.M., 2023). An organization whose purpose was to speak for British business found its existence put to a membership vote.
Uber's 2019 settlement with the EEOC shows what accountability can look like when it is designed into systems. The EEOC found reasonable cause to believe Uber had permitted a culture of sexual harassment and retaliation. Alongside $4.4 million in compensation, Uber agreed to a three-year monitor and to build a system to flag employees accused of harassment and managers who failed to respond to reports in a timely way, with the EEOC praising its commitment to identifying repeat offenders (CNBC, 2019). Flagging allegations and unresponsive managers turns accountability from an aspiration into a data-driven process.
A common pitfall: confusing statements with accountability. Leaders' messages about "zero tolerance" can actively damage trust when employees see senior people or commercially valuable colleagues escape consequences. Climate is built from observed decisions.
Trusted Reporting and Fair Response
The reporting gap is the defining feature of this field. Only 15 percent of UK workers harassed at work reported it formally (Adams et al., 2021); only 30 percent of women harassed in the TUC's survey told their employer (Trades Union Congress, 2023); and the EEOC task force estimated that 87 to 94 percent of people harassed never file a formal complaint (Feldblum & Lipnic, 2016). People stay silent because they expect not to be believed, fear damage to their relationships and careers, and fear retaliation. Dobbin and Kalev (2020) found that legalistic grievance procedures were followed by declines in the representation of Black, Latina, and Asian American women managers, identified retaliation against complainants as a central problem, and found that alternatives such as ombuds offices and voluntary mediation were associated with better outcomes. At the US Postal Service, for example, formal discrimination and harassment filings fell by more than 30 percent over four years after voluntary mediation was introduced (Dobbin & Kalev, 2020).
UK law is reinforcing this pillar. From 6 April 2026, sexual harassment became an express category of protected disclosure under whistleblowing law, protecting workers who raise concerns about harassment that has happened, is happening, or is likely to happen, whether it affects them or others (Syder, 2026). Section 24 of the Employment Rights Act 2025 will make contractual confidentiality clauses void to the extent they prevent workers from disclosing harassment or discrimination, subject to excepted agreements yet to be defined in regulations (Davies, 2026; Employment Rights Act 2025). Employers that rely on non-disclosure agreements to contain complaints will need to rethink that approach.
Effective approaches:
Multiple routes: Offer several reporting channels, including options outside the line management chain and, where appropriate, anonymous reporting.
Third-party reporting: Make it easy for staff to report harassment by customers and for non-employees to raise concerns.
Proportionate options: Provide informal resolution and mediation routes as well as formal investigation, letting the person affected shape the process where safe.
Independent investigation: Use investigators independent of the accused's chain of command, especially when managers are implicated.
Retaliation monitoring: Track the experiences of people who report for months afterward and treat retaliation as serious misconduct.
Pattern detection: Record concerns centrally so that repeated low-level allegations against the same person are visible.
The Metropolitan Police Service is the starkest recent example of what happens when reporting systems fail. Baroness Casey's review, commissioned after the murder of Sarah Everard, found that female officers and staff routinely faced sexism and misogyny, that the force had not protected women from officers who abused their position for sexual purposes, that complaints were more likely to be dismissed than acted upon, that complainants were often disbelieved or faced counter-allegations, and that patterns of predatory behavior went unidentified (ITV News, 2023a). The review described a culture of denial in which speaking up was unwelcome. A reporting system that cannot connect separate allegations about the same person will keep missing the most dangerous people.
London Fire Brigade commissioned an independent culture review led by Nazir Afzal after the death of a trainee firefighter in 2020. Published in November 2022, the review found that women described sexist abuse dismissed as banter, being groped during training exercises, being photographed without consent, and, in one case, being sent explicit video calls after complaining (Fire Protection Association, 2022). The Commissioner apologized, accepted all 23 recommendations, and pledged clear guidance on unacceptable behavior and its consequences. The review's lesson for other organizations is that the people most at risk had often concluded that complaining would make things worse.
A common pitfall: measuring success by low complaint numbers. A falling volume of reports may mean harassment is decreasing, or that people have given up. Reporting data only means something when read alongside anonymous survey data on experience.
