Britain's Employment Rights Act is arriving as a sequence of operating deadlines rather than a single legal event. The next important package takes effect on October 30, bringing stronger duties on workplace sexual-harassment prevention and third-party conduct alongside changes to trade-union access, recognition and representative facilities. For employers, the challenge is not merely knowing that the law changed. It is knowing which parts changed now, which remain for 2027, and which workplace process owns the response.
The government has deliberately phased implementation. Measures already introduced in 2026 include changes to statutory sick pay, paternity and parental leave, whistleblowing protection, collective-redundancy awards, tribunal time limits and parts of trade-union law. The Commencement No. 6 Regulations identify a distinct October 30 package. Guaranteed hours, further dismissal reforms, mandatory gender and menopause action plans and other measures remain on later timetables. Treating the entire Act as already operational would be as misleading as treating it as a future concern.
On harassment, the October package raises the preventive standard. Employers will be required to take all reasonable steps to prevent sexual harassment of employees, moving beyond the previous formulation of reasonable steps. It also brings in an obligation not to permit harassment by third parties. That matters most in sectors where customers, patients, passengers, contractors or service users are a routine part of the working environment.
The third-party dimension changes where organizations must look for risk. A policy focused only on employee-to-employee misconduct is incomplete when the foreseeable source of harm can be outside the payroll. Retail, hospitality, healthcare, transport and public-facing services may need to examine customer codes, escalation authority, staffing, security, complaint handling and the commercial pressure that can discourage workers from challenging abusive behavior.
"All reasonable steps" also turns prevention into an evidence question. Training can be relevant, but a training completion rate is not the same as an effective control. An employer may need to show how it identified risk, tailored measures to the workplace, responded to earlier incidents, protected complainants, supervised managers and corrected failures. The government retains power to specify evidence-based steps through later regulations, but the broader duty is not waiting for a checklist to become meaningful.
The trade-union changes create a different operational test. Independent unions gain a statutory route to request access to workplaces, including physical and digital access, within a framework overseen by the Central Arbitration Committee when agreement cannot be reached. Recognition procedures, facilities for representatives and protections connected with industrial action also change. The implementation details include transitional and saving provisions, so organizations with active cases need to know which legal regime applies to which stage.
Digital access deserves particular attention. A workplace is no longer only a building; it can include communication systems, remote channels and the digital spaces through which workers receive assignments or information. Access arrangements therefore intersect with cybersecurity, privacy, operational continuity and the employer's communications rules. Those concerns do not erase the right. They become part of designing a proportionate, documented arrangement.
The common governance problem across the harassment and union measures is distributed responsibility. Customer-facing managers may control the immediate response to third-party behavior. HR may own policy. Legal teams may interpret the statute. Security may control access. IT may administer digital channels. Procurement may set expectations for contractors. If each function assumes another one owns the risk, the organization can have a compliant policy and a failing service.
The answer is not to collapse every issue into a central approval queue. It is to establish clear thresholds: what frontline staff can stop, when a manager must escalate, how a worker records an incident, how a union request is routed, who negotiates access, what evidence is retained and how retaliation is monitored. Those controls should work at the speed of the workplace, not only at the speed of a legal review.
Organizations operating across the United Kingdom also need to distinguish legal compliance from voluntary management standards. ISO 30415 can help structure thinking about inclusion in human-resource practices, but it is not the source of these duties and does not certify compliance with the Employment Rights Act. The statutory text, commencement regulations, official guidance and eventual tribunal decisions govern the legal obligations.
The October package is consequential because it reaches ordinary interactions: a customer's behavior, a representative's access request, a manager's response, a digital channel and the evidence left behind. Britain is turning broad commitments on dignity and worker voice into specific organizational interfaces. The employers best prepared will be those that can show not just what their policy says, but how the workplace acts when the policy is tested.