All Reasonable Steps: Preventing Sexual and Third-Party Harassment as the Legal Duty Shifts From Response to Prevention

[00:00:00] For the last 40 years, the corporate world has operated under a very strange, almost backward set of rules. Oh, absolutely backward. Right. I mean, companies were essentially rewarded for what they did after the damage was already done. Yeah, totally reactive. Exactly. Like, if a company had a policy written in a handbook somewhere, and if they investigated a complaint after someone was harmed, and eventually disciplined the bad actor, the legal system basically patted them on the back. They treated them like a perfectly responsible employer.

[00:00:29] Which is just wild. But, welcome to the Deep Dive. Today is Monday, October 12th, 2026, and we are looking at a fundamental shift in workplace law and culture that is quite literally just weeks away. Just a few weeks, yeah. So, if you work for a living, manage a team, or frankly, even if you just shop at a local store or visit a doctor, what we are exploring today is going to change the very fabric of your daily interactions. It really is going to touch everyone.

[00:00:57] It is. And we are drawing our insights today entirely from a fascinating, just eye-opening article in the Human Capital Leadership Review by Dr. Jonathan H. Westover. That's a brilliant piece of research. Right. So, our mission today is to unpack this massive paradigm shift going into effect on October 30th, 2026. Under the UK Employment Rights Act 2025, that reactive after-the-fact model we were just talking about, it's been completely flipped upside down. Completely inverted, yes.

[00:01:26] The burden is officially shifting from response to prevention. Okay, let's unpack this. What exactly is this new legal standard that has organizations globally scrambling to adapt right now? Well, it represents a profound change in the underlying philosophy of employment law. Up until this point, the legal architecture was essentially designed as a safety net. Right. To catch people who fall. Exactly. To catch people only after they had already fallen.

[00:01:52] But this new standard, which formally takes effect on October 30th, mandates a proactive approach. Meaning they can't just wait around for a complaint anymore. Exactly. Employers must now take all reasonable steps to prevent sexual harassment from happening in the first place. This is an anticipatory duty. Anticipatory, right. Yeah. An organization has to actively foresee where the harm might happen and actually dismantle those conditions.

[00:02:18] And the truly revolutionary component of this legislation is its scope. It crucially includes harassment by third parties. Wait. Third parties. So, not just coworkers. Right. Not just internal staff. We are talking about customers, clients, patients, outside contractors, and even just general members of the public. Wow. Yeah. The employer is now legally liable if they fail to take all reasonable steps to prevent those external individuals from harassing their employees.

[00:02:47] You know, whenever I think about that old 40-year model we were leaving behind, I keep coming back to this analogy. It is as if we designed a municipal safety system that treats every single company like a local fire department. I like that analogy. Yeah. And for decades, we have been praising the fire chief for showing up with the hoses, putting out the blaze, and, you know, filing the correct paperwork afterward. Doing all the right administrative steps. Exactly.

[00:03:12] Meanwhile, we completely ignored the fact that the very same fire chief was happily storing open, leaking barrels of gasoline in the basement. Right. Exactly. We rewarded the dramatic reaction to the fire, but we completely ignored the hazardous conditions that made the fire inevitable in the first place. That is an incredibly sharp way to conceptualize the flaw in the old system. The legal framework rewarded the cleanup crew while turning a total blind eye to the hazard creation. Right.

[00:03:42] And to really understand the weight of this, you have to look at the global landscape because this shift toward prevention, it isn't happening in a vacuum. We are seeing international standards rapidly diverging. Which has to be a headache for big companies. Oh, it is a highly complex patchwork for multinational organizations right now. Australia, for example, they've moved very early on this philosophy. Oh, really? When did they do that? Back in December 2022, they inserted a positive duty into their Sex Discrimination Act.

[00:04:11] And then a year later, they handed their Human Rights Commission full enforcement powers to investigate and actually hold companies accountable. Wow. So they've been ahead of the curve. They have. And internationally, you also have the International Labor Organization's Convention 190. That set a global benchmark for eliminating violence and harassment in the world of work. Okay. And that convention now has around 50 ratifications globally. That sounds like a lot of momentum.

