The duty to prevent sexual harassment
Since October 2024 employers have had to take reasonable steps to prevent sexual harassment - before anything happens, not after a complaint. The duty is short. Proving you met it is the work.
"An employer (A) must take reasonable steps to prevent sexual harassment of employees of A in the course of their employment" (s.40A Equality Act 2010, in force 26 October 2024). It is proactive: it applies whether or not anyone has complained. Breach it alongside a successful harassment claim and the tribunal can uplift compensation by up to 25% (s.124A).
What changed in October 2024
Before the Worker Protection (Amendment of Equality Act 2010) Act 2023, the law was reactive: an employer could defend a harassment claim by showing it had taken all reasonable steps to prevent it, but there was no duty to have done anything in advance. Now there is a standing obligation, owed to every employee, at all times.
Two consequences follow, and the second is the one people miss:
- The tribunal can add up to 25% to compensation where the duty was breached - on top of an award that is already uncapped in discrimination cases.
- The Equality and Human Rights Commission can enforce the duty directly, without any individual bringing a claim. You do not need a complainant to have a problem.
An employee cannot sue you for breaching the duty by itself; it only bites where a harassment claim has already succeeded. That sounds reassuring and should not be. It means the duty is assessed with hindsight, in the middle of a case you are already losing, by a tribunal looking at what you did before it happened.
What "reasonable steps" means in practice
The Act does not define it, and deliberately so - what is reasonable for a 12-person agency is not what is reasonable for a 500-person hospitality group. What is consistent is that the steps must be real, proportionate to your risk, and evidenced. The following is what an employer is generally expected to be able to show.
The single most useful document you can hold, and the one most employers do not have. Where in this business is harassment more likely - lone working, night shifts, alcohol at events, power imbalances, customer-facing roles, isolated sites? Write it down, decide what you are doing about each, and review it. An employer who has assessed its risks and acted proportionately is in a different position from one who simply had a policy.
The duty is to prevent harassment of your employees in the course of their employment - not only harassment by other employees. Customers, clients, contractors, delivery drivers and members of the public are in scope of the risk you have to think about. In customer-facing sectors this is usually the first thing examined, and "it was a customer, not one of ours" is not an answer.
A dignity-at-work or anti-harassment policy sitting unread in a shared drive is weak evidence. A policy that was issued, acknowledged by name and date, and reissued when it changed is strong evidence. The difference is entirely in the record-keeping, which is why acknowledgement tracking matters more here than for almost any other policy.
Training everyone can describe but nobody can prove is worth little in a hearing. Record who was trained, on what, and when - including new starters and managers, who need more than the general course because they are the people a report is likely to reach first.
If the only way to report is up the line, the one case that most needs reporting - where the manager is the problem - has nowhere to go. An alternative named contact, or an anonymous channel, closes that gap. Anonymous routes have a real limitation worth being honest about internally: you cannot investigate what you cannot ask about. They still surface patterns you would otherwise never see.
Steps taken after a report are part of the picture, but so is what you did with softer signals - an exit interview theme, a spike in a particular team, an anonymous comment. The duty is preventative, so evidence that you noticed something and responded is worth more than evidence that you investigated a formal complaint well.
What an evidence pack looks like
If the duty were tested tomorrow, you would want to hand over, in one place: the risk assessment and its review dates; the policy, its version history and who acknowledged it; training completion by person and date; the reporting routes and how they were communicated; anonymised case statistics showing what was raised and what happened; and the dates of any changes you made as a result.
None of that is exotic. It is simply a set of records that are usually scattered across a drive, a training provider, an inbox and somebody's memory - which is why they are hard to produce at exactly the moment they matter.
What this is not
It is not a guarantee against liability. The duty is to take reasonable steps, not to achieve a harassment-free workplace, and an employer that did everything sensible can still face a claim about an individual's conduct. What the steps change is the uplift, the EHRC exposure, and - much more often - whether the thing happened at all.
Our anti-harassment policy template covers the policy element, and CoDash's compliance hub assembles the rest of the evidence pack from what the system already holds.
Keep reading: All 66 HR guides · 30 free templates · 24 calculators
The evidence pack, assembled for you
CoDash holds the policy and who acknowledged it, training completion per person, an anonymous reporting route and anonymised case statistics - and pulls them into one reasonable-steps view, because scattered records are the reason this duty is hard to prove.