October Regulatory Spotlight

United Kingdom: four of the employment law changes landing this month

In this update we want to highlight four of the more important employment law changes landing this month: the shift to “all reasonable steps” on sexual harassment, a new duty to prevent harassment by third parties, the doubling of tribunal time limits, and the expansion of right-to-work checks. 
 

01. One additional word, a much bigger duty: unpacking “all reasonable steps” 

In October 2024 the Worker Protection Act required employers to take reasonable steps to prevent sexual harassment. From October 30, 2026, section 20 of the Employment Rights Act 2025 changes that to all reasonable steps. 

Adding one word changes the test. Before, a company could point to anti-harassment training, or a policy everyone had received, or a reporting channel, and argue it had taken reasonable steps. Now, picking one or two of those is no longer a defense in itself. If a step is reasonable to take, the company must have taken it. 

What counts as reasonable differs between a two-person shop and a multinational, but for most companies the following is table stakes, and each item needs evidence behind it: 

• Anti-harassment training, with a record of who completed it and when 
• A defined policy, with tracked acknowledgements that every employee has seen the latest version 
• Clear instructions on who staff can speak to about harassment, again with acknowledgements recorded 
• An anonymous whistleblowing channel where staff can report without fear of reprisal. It is hard to argue you took all reasonable steps without one 

02. Third-party harassment: customers, contractors, and the public 

Also from October 30th, employers must take all reasonable steps to prevent harassment of their employees by third parties: anyone who is not the company or a coworker. That covers contractors, customers and clients, employees of a parent company, and members of the public. And it applies to harassment on every Equality Act protected characteristic, not just sex: race, disability, religion, age, and the rest are also covered. 

The reasonable steps here look different. You cannot fire a customer who harasses your staff, but you can decline their business, which means you need a defined policy on when to do so and everyone needs to know it exists. Beyond that, the familiar pattern applies: training, policies, reporting mechanisms, and a system that can show everyone has completed, received, and acknowledged them. 

The penalties are severe. Employment tribunals can award uncapped compensation for injury to feelings and financial loss, plus interest, and the Equality and Human Rights Commission can impose compliance measures of its own, with the reputational damage that follows. 

03. Tribunal time limits double 

Since October 1, 2026, most three-month time limits for bringing an employment tribunal claim have become six months. That covers unfair dismissal, discrimination, harassment, whistleblowing detriment, wage claims, and breach of contract, in England, Wales, and Scotland (Northern Ireland has separate law, and breach of contract claims in Scotland switch on November 9th). It applies to anything that happens after, or is ongoing, on October 1st. 

A telling example: an employee on a three-month notice period who suffers a whistleblowing detriment on October 1st could resign a month later, work out their notice, and still contact Acas about a tribunal claim after they have left the company.

04. Right-to-work checks reach further down the supply chain 

The Border Security, Asylum and Immigration Act 2025 took effect on October 1st and widens the definition of “employer” for right-to-work verification purposes. Until now, checks were only required for employees (and apprentices). Section 48 of the Act adds three further working arrangements, and the duty to check falls on whichever business engages the person under each one: 

• Individuals engaged under a “worker’s contract”. This is the employment law category of “worker” rather than “employee”: people who personally perform work under a contract that is not a contract of employment. In practice it brings in casual, zero-hours, bank, seasonal, and temporary staff. 
• Individual subcontractors. A self-employed individual who personally does work that a business has subcontracted now needs to be checked by the business that subcontracts. While a sole trader who finds their own clients and contracts with them directly remains outside the scheme, a sole trader who takes work from a contractor or an intermediary needs to be checked. 
• People matched to work by an “online matching service”. Platforms that match service providers to customers for a fee, such as food delivery, courier, and ride-hailing apps, now need to check the people they match. The platform must also verify that the person doing the job is the person who was checked, at least once in any 24 hours of activity. 

The new duties apply to engagements that begin on or after October 1, 2026; there is no requirement to retrospectively check people engaged before then (follow-up checks for anyone with time-limited permission still fall due). Checks must be done before the first shift, and the civil penalty for getting it wrong is up to £45,000 per illegal worker for a first breach and £60,000 for a repeat within three years, with sponsor license revocation, director disqualification, and, where the business knew or had reasonable cause to believe the person had no right to work, criminal liability of up to five years’ imprisonment and an unlimited fine. 

The bigger change is extended liability. If you subcontract work, you can now be fined for illegal working by your subcontractor’s people, even though you never engaged them and have no direct relationship with them. If Firm A is hired to make a delivery, gets too busy, and passes the job to Firm B, and Firm B’s driver has no right to work, Firm A can now be held liable. Your subcontractor still owns the check, but you share the exposure. The same extended liability applies where a contract lets an individual send a substitute in their place, and to platforms whose service providers are companies rather than individuals. 

The statutory excuse against that extended liability has three requirements, and your third-party risk governance process should insist on all of them before any work starts: 

1. A signed agreement committing the subcontractor or labor supplier to carry out right-to-work checks 
2. Evidence of their substitution process, showing they check anyone they send in place of an agreed worker 
3. Evidence of their identity verification process, showing they confirm that the people who turn up to work are the people they checked

Germany: a proposal to quadruple § 30 OWiG fines, and to give compliance credit at last

Tucked inside a May 2026 government draft bill implementing the EU Environmental Crime Directive is a proposal to rewrite Section 30 of the Administrative Offences Act (OWiG). While still a draft, if adopted as written it would reach well beyond environmental offenses to cover fraud, bribery, sanctions breaches, and money laundering. Two of the changes matter most to compliance teams. 

Fine caps would rise fourfold 

The maximum punitive fine for intentional violations would rise from €10 million to €40 million, and for negligent violations from €5 million to €20 million. As today, the fines actually imposed are intended to be scaled to the company’s size and earning power, up to the cap. With the higher caps, that would give an effective deterrent similar to the percentage-of-turnover fines in EU competition law (10%) and the GDPR (4%), without being expressed as one. 

The caps are only part of the picture. On top of the punitive fine, the company must forfeit any profit made from the violation, and that element is uncapped. It can easily be the larger number, which means the total penalty has no upper limit. 

For the first time, German law would reward a working program 

To balance the higher fines, the draft writes into German law for the first time that an effective compliance program, a serious internal investigation, and remediation can reduce a company’s fine. The U.S., UK, and French regimes already give this credit; Germany has not, until now. 

Two things earn the reduction: 

1. Serious efforts to investigate. The draft does not define “serious”, so each prosecutor decides, though the 2020 draft pointed to independence, cooperation, and disclosure. That is a strong case for internal incident management software that records who decided what, and why. The investigation also needs to be run by an independent internal team working outside the management hierarchy: if the people conducting the investigation were themselves involved in the misconduct, there is no reduction at all (explanatory memorandum to § 30(2a) s. 3 no. 5, BT-Drs. 21/6133).  
2. Lived compliance. A genuine compliance system reduces the fine if misconduct occurs, but boilerplate does not count. The program must be built to prevent misconduct, actually operated, and matched to the company’s real risks. A system used to hide misconduct can raise the fine. 

The practical advice is to build the evidence now, not when the law is final. Run a drill: stage a mock investigation over 48 hours and review the gaps. And keep reports, investigations, training records, and risk assessments in one dedicated tool, so the evidence is ready the moment an authority asks.