Behavior-Focused, Bystander, and Manager Training
Training is the most common response to harassment and the most criticized. The EEOC task force concluded that, as typically delivered, training "has not worked as a prevention tool" because it has focused too heavily on avoiding legal liability (Feldblum & Lipnic, 2016). NASEM (2018) reached a similar conclusion, finding that policies and training have not been shown to prevent harassment on their own and recommending that training focus on changing behavior rather than beliefs. Roehling and Huang's (2018) interdisciplinary review found that the empirical evidence on training effectiveness is thin and that effectiveness depends heavily on design, delivery, and organizational context. Dobbin and Kalev (2020), drawing on data from more than 800 US companies over three decades, found that conventional "forbidden behavior" training was followed by declines of more than 5 percent in white women's representation in management over the following years and cited studies suggesting that such training can make some men more likely to blame victims.
Two kinds of training look more promising. Bystander intervention training teaches employees to recognize harassment and to intervene safely, whether by direct challenge, distraction, delegation to someone with authority, or support afterward. A Campbell systematic review of 27 high-quality studies, including 21 randomized controlled trials, found that bystander programs increase bystander intervention, although it found no evidence that they reduce perpetration and the studies were drawn from schools and colleges rather than workplaces (Kettrey et al., 2019). Dobbin and Kalev (2020) found that workplace bystander trainees were more likely to report intervening in real situations months later. Manager training, which teaches supervisors how to spot problems and respond to them, was followed by increases in the representation of women in management of between 2 and more than 6 percent depending on the group (Dobbin & Kalev, 2020).
Effective approaches:
Behavior over law: Focus on recognizing situations, practicing responses, and knowing what happens next, with legal content kept brief.
Bystander skills: Teach concrete intervention options and give people realistic practice in workplace scenarios, including scenarios involving customers.
Manager response: Train supervisors to receive disclosures, act on what they observe, and protect people from retaliation.
Tailored content: Build scenarios around the organization's actual risks, such as late-night shifts, patient interactions, or client hospitality.
Respect framing: Combine harassment content with broader civility and respect programs, as both NASEM and the EEOC task force suggest.
Ford's experience at its Chicago Assembly and Stamping plants shows both the role and the limits of training as a remedy. In 2017 the company agreed with the EEOC to pay up to $10.125 million to resolve findings of sexual and racial harassment of female and African American employees and retaliation against those who complained. The non-monetary terms, lasting five years, included regular training at the two facilities, continued distribution of anti-harassment policies, reporting of complaints to the EEOC, and monitoring of the workforce for harassment (EEOC, 2017). Training here is one element among several, coupled with monitoring and external reporting; in a large manufacturing environment, it is the monitoring that gives the training credibility.
McDonald's UK's 2025 action plan agreed with the EHRC similarly treats training as targeted rather than generic. The company committed to refresh sexual harassment training for restaurant managers, including franchisees, to cover social media and the grooming of young or vulnerable workers (EHRC, 2025b). Those topics reflect the specific risks of a young workforce in which contact through social media can extend well beyond the shift, risks that a general annual module would not address.
A common pitfall: using a short online module as the organization's main prevention measure. Under the "all reasonable steps" standard, the EHRC and tribunals are likely to ask whether training was tailored, refreshed, and evaluated, and whether it changed what people did. A completion rate is not evidence of prevention.
Measurement, Monitoring, and Transparency
Organizations cannot manage what they cannot see, and harassment tends to stay out of sight. NASEM (2018) recommended that institutions use validated, confidential climate surveys, disaggregate data by race, ethnicity, sexual orientation, and gender identity, and publish annual reports on their progress. The eighth step of the EHRC's guide asks employers to monitor and evaluate their actions, and the Australian positive duty's seventh standard calls for monitoring, evaluation, and transparency (Australian HR Institute, 2023; Wren & Steele, 2024). Measurement serves two purposes: it tells leaders where to act, and it creates the evidence an employer will need to show that it took all reasonable steps.
Effective approaches:
Behavioral climate surveys: Ask anonymously about specific behaviors experienced and witnessed, including from third parties, rather than asking whether people have been "sexually harassed."
Leading indicators: Track perceived tolerance, confidence in reporting, and trust in investigations, not only incident counts.
Independent audit: Use external reviewers or unannounced audits to test whether policies operate as described.
Disaggregation: Break results down by site, role, shift, and demographic group to find hot spots.
Published progress: Report outcomes and actions to staff and, where appropriate, publicly, to create accountability.
Activision Blizzard's consent decree with the EEOC, approved by a federal court in March 2022, built monitoring directly into the remedy. Alongside $18 million in monetary relief, the decree required unannounced audits of harassment, training for human resources staff, evaluation of disciplinary procedures, an equal employment opportunity component in performance reviews for managers, supervisors, and HR personnel, and a third-party consultant to review compliance (HR Dive, 2022). The design reflects a recognition that self-reported compliance is not enough; independent checks and links to managerial evaluation are what give a prevention program teeth.
