It won’t take much to imagine this scenario…
An employee tells her manager that an important customer has made repeated personal comments and touched her in a way that made her uncomfortable. The customer’s repeat business is highly valued by the employer as they regularly spend tens of thousands of pounds with them.
The employee needs to feel safe and supported. The allegation needs to be investigated fairly. The business wants to protect an important relationship. It can feel like a choice between protecting the employee and protecting the business. It doesn’t have to be.
One of the biggest tests of an organisation’s culture is how it responds when doing the right thing carries a commercial cost. Legally, it’s also about to become even more important.
From 30 October 2026, all employers will have a new preventative duty to protect employees from being harassed by third parties. At the same time, the existing duty to take reasonable steps to prevent sexual harassment will be strengthened, requiring employers to take “all reasonable steps”.
What happens between employees is no longer the only concern. Organisations need to think seriously about the behaviour of customers, clients, contractors, suppliers, patients, service users and anyone else their employees encounter through their work.
When commercial value complicates the response
Most organisations will say that they won’t tolerate harassment, and most of them mean well. But that position is relatively easy to maintain when the person responsible has little influence or commercial importance. It becomes harder when they generate significant revenue, control an important contract or have a longstanding relationship with senior leaders. This is when a ‘zero tolerance’ approach is truly tested.
The temptation may be to minimise what happened, deal with it “informally” or move the employee away from the customer without addressing the customer’s behaviour. The organisation may tell itself that it has found a practical solution. The employee may feel that the customer’s value matters more than her dignity. Colleagues will notice too. They may think that speaking up is only safe when the person complained about is commercially expendable.
The consequences rarely remain confined to the complaint. Trust deteriorates, concerns go unreported and stress, absence or attrition can follow. An allegation involving one employee can quickly become a much wider cultural and wellbeing issue.
What changes on 30 October?
Employers have been under a proactive duty to take reasonable steps to prevent sexual harassment since October 2024. That duty already requires them to consider the risk of sexual harassment by third parties.
From 30 October 2026, the Employment Rights Act 2025 will raise the standard from “reasonable steps” to “all reasonable steps”. An employer will need to show that there were no further preventative steps it could reasonably have been expected to take to prevent the sexual harassment.
The Act will also introduce express protection against third-party harassment. An employer will be treated as permitting that harassment where an employee is harassed in the course of their employment and the employer failed to take all reasonable steps to prevent it. That protection extends beyond sexual harassment and can cover harassment related to protected characteristics including race, disability, age, religion or belief, sex and sexual orientation.
Not every rude or upsetting encounter will meet the legal definition of harassment. Nor will employers be expected to exercise the same control over a customer that they can exercise over an employee. But organisations will need to consider what risks could reasonably have been anticipated, what they did to prevent them and how they responded when a concern was raised. Prevention will need to begin well before a complaint arrives.
Let’s revisit our opening scenario
The facts remain the same. An employee has reported inappropriate comments and unwanted touching by a commercially important customer. The allegation hasn’t yet been investigated and the customer has threatened to take his business elsewhere. What happens next will shape both the legal risk and what employees learn about the organisation’s culture.
Scenario #1 – protecting the customer at all costs
The manager questions whether the employee may have misunderstood the situation. He explains that’s “just how he is”, that the customer is naturally tactile and reminds her how important the account is to the business.
The allegation isn’t investigated or escalated. Instead, the employee is removed from the account. She loses commission and access to a high-profile project, while the customer continues working with the organisation as though nothing happened.
From the organisation’s perspective, the immediate problem appears to have been contained. In reality, the employee has experienced a financial and professional disadvantage after raising a serious concern.
Her colleagues see what happens and decide that remaining silent may be the safest option. The organisation hasn’t protected its business, instead it has exchanged an uncomfortable customer conversation for legal risk, damaged employee trust and a much more complex employee relations problem.
Scenario #2 – Supporting the employee, but avoiding the difficult decisions
This time, the manager listens and reassures the employee that the concern will be taken seriously. She isn’t required to meet the customer while matters are considered and doesn’t lose out on commission or professional opportunities.
The organisation speaks to the customer informally. He denies the allegation, says no offence was intended and agrees to be more careful. Keen to preserve the relationship, the organisation accepts that assurance and considers the matter closed.
This response is better. The employee isn’t blamed or financially disadvantaged, and some immediate protection is provided.
But no proper investigation takes place. Witnesses aren’t interviewed, previous concerns aren’t checked and nobody considers whether other employees remain at risk. The response contains the immediate problem without truly understanding or preventing the behaviour.
The employee is left uncertain about whether she was believed or what will happen if the customer behaves similarly again. Good intentions have reduced some of the damage, but they haven’t addressed the underlying risk.
Scenario #3 – protecting the employee and the business
The manager listens without minimising the concern, thanks the employee for raising it and explains what will happen next. She isn’t warned about the commercial importance of the account.
Direct contact with the customer is paused while the allegation is investigated. Temporary arrangements are agreed with the employee and designed to ensure she doesn’t lose commission, responsibility or professional opportunities.
Relevant records are reviewed, witnesses are spoken to and checks are made for previous concerns. The customer is informed of the allegation and given an opportunity to respond. Taking the complaint seriously doesn’t mean predetermining the outcome or remaining passive while facts are established.
The investigation supports the employee’s account. The customer is told clearly that the behaviour was unacceptable and that any repetition will result in the relationship ending. Future meetings are subject to appropriate boundaries.
The organisation also looks beyond the individual complaint. It considers where employees interact with third parties, whether those risks are reflected in its risk assessment and whether managers understand what they’re authorised to do and that they receive the required training. Expectations are made clear to customers and suppliers, reporting routes are reinforced and senior leaders support managers who intervene.
The employee feels heard and protected. The customer has been treated fairly and the business can make an informed decision about the relationship. This is what a commercially responsible response looks like.
The customer isn’t always right
Preparing for the new duty isn’t simply about updating policies and putting up posters before 30 October. It requires organisations to understand where employees interact with third parties, identify the risks those relationships create and empower managers with the confidence and authority to act when concerns are raised.
Not every allegation will require a customer relationship to end. The appropriate response will depend on the nature of the conduct, the evidence, the continuing risk and whether effective safeguards can be introduced. Commercial considerations don’t have to be ignored. But they should influence how carefully a situation is managed, not whether the employee receives protection at all.
Organisations often describe their people as their greatest asset. Third-party harassment tests whether that statement survives contact with commercial reality. Employees will remember who was heard, who was supported and who was expected to carry the consequences when someone crossed the line. The customer may be important, but that doesn’t always mean they’re right.
You might also like:
