Worker Protection Act: All Reasonable Steps and the End of Tick-Box Training

Somewhere today, someone will summon the courage to tell their manager that a colleague — or a customer — has been sexually harassing them. It will be one of the hardest things they have ever done. And the person they tell will not be ready. Not because they don't care. Because they have never practised this moment.

That is the human cost of a system that confuses awareness with competence. And in October 2026, it becomes a legal one too.

When the Employment Rights Act 2025 amends section 40A of the Equality Act 2010, "reasonable steps" becomes "all reasonable steps." That single word — all — doesn't raise the bar. It reveals that most organisations were never clearing it. But the real indictment is not legal. It is that for decades, the people who needed someone ready on the other side of that conversation have been met, instead, by someone who watched a video nine months ago.

Consider Sarah. She's a regional manager at a mid-sized hospitality chain — 4,200 employees, sixty-three sites, a Head of Compliance who reports to the board twice a year. Sarah completed her harassment awareness e-learning module in January. Forty-five minutes. Multiple choice. She scored 88%. The LMS recorded her completion, and the compliance team added her name to the spreadsheet that proves the organisation has trained its managers.

In March, a member of her team — a twenty-three-year-old server called Priya — tells Sarah that a regular customer has been making sexual comments for weeks. The comments have escalated. Priya hasn't slept properly in days. She has rehearsed this conversation over and over in her head, terrified of being seen as difficult, equally terrified of going back to that section of the restaurant. It has taken her three weeks to say something.

Sarah freezes. Not because she doesn't care — she does. Not because she doesn't know the policy exists — she completed the module. She freezes because she has never done this before. She has never sat across from someone who is visibly scared and had to find the right words, in the right tone, at the right pace. She has never practised the moment that matters.

She tells Priya she'll "look into it." She means it kindly. Priya hears it as dismissal — as confirmation of every fear that kept her silent for three weeks. She leaves the conversation feeling smaller than when she walked in. Three weeks later, Priya resigns. Four months after that, the tribunal claim arrives.

When the organisation's lawyers prepare their defence, they reach for the evidence. What do they have? A completion certificate showing Sarah watched a video and answered some questions. Nine months ago.

Under the current law, that evidence is already weak. Under "all reasonable steps," it is no defence at all.

The alibi that stopped working

For two decades, UK employers have treated compliance e-learning as both the intervention and the evidence. The module is the preparation. The completion certificate is the proof. This conflation has survived because nobody seriously tested it — not the regulator, not the tribunals, not the organisations themselves.

That era is ending, and it isn't ending quietly.

Sex discrimination tribunal claims have tripled — from 457 to 1,375 — in the twelve months since the initial preventative duty took effect in October 2024. The EHRC has entered legally binding enforcement agreements with McDonald's, Lidl, and IKEA, all before a single tribunal has applied the new 25% compensation uplift. McDonald's alone receives an average of two sexual harassment complaints per week, according to its own CEO. Over 700 tribunal claims have been filed against the company through Leigh Day.

The enforcement machinery is not warming up. It is already running.

And the question it asks is not "did your people complete the module?" It is "can your people handle the moment?"

Those are fundamentally different questions. The first can be answered with a spreadsheet. The second cannot.

What "all" actually demands

The shift from "reasonable steps" to "all reasonable steps" is less about legal semantics and more about what it forces organisations to confront. Under the current standard, employers must demonstrate proportionate preventative action. Under the new standard, they must show there are genuinely no further steps they could reasonably have taken. Linklaters has described this as "a notoriously high bar." Clyde & Co has raised concerns it could amount to "de facto strict liability."

The EHRC's eight-step employer guide, published alongside updated technical guidance in September 2024, makes the practical expectation explicit. Training, it states, must go "beyond tick-box e-learning." It must be scenario-based, cover all three types of harassment, include bystander intervention and power dynamics, and be refreshed at regular intervals. Managers and senior employees require bespoke, enhanced sessions. Training records — attendance, content, dates — constitute essential compliance evidence.

Read that carefully. The regulator is not asking whether your people watched a video. It is asking whether your managers can navigate the specific, uncomfortable, pressurised conversation that determines whether a person is protected or abandoned.

The tribunal in Hunter v Lidl Great Britain (2023) found a "culture of harassment" in an Oxfordshire branch. Managers were unaware of anti-harassment policies. No risk assessments had been conducted. The complaints system was entirely reactive. The award was £50,885 — modest by current standards, but the reputational exposure was the real cost. Lidl entered a Section 23 agreement in August 2025, committing to staff surveys, complaint monitoring, diversity consultations, and continuous risk assessment.

In Allay (UK) Ltd v Gehlen (2021), the Employment Appeal Tribunal established that "stale" or "brief" training was insufficient for a reasonable steps defence. If that was the standard under the old wording, consider what "all reasonable steps" will require.

The gap nobody measures

Here is the uncomfortable truth the compliance industry has been reluctant to name: most organisations have no idea whether the people in their workforce — the ones who will be sat across from someone frightened, shaking, ashamed — are actually capable of showing up for that person.

They know how many people completed the module. They know the average quiz score. They know the percentage of the workforce that is "up to date." These metrics are comforting. They are also meaningless — not just as legal evidence, but as any kind of assurance that the person making a disclosure will be met with competence and care.

They do not tell you whether Sarah — confronted by a frightened twenty-three-year-old disclosing harassment by a customer — would respond with competence and care, or freeze.

This is the gap. Not a knowledge gap — an evidence gap. The organisation has evidence of awareness. It has no evidence of competence. And when the tribunal, the EHRC, or the board asks the question that actually matters — "can your people do this?" — the honest answer, for most organisations, is: we don't know.

The compliance function has been presenting completion data as proof of readiness, and the board has been accepting it, because nobody had a better alternative. Culture surveys measure what people say they would do. Annual refresher modules measure what people clicked through. Neither measures what people actually do under pressure, in the moment, when it counts.

Consider the psychology of that moment. Priya is sitting in front of Sarah. She is visibly upset. She is minimising what happened because she is afraid of overreacting. Sarah must simultaneously make Priya feel heard, ask the right questions without leading or dismissing, explain the reporting options without making Priya feel she's lost control, and document the conversation accurately. She must do this while managing her own anxiety — the fear of saying the wrong thing, of making it worse, of the legal exposure she vaguely remembers from a module she completed nine months ago.

No multiple-choice quiz on earth prepares someone for that. And no completion certificate proves they could do it.

The retention problem nobody discusses

Even if the e-learning content were perfect — and most of it is competently designed — the delivery mechanism undermines it. The forgetting curve is not a theory. It is a measured, replicated reality: people forget approximately 75% of passively consumed content within six days. A module completed in January is neurologically irrelevant by February.

Active practice — where the learner must perform under pressure, make decisions in real time, and receive immediate feedback — raises retention to approximately 90%. Not because the content is better, but because the neural pathways are different. Doing something and watching something activate fundamentally different cognitive processes.

This is not a marginal improvement. It is the difference between evidence that survives a tribunal and evidence that doesn't.

A completion certificate dated nine months before the incident tells a tribunal one thing: the organisation prioritised administrative compliance over genuine readiness. Under "all reasonable steps," that is not a defence. It is an admission.

The third-party problem e-learning cannot solve

October 2026 introduces a second shift that compounds the first. Employers become liable for harassment by third parties — customers, clients, contractors, members of the public — where the employer failed to take all reasonable steps to prevent it. No prior-incident requirement. No knowledge threshold. The liability is immediate.

For customer-facing industries, this changes everything. Unite's 2018 survey found nine in ten hospitality workers had experienced sexual harassment. Women who work for tips are twice as likely to experience it. The British Retail Consortium reports that violence and abuse against shop workers has risen 50% in a single year — 1,300 incidents daily.

You cannot e-learn your way out of this. A video explaining that customers sometimes behave inappropriately does not prepare a twenty-year-old barista — already anxious, already unsure of her authority — to handle the moment a customer crosses the line while her colleagues watch and her manager is on break. A module on de-escalation techniques does not build the muscle memory needed to intervene calmly and effectively when someone's dignity is on the line.

These are performance skills, not knowledge tasks. They require rehearsal under realistic pressure. They require practice — repeated, uncomfortable, imperfect practice — until the right response becomes instinctive rather than theoretical.

What evidence actually looks like

The EHRC's guidance is clear that compliance is not a one-off exercise. It is an ongoing, anticipatory obligation. "All reasonable steps" demands not just that the organisation tried, but that it continuously verified whether its efforts were working.

That means the question is no longer "did we provide the content?" It is "can we prove, with timestamped, auditable evidence, that our people demonstrated competence in the specific scenarios that carry risk?" Not for the audit trail's sake — for the sake of the next person who walks into their manager's office, heart pounding, hoping to be heard.

The difference is the difference between a completion rate and a competence rate. Between "92% of managers completed the module" and "87% of managers successfully navigated a third-party harassment disclosure scenario under pressure, on this date, and met our conduct standards."

One of those sentences protects the organisation. The other is a comfort blanket.

When the EHRC writes to your board — as it wrote to every McDonald's franchisee — it will not ask for your LMS dashboard. It will ask what you did, whether it worked, and how you know. When the tribunal examines your reasonable steps defence, it will not be impressed by volume. It will be interested in evidence that your managers could do the thing they needed to do, at the moment they needed to do it.

The question for October 2026

The organisations that will be most exposed are not the ones that did nothing. They are the ones that did something — the standard thing, the accepted thing, the thing every employment lawyer has recommended for a decade — and assumed it was enough.

E-learning is not the enemy. Content delivery has a role. Awareness matters. Policy communication is necessary. But necessary and sufficient are not the same word, and October 2026 is the moment the legal framework finally distinguishes between them.

Priya deserves better than a manager who completed a module. She deserves someone who has done this before — who has practised the words, sat with the discomfort, learned where their instincts fail them, and come back to try again. Someone who, when Priya finally finds the courage to speak, doesn't make her regret it. Not perfect. Ready.

The EHRC has told organisations what "all reasonable steps" looks like. Tribunals have told organisations what insufficient preparation costs. The enforcement agreements, the tripling claims, the 25% uplift mechanism — the direction is unmistakable.

And yet, somewhere today, in an organisation that considers itself compliant, a Head of Compliance is presenting a dashboard of completion rates to a board that has no idea what those numbers actually mean.

The question is not whether your people completed the training.

The question is whether you would bet your defence on it.

Real Talk Studio builds AI-powered conversation simulations that test whether your people can handle high-stakes compliance scenarios under pressure — not whether they watched the video. Timestamped transcripts. Behavioural scoring. Audit-ready evidence of competence. Because the person on the other side of that conversation deserves someone who's ready. Find out more at realtalkstudio.com.