The New Duty to Prevent Sexual Harassment at Work: What It Really Means for Your Policies

The Equality and Human Rights Commission has fundamentally changed how workplace harassment is treated in the UK. What used to be a reactive obligation is now a proactive legal duty. Employers are no longer judged on how they respond after something goes wrong. They are judged on what they did to prevent it in the first place.

This is not a subtle shift. It is structural. And it places policies at the centre of compliance in a way most organisations are not prepared for.

The shift from reaction to prevention

For years, many organisations approached harassment through a familiar model. Have a policy in place. Provide a reporting route. Investigate complaints when they arise. That model is no longer sufficient.

Under the updated framework linked to the Worker Protection (Amendment of Equality Act 2010) Act 2023, employers must now take reasonable steps to prevent sexual harassment before it happens. This duty came into force in October 2024 and is supported by detailed technical guidance from the regulator.

The distinction matters. Prevention requires anticipation. It requires understanding where risk exists in your organisation and acting before an incident occurs. It requires evidence.

This is where most businesses begin to struggle.

Why most organisations are already exposed

The majority of companies believe they are compliant because they have a harassment policy. In reality, most policies fall short in three critical ways:

• They are **static** — written at a point in time and not meaningfully updated
• They are **generic** — based on templates that lack operational detail
• They are **disconnected** — not linked to real-world activity across teams or environments

The new duty exposes all three weaknesses.

A policy that sits in a folder, however well written, does not demonstrate prevention. A document alone cannot show that risks have been assessed, that staff understand expectations, or that the organisation is actively managing behaviour.

From a regulatory and tribunal perspective, this gap is where risk lives.

What the guidance actually expects

The technical guidance is detailed, but its underlying message is consistent. Employers must be able to show that they have taken reasonable steps to prevent harassment. That includes having appropriate policies, but it goes significantly further.

A compliant approach requires:

• A clear, well-structured policy that:
• Defines harassment
• Provides real examples
• Sets expectations
• Outlines reporting and investigation processes
• Explicit coverage of **third-party interactions** (customers, clients, suppliers)

Beyond the document itself, organisations must:

• Assess where harassment risks are most likely to arise
• Identify, document, and act on those risks
• Provide **ongoing training**, not one-off sessions
• Monitor effectiveness through:
• Complaints
• Exit interviews
• Employee feedback

None of this can be demonstrated without a clear record of what has been done, when, and why.

The role of evidence in modern compliance

One of the most important aspects of the new framework is the emphasis on evidence.

If a claim arises, the question is no longer simply whether a policy existed. The question is whether the employer can prove that they took reasonable steps to prevent the issue.

That proof may include:

• Records of policy updates
• Evidence of staff training
• Documentation of risk assessments
• Data showing how concerns were monitored and addressed

Tribunals can increase compensation by up to 25% if an employer fails in their preventative duty. The regulator also has enforcement powers.

In practical terms, compliance is no longer about having the right documents. It is about maintaining a clear, continuous record of preventative activity.

Why policies are now a live system, not a document

Policies have traditionally been treated as static documents. The new duty requires them to function as part of a live system.

A policy must:

• Reflect current law
• Align with real organisational practice
• Be understood by employees
• Evolve as risks change
• Connect to actions such as training and oversight

Viewed this way, a policy becomes a control layer — translating legal requirements into operational behaviour.

Most organisations do not currently manage policies in this way. That is why the gap between expectation and reality is so significant.

The challenge of “reasonable steps”

The concept of reasonable steps is deliberately flexible. Expectations scale based on size, sector, and complexity.

• Small businesses are not held to the same standard as multinationals
• All employers, however, must act proportionately and seriously

There is no universal checklist. Organisations must:

• Interpret what is reasonable in their context
• Justify their approach with evidence

That justification must show:

• Risks were considered
• Appropriate actions were taken
• The approach was reviewed and updated

Compliance becomes an ongoing cycle of assessment, action, and adjustment.

Where most businesses get it wrong

Common failures include:

• Treating compliance as a **one-time task**
• Delivering **generic, one-off training**
• Failing to embed risk assessment into operations
• Fragmenting data across systems (policies, training, incidents)
• Lacking leadership visibility on compliance status

This approach cannot meet the new standard.

The commercial reality behind the regulation

Although legal in nature, the impact is commercial:

• Claims and enforcement carry financial risk
• Reputational damage affects market position
• Governance standards influence:
• Procurement
• Partnerships
• Investment decisions

Organisations with strong, evidence-based compliance are more resilient and competitive.

What good looks like now

A modern approach to harassment prevention includes:

• Current, organisation-specific policies
• Documented and regularly reviewed risks
• Ongoing, relevant training
• Tracked activity and reviewed outcomes
• System-wide updates when laws or risks change

Most importantly, there is a clear audit trail demonstrating preventative action and rationale.

This is what regulators and tribunals expect.

The opportunity hidden in the change

The new duty introduces risk, but also opportunity.

Organisations that act early can:

• Differentiate through strong governance
• Reduce uncertainty with structured oversight
• Gain a competitive advantage in a changing regulatory landscape

Final thought

The message from the Equality and Human Rights Commission is simple, even if the implications are not:

• Prevention is now the standard
• Evidence is now essential
• Policies alone are no longer enough

The real question is not whether an organisation has a policy — but whether that policy is part of a system that actively prevents risk and proves it.

That is the new benchmark for compliance.