Here is a change almost nobody is talking to small businesses about. From October 2026, if a customer, client, contractor or supplier harasses one of your staff, you, the employer, can be legally liable for it, unless you have taken all reasonable steps to prevent it. This covers all types of harassment, and at the same time the existing duty to prevent sexual harassment is being raised from "reasonable steps" to "all reasonable steps". (Acas: Employment Rights Act 2025.)
If you run a café, shop, salon, pub or any business where your team deals with the public, this lands squarely on you.
What counts as third party harassment?
The regular customer who makes comments about the appearance of your barista. The client who sends late night messages to your account manager. The delivery driver whose "banter" your team dreads. Behaviour you might once have shrugged off as "the public being the public" becomes something the law expects you to actively prevent, and "we didn't know" or "they don't work for us" will not be defences.
What does "all reasonable steps" mean for a five person business?
The law does not expect you to control every customer. It expects you to be able to show you did what a reasonable small employer could do. In practice, tribunals will look for evidence in four places:
- A written policy. A harassment policy that explicitly covers third parties: what behaviour is unacceptable, how staff report it, and what you will do about it.
- Staff knowing about it. A policy nobody has seen is worse than useless at tribunal. A short team briefing, recorded in an email, is evidence.
- Visible expectations. Many businesses will post a simple notice: "Our team has the right to work free from abuse and harassment." Small step, easy to evidence.
- Acting when it happens. If someone reports a problem and nothing changes (the customer keeps their table, the client keeps their contract, the report goes nowhere), your policy becomes evidence against you.
Why acting early matters
Two other changes amplify this one. Tribunal claim windows double to six months in October 2026, and from April 2026 sexual harassment disclosures already carry whistleblower protection. The direction of travel is unmistakable: harassment is moving from an HR topic to a boardroom risk, and tribunals will expect even the smallest employers to have seen it coming.
Put this in place before October
- Adopt a written harassment policy that names third party harassment.
- Brief your team: fifteen minutes, then confirm it in writing.
- Decide in advance what you will do about a harassing customer or client, so the first time is not improvised.
- Keep records of all of it.
Our Complete Bundle includes the grievance procedure your staff will use to raise concerns and the disciplinary framework for handling incidents involving staff, all drafted for small businesses in England and Wales. If you want a third party harassment policy tailored to how your business actually operates, that is exactly the kind of focused job to bring to Cynthia.
Guidance for employers in England and Wales, not legal advice. The definition of "all reasonable steps" will be further specified in 2027. We will keep our templates and this article updated.