[00:04:38] But, you know, the whole world isn't moving in lockstep, right? The global regulatory landscape seems pretty fractured depending on where you look. Like, what about the U.S.? The direction of travel is certainly not uniform across all borders. That's very true. In the United States, for instance, we've observed a very different regulatory trajectory in recent years. How so? Well, the U.S. Equal Employment Opportunity Commission, or EEOC, they issued comprehensive workplace harassment guidance in April 2024. Okay.

[00:05:06] Subsequently, parts of that guidance were vacated by a federal court in 2025. And following those legal challenges, the EEOC voted in January 2026 to rescind that guidance entirely. Got it. It is important to state, however, impartially, that Title VII's underlying prohibition on workplace harassment remains completely untouched by those regulatory shifts. But, if we connect this to the bigger picture, for multinational leaders, this divergence is a logistical and cultural nightmare.

[00:05:35] I can imagine. The legal floor of obligation now differs sharply depending on which country a specific office is located in. Yet, the human harm and the psychological conditions that allow that harm to occur, they do not change simply because an employee crossed a geographical border. Right. I mean, you simply can't tell your marketing team in London that they have a fundamentally different right to physical and psychological safety than your marketing team in Chicago. Exactly. It doesn't work. It creates an untenable double standard for any unified corporate culture.

[00:06:05] So, now that we understand the rules of the game are shifting rapidly toward prevention, we really need to look at the data. The data is crucial here. We have to understand why this reactive fire department model failed so spectacularly across the board. And, as we go through these numbers, I want you, the listener, to really think about the dynamics in your own workplace because the statistics are staggering. They really are sobering. Let's start with data from the U.K. Government Equality's Office in 2020.

[00:06:33] They found that 29% of workers had experienced harassment in the previous 12 months, but only 15% of those individuals formally reported it. And that gap, the gap between experience and reporting, is the most telling metric we have. And we see this mirrored internationally with even starker contrasts. Like where? Well, the U.S. EEOC's task force reviewed decades of comprehensive survey research.

[00:06:57] They estimated that up to 85% of women experience harassment at work, depending heavily on how the survey questions are actually phrased. 85%? 85%. That is massive. It is. But here is the kicker. Roughly 70% of those people never speak to a supervisor, a manager, or a union representative about what happened. Nine in 10 take no formal action whatsoever. Wow. The silence across the global workforce is absolutely deafening.

[00:07:27] The scale of that silence is terrifying. And then you factor in the third-party element we mentioned earlier, which completely changes the narrative of who the perpetrator is. Right. The Trades Union Congress in 2023 reported that 58% of working women experienced harassment. But the critical piece of their finding was that about two in five of those recent incidents were perpetrated by a third party. Which means not a co-worker. Right. Exactly. Meaning a customer, a client, or a patient.

[00:07:56] Which totally shatters the illusion that harassment is solely an internal peer-to-peer issue that can be solved just by screening hires better. The threat is constantly walking through the front door. Exactly how vulnerable some of these sectors are, well, it becomes alarming when you drill down. Take a 2023 study by Begany and colleagues looking at the UK surgical workforce. Oh, this study is shocking. It really is. They found that 63.3% of women in surgery had been targets of sexual harassment by colleagues.

[00:08:27] And more disturbing, 29.9%, so nearly a third, have been sexually assaulted by a colleague. A third? We are talking about a hospital environment. The very place dedicated entirely to saving human lives is hemorrhaging critical talent and compromising basic safety because of this behavior. And the implications of that surgical data go far beyond employment law. I mean, a surgical theater is a high-stress, deeply hierarchical environment. Very hierarchical, yeah.

[00:08:56] If a resident or a nurse is being harassed by an attending surgeon, speaking up could effectively end their medical career. So a third of the female surgical workforce is operating under conditions of active trauma. Which is terrifying for patient care, too. Exactly. That directly impacts cognitive load, decision-making, and ultimately patient outcomes. Right. So what is the root cause?

[00:09:18] Well, when we look for the root cause driving all of these statistics, from retail to high-level surgery, the academic research is incredibly consistent. What do they point to? Relying on comprehensive studies by the National Academies of Sciences, Engineering, and Medicine in 2018, as well as a massive meta-analysis by Willness, Steele, and Lee in 2007, which covered nearly 70,000 respondents, we find one dominant factor. Okay. What is it?

[00:09:44] The single most potent predictor of harassment in any workplace is not the presence of a few isolated bad apples. It is perceived organizational tolerance. Perceived organizational tolerance. Yes. It is the workforce's collective, unspoken belief about what leadership will actually let high performers get away with. So it's less about the literal rulebook sitting on an HR desk somewhere, and entirely about the unwritten social contract of the office. Precisely.

