Sexual harassment risk assessment: the risks, the steps and the record

The duty: all reasonable steps, from 30 October 2026

Employers must take all reasonable steps to prevent sexual harassment of their employees. Section 40A(1) of the Equality Act 2010 reads: “An employer (A) must take all reasonable steps to prevent sexual harassment of employees of A in the course of their employment.” The duty has applied since 26 October 2024; the word “all” was added by section 20 of the Employment Rights Act 2025 and came into force on 30 October 2026 under regulation 3 of S.I. 2026/1065, which makes no transitional provision for it. Sexual harassment here has the meaning in section 26(2): unwanted conduct of a sexual nature that has the purpose or effect of “violating B's dignity, or creating an intimidating, hostile, degrading, humiliating or offensive environment for B”.

The change from “reasonable steps” to “all reasonable steps” is the reason old assessments need rewriting. Acas, in Preventing sexual harassment (updated 30 October 2026), says it means “taking all of the steps that are reasonable for your organisation rather than just some of the steps” and “focusing on preventing sexual harassment rather than only reacting to incidents”. The EHRC's Sexual harassment and harassment at work: technical guidance (last updated 30 October 2026) says: “If there are other reasonable steps that an employer could have taken, but it decides not to, then it will likely fail to comply with the preventative duty” (paragraph 3.36). The test is objective: what a tribunal would consider reasonable, not what the employer thought (3.33).

The same day brought a second duty. Section 40(1A) of the Equality Act 2010, inserted by section 21 of the Employment Rights Act 2025, says “An employer (A) must not permit a third party to harass a person (B) who is an employee of A”, and an employer permits it only if the harassment happens in the course of B's employment and “A failed to take all reasonable steps to prevent the third party from doing so” (section 40(1B)). This duty is wider than sexual harassment. The Department for Business and Trade's Employment Rights Act factsheet on preventing workplace sexual harassment says “All three forms of harassment in section 26 of the Equality Act 2010 are covered”: harassment related to age, disability, gender reassignment, race, religion or belief, sex or sexual orientation; sexual harassment; and less favourable treatment for rejecting or submitting to it. The government's Workplace sexual harassment and third-party harassment page confirms the exclusions: it covers harassment related to a protected characteristic “apart from pregnancy and maternity, and marriage and civil partnership”.

The two duties are enforced differently. Under section 40A(3), a breach of section 40A(1) is enforceable only by the EHRC or by an employment tribunal through a compensation uplift: where a tribunal upholds a sexual harassment claim and awards compensation, section 124A requires it to consider whether the employer also breached section 40A(1), and the uplift “may be no more than 25%” of the award. The EHRC says “an individual cannot bring a claim for a breach of the preventative duty alone” (3.23). A claim under the third-party duty is different in that respect: “a worker can bring a claim about harassment by a third party directly against their employer” (3.89).

No statute or regulation yet requires a written risk assessment. Section 40B, inserted by section 22 of the 2025 Act on the same day, lets ministers specify steps to be regarded as reasonable, including “carrying out assessments of a specified description”; none has been made, and the government said in January 2026 that it expects the regulations in “2027/28 (after consultation)”. Until then the assessment is one of the reasonable steps Acas and the EHRC expect, and the place where the others are written down. The government's page says the measures apply to England, Wales and Scotland, “but not to Northern Ireland, where equality and discrimination law is devolved”. The technical guidance does not describe itself as statutory; it refers readers separately to the Commission's statutory code of practice for employment.

Who the assessment protects, and who counts as a third party

The duties protect people in “employment” as section 83(2) of the Equality Act 2010 defines it: “employment under a contract of employment, a contract of apprenticeship or a contract personally to do work”. That takes in apprentices and many workers who are not employees. Volunteers are a different case: the EHRC says “Volunteers are not protected under the work provisions of the Act” (3.6). A charity's volunteers, a school's parent helpers and a care home's visiting volunteers are still worth including in the assessment as good practice, but, unless the arrangement is in reality a contract personally to do work, the statutory duties do not reach them.