Rio Tinto's choice to publish its culture review, including uncomfortable numbers, created a public baseline against which progress can be judged (Rio Tinto, 2022). McDonald's UK's commitment to quarterly staff surveys and an external audit of its new complaint handling unit, under the extended EHRC agreement, similarly uses measurement as both a management tool and an accountability mechanism (EHRC, 2025b). The common thread is that data collection is designed in from the start and tied to someone who must act on it.
A common pitfall: surveying without acting. Surveys that reveal problems and are followed by silence teach employees that speaking up is pointless, and they create a documentary record that the employer knew of risks and did nothing. Every survey should come with a commitment to report results and actions back.
Building Long-Term Prevention Capability
Integrating Harassment Into Health, Safety, and Risk Governance
The most durable shift leaders can make is to stop treating harassment as a matter of individual misconduct and start treating it as an organizational hazard, managed through the same disciplines as other safety risks. ILO Convention 190 explicitly links harassment prevention to occupational safety and health management and psychosocial risk (International Labour Organization, 2019). Australia's positive duty applies to employers and to persons conducting a business or undertaking, a concept borrowed from work health and safety law, and the AHRC's standards read very much like a safety management system (Australian HR Institute, 2023). The UK's move to "all reasonable steps," with its emphasis on assessment, reporting, and complaint handling, points the same way (Employment Rights Act 2025).
In practice, integration means harassment risk appears on the corporate risk register with an owner, controls, and indicators; it is considered when new products, services, sites, or shift patterns are designed; and it is reviewed by the board with the same seriousness as financial and physical safety risks. For organizations with frontline customer contact, it means operations leaders, not only HR, own third-party risk. A hotel general manager who decides staffing levels for a late-night event, or a hospital manager who decides whether staff conduct home visits alone, is making harassment prevention decisions whether or not they recognize it.
Integration also means treating near misses and low-level incidents as data. Safety-critical industries treat minor incidents as early warnings of major ones. NASEM's (2018) insistence that gender harassment, the most common form, be tackled explicitly suggests the same logic applies here: an organization that tolerates sexist jokes and comments is signaling the climate in which more serious conduct becomes possible.
Designing for Third-Party Risk and Commercial Pressure
Third-party liability raises a question many organizations have avoided: what will we do when a valuable customer, client, or patient harasses our staff? The commercial pressure is real. Gettman and Gelfand (2007) found that client power is itself a predictor of customer harassment, and the EEOC task force named customer service and client satisfaction as a risk factor (Feldblum & Lipnic, 2016). An organization that says it will protect staff but in practice keeps serving the harasser is likely to struggle to show that it took all reasonable steps.
Building capability here means deciding in advance, at senior level, what the organization's position is. That includes publishing customer conduct standards; giving frontline managers explicit authority to refuse service or remove people without fear of commercial blame; building harassment terms into client contracts, venue agreements, agency contracts, and franchise agreements; and agreeing escalation routes when the harasser is a major client or a vulnerable patient. In health care and social care, where refusing service may not be possible, it means clinical and safeguarding protocols that protect staff while meeting duties of care, such as chaperone arrangements, risk flags on records, and reallocation of staff.
Supply chains and franchise networks require particular attention. The EHRC's letter to McDonald's franchisees made clear that each franchisee carries its own legal duty, but brand owners carry the reputational consequences of their franchisees' failures (EHRC, 2025a). Leaders of networked organizations should consider what minimum standards, training, and audit rights they require of partners and how they will respond when a partner fails.
Navigating Divergent Global Standards
For multinational organizations, the legal picture is fragmenting. The UK is raising its standard and extending it to third parties (Faragher, 2026). Australia has a positive duty enforced by a regulator with investigative powers (Australian Human Rights Commission, n.d.). In the United States, the EEOC's rescission of its 2024 guidance removes a detailed federal statement of expectations, though Title VII's prohibition on harassment, state and local laws, and private litigation remain (Maunz et al., 2026). ILO Convention 190, with around fifty ratifications, sets an international benchmark that many governments are still incorporating into domestic law (International Labour Organization, n.d.).
The tempting response is to comply locally at the lowest available level. That is unwise for three reasons. First, the behaviors and climate that drive harassment are organizational, not national, and a global culture cannot be run at different levels of tolerance in different offices. Second, a failure in any one location can become a global story, as the CBI, Rio Tinto, and McDonald's cases show. Third, legal floors move, sometimes quickly, as Figure 3 shows, and an organization designed around the highest standard is less exposed to the next change.
