Insight from an HR consultant in Edinburgh on the new third-party harassment duty arriving in October 2026 and what you need to do before it takes effect.
If a customer behaves badly towards one of your team, you might assume that’s a customer problem, not an employer problem.
From October 2026, the law won’t see it that way.
You’ll be held directly responsible if you haven’t taken all reasonable steps to prevent it.
For small businesses where staff regularly deal with the public, this is a shift worth understanding now rather than later.
Here’s what’s changing and what it means for you.
What’s happening in October 2026
Two changes to harassment law are coming at the same time. The first raises the bar for how employers handle sexual harassment claims. Where tribunals currently look at whether you took reasonable steps to prevent harassment, the new standard asks whether you took ‘all’ reasonable steps. That difference matters. It means you’ll need to show there was nothing more you could reasonably have done.
The second change introduces a legal duty that makes employers liable for harassment carried out by third parties. That includes customers, clients, suppliers, contractors and members of the public.
So if someone outside your organisation harasses a member of your staff, and you can’t demonstrate what you did to prevent or respond to it, a tribunal could hold you accountable.
This applies across all relevant protected characteristics, including age, disability, gender reassignment, race, religion or belief, sex and sexual orientation.
Why your current harassment policy might not be enough
Most harassment policies are written with internal situations in mind. They cover behaviour between colleagues or between managers and their teams. That’s fine for what it is, but it doesn’t address the risk that comes from people outside your business.
If your policy simply uses the word ‘harassment’ without specifying who the potential perpetrators might be, it won’t demonstrate to a tribunal that you’ve considered third-party risk at all. And that gap could cost you.
Here is what a solid policy clause needs to cover.
Who your policy should name
Your harassment policy needs to spell out that it covers behaviour from anyone your employees interact with through work. That means customers, clients, suppliers, contractors and members of the public.
Leaving it vague sends a message that you haven’t turned your mind to this particular risk. A tribunal will notice.
Treating third-party harassment with the same weight
One of the most common mistakes we see is businesses treating harassment from a customer as a customer service issue rather than a genuine harassment complaint. Your policy should make it clear that harassment from someone outside the business is taken just as seriously as harassment from a colleague or manager.
Your employees need to know that their experience won’t be downplayed because the person responsible happens to be paying for your services.
A reporting route that actually works
Your internal grievance process is designed for situations where the other person involved is also an employee. That doesn’t work well when the perpetrator is a customer standing in front of your staff member.
Third-party incidents need a more immediate route. Typically, that means reporting to a line manager or duty manager in the moment, rather than waiting days for a formal grievance meeting. Speed matters here, both for your employee’s wellbeing and for your ability to document what happened.
Being prepared to act against the third party
This is the part that loads of businesses miss entirely.
Your policy should commit to taking action against the person who caused the problem. That might mean issuing a warning to a client, refusing to serve a customer, ending a supplier contract or barring someone from your premises.
If your policy only talks about supporting the employee after the event but says nothing about consequences for the third party, it’s incomplete.
Removing the expectation to tolerate bad behaviour
There’s often an unspoken expectation in customer-facing roles that staff should smooth things over and keep the relationship intact. Your policy needs to explicitly remove that expectation.
No employee should feel they have to continue serving someone who has harassed them just to keep a client happy or protect a commercial relationship. Stating this clearly in your policy gives your team the confidence to report incidents without worrying about the fallout.
What an example policy clause could look like
Something along these lines would cover the key points:
“This policy covers harassment by anyone an employee encounters through their work, including customers, clients, suppliers, contractors and members of the public. Any report of third-party harassment will be investigated and treated with equal seriousness to harassment involving a colleague. The business may take action including speaking to the individual, withdrawing service or ending a contract or relationship where appropriate.”
You can adapt the wording to suit your business, but the core elements need to be there.
Other things to check before the deadline
Beyond updating your policy, there are a few practical things worth sorting out now.
- Ensure clear reporting channels: Make sure your client-facing staff know how to report a third-party incident and who to approach.
- Record past incidents: If an incident has already occurred, write down what happened and how you responded; having that record could be important if past events are reviewed.
- Update risk assessments: Conduct a written risk assessment that covers third-party contact across shop floors, client meetings, or delivery rounds
If an incident has occurred and you’re unsure whether your response would hold up under the new standard, it’s worth getting advice now. As part of our HR consultancy services in Edinburgh, we regularly help businesses work through this kind of review.
Getting ready before October
The good news is that none of this requires a massive overhaul. For most small businesses, it’s about reviewing what you already have, filling in the gaps, and making sure your team know what to do if something happens.
We can look at your existing harassment policy, help you put a clear and practical process in place for third-party incidents, and make sure you’re covered before the October deadline.
If a customer or client has already caused a problem for one of your employees, or you simply want to get ahead of this, we’d love to have a conversation about how we can help.
As an outsourced HR consultant in Edinburgh, we work with small businesses to make sure changes like these feel manageable.
Get in touch to book a discovery call and we can talk through what you need.
