Third-party harassment: assessing risks from customers, clients and visitors

Since 30 October 2026, changes made by the Employment Rights Act 2025 mean employers can be liable for harassment of their employees by third parties where they haven't taken all reasonable steps to prevent it. The duty to take all reasonable steps to prevent sexual harassment also applies to harassment by third parties.

In practice, that means thinking ahead about where your employees come into contact with third parties, and what you'll do to reduce the risk — not only responding after something has happened.

This is general information, not legal advice. The EHRC and Acas publish guidance on third-party harassment that's worth reading alongside this guide.

• Customer-facing roles in shops, hospitality, healthcare and services
• Visiting customers or clients at their premises or homes
• Working alone, in the evening or in isolated locations
• Client entertainment, conferences and events, particularly involving alcohol
• Business travel and overnight stays with clients or suppliers
• Contact by phone, email, messaging or social media
• Situations where employees feel they can't refuse a client or end an interaction

• Which teams have regular contact with third parties, and how often?
• Do employees work alone with third parties, or at locations you don't control?
• Do employees know they can end an interaction or leave if they feel uncomfortable?
• Do customers and clients know what behaviour you expect?
• Is there a clear way to report a concern about a third party, and does it get acted on?
• Has anything happened before, and did the controls change afterwards?

If the honest answer is "not sure", treat that as something to check rather than assuming a control is in place.

• A clear statement of expected behaviour for customers, clients and visitors
• Making sure employees know they can end an interaction or leave a situation
• Lone working arrangements, check-ins and a named contact
• Event and entertainment guidance, including expectations around alcohol
• Accommodation and travel arrangements that don't put employees in vulnerable positions
• A reporting route that covers third parties and isn't limited to one manager
• A plan for what you'll do if a third party behaves inappropriately, including when to stop working with them

Not every control will fit every organisation. Choose the ones that make sense for how your people work, and record why.

Third-party risks sit best inside your overall sexual harassment risk assessment rather than in a separate document. That way, colleague-to-colleague risks, third-party risks and your shared controls are reviewed together and actions don't get duplicated.

PolicyPilot asks about customers, clients, lone working, travel and events, and includes third-party risks in your suggested assessment where your answers mean they may apply. You review and decide what stays in.