From 30 October 2026, employers become liable when a third party harasses one of their workers, unless they took all reasonable steps to prevent it. In a multi-let building, most of those third parties come through the front door: contractors signing in, couriers dropping parcels, visitors waiting for a host, occupiers' staff with a complaint. So much of the practical work happens at reception and on site, not in an HR policy.
This page is for building managers, heads of property management and front-of-house leads in UK commercial and mixed-use buildings. It covers what changes, what reasonable steps tend to look like on site, and who owes the duty when several employers share a building.
What changes with the harassment duty on 30 October 2026?
The Employment Rights Act 2025 changes two things on 30 October 2026.
First, the duty to prevent sexual harassment gets stricter. Employers have had to take "reasonable steps" since October 2024. From 30 October, it becomes "all reasonable steps".
Second, and more significant for buildings, employers become liable when a third party harasses one of their workers at work, unless they took all reasonable steps to prevent it. A third party is anyone who isn't the employer or a colleague. This covers harassment related to age, disability, gender reassignment, race, religion or belief, sex and sexual orientation, not only sexual harassment. One incident is enough.
Government can make regulations setting out specific steps, but they're unlikely before 2027 at the earliest. That doesn't leave employers without a guide. The Equality and Human Rights Commission's technical guidance and eight-step guide on preventing sexual harassment already apply, and Acas has published guidance on the new third-party duty. Acas suggests regularly assessing the risk of third-party harassment, having a clear policy on it, and thinking about which third parties your workers actually deal with.
What do "all reasonable steps" look like on site?
On site, reasonable steps tend to look like knowing who's in the building, making it easy to report a problem, and being able to show what you did next. The table below sets out common situations in a multi-let building, a step you might take, and the record that would show it. These are examples, not a legal checklist. What's reasonable depends on each employer's size, setting and risks.
| Site situation |
A reasonable step |
The record that shows it |
| A contractor starts work on site |
Brief them on the conduct you expect before they start |
A signed induction, with the date and the version they saw |
| A visitor arrives at reception |
Sign them in against a named host |
A visitor log showing who, when and who they came to see |
| Somebody reports something at the front desk |
Log it and route it to a named person the same day |
A timestamped report, with who picked it up and what they did |
| A member of staff works alone or out of hours |
Know who else is on site and how to get help |
Access records and the rota for that shift |
| Occupiers need to know the building's standards |
Tell them, and tell them again when things change |
A record of what you sent, when and to whom |
| The same person causes a problem twice |
Restrict their access, with the reason recorded |
An access change linked to the original report |
Employment lawyers are giving similar advice: review your risk assessments so they cover third-party contact, make sure staff know how to report a problem, and keep written records of the steps you take.
It's also worth knowing that people now have longer to bring a claim. Employment tribunal time limits for most claims doubled from three to six months on 1 October 2026.
Who owes the duty in a multi-let building?
Each employer owes the duty to its own workers. In a multi-let building, that usually means several employers at once: the managing agent for its own site staff, an FM or security contractor for theirs, and each occupier for its own people.
What counts as reasonable depends on that employment relationship and on each employer's own circumstances. A managing agent can't take all reasonable steps on behalf of a security contractor's staff, and an occupier can't rely on the building's visitor log as its own policy or training.
Where the managing agent does help is with the building itself. The sign-in record, the access log and the front-desk report usually sit with whoever runs the building. Those records can help any of the employers show what happened on site. They don't discharge another employer's duty, and each employer should take its own advice.
Where Locale fits
Locale helps your front desk and building team keep those site records as part of the day's work: visitor sign-in, contractor inductions, access, front-desk reports and occupier communications, on one platform built as one, under your building's own brand. Around 1,200 buildings run on Locale today.
That can help you show what happened and what you did. It can't decide whether those steps were enough.
Answer any compliance question: the audit trail your building already has →
Visitor management for commercial buildings →
Get every compliance date in one place
The harassment duty is one of six dates that matter most to managing agents before August 2027. The Managing Agent's Compliance Calendar 2026–27 covers every dated item in the window, and what each one asks you to produce. It's free.
Download the Compliance Calendar 2026–27
Frequently asked questions
When does the new harassment duty start?
The strengthened harassment duty starts on 30 October 2026 under the Employment Rights Act 2025. From that date, employers must take all reasonable steps to prevent sexual harassment of their workers. They also become liable for harassment of their workers by third parties, such as visitors and contractors, unless they took all reasonable steps to prevent it.
What counts as third-party harassment?
Third-party harassment is harassment of a worker, in the course of their work, by someone who isn't their employer or a colleague. That includes visitors, contractors, customers and occupiers' staff. From 30 October 2026, it covers harassment related to age, disability, gender reassignment, race, religion or belief, sex and sexual orientation, not only sexual harassment.
What are "all reasonable steps" to prevent harassment?
There's no fixed list yet; government may make regulations from 2027 at the earliest. Until then, the EHRC's technical guidance and Acas guidance set out what employers should be doing. That includes assessing third-party risks, having a clear policy, training staff, making it easy to report problems and acting on reports. What's reasonable depends on the employer's size, setting and risks.
Does the harassment duty apply to managing agents?
Yes, as employers of their own site staff, such as reception, security and building teams. FM contractors and occupiers owe the duty to their own staff. The managing agent's visitor, access and front-desk records can help any employer show what happened in the building, but they don't discharge another employer's duty.
Do I need a single incident or a pattern for liability?
A single incident is enough from 30 October 2026. The earlier third-party regime, repealed in 2013, required at least two previous incidents that the employer knew about. The new rules remove both conditions, which is why the steps you take before any incident matter so much.
Detail verified as at 29 September 2026.
Sources
-2.png)