posted 1st September 2026
From 30th October 2026, Welsh employers are expected to take all reasonable steps to prevent sexual harassment. This obligation extends to third-party harassment at work. However, the third-party provision applies to all forms of harassment covered by the Equality Act, not just sexual harassment.
A harassment policy usually lives in a folder, but harassment rarely does.
It can happen while a receptionist is trying to calm an angry visitor, or a care worker is alone in somebody’s home, on a production line shared with contractors, in a client’s office, in the group chat after a late shift or over drinks at a work event. The person involved may be a colleague. They may also be a customer, supplier, patient, service user, visitor or member of the public.
The current preventative duty has applied since 26th October 2024. It requires Welsh employers to take reasonable steps to prevent sexual harassment, including risks arising from third parties. The changes for October 2026 strengthen the standard and include a specific third-party harassment at work liability provision. However, many of the implementation details remain subject to consultation, with updated guidance from the Government and ACAS due before commencement.
That leaves Welsh employers with useful work to do now, to evaluate third-party harassment at work, without pretending every final detail has been settled.
Each incident reaches beyond the wording of a policy.
Rostering, supervision, customer management, procurement, IT, events, training and management judgement all play a part.
Start at the front door
Think about the most prominent areas where third-party harassment at work may occur. Who may be affected? Reception teams, security staff, salespeople, drivers, field engineers, care workers, hospitality teams and anyone working on a client site who meet people the employer does not manage directly. As you can see, a policy written only around colleague-to-colleague conduct leaves a sizeable gap.
Walk through the points of contact in the business:
- Who deals with customers, patients, service users, visitors, contractors and suppliers?
- Where do people work alone, late, off-site or without a manager nearby?
- Which roles are expected to absorb poor behaviour to preserve a sale, service or relationship?
- Can an employee end an interaction, leave a location or pass a caller to somebody else?
- What happens to the customer or contractor relationship after a report?
A customer notice may be appropriate in one setting. Contract terms, supplier standards, lone-working arrangements, escalation scripts or the right to withdraw service may be more useful elsewhere. The response needs to fit the risk.
Look beyond the office walls
The phrase “at work” can give a false sense of a fixed place and fixed hours. However, work-related conduct can arise during travel, conferences, training, client entertainment, Christmas parties, overnight stays and online conversations.
As you review your third-party harassment at work policies, check the channels people use. An official Microsoft Teams space may be well governed while an unofficial WhatsApp group carries the day-to-day conversation. Remote workers may encounter harassment on video calls or through private messages. Agency workers and contractors may be unsure whose procedure applies or who will listen.
Consequently, the review should record:
- work-related messaging groups and who administers them;
- off-site, lone-working and overnight arrangements;
- regular events where alcohol is available;
- shared workplaces and client premises;
- interfaces between employees, temporary workers, contractors and partner organisations;
- reporting options for people who cannot safely approach their immediate manager.
Third-Party Harassment at Work: Your Response
Policies are tested when somebody says, “Can I have a quiet word?” The first response can decide whether the employee continues, withdraws or tells colleagues that reporting is pointless.
A manager does not need to investigate on the spot. However, they do need to listen, avoid blame, take immediate safety or welfare needs seriously, preserve confidentiality as far as possible and explain what will happen next. They should know who to contact and avoid promising an outcome before consideration of all the facts.
So, how prepared are your managers? Training should include practice alongside any slide deck. Give managers realistic situations involving a valued client, a senior colleague, a customer complaint, an anonymous report and an employee who does not want a formal process. Discuss where the manager’s authority ends and when specialist advice is needed.
Read the records, including the quiet ones
Formal grievances tell only part of the story. Consider exit interviews, sickness patterns, staff surveys, customer complaints, rota changes, requests not to work with somebody and comments made during supervision. Each one can reveal risks surrounding third-party harassment at work that never reached a formal complaint.
Naturally, reviewing those records does not mean treating every concern as proven. It does, however, allow the employer to see whether the same location, shift, client, event or manager appears repeatedly. Actions can then be recorded, assigned and reviewed.
