The Employment Rights Act 2025 (“ERA 2025”) introduces significant new duties for employers. Are you ready?

The ERA 2025 introduces a crucial obligation on employers to take reasonable steps to prevent third-party harassment, or they otherwise may be liable for unwanted incidents that occur in the workplace.

Here's what employers need to know:

You are a UK employer. You’ve got a team on the front line, dealing with the public every day. It’s a tough gig, and generally, your staff generally handle it well.

But what happens when a customer walks in and racially abuses your employee? Or worse, sexually harasses them?

Historically, employers would not be liable for the conduct of third parties. If you supported the staff member afterward and made a statement saying, “we don’t tolerate this”, you were probably in the clear.

Not anymore.

The ERA 2025 is ripping up that old rulebook and is modernising employment law to extend protections to workers across the country. From 30 October 2026, a single incident of harassment from a third party (like a customer) is enough to result in a claim at the Employment Tribunal. We aren’t talking about a pattern of behaviour here. One incident. One liability.

Section 21 of the ERA 2025, introduces a new head of claim under section 40 of the Equality Act 2010 (“EqA 2010”) which states:

An employer (A) must not permit a third party to harass a person (B) who is an employee of A.

A permits a third party to harass B only if—

the third party harasses B in the course of B’s employment by A, and

A failed to take all reasonable steps to prevent the third party from doing so.

In this section “third party” means a person other than—

(a) A, or

(b) an employee of A.

This provision extends protection beyond internal workplace interactions and ensures that employees are safeguarded from any discriminatory conduct in circumstances where it originates from individuals who are not directly involved with the employer. This section applies to all employees and covers harassment based on protected characteristics under section 4 of the EqA 2010.

Here is why Section 21 of the ERA 2025 needs to be top of your priority list, and what you need to do about it.

The “All Reasonable Steps” Trap

The new law inserts a fresh claim into the EqA 2010 (Section 40). It essentially says: an employer must not permit a third party to harass an employee.

And here is the kicker: you are deemed to have “permitted” it if:

The harassment happened during their employment.

You failed to take all reasonable steps to prevent it.

That’s right. The duty is now preventative. Having a “zero-tolerance” poster on the wall and being nice to the victim after the incident may no longer be a sufficient defence. The law now assumes that an employer is now liable unless you can prove you did absolutely everything you reasonably could to stop the incident happening in the first place.

What Are “Reasonable Steps”?

I know what you are thinking: “How am I supposed to know what ‘all reasonable steps’ means? The law isn’t clear!”

You are right – there is no checklist. What is “reasonable” for massive retailers differs from what is “reasonable” for smaller businesses.

However, the Equality and Human Rights Commission (“EHRC”) guidance on sexual harassment and harassment at work provides a useful roadmap for employers seeking to comply with their positive legal duty. The Employment Tribunal will likely look at (but not limit itself to):

• Your Size and Resources: Can you afford training? Do you have a dedicated HR team?

• The Working Environment: Is it a quiet office or a chaotic pub at 2AM?

• The Nature of Contact: Do your staff interact with customers for 5 minutes or 5 hours?

• The Risks: Have you identified the specific risks of your workplace?

Your Strongest Defence: Risk Assessments

If there is one takeaway from this provisional change, it is this: Conduct a Risk Assessment. Now.

If a claim lands on your desk and you cannot produce a documented risk assessment showing how you identified risks and mitigated them, you will find it significantly harder to defend the complaint. You need to show you were proactive, not reactive.

Identify the risks. Where are your staff vulnerable?

Implement controls. How will you mitigate those risks? (Training, signage, security, de-escalation policies).

Explain your decisions. Did you decide not to install a security camera? Document why. A clearly written explanation is your best friend in a Tribunal.

The good news (yes, there is some)

Here is the silver lining: a step can be considered “reasonable” even if it would not have prevented the act of harassment.

Why? Because you cannot control a stranger walking through your door. The law understands that. They don’t expect you to be psychic. They expect you to be prepared.

If you have done the risk assessment, implemented a robust training policy, trained your staff, and documented your reasoning, a Tribunal is far more likely to accept that you did take “all reasonable steps”, even if the incident still occurred.