The assessment covers harassment by colleagues and managers and by third parties. Section 40(1C) defines a third party as anyone other than the employer or its employees, and the EHRC's own definition gives examples including “a customer, client, self-employed contractor or freelancer, suppliers, service user, patient, student, pupil, friend or family of colleagues, delegate at a conference and members of the public”. Acas adds “people at conferences or events”. In practice:

• Schools: pupils, parents and carers, visitors, contractors on site, coaches and instructors on trips.
• Nurseries and childminders: parents and carers at drop-off and collection, visiting professionals, contractors.
• Care homes and home care: residents and the people receiving care at home, relatives and visitors, visiting professionals, and the households a home care worker enters alone.
• Charities: service users, members of the public, event guests and donors, staff of partner organisations, and the households an outreach worker visits.

In a school in England, keep the two duties apart. Keeping children safe in education, Part five, deals with child-on-child sexual harassment and sexual violence: a safeguarding duty to pupils. This assessment is about staff as the people harassed, including by pupils and parents, who are third parties to the school as employer.

Care raises a harder case: a resident whose dementia or brain injury shows itself in sexualised behaviour towards a carer. Under section 26(4) a tribunal weighs the worker's perception, the other circumstances of the case and whether it is reasonable for the conduct to have that effect, so the assessment does not need to decide whether such conduct is harassment in law. It needs to plan for it. The EHRC's list of third-party steps includes “consideration of mitigating measures that protect staff if it is not possible to remove the third party (for example, if this would present a risk to staff safety, or if the employer is obliged to provide a service such as healthcare)” (4.33), and the government's factsheet says the steps an employer can take for third parties “are clearly more limited than the steps they can take in respect of their employees” and that employers “will not be penalised for failing to take unworkable or impractical steps”.

The risks to assess in schools, nurseries, care and charities

Acas starts from the premise: “Sexual harassment can happen in any organisation. You must not assume that it will not happen.” It says “You should assess any possible risks in your organisation”, considering factors specific to your sector, the type of work, ways of working and different roles, and it names higher risk factors such as “meeting clients or service users alone”, “an environment where people are drinking alcohol”, “work-related social events”, “power imbalances between workers” and “travelling for work, including overnight stays”. Some people may be at higher risk, for example “younger workers, including apprentices and interns” and “people with learning difficulties”.

The EHRC says “Employers should make an assessment of risks relating to harassment, sexual harassment and victimisation” (4.16), and its list of factors (4.17) adds “job insecurity, for example, use of zero hours contracts, agency staff or contractors”, “lone working and night working”, “out of hours working”, “customer-facing duties”, “working from home”, “attendance at events outside of the usual working environment, for example, training, conferences or work related social events”, “socialising outside work” and “social media contact between workers”. A second list (4.19) names factors that raise the risk of sexual harassment in particular, including “working alone with a third party”, “night working”, “a failure to respond appropriately to previous reports of sexual harassment” and “risks that only affect one job role or worker (these should still be considered and addressed)”. Workers with more than one protected characteristic “may be particularly vulnerable” (4.18).

Mapped onto the four sectors, those lists usually turn up:

• Working alone with a third party: one-to-one tuition and music lessons, intimate and personal care, home care visits, outreach and befriending, a nursery practitioner alone with a parent at collection.
• Night and out-of-hours working: night shifts in care, sleep-in cover in supported living, parents' evenings, lettings and caretaking after school hours.
• Events, overnight stays and alcohol: residential trips and sports fixtures, fundraising events and galas, conferences, and the staff party, which falls squarely under “work-related social events”.
• Power imbalances and young workers: apprentices in nurseries and care, trainee teachers, newly qualified staff, and junior staff whose shifts or references depend on one manager.
• Online contact: Acas says “All reasonable steps includes protecting workers from online and in-person sexual harassment.” Staff group chats on personal phones, messages from parents, relatives or service users to a worker's own number, and direct messages from colleagues out of hours all belong in the assessment, because that is where much of the risk the EHRC calls “social media contact between workers” now sits.
• Insecure and agency work: bank, agency and supply staff who may not know the reporting routes or feel able to use them.

Do not write the list alone. The EHRC says “Employers should consult with trade unions or employee representatives when conducting risk assessments” (4.17), and for third-party risks suggests that “An employer may wish to consider an anonymous survey to encourage openness” (4.32). The complaints log is evidence too: Acas lists “keeping a record of sexual harassment complaints to watch for any patterns of unwanted behaviour” among the steps. And the EHRC notes that “Existing risk management frameworks, traditionally used in the workplace health and safety context, could be used for this process” (4.16), so the assessment can sit beside the existing lone working and violence-at-work assessments; the lone working policy guide covers those.

