Have you felt the wind change?

You can’t fly through a storm

Picture the bar after the event. The formal agenda is done, the room has loosened up, and the drinks are flowing. One of the guest speakers, someone whose name carries weight in your sector, makes a comment about a young colleague’s body. Or a hand lands where it should not. Or the leering starts and does not stop.

The colleague smiles tightly and stays, because this is the room where connections and careers are made. Someone nearby laughs it off. Nobody wants to be the person who makes it awkward for someone senior.

For a long time, the story ended there. If anyone was held to account, it was the person doing the harassing, and often not even them.

On 30 October, the wind changed.

What the forecast says now

The Employment Rights Act 2025 makes two separate changes, and it helps to keep them apart.

Change one: preventing sexual harassment. Employers already had to take "reasonable steps" to prevent sexual harassment between colleagues, Now the law upgrades that bar to “all reasonable steps”. One word, a lot of weight. This specific change is about sexual harassment only, and it is entirely about proactive prevention, not just response. It means regulators can fine an organisation for having a poor culture even if no employee ever files a complaint. (Note: For other internal harassment like race or age, employers can still use an "all reasonable step" defence to fight a tribunal claim, but they don't face the same proactive regulatory auditing.)

Change two: harassment by third parties. Employers are now directly liable when someone who is not their employee (clients, customers, contractors, suppliers or visitors) harasses one of their workers in the course of work. To defend against this the employer must prove that they took "all reasonable steps" to prevent it. unless the employer can show it took all reasonable steps to prevent it. Third parties means clients, customers, contractors, suppliers, visitors and members of the public. In practice, that is anyone who is not your employee. This change covers sexual harassment, and it also covers harassment related to age, disability, gender reassignment, race, religion or belief, sex and sexual orientation. A racist remark from a client. A homophobic joke from a supplier. A customer mocking a colleague’s disability. All of it is now a risk to your organisation, not just to the person on the receiving end.

Unlike change one, this third-party rule applies to almost all protected characteristics. If an employer fails to take all reasonable steps to prevent a client from making a racist remark, a homophobic joke or a sexist comment, the organisation is legally and financially at fault.

Harassment is also not only what people say. It is unwanted conduct linked to a protected characteristic that violates someone’s dignity or creates an intimidating, hostile or humiliating environment, and it is the effect that counts, whatever the person meant by it. Think of a guest who touches a Black colleague’s hair without asking. A visitor who keeps “forgetting” a trans colleague’s name on purpose. A contractor who mimics a colleague’s accent or stammer. Offensive images shared in a group chat. Late-night messages to a junior member of staff. A guest who stares and does not stop.

This has been building. Employers have had to take reasonable steps to prevent sexual harassment since October 2024. What has changed is how high the bar is, and how far it reaches.

So if something goes wrong at your event, the question will not only be “what did the guest do?” It will be “what did you do before the event began?”

What “all reasonable steps” will look like in practice is still being worked out. In the meantime, the Equality and Human Rights Commission (EHRC) guidance is the best map we have, and it lists the risk factors you can probably already picture: alcohol, work events, power imbalances, lone working and customer-facing roles.

Why the risk is real

Because this is not rare. A 2023 TUC poll found that 58% of women had experienced sexual harassment, bullying or verbal abuse at work, and in two in five of the most recent incidents the person responsible was a third party rather than a colleague. The EHRC has found that around a quarter of the harassment cases reported to it involved third parties, and that employers often treat it as a normal part of the job. Fawcett Society research found that 68% of disabled women had been sexually harassed at work.

The bar in our scene is the dramatic version. The most common version is far more ordinary. In a 2016 TUC survey, eight in ten incidents happened on work premises, and about one in seven at a social event such as a Christmas party. The government’s 2020 survey found that unwelcome sexual jokes and unwelcome staring were among the most common forms in the workplace. Most of it happens in the normal working day, in meetings, corridors, messages and calls, which is why one-off event planning is not enough.

Harassment follows power. It lands hardest on people who experience minoritisation and have the least power in the room: the agency worker, the junior colleague, the disabled woman, anyone whose job or standing depends on keeping the peace. Treating it as one person’s bad behaviour has always been a way of making a structural problem look personal. The better question is: how is this arranged, and who does the arrangement leave exposed?

Run the event again

So what can a host do about the behaviour of someone who does not work for them? The answer is structural, and most of it happens before anyone arrives.

This time, someone has thought about the event in advance. The risks have been written down, including alcohol, a late finish, guests with more power than the people hosting them, and staff or volunteers working alone. The guest speaker has been told, politely and in advance, what behaviour is expected. There is a named person guests and staff can go to, and everyone knows who that is. Nobody is left to handle a difficult guest alone.

If something still happens, there is a clear route to report it that night, the next morning, or anonymously. And the host writes down what happened and what they did.

Behind the event sits the paperwork

It matters more than it sounds. In recent policy reviews with clients, the same gaps keep coming up.

Grievance policies often still assume harassment only comes from colleagues and managers. They need to say plainly that it can come from clients, customers, contractors, suppliers, visitors and the public. Reporting needs more than one door: line manager, HR, anonymous options and wellbeing support. Anonymous reports are worth more than most organisations admit. Even without an investigation, they show patterns, risks and cultural problems early, which help with future prevention planning.