If you have not, then approach us to help.

The Bottom Line

The clock is ticking. Now that October is here, the onus is on you to prove you are innocent.

Don’t wait for a claim to test your luck. Start preparing your risk assessments and reviewing your policies now. A stitch in time saves… well, a hefty legal bill and a damaged reputation.

Asad Farooq is a Legal Consultant at Irwell Law who specialises in defending claims at the Employment Tribunal.

Need to ensure you are compliant? Contact the team at Irwell Law (TribunalEdge@irwell-law.com or info@irwell-law.com)

FAQs

Can an employer be liable for harassment by a customer?

Yes. From 30 October 2026, employers may be liable if a customer, client or other third party harasses an employee and the employer failed to take all reasonable steps to prevent it.

Does there need to be a pattern of behaviour?

No. A single incident may be enough to trigger liability.

What are reasonable steps?

The law does not provide a fixed checklist, but Tribunals may consider factors such as training, policies, risk assessments, reporting procedures and workplace-specific controls.

Should employers carry out a risk assessment?

Yes. A documented risk assessment is likely to be a key part of demonstrating that reasonable preventative steps were taken.

If your organisation uses contractors, freelancers, agency workers or outsourced labour, a recent change to the law could affect your Right to Work obligations. Since 1 October 2026, businesses may need to consider Right to Work checks in a wider range of circumstances than before.

The expansion of the UK's Right to Work Scheme does not replace existing checks for employees. Instead, it extends potential compliance obligations and civil penalty liability to certain workers, individual subcontractors, online matching arrangements and some labour supply chains.

Importantly, the focus is no longer just on job titles or contractual labels. Whether someone is described as a consultant, freelancer, self-employed contractor or subcontractor is not, by itself, enough to decide whether the rules apply. The key question is whether the individual is personally providing work or services and whether the arrangement falls within the expanded scheme.

For employers, this means now is the time to review contractor arrangements, labour supply chains and onboarding processes to find where Right to Work checks may be needed and reduce the risk of compliance issues.

Quick Summary

• Right to Work checks are no longer only an employee issue.

• Since 1 October 2026, the scheme may apply to certain workers, subcontractors and labour supply arrangements.

• Calling someone a freelancer or contractor does not automatically place the arrangement outside the rules.

• A correctly completed Right to Work check may provide a statutory excuse if an individual is later found to be working illegally.

• Employers should review their workforce and supply chain arrangements to understand whether the expanded scheme applies

• Right to Work checks must be applied consistently and without discrimination, not just to workers suspected of lacking permission to work.

When Did the Rules Change?

The expanded scheme came into force on 1 October 2026 under provisions introduced by the Border Security, Asylum, and Immigration Act 2025. The new Code applies to all new employment commencing on or after 1 October 2026, together with any repeat Right to Work checks undertaken on or after that date.

Who Could Be Affected?

Employees

The existing Right to Work checking requirements continue to apply to employees.

Workers Under a Worker's Contract

Individuals who personally undertake work or services under a worker's contract may fall within scope. This can include casual workers, temporary staff, agency workers and some zero-hours arrangements.

Freelancers and Independent Contractors

Individuals providing services personally may require Right to Work checks depending on the facts of the arrangement. The description used in the contract is not conclusive.

Individual Subcontractors

An individual subcontractor who personally provides work or services may fall within scope, even where the written agreement describes them as self-employed or an independent contractor.

Agency Workers

Responsibility for carrying out checks will depend on the arrangement. Businesses should not assume that an agency's checks automatically provide their own statutory excuse.

Labour Supplied Through Intermediaries

Where labour is supplied through employment businesses, agencies, umbrella companies or other intermediaries, checking obligations and liability may arise depending on the contractual structure.

Personal Service Companies (PSCs)

Using a personal service company does not automatically place an arrangement outside the expanded scheme. Businesses should assess whether they are contracting with a genuine independent business or engaging a named individual who is personally providing labour.