[00:10:13] If the top-billing salesperson is known for making inappropriate comments, but management just looks the other way because he brings in a massive amount of revenue, everyone else in that office learns immediately that the behavior is actually tolerated. The handbook becomes totally irrelevant in that scenario. But this brings up a crucial question regarding the outside threats. Why is third-party harassment so rampant, specifically in these customer-facing or patient-facing roles? It comes down to a very specific power dynamic.

[00:10:41] And we can look to research by Getman and Gelfand in 2007 to understand the mechanics of it. They demonstrated that customer harassment is driven heavily by client power and the commercial dependency of the business. It is fueled by that age-old, highly toxic commercial norm that the customer is always right. Right. When an employee is reliant on a client for a massive corporate contract or a waitress is reliant on a tip to pay her rent, the power disparity is immense. It's a trap, basically.

[00:11:10] Exactly. Take the healthcare sector, which you mentioned earlier. NHS England reported in 2023 that staff faced more than double the amount of unwanted sexual behavior from patients and the public compared to what they faced from their own colleagues. Double? That is crazy. Third-party harassment thrives because the employer has traditionally had less direct disciplinary control over the perpetrator, combined with a deep-seated cultural reluctance to ever turn away revenue or upset a patron. Okay.

[00:11:40] Here's where it gets really interesting. If perceived tolerance is the actual disease, and third-party harassment is this massive commercially driven blind spot we've been ignoring for decades, how do organizations actually cure this? That is the big question. Right. How do they meet this daunting new, all-reasonable steps standard the law is demanding? The article outlines a comprehensive evidence-based approach to dismantling these risks.

[00:12:06] The first major shift requires companies to completely overhaul how they assess risk, explicitly bringing third parties into the equation. Right. Because under the new legal framework, treating a risk assessment as a generic HR checklist that someone fills out once a year is a recipe for tremendous legal liability. You have to anticipate where the power imbalances are the most extreme. Like where? Well, consider the horrific failure of the President's Club charity dinner in London in 2018. Oh, I remember that.

[00:12:34] The organizers hired hostesses and explicitly instructed them to wear revealing outfits, and then intentionally grouped them based on the preferences of the wealthy clients they were serving. Just awful. These women faced rampant groping and severe harassment from the guests. The organizers had completely failed, or rather actively refused, to assess and mitigate the obvious, foreseeable risks created by their clients, the alcohol, and the environment. And what happened to the charity?

[00:13:00] The resulting fallout was so severe that the entire charity collapsed within days of the investigative report being published. It is wild to think they intentionally grouped young women by client preference. It makes you wonder how many subtle versions of that exist in everyday hospitality. Oh, everywhere. Like a restaurant manager assigning a specific waitress to a regular customer who is known for being handsy but leaves massive tips. They were essentially engineering a specialized environment for harassment. Precisely. They built the hazard.

[00:13:30] But, you know, contrast that catastrophic lack of foresight with what happened to McDonald's UK. Okay, what happened there? They faced a wave of allegations and received formal warnings from the Equality and Human Rights Commission in 2025. The regulator made it explicitly clear that every single franchisee, not just the corporate entity, is directly liable for complying with the preventative duty. So the local owners were on the hook? Yes. McDonald's was forced to implement strict, location-by-location risk assessments.

[00:14:00] They had to prove that they were assessing exposure based on specific roles, different shifts, and varying customer demographics. Because the risks change? Exactly. The threats facing a teenager working a late-night drive-thru window on a Saturday are fundamentally different from the risks during a suburban Tuesday morning breakfast shift. That makes total sense. McDonald's having to implement these hyper-local assessments is a huge step.

[00:14:24] But, you know, identifying the risk on a piece of paper is completely useless if the people at the very top of the organization don't actually care. That is the second pillar, leadership accountability. Exactly. This brings up the critical question of who actually bears the consequence when these assessments are ignored. The contrast in leadership accountability between Rio Tiento and the Confederation of British Industry, or the CBI, is just staggering. It's a perfect case study.