Workplace relationship policies need to move on from “disclose your office romance” towards power, conflicts of interest and safeguarding. Social media policies should say that behaviour standards apply online, because that is where a lot of harassment now happens. Contracts with clients and suppliers can pass the expectations down. And records matter, because “all reasonable steps” will be judged on evidence.

Most organisations have these policies. Fewer have checked them against the new standard, and that check is something we do.

And the people in the room?

Structure is what prevents harassment. But structures are run by people, and some harm will still fall through. Someone has to decide what to do in the moment.

That is why training has two jobs. The first is to make sure people know what is in your policies: what is expected, where to report, and what they are meant to do. A policy nobody understands will not be implemented well. The second is to prepare people for when prevention fails. That is where the Storm Disruption Model comes in. It does not claim to stop harm from happening. That is the job of structural change. It is about limiting the harm when it does, and then feeding what you learn back into the system.

At Sorabird Co, we think of harassment and discrimination as weather. When someone is subjected to it, they are the one caught in the storm. The forces around them start to shift, and the situation becomes harder to navigate. The weather gets worse, and the more harmful the harassment, the stronger the storm.

You cannot fly through a storm. But if you are the person who sees it forming, you can learn to read it, and to disrupt it.

The model is written for the person who witnesses harassment or discrimination: the colleague at the next table, the manager, the host. The person it is happening to stays at the centre throughout. It has two phases, reflecting how we work at Sorabird Co: from the inside out and the outside in.

The inside out phase is your own work as the witness, and it is private and low risk for everyone, whatever their position. You notice that something felt off, and you trust that. You name what happened, even if the naming is imperfect. Then you navigate: how you are feeling, what capacity you have, and what risk, power and privilege mean for what is safe for you to do. Power is not just job title. A junior colleague and a senior director do not face the same risks if they speak up. Neither do a Black employee or a disabled employee, who may be treated differently for speaking up, may fear victimisation for doing so, and may hold less real or perceived power in the room than their role suggests. The model asks you to be honest about that.

The outside in phase is where you act. You consider what outcome would serve the person harmed and what would serve the system. You disrupt, which does not always mean a confrontation, because there are many ways to shift a storm and the right one depends on who you are and what is safe. You offer care, checking in with the person harmed and asking before you act on their behalf. And you shape the system, asking what was broken and what you can change from where you stand.

The most important principle is also the simplest: there is always something you can do.

The forecast question

The most useful question is not “do we have a policy?” It is “what is the weather like for the people most exposed here, and what have we done about it before the cloud arrives?”

If you would like us to assess your policies against the new standard, or train your managers and teams in active bystander skills using the Storm Disruption Model, I would love to hear from you.

This piece is general information, not legal advice. For decisions about your specific obligations, please speak to an employment lawyer.

Frequently asked questions

The answers below are plain-language summaries, not legal advice. For the official position, see Acas and the GOV.UK guidance on workplace sexual harassment and third-party harassment.

What changed on 30 October 2026?
Two things, both amendments to the Equality Act 2010 made by the Employment Rights Act 2025. Employers must now take “all reasonable steps” to prevent sexual harassment of their workers, up from “reasonable steps”. And employers are now liable if a third party harasses a worker in the course of their work, unless the employer took all reasonable steps to prevent it.

What is the difference between the two changes?
The first is about preventing sexual harassment of workers, whoever is responsible. The second is about harassment by third parties, such as a client, customer or contractor, and it covers sexual harassment and harassment related to age, disability, gender reassignment, race, religion or belief, sex and sexual orientation.

Who counts as a third party?
Anyone who is not the employer or one of its employees. That includes clients, customers, contractors, suppliers, visitors, service users and members of the public.

What does “all reasonable steps” mean?
It is not yet defined in law, and what is reasonable will vary between organisations. The EHRC’s technical guidance, which starts with a risk assessment, is the main reference for now. See Acas and GOV.UK, linked above, for the official guidance.

Where does workplace sexual harassment most often happen?
Most often in the ordinary working day, on work premises, through jokes, comments, staring and unwanted touching. It also happens by phone, text, email and online. Work events and social occasions carry extra risk, which is why the EHRC guidance names them as risk factors.

Do work events and social occasions count?
They can. They belong in your risk assessment, including the drinks afterwards.

Is training enough?
No. Prevention is structural: risk assessments, clear policies, reporting routes, and how events and third party contact are set up. Training makes sure people understand and apply those structures, and prepares them for when something still gets through.

What is the Storm Disruption Model?
Our framework for responding when someone witnesses harassment or discrimination. It has two phases, inside out and outside in, and it keeps the person harmed at the centre. It limits harm and feeds learning back into the system. It does not replace prevention. We deliver it as active bystander training.

Who can help us check our policies and train our people?
Sorabird Co. We assess policies against the new standard, including grievance, anti-harassment, relationship and social media policies, and we deliver active bystander training built on the Storm Disruption Model. Get in touch to talk about your own forecast.

Do these changes affect trade unions and membership organisations?
The risks are real for them too. Trade unions employ staff and host conferences, branch meetings and member events with speakers, partners and visitors. We are proud to work with trade unions, and we want to work with more, helping them check their policies and prepare their reps and staff to respond when something happens.Write your text here...

Contact

Email

hello@sorabird.co

© 2026. All rights reserved.

Sorabird Co is a UK-registered, mission-led inclusive wellbeing company serving UK-based organisations and companies operating in Japan. Sorabird Co centres the experiences of minoritised and underrepresented employees so that everyone can genuinely thrive at work.

Company Number - 16896121

Privacy Policy