Writing it down: the risks, the steps taken and the steps rejected

The EHRC sets out the reasoning an employer should follow: consider the risks, consider what steps could reduce them, consider which of those steps are reasonable, and “implement all steps it concludes are reasonable for it to take” (3.35). It adds that “Assessments should identify the risks and the control measures identified to minimise the risks” (4.17). Because the test is now all reasonable steps, the most useful thing the document can show is the third stage: the steps the employer considered and did not take, and why.

A workable sexual harassment risk assessment template has a row for each risk and these columns:

1. The risk: the situation, in the organisation's own words (night shifts on the first floor, the year 6 residential, parents' messages to staff phones).
2. Who could be harmed, and by whom: the role, and whether the risk comes from colleagues, managers or a named kind of third party.
3. What is already in place: the policy, the training, the rota rule, the notice at reception.
4. Further steps to be taken, each with an owner and a date.
5. Steps considered and not taken, with the reason. The EHRC lists factors that may be relevant in deciding whether a step is reasonable, including “the size and resources of the employer” and “the time, cost and potential disruption of taking a particular step, weighed against the benefit it could achieve” (3.38). A reason written at the time is far stronger than one reconstructed after a claim.
6. How staff report it: Acas says “You should make sure workers have more than one way to report sexual harassment”, including “situations where they felt at risk, even if nothing happened”, and the EHRC says “Employers should ensure staff are aware of reporting mechanisms and management know what to do if a worker raises a complaint of harassment” (4.20).
7. Review: the date of the next review and what would bring it forward.

Around the table, record who was consulted and when, who owns the assessment, and the training that goes with it; Acas lists “training managers on how to assess and manage risks of sexual harassment”. The EHRC adds that “Employers should produce an action plan that sets out what preventative steps they will take to address any identified risks” (4.22), should consider publishing it, and may appoint “a designated lead” for it (4.23). The complaint route itself belongs in the grievance procedure, and since 6 April 2026 a disclosure “that sexual harassment has occurred, is occurring or is likely to occur” can be a protected disclosure under section 23 of the Employment Rights Act 2025, which the whistleblowing policy should reflect.

Reviewing it, and what a tribunal or the EHRC will look at

No law sets a review interval for the assessment. The EHRC calls the preventative duty “an anticipatory duty” and “a continuing duty”: “Employers should not wait until a complaint of sexual harassment has been raised before they take any action” (3.20), and “Employers should regularly review how they are meeting the duty to ensure any change in circumstances or working practices are taken into account” (3.21). It says employers “should also review the risk assessment regularly and take mitigating action if they identify any new or additional risks” (4.21), and that “Policies and steps taken to prevent harassment should be reviewed annually” (4.57). Set a date at least a year ahead, and review before it after any complaint or incident, a staff survey, a new service, site or role, a change in staffing such as more agency or night cover, and before a residential trip, a conference or the staff party.

Keep every dated version. If a complaint reaches a tribunal or the EHRC, the question is what the employer had done before the harassment happened. Writing about the defence in section 109(4), where an employer escapes liability for an employee's harassment only if it “took all reasonable steps to prevent” it, the EHRC is clear that “The fact that an employer has taken steps such as an investigation and disciplinary action to deal with the harassment after it has occurred will not be sufficient on its own to avoid liability” (3.73); the preventative duty now uses the same words. Whether earlier steps worked is relevant too: “whether steps taken appear to have been effective or ineffective” is one of the EHRC's factors (3.38). A risk assessment last opened two years ago, with no record of review after a complaint, tells that story badly even if the steps it names were sound.

A step can be worth taking even if it would not have stopped a particular incident: the EHRC says “A step may be reasonable, even if it would not have prevented a particular act of sexual harassment, for example, if it reduced the risk of sexual harassment occurring” (3.39). The assessment is where that reasoning is kept.

Where ComplyChat fits, and where it does not

ComplyChat is not a risk assessment tool, a reporting hotline or an HR case management system, and using it does not meet the duty or make an employer compliant. The assessment, the policy, the training, the reporting routes and the way complaints are handled are the employer's to write and run.

Where it fits is one row most assessments now need. The EHRC names “social media contact between workers” and “out of hours working” as risk factors, and Acas says all reasonable steps include protecting workers from online harassment. In many schools, nurseries, care homes and charities that contact runs through a staff group chat on personal phones, and through parents, relatives or service users messaging a worker's own number. The employer did not set those groups up, cannot set their terms, and usually first sees what was said when a screenshot arrives with a complaint. The WhatsApp policy for staff guide sets out the clauses for that case.