The practical answer is a global minimum standard set at or near the strictest jurisdiction in which the organization operates, with local adaptation for legal procedure, language, and culture. In practice that currently means designing around the UK's "all reasonable steps" duty and Australia's positive duty: risk assessment including third parties, leadership accountability, trusted reporting, behavior-focused training, and measurement, applied everywhere.
Conclusion
The move from "reasonable steps" to "all reasonable steps," and the extension of employer liability to harassment by customers, clients, and patients, marks a decisive change in what the law expects. Employers can no longer rely on having responded well after the event. They are expected to have anticipated the risk, taken every reasonable step to prevent it, and be able to show that they did so. The detailed regulations that will define those steps are still to come, but the direction is clear, and the EHRC's existing guidance already sets out much of what will be expected.
The research supports that shift. Three decades of evidence suggest that harassment is driven less by a small number of bad individuals than by organizational climates in which people believe misconduct will be tolerated. Policies and training alone have not been shown to change that climate. What does appear to work is a system: honest assessment of where risks lie, including at the boundary with customers; leaders who own the issue and apply consequences consistently; reporting routes that people trust and that protect them from retaliation; training that builds skills rather than reciting law; and measurement that tells leaders the truth. The organizations described here, from mining companies and fast-food chains to police forces, fire services, and hospitals, show both the costs of getting this wrong and the outlines of what getting it right looks like.
For leaders, the October 2026 deadline is best treated not as a compliance date but as a prompt to ask a simple question: if a tribunal, a regulator, or a journalist examined our organization tomorrow, could we show that we had taken all reasonable steps? For most organizations, the honest answer today is "not yet."
Assess before you act: Conduct a role-level harassment risk assessment that explicitly includes customers, clients, patients, contractors, and the public, and involve frontline staff in doing it.
Make leaders accountable: Put harassment prevention on the board agenda, include it in managers' performance reviews, and apply consequences regardless of seniority or commercial value.
Fix the reporting gap: Offer multiple trusted reporting routes, including for third-party harassment, monitor for retaliation, and remove confidentiality clauses that silence workers.
Train for behavior: Replace legalistic modules with tailored bystander and manager training built around your actual risks.
Decide your customer stance now: Set and publish customer conduct standards, give frontline managers authority to act, and build harassment terms into contracts and franchise agreements.
Measure and publish: Use anonymous behavioral climate surveys, independent audits, and regular reporting to staff to track whether prevention is working.
Set one global floor: Design your program around the strictest standard you face, currently the UK and Australian duties, and apply it everywhere.
Research Infographic
References
Adams, L., Hilger, L., Moselen, E., Basi, T., Gooding, O., & Hull, J. (2021). 2020 sexual harassment survey. Government Equalities Office.
Australian HR Institute. (2023, December 13). New guidelines for positive duty to eliminate sexual harassment. Australian HR Institute.
Australian Human Rights Commission. (n.d.). What is the positive duty? Australian Human Rights Commission.
Begeny, C. T., Arshad, H., Cuming, T., Dhariwal, D. K., Fisher, R. A., Franklin, M. D., Jackson, P. M., McLachlan, G. M., Searle, R. H., & Newlands, C. (2023). Sexual harassment, sexual assault and rape by colleagues in the surgical workforce, and how women and men are living different realities: Observational study using NHS population-derived weights. British Journal of Surgery, 110(11), 1518–1526.
City A.M. (2023, April 24). CBI admits group failed to root out "toxic" workers amid sexual misconduct crisis. City A.M.
CNBC. (2019, December 18). Uber to pay $4.4 million to resolve EEOC sex discrimination charge. CNBC.
Davies, K. (2026, March 19). Employment Rights Act: Preparing for change: New harassment measures extend protections for employees. DLA Piper.
Deloitte Access Economics. (2019). The economic costs of sexual harassment in the workplace. Deloitte Access Economics.
Dobbin, F., & Kalev, A. (2020). Why sexual harassment programs backfire: And what to do about it. Harvard Business Review, 98(3), 45–52.
Employment Rights Act 2025, c. 36.
Equality and Human Rights Commission. (2025a, March 14). McDonald's franchises warned by equality regulator to comply with legal duties or risk enforcement action. Equality and Human Rights Commission.
Equality and Human Rights Commission. (2025b, November 7). Equality regulator extends agreement with McDonald's to prevent sexual harassment. Equality and Human Rights Commission.
Faragher, J. (2026, September 28). Employment law changes in October 2026. Personnel Today.
Feldblum, C. R., & Lipnic, V. A. (2016). Select task force on the study of harassment in the workplace: Report of co-chairs. U.S. Equal Employment Opportunity Commission.
