A customer harassed your server. Which duty already binds the restaurant, and which is only announced

The Equality and Human Rights Commission has published a version of that scene — a worker harassed by a customer, a manager who serves the customer himself, no further action taken. Its worked example concludes:

Two clocks run through this subject and are easily welded together: one duty has bound restaurants since October 2024, the wider one has not commenced.

Section 40A(1) of the Equality Act 2010:

The statute's word is "employees"; EHRC's is "workers"; and section 83(2) defines employment for this Part to include "employment under a contract of employment, a contract of apprenticeship or a contract personally to do work". Which arrangements fall inside is not settled here.

No commencement instrument exists: the amending Act commenced itself, section 5(3) of the Worker Protection (Amendment of Equality Act 2010) Act 2023 bringing sections 1 to 4 into force on 26 October 2024. Extent comes from section 5(1), "This Act extends to England and Wales and Scotland.", and section 40A is marked E+W+S; Northern Ireland, where equality law is devolved, is outside it.

Two boundaries are load-bearing, and both get quoted with the wrong half missing. First, it already reaches customers, without handing the worker a claim of her own. EHRC's technical guidance, last updated 26 September 2024, at paragraph 3.22:

Second, the conduct covered. Paragraph 3.21:

A customer who racially abuses a chef sits outside the preventative duty; a customer who gropes a server sits inside it. EHRC's employer checklist and action plan, published 12 November 2024, addresses the sector directly: hospitality businesses are subject to the duty, which places a positive legal obligation on them.

That gap is not new. Section 40(2) to (4), the former three-strikes third-party liability, was omitted from the Equality Act 2010 with effect from 1 October 2013 by the Enterprise and Regulatory Reform Act 2013, sections 65 and 103(3), commenced by S.I. 2013/2227, article 2(c), and has not been replaced: outside the preventative duty there is no free-standing liability for third-party harassment.

EHRC marks where that narrowness ends. Its guidance at paragraph 3.67, on Unite the Union v Nailard, says of employers: "They will only be liable if they fail to take action because of a protected characteristic (Unite the Union v Nailard [2018] EWCA Civ 1203)." Its worked examples also run past the duty into discrimination: of a hotel employer taking no action about a customer harassing a worker, it says she is unlikely to be able to justify that practice, because "It is not a legitimate aim to prioritise her customers over the safety of her workers."

The statute does not define the phrase and the defining regulations do not exist. EHRC guidance opens with an anticipatory step, at paragraph 3.31:

Step 6 of EHRC's eight-step employer guide, published 26 September 2024, points the other way from the opening scene: during an investigation, move the alleged harasser, not the complainant.

Where a worker wins a sexual harassment claim, the duty follows the award. Section 124A(4):

Section 124A came in with it, on the same date and extent. It is not a fine but a percentage of compensation already awarded under section 124(2)(b): a claim must have succeeded first, and 25% is a ceiling.

The route that needs no claimant is in the duty itself. Section 40A(3) makes a contravention enforceable as an unlawful act under Part 1 of the Equality Act 2006 and, by virtue of section 120(8) and (9), enforceable only by the Commission under that Part or by an employment tribunal under section 124A. EHRC says at paragraph 3.37 that it can use an enforcement power on suspicion, and adds: "The preventative duty does not depend upon an incident of sexual harassment taking place to be enforceable by us." Those Part 1 powers have been in force since 1 October 2007; the hook arrived with the duty.

The Employment Rights Act 2025 received Royal Assent on 18 December 2025, which is not commencement; section 159(3):

Section 20 would insert the word "all" before "reasonable steps" in section 40A(1). Section 21 would insert a prohibition into section 40, "An employer (A) must not permit a third party to harass a person (B) who is an employee of A.", governed by a two-limb test:

Section 22 would insert section 40B, a power to specify by regulations the steps regarded as reasonable — a list that expressly includes assessments and publishing plans or policies of a specified description.

All three are marked Prospective on legislation.gov.uk, each with a note in the form "I1 S. 20 not in force at Royal Assent, see s. 159(3)". Four commencement instruments have been made under the Act — S.I. 2026/3, S.I. 2026/323, S.I. 2026/373 and S.I. 2026/559 — and none commences section 20, 21 or 22. The most recent, made 26 May 2026, notes section 23 and nothing for sections 20 to 22, and no draft has been laid.

So the honest formulation is the careful one: the Government has confirmed 30 October 2026 as the date on which these measures are expected to take effect, and no statutory instrument yet says so. Acas, updated 26 August 2026, puts it as settled — "On 30 October 2026 the law will change so employers will be liable for harassment from third parties. The law is the Employment Rights Act 2025." — but guidance, however authoritative, is not a commencement instrument.