Online Matching Platforms

Some online marketplaces and matching services may fall within the scheme where they provide details of individual service providers to customers, and the relevant statutory conditions are met. Platforms that simply provide advertising may be treated differently.

Can Businesses Be Liable for Workers Further Down the Supply Chain?

Yes, businesses can be liable in some supply chain arrangements.

One of the most significant changes is the introduction of extended liability in certain labour supply and subcontracting chains. In some circumstances, organisations higher up the contractual chain could face liability for illegal working carried out by an individual engaged through another organisation.

However, liability does not automatically transfer to every organisation in the chain. The legal tests are arrangement specific. The position should be assessed carefully where arrangements involve labour supply, personal service, substitution arrangements, online platforms, or multiple layers of subcontracting.

What About Substitution Clauses?

A contractual right of substitution does not automatically remove Right to Work obligations.

Where an individual is engaged but provides a substitute to carry out the work, extended liability may arise in certain circumstances. Businesses should review substitution arrangements carefully and ensure contracts clearly address responsibility for compliance.

Will Genuine Outsourced Services Be Affected?

Not necessarily, but it depends on the arrangement.

A genuine business-to-business service arrangement may fall outside the direct Right to Work checking requirements where a supplier is delivering a defined service using its own workforce and management structure.

Businesses should distinguish between:

A supplier delivering a genuine, outsourced service

A supplier providing named individuals or labour to work under the customer's direction

The second arrangement creates a greater risk of direct or extended Right to Work obligations.

What Should Employers Do Now?

Review Your Workforce

Find anyone providing services who is not a traditional employee, including:

• Workers

• Freelancers

• Contractors

• Consultants

• Agency workers

• Casual workers

• Zero-hours workers

• Self-employed individuals

• Individual subcontractors

Audit Supplier Relationships

Review arrangements involving:

• Outsourced services

• Labour providers

• Recruitment agencies

• Umbrella companies

• Subcontractors

• Labour supply chains

Review Contracts

Consider whether agreements adequately address:

• Right to Work compliance obligations

• Evidence requirements

• Audit rights

• Onward subcontracting

• Substitution arrangements

Review Recruitment and Onboarding Processes

Ensure checks are carried out before work starts where the arrangement falls within the expanded scheme. Right to Work checks must be applied consistently and without discrimination, not just to workers suspected of lacking permission to work.

Frequently Asked Questions

What is the new Right to Work rules from October 2026?

The scheme has expanded to cover a wider range of working arrangements, including certain workers, individual subcontractors, online matching arrangements and some labour supply chains.

Do freelancers need Right to Work checks?

Potentially. Whether a check is required depends on the reality of the arrangement and whether the individual is personally providing work or services within the expanded scheme.

Are contractors exempt from Right to Work checks?

No. Describing someone as a contractor does not, by itself, place the arrangement outside the scheme. The facts of the arrangement must be assessed.

Do agency workers need Right to Work checks?

Responsibility depends on the structure of the arrangement. Businesses should determine who has responsibility for compliance and avoid assuming another organisation's checks provide full protection.

Can a business be fined if a subcontractor uses an illegal worker?

In some circumstances, yes. Extended liability provisions may expose organisations higher up a contractual chain to liability, although this will depend on the structure of the arrangement and the statutory tests that apply.

Do personal service companies remove Right to Work obligations?

Not automatically. Businesses should assess whether they are contracting with a genuine independent business or engaging an identified individual who is personally providing labour.

How Irwell Law Can Help

The expansion of the Right to Work Scheme creates new compliance risks for employers, labour providers, recruitment businesses and organisations using contractors or outsourced services.

Our employment law specialists can help you: * Review your workforce arrangements

• Assess contractor and supplier relationships

• Audit Right to Work processes

• Update contracts and policies

• Reduce the risk of civil penalties and loss of statutory excuse protection

Need Right to Work compliance advice now that the October 2026 changes are in force?

Contact Irwell Law for specialist employment law support for employers, contractors and labour supply arrangements.

Disclaimer: This article is intended as general information only and does not constitute legal advice. The application of the Right to Work rules will depend on the specific facts of each arrangement. Bespoke legal advice should be obtained before acting.