[00:14:53] You have Rio Tiento, a global mining giant, who published a brutal, unflinching external review, revealing that 28.2% of their female employees had been harassed. Most companies would try to bury that number. Absolutely hide it. But their CEO made a public apology, accepted all the recommendations, and set a highly visible public baseline to fix it. They absorbed the reputational hit to take accountability. Which is rare. Very.

[00:15:21] On the flip side, you have the CBI in 2023. They faced severe rape and misconduct allegations against senior figures, and they tried to handle it quietly, internally. They tried to protect the prestige of the brand instead of holding top leaders accountable for horrific behavior. And it backfired spectacularly. Completely. The organization essentially collapsed. They lost massive foundational members like Aviva and John Lewis overnight because the trust was entirely broken.

[00:15:50] That contrast is the defining lesson for modern executives. What's fascinating here is that corporate messages about zero tolerance actually do more damage to employee trust if the workforce subsequently watches senior, high-performing people escape consequences. Because it just proves it's all talk. Exactly. The CBI operated under the antiquated belief that severe harassment was merely an internal PR issue to be contained and managed.

[00:16:16] They learned the hard way that it is a strategic, existential threat to the survival of the entity. Right. Accountability systems must be hyper-visible, relentlessly consistent, and applied to the absolute highest performers, regardless of their seniority or the revenue they bring in. And when leadership proves they will protect top performers over the safety of the staff, you get a massive chilling effect on the workforce. If people don't trust the system to protect them, they simply won't use it. Which brings us to pillar three. Trusted reporting. Right.

[00:16:46] You mentioned earlier how 70% of people never speak up. We've seen this breakdown of trust fail spectacularly in the very institutions that are tasked with public safety. We certainly have. And the institutional damage is profound. Look at the Metropolitan Police Service. The Independent Casey Report uncovered a deep, systemic culture of denial where female officers faced routine misogyny. Wow. Internal complaints were frequently dismissed, minimized, or worse, the complainants themselves faced retaliatory counter-allegations.

[00:17:16] Retaliation is the ultimate silencer. It is. And we saw a similar breakdown in the London Fire Brigade. The Independent Review conducted by Nazir Afsal found that women were actively afraid to complain about sexist abuse. Why were they afraid? They feared it would make their daily working conditions worse, or chillingly, that their colleagues wouldn't protect them in actively dangerous, life-threatening fire situations. That is horrifying.

[00:17:41] When reporting channels fail this fundamentally, the organization loses its primary source of crucial safety information. That is why the new UK rules are taking such aggressive steps. What are they doing? They actually void contractual confidentiality clauses, commonly known as NDAs, to the extent those agreements prevent workers from disclosing harassment. You can no longer legally buy a victim's silence to protect the brand's reputation. That is huge. It is.

[00:18:07] Establishing trusted reporting means offering multiple avenues for disclosure, ensuring genuinely independent investigations, and maintaining fierce, proactive anti-retaliation monitoring. Okay. I have to push back a little on the corporate response to all of this, specifically when it comes to the fourth pillar, training. Okay. Let's hear it. Because whenever a company gets in trouble, their immediate response is to roll out new HR modules.

[00:18:30] And when I hear behavioral training, I immediately picture an entire office clicking through dreary legalistic slides on their computers, just trying to get to the quiz at the end while eating a turkey sandwich at the desk. Yes. The classic compliance module. Right. Does that kind of rote compliance even count as prevention under this new law? It is a vital question. And the empirical data gives us a very clear, very surprising answer. No. It absolutely does not count as prevention.

[00:18:59] And in many cases, it actually makes the culture significantly worse. Wait. Really? Worse? Research by Dobbin and Kalev, published in the Harvard Business Review, looked at data spanning over 800 U.S. companies. They found that conventional forbidden behavior training, the exact kind of dreary legalistic module you just described, actually backfires. How so? In the companies they studied, rolling out that type of training was followed by a 5% drop in the representation of women in management positions. Wait.

[00:19:29] It actually causes a measurable drop in female leadership? That's incredible. The tool designed to protect women is actively driving them out of leadership roles. It is a devastating unintended consequence. Because those modules focus far too heavily on avoiding legal liability for the company. They often rely on crude stereotypes. And in some psychological contexts, they can actually make participants more likely to blame victims or view female colleagues as legal liabilities rather than peers.