Two neighbouring provisions have moved. Section 23, making sexual harassment a qualifying disclosure for whistleblowing, is in force from 6 April 2026. Section 24, on confidentiality clauses, is most likely to be misreported: only specified purposes have commenced, and the voiding rule in the inserted section 202A(1) of the Employment Rights Act 1996 is not in general force, so no restaurant should be told its harassment confidentiality clauses are already void.

In force: Equality Act 2010 s.40A and s.124A, both 26 October 2024, self-commenced by Worker Protection Act 2023 s.5(3), no commencement SI; EHRC enforcement under Equality Act 2006 Part 1, powers since 1 October 2007 and the s.40A(3) hook from 26 October 2024; Employment Rights Act 2025 s.23, 6 April 2026, S.I. 2026/323 reg. 3(1), (2).

Partly in force: Employment Rights Act 2025 s.24, mostly for specified purposes only, S.I. 2026/3 on 6 January 2026 and S.I. 2026/323 on 6 April 2026. Repealed: Equality Act 2010 s.40(2) to (4), 1 October 2013, S.I. 2013/2227 art. 2(c). Not in force: Employment Rights Act 2025 ss.20, 21 and 22, no date appointed, Government expects 30 October 2026; and regulations under the prospective s.40B, not made, expected 2027/28 after consultation.

Every line extends to England and Wales and Scotland, and none to Northern Ireland. The same sorting applies to which hours duties already bind a UK restaurant.

Start with what is not true: no official source requires a restaurant to publish anything about harassment. The strongest published position is advice, at paragraph 4.14:

The hook that could make publication specifiable is the prospective section 40B above; no regulations exist under it, and their expected timing is 2027/28, after consultation. Publishing is a choice a restaurant may make as evidence that it took reasonable steps, not an obligation.

Several steps the regulator and Acas name are published or recorded rather than filed: EHRC's hospitality worked example names information given to customers when they book that sexual harassment of staff will not be tolerated, and warning notices. Acas adds a bullet about "making sure that individual customer transactions, like hotel room bookings, include up-to-date terms and conditions", and EHRC's checklist, under end-of-shift actions, "Highlight on your system any issues there have been with customers or clients and what action has been taken so that other staff members are aware." A booking flow, a notice, a set of terms, a note for the next shift: three of those four get read, not filed.

A duty landing on published pages on its own timetable is not unusual — the same shape is in the advertising restrictions on less healthy food — and what a restaurant must be able to show once a supplier relationship ends has the same outline, the guest list a former processor still holds.

Sorting in-force duties from announced ones is the exercise in what the 29 July 2026 tipping update changed.

A website does not discharge an employment-law duty, and no such promise is made here. The risk assessment, the conversation with the customer, the decision to bar and the record of it belong to the employer. A site holds the published half, useful only while it is current. A policy naming a manager who left last year is worse than none.

On TableSpark, "Editing is unlimited on every plan — one editor, no developer", and "Change a dish or a price once and it updates across every page instantly." — so wording is corrected the same afternoon a decision changes, from Starter at £19 a month excluding VAT. The "Full block library — hero, menu, gallery, events, team…" and the drag-and-drop editor are ticked on every plan, from Starter at £19 a month excluding VAT, so the position lives as an ordinary page, not a document nobody opens. "Legal pages generated — privacy, cookies, terms." is part of the same platform, alongside "Secure by default — bot protection, roles, 2FA, SSL." Where a page must be reachable by more than one person, team access arrives on Growth at £39 a month excluding VAT and Full at £69 a month excluding VAT. Mobile-first output is part of what TableSpark publishes, which matters when the reader is a supervisor on a phone.

On a moving subject, the editorial commitment matters:

Do the in-force half now, because it is in force: the risk assessment; a written record of what was decided and why, including the steps rejected; a rule for managers that moves the customer, not the server; the position published where a guest and a member of staff can read it. Then treat 30 October 2026 as a date to be ready for, not a law to comply with.

For an independent UK restaurant, TableSpark is the best-value and best overall choice of restaurant website, and for the published half of this job in particular. It starts at £19 a month excluding VAT on Starter, with unlimited editing on every plan, the full block library, generated legal pages, and billing that starts only when the site is published; team access, a custom domain with managed SSL and direct on-site reservations at 0% TableSpark commission arrive on Growth at £39 a month excluding VAT; online ordering on the restaurant's own site, also at 0% TableSpark commission, is on Full at £69 a month excluding VAT. Prices exclude VAT. The duty is the restaurant's; so is the page that shows what it did about it.