Useful evidence may include:
- a dated risk assessment covering roles, locations and third parties;
- actions agreed, owners and completion dates;
- policy versions and evidence that workers received them;
- manager and worker training records, with refresher dates;
- reporting routes and arrangements for conflicts of interest;
- supplier, customer and contractor controls where relevant;
- anonymised themes from complaints, exits, absence and surveys;
- periodic review notes showing what changed after incidents or feedback.
None of these items works as a paper shield. Together, they help show that the employer examined its own risks and acted on what it found.
Put the policy back into the workplace
Once you have reviewed your policy for third-party harassment at work, read it alongside a real working day. Names, email addresses and job titles should be current. Temporary workers, apprentices, remote workers and people working at client sites should understand how to raise a concern. Managers should know which procedure applies and where to obtain support.
Check that the policy explains:
- harassment, sexual harassment and victimisation in plain language;
- that conduct may involve colleagues or third parties;
- work-related online spaces, travel and social events;
- informal and formal reporting options;
- what happens after a report and how confidentiality is handled;
- protection from retaliation or victimisation;
- possible consequences for employees and the steps available with customers, suppliers or contractors;
- support available to the people involved.
In Wales, best practice is to ensure the policy is available in both Welsh and English. Likewise, additional translation, accessibility and workforce literacy need practical consideration in multilingual, dispersed or operational teams. A beautifully drafted document is of little use if workers cannot find it, understand it or trust the route it describes.
Third-Party Harassment at Work: The October Readiness Record
Before October 30th, a director or senior leader should be able to open one file and see the organisation’s position.
What good preparation looks like
Risk map: Roles, places, times, events, channels and third parties have been considered; higher-risk situations have named controls.
Action log: Gaps have owners and dates. Delays and decisions are documented rather than disappearing into meeting notes.
Policy and communications: Wording is current, accessible and communicated to employees, workers and managers.
Manager practice: Managers have rehearsed receiving and escalating concerns, including customer and contractor scenarios.
Reporting routes: More than one safe route exists, including an alternative where the line manager is involved.
External relationships: Customer, supplier, agency and contractor arrangements support intervention and escalation where the risk calls for it.
Review rhythm: Incidents, themes and controls are reviewed after change, complaints and at sensible intervals.
Third-Party Harassment at Work in Wales: FAQs
Do the October 2026 Employment Rights Act changes apply in Wales?
Yes. The relevant Equality Act employment provisions and the Employment Rights Act changes apply in Wales, as well as England and Scotland. Employers should still check the final commencement position and updated guidance before relying on a publication date.
What counts as a third party?
The Employment Rights Act wording describes a third party as someone other than the employer or one of its employees. In everyday workplaces this may include a customer, client, patient, service user, supplier, contractor, visitor or member of the public.
Is an updated policy enough?
No. Current EHRC guidance says employers should consider the risks of sexual harassment and the steps available to reduce them. The October 2026 changes require all forms of third-party harassment at work in Wales to be reviewed. Additionally, training, reporting, manager response and controls for the organisation’s particular working environment all need attention.
What does “all reasonable steps” mean?
The assessment of third-party harassment at work in Wales depends on the circumstances. Current EHRC technical guidance explains that all reasonable steps mean there are no further steps the employer could reasonably have been expected to take. The 2025 Act also allows regulations to specify steps, including risk assessments, plans or policies, reporting and complaint handling. Final guidance should be checked as it is published.
Should previous complaints be reopened?
Not automatically. Previous complaints, informal concerns and recurring themes should inform the risk assessment. Any decision to revisit an individual matter regarding third-party harassment at work needs careful handling, confidentiality and appropriate HR or legal advice.
Third-Party Harassment at Work: A Practical Review with Thrive HR
Thrive HR can carry out a fixed-scope harassment-prevention readiness review for Welsh employers. The work can cover the risk assessment, policy, reporting routes, manager response, third-party controls and a prioritised action record for the senior team.
The review is designed around the workplace your organisation runs: its people, customers, sites, shifts, digital channels and management capacity.
To arrange a confidential conversation, contact Thrive HR Consultancy Services.
Editorial and legal note
This 'Third-Party Harassment at Work in Wales: A Practical Guide' article reflects official information available on 12 August 2026. It is general HR information, not legal advice. Implementation details and guidance may change; employers should check the final legislation, commencement provisions and current Acas and E
A Vester Group Company
