Sexual harassment prevention: why SMEs should review policies, training and risk assessments now

 

The UK’s framework for preventing workplace harassment is continuing to evolve. Since 26^th October 2024, employers have been under a new legal duty to take “reasonable steps” to prevent sexual harassment at work. (Click to view)

The next phase is expected to raise the bar further from 30^th October 2026, moving from “reasonable steps” to “all reasonable steps” alongside a new, clearer route to employer liability where staff are harassed by third parties (for example, customers, clients, suppliers or contractors). (Click to view)

If you’re an SME, it’s easy to assume this only affects big organisations with large HR teams. In reality, these changes matter most where people work closely together, managers “wear multiple hats”, and staff regularly deal with the public.

Below is a practical overview of what to think about first—so you can reduce risk, protect your team, and avoid scrambling later.

1) What’s changing (and why it matters)

A higher standard: “reasonable steps” → “all reasonable steps”

From October 2024, the duty has been to take reasonable steps to prevent sexual harassment. (Click to view)

From 30th October 2026, the requirement is expected to become all reasonable steps. (Click to view)

In plain English: you may need to show you’ve done everything that would reasonably be expected for your business, given your size, sector and risk profile,  not just “something”.

What SMEs should take from this:

• A generic policy and a once-a-year e-learning module may not feel sufficient if something goes wrong.
• Evidence will matter: what you assessed, what you put in place, what you communicated, and what you did when concerns were raised.

More exposure around third-party harassment

Another significant shift is the expanded obligation on employers not to permit their employees to be harassed by third parties which can include customers, clients, contractors, suppliers and consultants. (Click to view)

Importantly, this is expected to apply to harassment related to protected characteristics including:

• age
• disability
• gender reassignment
• race
• religion or belief
• sex
• sexual orientation

And crucially, employer liability may arise even if there was no prior warning (there is no return to the old “three strikes” approach). (Click to view)

What SMEs should take from this
If your team interacts with the public retail, hospitality, care, trades, professional services, property, events, this is a real risk area. “They’re a customer” won’t be a defence.

2) What “all reasonable steps” is likely to look like in practice

We’re still awaiting fuller detail in updated guidance and supporting regulations, and the EHRC has indicated it is working on updates. (Click to view)

That said, most organisations won’t go far wrong by focusing on three practical pillars:

(A) A real-world risk assessment (not a tick-box)

SMEs often have good intentions but don’t always document risk clearly. A strong approach is to identify whereharassment risk could realistically show up in your business and why.

Higher-risk scenarios often include:

• work social events (especially where alcohol is involved)
• conferences and off-site events
• travel / overnight stays
• lone working
• customer-facing environments and high-pressure service situations
• contractor-heavy workplaces (multiple teams, blurred lines of responsibility)

Tip: Treat harassment risk like you would health & safety risk: identify hazards, consider who might be impacted, put controls in place, review after incidents.

(B) Bespoke policies people actually use

Many SMEs have a “Dignity at Work” policy that’s technically fine but practically ignored.

Consider whether you need:

• a dedicated sexual harassment policy, or
• a clear separate section within your main policy that’s easy to find, easy to read, and explains reporting options simply.

At minimum, your documents should be consistent and plain-English on:

• what harassment is (with examples relevant to your workplace)
• what to do if it happens (including informal vs formal routes)
• confidentiality and record keeping (what you can/can’t promise)
• expected manager actions and timeframes
• outcomes and consequences
• support options for affected employees

(C) Training that matches your real escalation points

Training doesn’t need to be expensive to be effective but it does need to be credible.

For SMEs, the biggest “failure points” are usually:

• a manager trying to handle something quietly to “keep the peace”
• confusion about what’s a grievance vs what’s safeguarding vs what’s whistleblowing
• delays (because everyone is busy)
• inconsistent outcomes across teams

Practical training should cover:

• how to receive a disclosure (what to say and what not to say)
• when a concern must be escalated
• how to separate “support” from “investigation”
• what good documentation looks like
• third-party harassment scenarios (and how to set boundaries with customers/clients)

3) Third-party harassment: practical controls SMEs can implement now

If employees deal with customers, clients or contractors, the best prevention strategy is to make expectations visible before something happens.

Here are practical controls that are proportionate for many SMEs:

Set behavioural expectations with third parties

Depending on your environment, this can include:

• wording in terms and conditions (for customers/clients)
• clauses in supplier/contractor agreements
• signage or notices in reception/front-of-house areas
• event invitations and joining instructions (for meetings, conferences, socials)

The message can be simple: respectful behaviour is expected; harassment is not tolerated; you may refuse service or end the engagement.

Plan events properly (especially where alcohol is involved)

If you run socials or host clients:

• send reminders ahead of time about professional behaviour
• consider alcohol-free or low-alcohol options as the default
• name a couple of designated points of contact at events (people staff can approach if something feels off)
• think through transport and end-of-evening arrangements

Make reporting easy and safe

A policy is only helpful if people feel able to use it.

SMEs often benefit from offering:

• more than one reporting route (e.g., line manager or another manager or an external HR contact)
• a short “what happens next” explainer (so staff know what to expect)
• a clear commitment to taking concerns seriously, even when the alleged harasser is a high-value client

4) A simple “SME checklist” to review this quarter

If you want a straightforward starting point, ask:

1. Do we have a clear, workable approach to sexual harassment prevention (policy + process + training)? (Click to view)
2. Have we identified where our real risks sit (events, travel, customer-facing roles, lone working)?
3. Do our managers know what to do in the first 30 minutes after someone reports a concern?
4. Can we evidence what we’ve done training logs, policy sign-off, updates, actions taken?
5. Do we set expectations with customers/clients/contractors and do staff feel backed if they enforce them?

Looking ahead (and how to stay ready)

The direction of travel is clear: employers will be expected to take a proactive approach, build on what they’ve put in place since October 2024, and be able to demonstrate robust, practical sexual harassment prevention, especially where third-party interactions are part of everyday work. (Click to view)

Two strong places to start are:

• thoughtful, regularly reviewed risk assessments, and
• bespoke policy wording and training that fits your business, not a template.

If you’d like help reviewing your current approach policies, training for managers, risk assessments, or practical planning for events and client-facing teams, Tick HR Solutions can support you to put a proportionate plan in place.

This article is general guidance and not legal advice.

Want a quick, practical review? Send us your current policy and a brief overview of your workplace setup (roles, customer contact, and any upcoming events), and we’ll recommend a sensible action plan.

Information based on current GOV.UK, Acas & EHRC summaries of the duties and expected changes. (Click to view)