Third-party harassment: what SMEs need to do now
A customer makes a racist remark to a member of staff. A client repeatedly sends unwanted messages. A contractor makes sexual comments on site. A visitor behaves aggressively towards an employee and the manager dismisses it as something people in the role simply have to tolerate.
These incidents may come from outside the workforce, but they are still workplace issues. From 30 October 2026, the legal risk for employers becomes much clearer: an employer can be liable where a third party harasses a worker in the course of employment, unless the employer has taken all reasonable steps to prevent it.
For small and medium-sized employers, the answer is not a complicated compliance programme. It is a proportionate, documented approach that reflects the people your team meets, the environments in which they work and the risks they genuinely face.
What is third-party harassment?
A third party is someone who does not work for the employer but comes into contact with a worker through work. That can include customers, clients, service users, patients, students, suppliers, contractors, tradespeople, event attendees and members of the public. The behaviour can happen face to face or online.
Harassment under the Equality Act 2010 can include unwanted conduct related to age, disability, gender reassignment, race, religion or belief, sex or sexual orientation; sexual harassment; and less favourable treatment because of a person’s response to certain harassment. A serious one-off incident can be enough—there does not have to be a pattern.
The key change
From 30 October 2026, ‘we did not employ the person who behaved badly’ will not, by itself, protect the business. The question will be whether the employer took all reasonable steps to prevent the harassment.
Why this matters particularly to SMEs
SMEs are not exempt. What is reasonable will depend on the organisation’s size, sector, work and available resources, but a smaller budget is not a reason to do nothing. In practice, smaller businesses can be more exposed because reporting routes are informal, managers have had limited training, incidents are not recorded and employees may have no alternative person to approach.
The risk is also broader than a legal claim. A poor response can damage trust quickly, increase absence and turnover, undermine recruitment and create reputational problems with customers and the wider community. Management time is then spent reacting to an issue that could often have been reduced through clearer expectations and earlier intervention.
The dangerous assumptions
‘The customer is always right.’ Commercial value does not remove the employer’s responsibility to protect staff.
‘It was only banter.’ The effect of the conduct matters, not only the intention behind it.
‘Nobody made a formal complaint.’ Workers may stay silent if they believe nothing will change or fear losing shifts, opportunities or client relationships.
‘We dealt with that one incident.’ A response after the event is important, but prevention requires employers to look at foreseeable risks before another incident occurs.
‘Our standard harassment policy covers it.’ A policy that says nothing about customers, clients, suppliers or contractors may not guide managers through the decisions they actually need to make.
What ‘all reasonable steps’ could look like
There is no single checklist that will fit every employer. Acas says the steps will depend on the organisation and gives examples including regular risk assessments, incident monitoring, suitable policies, training, contractual terms and clear communication to customers about consequences.
A sensible SME approach should include:
Map the exposure. Identify which roles deal with customers, clients, contractors or the public, including lone working, travel, late shifts, events and online contact.
Assess the real risks. Consider previous incidents, employee feedback, patterns by location or time, alcohol-related environments, aggressive behaviour and unequal power relationships.
Update the policy. Define third-party harassment, give relevant examples and explain how employees can report concerns and what managers must do.
Create more than one reporting route. Employees should not be forced to report only to the manager who witnessed or mishandled the incident.
Train managers and staff. Training should cover recognition, safe intervention, escalation, evidence preservation, support and non-retaliation—not simply ask people to confirm they have read a policy.
Set expectations with third parties. Use booking terms, client agreements, supplier terms, visitor notices or customer communications where appropriate.
Plan the immediate response. Managers should know when to remove a worker, end service, contact security or police, preserve messages or footage, and arrange welfare support.
Record and review. Log incidents, decisions and actions. Look for patterns and document why a potentially useful measure was or was not considered reasonable.
When an incident happens
The first response matters. Take the report seriously, check immediate safety, avoid blaming the employee and explain what will happen next. Investigate promptly and fairly, keep appropriate records and consider interim protections while the facts are established.
The commercial relationship may make decisions uncomfortable. A valued client may need to be challenged, a customer may need to be refused service or a contractor may need to be removed from site. Delaying action because the third party generates revenue can increase both the harm and the employer’s risk.
Do not wait until October
The strongest evidence is created through everyday practice: risk assessments that are reviewed, training that reflects actual scenarios, reports that are acted upon and decisions that are recorded. A policy produced after an incident will not show that the business had taken preventive steps beforehand.
Use the remaining preparation period to identify the risks, close the most important gaps and make expectations clear. The objective is not paperwork for its own sake. It is a safer workplace, more confident managers and a defensible response if conduct does occur.
A practical starting point
Review one team or location first. Ask: who do employees encounter, what could go wrong, how would they report it, what would a manager do, and what evidence would show the business had taken reasonable preventive action?
How Melford People Partners can help
Melford People Partners can help SMEs assess third-party harassment risks, update policies and reporting routes, prepare manager guidance and build practical training around the situations their people actually face.
If your business needs to prepare for the October 2026 change, arrange a confidential conversation.
Sources and legal note
Sources checked on 5 September 2026:
Acas, ‘Third party harassment - Harassment law changes’: https://www.acas.org.uk/employment-rights-act-2025/harassment-law-changes
Acas, ‘Harassment - Discrimination at work’: https://www.acas.org.uk/discrimination-and-the-law/harassment
GOV.UK, ‘Plan to Make Work Pay and Employment Rights Act: timeline update’: https://www.gov.uk/government/publications/implementing-the-plan-to-make-work-pay-and-employment-rights-act/plan-to-make-work-pay-and-employment-rights-act-timeline-update
Employment Rights Act 2025: https://www.legislation.gov.uk/ukpga/2025/36
This article provides general information for employers and is not legal advice. Employment law and statutory rates can change; advice should be taken on specific circumstances