If you’ve been following the changes to workplace sexual harassment legislation, you’ve probably noticed one phrase appearing everywhere: “All reasonable steps.”
At first glance, it looks like a minor wording change, so surely your existing policies and training cover it? Honest answer: probably not. In reality, it could become one of the most important employment law developments HR teams face over the next 12 months. So, let’s get into it.
What's Actually Changing in October 2026?
Essentially, in October 2026 the standard will upgrade from "reasonable steps" to "all reasonable steps".
One word. Significant difference.
Under the current standard, taking some reasonable steps in good faith offered meaningful protection. Under the new standard, an employment tribunal will ask a harder question: did you take all the steps that were reasonable in your circumstances?
That’s where many employers may find themselves exposed. The focus is now on being able to prove that prevention is embedded throughout your organisation, supported by evidence, reinforced by leaders, and actively reviewed.
And here’s the fun bit. Every organisation’s risks are different.
What's reasonable for a 50-person business is not reasonable for an organisation of 500 or 5,000. A professional services firm, healthcare organisation, manufacturing site and hospitality business all face different workplace realities, employee interactions and exposure points. Your size, your sector, your workforce demographics, your working environments - they all factor in. Which means “all reasonable steps” is unlikely to look identical from one employer to the next.
Why HR Leaders are (Understandably) Losing Sleep Over “All Reasonable Steps”
Historically, employers could defend themselves against certain harassment claims if they could show they had taken reasonable measures to prevent inappropriate behaviour.
The updated expectation goes further, focusing on whether there were additional practical steps the organisation could and should have taken.
That means tribunals and regulators may look beyond whether a policy exists and consider how well the organisation’s approach works in practice - whether it is understood, relevant to organisational risks, supported by effective training, embedded in management practice, acted on consistently, and reviewed over time.
In other words, employers may be judged less on what they have created and more on how effectively it works.
The Question Most HR Leaders Are Asking: Are We Actually Compliant?
You've already got a harassment policy. You might have even run some training. You've got a reporting line. On paper, it probably looks fine.
But here's what tribunal decisions and EHRC guidance are making increasingly clear: having the right documents isn't the same as taking all reasonable steps.
The questions that keep coming up are:
- Are we compliant with the sexual harassment duty 2026?
- How do we actually prove we've done enough and taken all reasonable steps?
- What does an employment tribunal look for when it's deciding whether we've met the standard?
- What counts as evidence - and are we collecting it?
- What happens if a harassment claim is upheld and we can't demonstrate compliance?
These are difficult questions because there is no universal checklist.
And the answer to that last one is where it gets serious. Under the preventative duty, if a harassment claim is upheld and an employment tribunal finds you haven't taken all reasonable steps, the EHRC can take enforcement action and tribunals can uplift compensation awards by up to 25%. That's on top of any damages already awarded.
So, What Does “All Reasonable Steps” Look Like in Practice?
This is where some guidance goes vague. Let’s not do that.
Here are the components that regulators, tribunals, and the EHRC are looking for, not as a tick-box list, but as a connected framework that demonstrates genuine organisational commitment.
1. A Documented Risk Assessment That's Actually Specific to Your Organisation
Generic risk assessments don't cut it under this standard.
The new expectations place greater emphasis on understanding where problems could realistically occur.
So, you need to have looked seriously at your own workplace and ask these questions:
- Where are the risk points?
- Which teams, locations, or dynamics create conditions where harassment is more likely?
- Are there power imbalances, lone working situations, client-facing roles, high-pressure environments, contractor and third-party interactions or after-work social cultures that need addressing?
A meaningful sexual harassment risk assessment should identify:
- Where risks exist
- Who may be affected
- What controls are in place to reduce those risks
It should be written down, regularly reviewed, and directly inform the steps you take. If your risk assessment doesn't reference anything specific to your organisation, it's unlikely to demonstrate "all reasonable steps."
What to keep as evidence: dated risk assessments, records of who conducted them, evidence of review cycles, and a documented link between the risks identified and the actions taken.
2. Training That's Tailored, Not Just Ticked Off
This is the big one. Training is often the first thing organisations think about when discussing reasonable steps.
But generic, e-learning completed once during onboarding, three years ago or a 45-minute webinar that everyone attended but nobody remembers does not meet the new requirements.
What does meet the sexual harassment standard is training that is:
- Relevant to your organisation - not generic content but learning that reflects your actual workplace, your culture, and the situations your people are likely to face
- Role-appropriate - what managers need to understand is different from what employees need to understand, and what senior leaders need to model is different again
- Regular and refreshed - not a one-off, but part of an ongoing learning culture
- Evidenced - with records of who attended, when, and what was covered
The key question isn’t whether training happened, it’s whether it changed awareness, confidence and behaviour. So training built around your sector, your workforce, your specific risk profile is what moves you from "we did some training" to "we took all reasonable steps."
What to keep as evidence: training records with dates and attendees, content outlines or programmes, records of manager-specific and leadership-specific sessions, participant feedback and evaluation, and evidence of refresher training cycles.
