The duty is already live. The evidence is the hard part.
Harassment prevention built around how your service actually runs — your visit types, your staffing mix, your risk profile — with training and a dated, version-stamped record sitting on top of it, not standing in for it.
The preventative duty is already in force, and direct liability for third-party harassment is coming. Both carry real exposure — uplifted compensation, and cases decided on whether the steps taken were actually reasonable for a service like yours. We track exactly where the law stands so you don’t have to; the detail is in the programme, not the pitch.
26 OCT 2024 — IN FORCE
Preventative duty. Reasonable steps to prevent sexual harassment of your workers — with tribunal compensation uplifts of up to 25% where the duty is breached.
6 APR 2026 — IN FORCE
Since 6 April 2026, information tending to show sexual harassment can be qualifying whistleblowing subject matter. Statutory protection still depends on the facts, including a reasonable belief that disclosure is in the public interest and use of an eligible route; legal coverage also depends on employment status. Separately, our policy prohibits retaliation against anyone who raises or supports a concern honestly, whether or not it is a protected disclosure.
1 OCT 2026 — SCHEDULED, SUBJECT TO COMMENCEMENT
The employment tribunal claim window doubles from three months to six.
30 OCT 2026 — SCHEDULED
The preventative duty strengthens to all reasonable steps to prevent sexual harassment. A separate third-party harassment provision also takes effect, covering harassment by people such as service users, relatives and visitors where the employer failed to take all reasonable steps to prevent it.
The compliance programme is the product.
What you’re buying is a structured compliance programme — built around your service, not a template with your logo on it. It covers risk assessment across the ways harassment actually reaches a domiciliary worker (service users, family and visitors, colleagues, management, contractors, and online contact), the policy and contract language that carries the commitment into the documents workers and agencies actually sign, the routes a report travels once it’s made, how incidents are logged and escalated, and how the whole system is checked over time so it doesn’t quietly stop working. Every part of it is grounded in your visit types, your staffing mix and your risk profile, not a generic one.
It runs to roughly two dozen linked components, each with a named owner and a standard it has to meet — because a control that only exists as a phrase in a document is the weakest point in a defence. A tribunal asks what the standard was and how it was evidenced, not whether the word appeared somewhere.
Training — the delivery layer
Workers complete specialised training on their phones, written for this sector: lone workers, in clients’ homes, on shift patterns that don’t leave room for a classroom. It’s built around the scenarios they’re actually likely to encounter, and the system distinguishes what a worker selected before feedback from what they confirmed after correction — with delayed recall checks and boosters built into the design, so understanding gets tested again after the fact. Every worker is included: employed, agency, bank, and volunteers.
Each completion is logged as a dated, version-stamped event: who, which version, when, and what they confirmed. That record shows the training step was taken. It is not, by itself, proof that a statutory defence is satisfied — it’s one evidenced part of a much larger programme, which is exactly why the whole system, not the course on its own, is the thing worth getting right.
What this does, and what it can’t.
“All reasonable steps” is a standard, not a checklist. A tribunal assesses it case by case, on the facts. There is no official timetable for regulations defining it in detail, which means no one can hand you a list and call it done — and anyone selling you a finished checklist is selling you something the law doesn’t recognise.
Taking all reasonable steps reduces risk and supports a defence. It does not guarantee that harassment won’t happen, and it does not guarantee that a claim can’t succeed. No programme and no adviser can promise a tribunal outcome. Anyone who tells you otherwise is overstating what’s possible.
And holding a folder is not the same as taking the steps. A structure completed once and filed in a drawer carries little weight — the steps have to be actually carried out, kept current, and recorded. That is the whole reason this is a working relationship and not a document you buy.
The duty stays with you. This provides the structure and the evidence trail to discharge it and to make good practice visible. It doesn’t transfer the duty, and it isn’t legal advice.
Duties you already have, assembled into evidence.
None of this invents a new obligation. The Equality Act’s preventative duty, health and safety law’s lone-worker risk assessment, the Care Act’s safeguarding framework, CQC’s notification requirements — every one is a duty a domiciliary provider already operates under. What’s usually missing isn’t the duty. It’s the evidence that it was met, and a plan for the day it’s tested.
Who this is for
Domiciliary care, specifically — carers working alone in clients’ homes, where the workplace is someone’s living room and the controls an office relies on don’t reach. You already know the shape of the risk: conduct from service users, from family members, from other visitors to the home; lone working as the default rather than the exception; capacity complications that make every incident harder to read; and a workforce that includes agency and bank staff who joined long after the last induction. The usual controls assume a venue: somewhere conduct can be managed because the premises are yours. In domiciliary care the premises are theirs. You cannot ban a service user from their own home — the control you hold is the care arrangement itself, and the structure has to be built around that fact.
There is no CCTV in a private home, so the evidence base is different — contemporaneous visit notes, call-monitoring logs, lone-worker app data, the care-planning audit trail. Generic e-learning wasn’t written for any of that, and the certificate it produces says almost nothing about it. “Harassment awareness, 45 minutes” doesn’t show what a lone carer was actually trained to recognise, or to do, or when the training last changed. The record has to fit the setting it will be read against.
What you get, and what happens after.
The engagement is scoped to the provider — size, staffing mix, what records already exist — and delivered as one programme: the compliance structure built around your service, training rolled out to your workers, and a maintenance playbook that hands the system to you rather than leaving you dependent on us to run it. You come out the other side able to keep the records current yourself.
That handover is documented, not assumed. It sets out how to keep the policy and training current as the law moves — the Government’s scheduled date for the third-party liability change is 30 October 2026, subject to commencement — and what to do when it does. There is no official timetable for regulations defining “all reasonable steps” in detail, so the structure is built to the higher standard now rather than waiting to be told what it means.