UK Employer Liability for Third-Party Harassment by Clients, Patients, and Customers

Pre-Flight Check: Why the Old 2013 and 2024 Defences Expired on 30 October 2026

For eleven years after Parliament repealed the old "three-strikes" rule in 2013, UK employers faced almost zero direct tribunal liability when a customer or client harassed staff. On 30 October 2026, direct uncapped tribunal liability returned without a single free pass.

Understand the exact statutory shift before advising a sales VP or store manager. Between October 2024 and October 2026, the Worker Protection (Amendment of Equality Act 2010) Act 2023 required preventive action against sexual harassment—including by third parties—under Section 40A, yet employees still could not bring a standalone direct tribunal claim solely for third-party harassment.

Under the Employment Rights Act 2025 (commencing 30 October 2026), amended Equality Act 2010 s. 40 closes that gap completely:

• Direct First-Incident Liability: An employer must not permit a third party (anyone other than the employer or a fellow employee—clients, customers, patients, service users, agency staff, delivery drivers, or conference guests) to harass an employee in the course of employment. An employer is treated as permitting the harassment if the harassment occurs and the employer failed to take all reasonable steps to prevent the third party from doing so.
• Every Relevant Protected Characteristic Covered: Unlike the Section 40A sexual-harassment preventive duty, Section 40 third-party liability covers harassment under Equality Act s. 26 across sex, race, disability, age, sexual orientation, gender reassignment, and religion or belief (with statutory free-speech carve-outs strictly limited to non-sexual overheard third-party expressions of political, moral, religious, or social opinion not aimed at harassing the worker).
• Double Statutory Exposure Since April & October 2026: Compensation under Equality Act s. 124 (including injury to feelings on the Vento bands plus uncapped financial loss) carries zero service threshold, tribunal filing limits doubled to six months on 1 October 2026, and since 6 April 2026 reporting sexual harassment is an explicit protected whistleblowing disclosure under ERA 1996 s. 43B—meaning sidelining an associate off a lucrative account after she reports a client triggers automatic unfair dismissal and whistleblowing detriment liability too!

Hour 0 to Hour 48: Chronological Triage When the Harasser Pays the Bills

Commercial pressure peaks in the first two hours after an incident at a client dinner, hotel bar, or hospital ward. Execute four non-negotiable containment steps before any revenue holder calls the client informally.

Picture Friday morning at 09:15. A 26-year-old audit senior reports that at Thursday night's closing dinner in Manchester, the client's Finance Director—representing £280,000 in annual recurring fees—put his hand on her lower back, made two explicit remarks about her hotel room, and texted her at midnight. The engagement partner emails HR: "Let's quietly swap her onto the Leeds audit on Monday so we don't blow up the client relationship."

Block that partner's move immediately. Moving the complainant off a career-defining engagement while leaving the harasser untouched penalises the victim—creating direct victimisation liability under Equality Act 2010 s. 27 and whistleblowing detriment under ERA 1996 s. 47B. Run this strict 48-hour sequence across your people operations desk:

1. Hours 0–4 — Immediate Physical & Digital Buffer: Suspend all direct 1:1 contact between the affected employee and the named third party immediately without cutting the employee's billable credit, bonus eligibility, commission, or shift pay. Preserve screenshots, WhatsApp messages, venue CCTV requests, and witness names while memories are fresh.
2. Hours 4–12 — Victim-Led Interim Routing Check: Meet the employee with a trained HR investigator. Ask explicitly what interim arrangement she wants while you escalate with the client: remaining on the account with the client's FD removed from contact, or moving to an equivalent prestige engagement at her own documented request with guaranteed utilisation parity.
3. Hours 12–24 — Pre-Incident Control Audit: Pull your live Section 40A/40 harassment risk register and the client Master Services Agreement (MSA). Check whether pre-engagement behavioral standards were issued, whether chaperone/two-person rules applied to late client hospitality, and whether this third party had any prior informal warning on file.
4. Hours 24–48 — Formal Third-Party Counterparty Intervention: Issue written executive-to-executive notice to the client's CEO/HRD (for B2B) or formal premises ban/service restriction (for B2C retail/hospitality), demanding replacement of the offending client representative or suspending service delivery under your contractual conduct clause.

Sector Control Calibration: B2B Accounts, Retail/Hospitality, and Healthcare

"All reasonable steps" does not demand locking your doors to the public, yet tribunals judge reasonableness against your degree of operational control. Match your preventive architecture to the exact customer relationship.