Fire Protection Association. (2022, November). Damning workplace culture report reveals severe shortcomings at London Fire Brigade. Fire Protection Association.
Fitzgerald, L. F., Drasgow, F., Hulin, C. L., Gelfand, M. J., & Magley, V. J. (1997). Antecedents and consequences of sexual harassment in organizations: A test of an integrated model. Journal of Applied Psychology, 82(4), 578–589.
Gettman, H. J., & Gelfand, M. J. (2007). When the customer shouldn't be king: Antecedents and consequences of sexual harassment by clients and customers. Journal of Applied Psychology, 92(3), 757–770.
HR Dive. (2022, March 31). Judge approves Activision Blizzard's $18M EEOC settlement over harassment. HR Dive.
International Labour Organization. (2019). Violence and Harassment Convention, 2019 (No. 190). International Labour Organization.
International Labour Organization. (n.d.). Violence and harassment in the world of work. International Labour Organization.
ITV News. (2018, January 24). Top charity event closes amid sexual harassment allegations: What you need to know. ITV News.
ITV News. (2023a, March 21). Casey report: What are the key findings of the Met Police review? ITV News.
ITV News. (2023b, June 5). CBI faces crunch D-Day vote on its future amid sexual harassment allegations. ITV News.
Kavanagh, M., & Beveridge, J. (2023, December 11). Positive duty for sexual harassment. Colin Biggers & Paisley.
Kettrey, H. H., Marx, R. A., & Tanner-Smith, E. E. (2019). Effects of bystander programs on the prevention of sexual assault among adolescents and college students: A systematic review. Campbell Systematic Reviews, 15(1–2), Article e1013.
Maunz, A. F., White, L., & Mrizek, R. J. (2026, January 27). EEOC rescinds enforcement guidance on harassment in the workplace. Jackson Lewis P.C.
McLaughlin, H., Uggen, C., & Blackstone, A. (2017). The economic and career effects of sexual harassment on working women. Gender & Society, 31(3), 333–358.
National Academies of Sciences, Engineering, and Medicine. (2018). Sexual harassment of women: Climate, culture, and consequences in academic sciences, engineering, and medicine. The National Academies Press.
NHS England. (2024, March). NHS staff report record levels of discrimination from the public. NHS England.
Restaurant Online. (2025, November 7). McDonald's to introduce further measures to protect staff from sexual harassment. Restaurant Online.
Rio Tinto. (2022, January 31). Rio Tinto releases external review of workplace culture [Press release]. Business Wire.
Roehling, M. V., & Huang, J. (2018). Sexual harassment training effectiveness: An interdisciplinary review and call for research. Journal of Organizational Behavior, 39(2), 134–150.
SmartCompany. (2017, April 28). Report shows 89% of hospitality workers experience sexual harassment: How can you help prevent it? SmartCompany.
Syder, C. (2026, February 25). Harassment and the Employment Rights Act 2025: What employers need to know. Penningtons Manches Cooper.
TLT. (2024, October 2). Updated EHRC guidance published on the new duty to prevent sexual harassment. TLT LLP.
Trades Union Congress. (2023, May 12). New TUC poll: 2 in 3 young women have experienced sexual harassment, bullying or verbal abuse at work. Trades Union Congress.
University of Sydney. (2023, March 23). Sexual harassment and customer abuse rife in retail. University of Sydney News.
U.S. Equal Employment Opportunity Commission. (2017, August 15). Ford Motor Company to pay up to $10.125 million to settle EEOC sexual and racial harassment investigation [Press release]. U.S. Equal Employment Opportunity Commission.
Willness, C. R., Steel, P., & Lee, K. (2007). A meta-analysis of the antecedents and consequences of workplace sexual harassment. Personnel Psychology, 60(1), 127–162.
Wren, A., & Steele, L. (2024, October 3). Final EHRC guidance on preventing sexual harassment at work. Farrer & Co.
Jonathan H. Westover, PhD, Chief Research Officer (Nexus Institute for Work and AI); Co-Founder & Chief Workforce and Learning Officer (Future State University); Founder & CEO (Human Capital Innovations); Professor of Organizational Leadership & Change (UVU). Read Jonathan Westover's executive profile here.
Suggested Citation: Westover, J. H. (2026). All Reasonable Steps: Preventing Sexual and Third-Party Harassment as the Legal Duty Shifts From Response to Prevention. Human Capital Leadership Review, 40(1). doi.org/10.70175/hclreview.2020.40.1.3
