The duty to prevent sexual harassment
Since October 2024 employers have had to take reasonable steps to prevent sexual harassment - before anything happens, not after a complaint. The duty is short. Proving you met it is the work.
"An employer (A) must take reasonable steps to prevent sexual harassment of employees of A in the course of their employment" (s.40A Equality Act 2010, in force 26 October 2024). It is proactive: it applies whether or not anyone has complained. Breach it alongside a successful harassment claim and the tribunal can uplift compensation by up to 25% (s.124A).
Changing on 30 October 2026 (note added 4 October 2026): the government's Employment Rights Act timeline lists two changes for that date. The duty becomes one to take all reasonable steps, and employers gain an obligation not to permit harassment of their employees by third parties such as customers. Until then the wording above is the law.
What changed in October 2024
Before the Worker Protection (Amendment of Equality Act 2010) Act 2023, the law was reactive: an employer could defend a harassment claim by showing it had taken all reasonable steps to prevent it, but there was no duty to have done anything in advance. Now there is a standing obligation, owed to every employee, at all times.
Two consequences follow, and the second is the one people miss:
- The tribunal can add up to 25% to compensation where the duty was breached - on top of an award that is already uncapped in discrimination cases.
- The Equality and Human Rights Commission can enforce the duty directly, without any individual bringing a claim. You do not need a complainant to have a problem.
An employee cannot sue you for breaching the duty by itself; it only bites where a harassment claim has already succeeded. That sounds reassuring and should not be. It means the duty is assessed with hindsight, in the middle of a case you are already losing, by a tribunal looking at what you did before it happened.
What "reasonable steps" means in practice
The Act does not define it, and deliberately so - what is reasonable for a 12-person agency is not what is reasonable for a 500-person hospitality group. What is consistent is that the steps must be real, proportionate to your risk, and evidenced. The following is what an employer is generally expected to be able to show.
The single most useful document you can hold, and the one most employers do not have. Where in this business is harassment more likely - lone working, night shifts, alcohol at events, power imbalances, customer-facing roles, isolated sites? Write it down, decide what you are doing about each, and review it. An employer who has assessed its risks and acted proportionately is in a different position from one who simply had a policy.
The duty is to prevent harassment of your employees in the course of their employment - not only harassment by other employees. Customers, clients, contractors, delivery drivers and members of the public are in scope of the risk you have to think about. In customer-facing sectors this is usually the first thing examined, and "it was a customer, not one of ours" is not an answer.
A dignity-at-work or anti-harassment policy sitting unread in a shared drive is weak evidence. A policy that was issued, acknowledged by name and date, and reissued when it changed is strong evidence. The difference is entirely in the record-keeping, which is why acknowledgement tracking matters more here than for almost any other policy.
Training everyone can describe but nobody can prove is worth little in a hearing. Record who was trained, on what, and when - including new starters and managers, who need more than the general course because they are the people a report is likely to reach first.
If the only way to report is up the line, the one case that most needs reporting - where the manager is the problem - has nowhere to go. An alternative named contact, or an anonymous channel, closes that gap. Anonymous routes have a real limitation worth being honest about internally: you cannot investigate what you cannot ask about. They still surface patterns you would otherwise never see.
Steps taken after a report are part of the picture, but so is what you did with softer signals - an exit interview theme, a spike in a particular team, an anonymous comment. The duty is preventative, so evidence that you noticed something and responded is worth more than evidence that you investigated a formal complaint well.
What an evidence pack looks like
If the duty were tested tomorrow, you would want to hand over, in one place: the risk assessment and its review dates; the policy, its version history and who acknowledged it; training completion by person and date; the reporting routes and how they were communicated; anonymised case statistics showing what was raised and what happened; and the dates of any changes you made as a result.
None of that is exotic. It is simply a set of records that are usually scattered across a drive, a training provider, an inbox and somebody's memory - which is why they are hard to produce at exactly the moment they matter.
What this is not
It is not a guarantee against liability. The duty is to take reasonable steps, not to achieve a harassment-free workplace, and an employer that did everything sensible can still face a claim about an individual's conduct. What the steps change is the uplift, the EHRC exposure, and - much more often - whether the thing happened at all.
Our anti-harassment policy template covers the policy element, and CoDash's compliance hub assembles the rest of the evidence pack from what the system already holds.
Frequently asked questions
What is the employer duty to prevent sexual harassment?
Section 40A of the Equality Act 2010 says an employer must take reasonable steps to prevent sexual harassment of its employees in the course of their employment. It came into force on 26 October 2024, inserted by the Worker Protection (Amendment of Equality Act 2010) Act 2023. It is a proactive duty: it applies whether or not anyone has complained.
What is the penalty for breaching the preventative duty?
Where a tribunal finds sexual harassment under section 40 and also finds the employer breached the section 40A duty, it can increase the compensation by up to 25% under section 124A. The duty is also directly enforceable by the Equality and Human Rights Commission, which does not need a complainant to act.
Is there a free-standing claim for breaching the duty?
No. An employee cannot bring a claim for breach of the preventative duty on its own - it bites where a sexual harassment claim has already succeeded, by uplifting the compensation. The Equality and Human Rights Commission can enforce it independently of any individual claim.
What counts as a reasonable step?
The Act does not define it, and what is reasonable depends on the employer's size, sector and risk. In practice it means a risk assessment, a policy people have actually seen, training that is recorded, a reporting route that does not depend on telling your own manager, action on third-party risk such as customers and contractors, and evidence that all of it happened.
Does the duty cover harassment by customers or clients?
The preventative duty is about preventing harassment of your employees in the course of their employment, which in practice means assessing and acting on third-party risk - customers, clients, contractors and members of the public - not only colleagues. Sectors with high customer contact should expect this to be the first thing examined.
Keep reading: All 79 HR guides · 45 free templates · 27 calculators
The evidence pack, assembled for you
CoDash holds the policy and who acknowledged it, training completion per person, an anonymous reporting route and anonymised case statistics - and pulls them into one reasonable-steps view, because scattered records are the reason this duty is hard to prove.