Both Acas guidance and the EHRC Technical Guidance confirm that tribunals weigh employer size, resources, sector risk profile, and practical leverage over the third party. What passes muster for an unscheduled street walk-in fails completely for a contracted B2B client:

• B2B Professional Services, SaaS & Agencies (High Control): Insert mutual anti-harassment and right-to-suspend/replace clauses into every MSA and Statement of Work; ban 1:1 post-21:00 alcohol-led client entertainment; require a senior partner to attend high-risk pitch dinners; and maintain a central CRM "Client Conduct Flag" so an abusive buyer dropped by Team A is never reassigned blindly to Team B.
• Retail, Hospitality & Leisure Venues (Premises Control): Display visible zero-tolerance signage at entrances, check-in desks, and table QR menus naming statutory harassment consequences; empower duty managers on the floor to refuse service and eject abusive patrons immediately without phoning head office; eliminate lone late-night room-service or closing shifts; and equip solo front-of-house staff with wearable panic/audio-incident triggers.
• Healthcare, Social Care & Domiciliary Visits (Clinical Duty Tension): Where clinical ethics or NHS/CQC duties prevent outright refusal of urgent medical care to a patient with dementia or acute behavioural disturbance, "all reasonable steps" requires pre-visit clinical risk flagging, mandatory two-carer pairing on flagged home visits, rapid shift rotation to prevent cumulative racial or sexual abuse of one nurse, and behavioural contracts or non-urgent discharge protocols for competent abusive patients or visiting relatives.

Copy-Ready B2B Client Escalation Notice & MSA Conduct Clause

Account directors freeze because they lack pre-approved legal language to confront a major buyer. Hand commercial leaders both a standard MSA clause and a ready-to-send counterparty notice.

Embed the contractual hook in every UK client and supplier template now, and send the escalation letter below within 48 hours of a substantiated B2B report:

PART A — STANDARD UK B2B MSA WORKPLACE DIGNITY CLAUSE (POST-30 OCT 2026)
"Mutual Workplace Dignity & Equality Act 2010 Compliance: Each party warrants that its personnel, officers, and guests shall treat the other party's personnel with dignity and shall not engage in any conduct constituting harassment or victimisation under sections 26, 27, 40, or 40A of the Equality Act 2010. Upon written notice of a credible allegation involving a named representative, the notified party shall immediately suspend that individual from all contact with the notifying party's personnel pending investigation and provide an alternative point of contact within 2 business days. Failure to remove or replace an offending representative constitutes a material, irremediable breach entitling the notifying party to suspend services on full fee protection or terminate this Agreement immediately without penalty."

---

PART B — 48-HOUR EXECUTIVE ESCALATION LETTER TO CLIENT COUNTERPARTY
CONFIDENTIAL — FOR THE ATTENTION OF [CLIENT CEO / GENERAL COUNSEL / HR DIRECTOR]
Subject: Urgent Contractual & Statutory Notice — Conduct Incident on [Date] ([Account Name])

Dear [Name],

I am writing to notify you of a serious workplace conduct incident reported following [the project meeting / client dinner] on [Date] involving [Client Representative Name & Title] and a member of our delivery team.

Under sections 40 and 40A of the Equality Act 2010 (as amended by the Employment Rights Act 2025), our firm holds a strict statutory duty to take all reasonable steps to prevent third-party harassment of our employees. Pursuant to Clause [X] of our Master Services Agreement:

1. Effective immediately, all project communications must route through [Senior Partner Name] while this matter is addressed, and [Client Representative Name] may not contact [Affected Employee / our project team] directly via phone, email, or messaging apps.
2. To continue uninterrupted delivery on [Project Name], please confirm in writing by [Time, +48 Hours] the appointment of an alternative authorised client sponsor so [Client Representative Name] has zero ongoing interaction with our staff, alongside your confirmation that relevant venue/digital records are preserved.

We value our commercial partnership and appreciate your prompt executive cooperation in upholding a safe, lawful working environment for both organisations.

Yours sincerely,
[Managing Partner / Chief Operating Officer]

Locking Alignment Across Sales Leadership, Floor Supervisors, and HR

A tribunal will demolish your "all reasonable steps" defence if commission structures punish managers who ban abusive buyers. Align incentives before the next quarter closes.

Train every account lead and shift supervisor via your manager support playbook so commercial targets never override statutory protection.