[00:19:57] So if the standard corporate module is actively harmful, what actually changes behavior? What consistently works is bystander intervention training and manager response training. You don't just teach employees to memorize the law. You teach them concrete, actionable skills. Like what? You teach a workforce how to safely intervene, how to distract a harasser, or how to delegate the situation when they see something inappropriate happening in real time. Empowering them to act. Exactly.

[00:20:26] And equally important, you teach frontline managers how to properly receive a sensitive disclosure without minimizing it, and how to actively shield that person from retaliation. Do we have an example of this working? A benchmark example of this is Ford's experience at its Chicago plants. Back in 2017, they agreed to a $10.1 million settlement with the EEOC over widespread harassment. That's a massive settlement. It was.

[00:20:52] And a foundational part of that non-monetary settlement was implementing regular, externally monitored training that focused strictly on actual workplace behavior and manager response protocols, rather than just forcing people to recite the company policy. So we've overhauled the assessments, forced leaders to take the hit, protected the whistleblowers, and trained the bystanders to actually speak up. That brings us to the fifth and final pillar, measurement. Right.

[00:21:20] Because if you're a CEO sitting in a boardroom looking at a dashboard, how do you actually know any of this is working? Because, I mean, an empty HR inbox doesn't necessarily mean the problem is gone. It just might mean the silence is back. This raises an important question. What does a drop in formal complaints actually indicate to leadership? Many executives mistakenly celebrate a sudden drop in reporting, assuming they have successfully eradicated the problem. But they haven't.

[00:21:45] But more often than not, a silent reporting line just means people have given up on the system. True measurement requires digging much deeper into the workforce psyche. How do you do that? You need anonymous, highly specific behavioral climate surveys that ask employees about distinct interactions. Not just asking broadly if they feel they were harassed, which is a loaded legal term many won't use. That makes sense. You have to ask about specific behaviors. Exactly. And crucially, you need independent, unannounced audits.

[00:22:15] When Activision Blizzard reached a massive $18 million consent decree with the EEOC over severe harassment allegations, the court mandate specifically required unannounced audits and a third-party consultant to continuously review their compliance. You can't just grade your own homework. Exactly. You cannot rely on a system self-reporting its own success. You have to actively and aggressively test the infrastructure. So what does this all mean?

[00:22:41] We are looking at a complete inversion of how the business world conceptualizes liability and safety. For you, the listener, whether you manage a global team of thousands or you are clocking in for a shift at a local cafe, the ultimate takeaway is a massive paradigm shift in what you are owed by your employer. The defining realization here is that workplace harassment is no longer being treated as just an interpersonal HR issue.

[00:23:06] It has legally, practically, and financially become an occupational health and safety hazard. Right up there with physical dangers. It belongs firmly on the corporate risk register right next to physical safety protocols, toxic chemical exposure, or structural integrity. And the macroeconomic costs of failing to grasp this is immense. I bet. Deloitte Access Economics conducted an analysis estimating that workplace sexual harassment cost the Australian economy roughly 2.6 billion Australian dollars

[00:23:35] in lost productivity and other financial costs in a single year. In a single year. Yes. With employers bearing about 70% of that financial burden through turnover, recruitment, and absenteeism, every single talented person who quits because they can no longer tolerate a hostile environment represents a massive operational cost. That's a huge financial drain.

[00:23:56] For global companies, navigating this diverging international landscape means the only logical, legally defensible move is to set a global minimum standard based on the strictest jurisdictions, which right now are the UK and Australia. And apply that rigorous standard everywhere. You cannot selectively protect your workforce based on postal codes. You really can't. The cost of doing nothing has finally eclipsed the cost of changing the culture. And as we wrap up this deep dive, I want to leave you with a final thought to mull over,

[00:24:26] especially regarding this massive new liability for third-party harassment. It's going to change everything. We spent a lot of time today talking about the legal structures and corporate risk registers. But think about what this means for our daily public culture. If third-party harassment is now a strict legal liability for businesses, meaning a company can literally be sued if they do not actively protect their staff from us, the general public,

[00:24:52] does this mark the official permanent death of the age-old business mantra, the customer is always right? That is the million-dollar question. Right. And if companies are legally forced to prioritize the psychological and physical safety of their employees over the satisfaction of an abusive customer, how is that going to fundamentally change the way we all experience shopping, dining, and healthcare in the years to come? It is a brave, demanding new world out there. Thank you so much for joining us on this deep dive.

[00:25:21] Stay curious, and we'll see you next time.