ComplyChat is designed to move work conversations into channels the organisation runs. Staff, and parents, families or volunteers added by their mobile number, talk in channels the organisation sets up; a mobile number verified by SMS is an identity, so nobody needs an account on the organisation's systems; everyone added is told the channel is on the record and can object or leave; and messages are recorded on the server as they are sent. On paid plans, once the organisation's tenant is connected, conversations are kept under the retention schedules within its own Microsoft 365 subscription, so when a complaint is made about something said in a work channel, the record is already in the organisation's hands rather than in a screenshot. The assessment can then name the channel as one control among the others.

A question for the next leadership or board meeting: which of the risks in your assessment would you first hear about from a screenshot of a group you do not run?

Questions people ask

Is a sexual harassment risk assessment a legal requirement?

No statute or regulation in force requires a written sexual harassment risk assessment, but section 40A of the Equality Act 2010 requires employers to take “all reasonable steps” to prevent sexual harassment, and the EHRC says an employer “is unlikely to be able to comply with the preventative duty unless they carry out a risk assessment”. Section 40B lets ministers specify assessments as reasonable steps by regulations, which the government said in January 2026 it expects in 2027/28 after consultation.

What does “all reasonable steps” mean?

Since 30 October 2026, section 40A(1) of the Equality Act 2010 requires an employer to take all reasonable steps to prevent sexual harassment of its employees. Acas reads this as “taking all of the steps that are reasonable for your organisation rather than just some of the steps”, and says “There’s no set list of steps that all employers must take.”

What should a sexual harassment risk assessment include?

Each risk, who could be harmed and by whom, the controls in place, the further steps with an owner and date, the steps considered and rejected with reasons, the reporting routes and a review date. Acas names higher risk factors including “meeting clients or service users alone”, “an environment where people are drinking alcohol”, “work-related social events”, “power imbalances between workers” and “travelling for work, including overnight stays”, and higher-risk groups such as “younger workers, including apprentices and interns”.

Who counts as a third party for sexual harassment?

Section 40(1C) of the Equality Act 2010 defines a third party as anyone other than the employer or its employees. Acas lists customers, clients, service users, members of the public, self-employed consultants and “people at conferences or events”; the EHRC's examples include pupils, patients and suppliers, so parents, pupils, residents, relatives and service users are all third parties to the employer.

Can staff bring a claim for harassment by a parent, resident or service user?

Yes, since 30 October 2026: section 40(1A) of the Equality Act 2010 makes an employer liable for third-party harassment of an employee in the course of employment where it failed to take all reasonable steps to prevent it, and the EHRC says “a worker can bring a claim about harassment by a third party directly against their employer”. That covers sexual harassment and harassment related to a protected characteristic other than pregnancy and maternity or marriage and civil partnership. A breach of the section 40A preventative duty, by contrast, cannot be claimed on its own.

How often should a sexual harassment risk assessment be reviewed?

No law sets a fixed interval; Acas lists “carrying out risk assessments and regularly reviewing them” among the steps, and the EHRC says employers should “review the risk assessment regularly” and that “Policies and steps taken to prevent harassment should be reviewed annually”. Review it at least once a year, and earlier after any incident or complaint, a change in services, staffing or premises, and before events such as residential trips or the staff party.

Official guidance and your next step

The law is in sections 26, 40, 40A, 40B, 109 and 124A of the Equality Act 2010; sections 40 and 40A were amended, and section 40B inserted, by sections 20 to 22 of the Employment Rights Act 2025 from 30 October 2026 (S.I. 2026/1065). The EHRC's technical guidance was updated and renumbered on 30 October 2026; the paragraph numbers in this guide are from that edition, with risk assessment at 4.16 to 4.23 and third-party harassment from 3.89. The Commission says it has also updated its employer 8-step guide and is updating its checklist and action plan for employers. Acas's Preventing sexual harassment and the government's Workplace sexual harassment and third-party harassment are the plain-English summaries. Quotations are from the pages as published on 2 and 3 November 2026.

This guide covers England, Wales and Scotland, where the duties apply, and is not legal advice. Northern Ireland has its own equality law.

Then do one thing: list every place your staff are alone with a pupil, parent, resident, relative or service user, every event where alcohol is served, and every group chat your staff use for work that the organisation did not set up. Those three lists are the first rows of your sexual harassment risk assessment.