3. Clear, Accessible, and Genuinely Safe Reporting Channels
Policies and procedures only work if people actually use them and people only use them if they trust them.
Employees need to know:
- How to raise concerns and report harassment
- Who they can speak to
- What happens after a report
- How confidentiality will be handled
- That retaliation will not be tolerated
Ask yourself honestly: do your employees know that? And do they believe something will be done if they do report harassment?
If the answer to any of those is uncertain, your reporting mechanism isn't functioning as it should. If people remain silent because they lack confidence in the process, a policy alone offers little protection.
Under "all reasonable steps," you need to demonstrate not just that a reporting channel exists, but that it's fit for purpose: communicated clearly, accessible to everyone (including shift workers, remote employees, and those for whom English isn't a first language), and backed by a process that people trust.
What to keep as evidence: records of how reporting processes have been communicated, employee survey data on awareness and trust, details of any third-party reporting lines, and logs of how reports have been handled (with appropriate anonymisation).
4. Managers Know What To Do
In many cases managers are generally the first people employees approach when something goes wrong and it is often assumed managers understand what sexual harassment looks like, how to handle disclosures, how to document incidents and how to support employees appropriately.
However this isn’t always the case. Manager-focused sexual harassment training is becoming increasingly important because a managers role in this topic is significantly different and could determine whether concerns are handled well or poorly.
What to keep as evidence: records of leadership training on harassment prevention with dates and attendees, programme outlines, feedback and evaluation, follow-ups and refreshers.
5. Leadership Behaviour Sets The Standard
Here's the piece that's hardest to document but perhaps most important in demonstrating genuine commitment: what does leadership actually do?
Senior leader behaviour, the way managers respond to low-level concerns, whether bystanders feel empowered to act - all these things speak to organisational culture in a way that no policy document can replicate.
"All reasonable steps" includes creating an environment where harassment is less likely to occur and that's a leadership question as much as an HR one.
This means senior leaders need to understand their role in setting the tone. It means managers need to know what to do when someone comes to them with a concern. It means bystander behaviour needs to be normalised and supported.
What to keep as evidence: documentation of how concerns raised informally have been followed up, communications from senior leaders on the topic, and records of any culture or climate surveys.
The Thread That Connects It All: Evidence
‘What evidence should we keep?’ is one of the most frequently asked questions from HR teams around the upcoming sexual harassment changes.
If there's one thing to take away from this, it's that having the right measures in place isn't enough if you can't demonstrate them. Evidence could include:
- Risk assessments
- Policy reviews
- Training records
- Attendance data
- Learning outcomes
- Follow-up sessions
- Employee communications
- Awareness campaigns
- Investigation records
- Manager guidance materials
- Culture survey results
- Action plans
Employment tribunals don't take your word for it. The EHRC doesn't take your word for it. What they look for is a coherent, documented trail that shows:
- You identified the risks specific to your organisation
- You took proportionate steps to address those risks
- You embedded those steps in a way that's ongoing, not one-off
- You have records to prove it
Think of it as your compliance narrative - the story of how your organisation actively works to prevent sexual harassment, told through documents, records, training logs, risk assessments, and leadership actions.
Are You Actually Compliant? The Honest Questions to Ask Yourself
Before October 2026, every HR or Business Leader should be able to answer yes to the following:
- Do we have a risk assessment that's specific to our organisation, not generic?
- Has our training been updated in the last 12 months and does it go beyond a one-size-fits-all e-learning module?
- Do we have separate provision for managers and senior leaders?
- Can we evidence that our reporting channels are genuinely accessible and trusted?
- Do our senior leaders visibly understand and take ownership of their role in prevention?
- Do we have a documented evidence trail that connects our risks to our actions?
If you're hesitating on any of those - you're not alone, but you do need to act.
What Happens If Employers Get It Wrong?
For many HR leaders, this is the question sitting quietly in the background.
If a sexual harassment claim is upheld against your organisation and a tribunal finds you haven't taken all reasonable steps to prevent it, the consequences are:
- Compensation uplifts of up to 25% can be applied to any award
- EHRC enforcement action can follow, including formal investigations and compliance notices
- Reputational damage - these cases don't stay private, and the impact on employer brand, recruitment, and retention can be lasting
- Personal liability for senior leaders in some circumstances is an emerging area of risk
The cost of getting ahead of this is a fraction of the cost of getting it wrong.
What a Genuine 'All Reasonable Steps' Solution Looks Like
If you're looking to update your sexual harassment approach in the workplace, the most useful thing you can do right now is have an honest conversation about where your current provision sits against the standard. Realistically, to be compliant and confident by October 2026, you need to be starting that work now.
Organisations that take sexual harassment prevention seriously tend to have better retention, higher psychological safety scores, and fewer people suffering in silence.
But it has to be done properly. That means:
- A genuine risk assessment, not a template
- Training that's built for your people, not a generic library module
- Visible, sustained leadership commitment
- A functioning reporting culture
- An evidence trail that tells a coherent story
We work with HR Leaders at organisations across the UK to design bespoke sexual harassment prevention programmes that are built around your workforce, your risk profile, and the evidence requirements of the updated legislation.
