London employers face a new legal duty over customer abuse from 30 October

From 30 October 2026, employers become legally liable when a customer, client or member of the public harasses their staff and the business has not taken “all reasonable steps” to prevent it. For London’s retailers, hospitality venues and service businesses, the question is no longer whether frontline abuse is a problem. It is whether they can prove they did enough about it.

The way British law treats abuse of frontline workers is about to change. Under the Employment Rights Act 2025, employers will have a new duty to prevent their employees being harassed by third parties: the shoppers, diners, passengers, patients and service users they deal with every day.

London has more exposure than anywhere else in the country. In a BRC-Opinium survey published in March 2026, 32% of Londoners said they had witnessed violence or abuse against retail workers in the past year. That was the highest of any UK region, against 21% nationally.

Abuse has become part of the job

The British Retail Consortium’s latest crime survey, published in February 2026, recorded around 1,600 incidents of violence and abuse against retail workers every day. That included 118 incidents of physical violence and 36 involving a weapon, each day.

The headline figure is down from more than 2,000 a day the year before. But it is still more than three times the 455 daily incidents recorded before the pandemic. Retailers estimate they have spent around £5bn over five years on CCTV, guards, body-worn cameras and other prevention measures.

The triggers are depressingly consistent. Shopworkers’ union Usdaw says around two-thirds of attacks on retail staff start with theft or armed robbery. In our own work training frontline teams, the flashpoints are the same across sectors: a refusal, a delay, a rule being enforced, or a customer under the influence of alcohol or drugs. A hotel receptionist, a bus driver and a council housing officer face versions of the same moment a cashier does.

What changes on 30 October

Two pieces of legislation move responsibility for frontline abuse further onto employers.

The third-party harassment duty. From 30 October 2026, the Employment Rights Act 2025 makes an employer liable if a third party harasses an employee in the course of their work and the employer failed to take all reasonable steps to prevent it. A third party is anyone who is not the employer or a colleague: customers, clients, contractors, visitors and the public.

The duty covers harassment related to any protected characteristic under the Equality Act 2010, including race, religion, sex, disability, sexual orientation and age. It is not limited to sexual harassment. That matters, because racial and sexual abuse feature heavily in the incidents frontline staff report. At the same time, the existing duty to prevent sexual harassment, in force since October 2024, is strengthened from “reasonable steps” to “all reasonable steps”.

Crucially, government regulations setting out what counts as a reasonable step are not expected until 2027. Until then, employers must judge it for themselves, and an employment tribunal will judge it with hindsight.

A new offence of assaulting a retail worker. The Crime and Policing Act 2026, which received Royal Assent on 29 April, creates a standalone offence of assaulting a retail worker in England and Wales. It carries up to six months in prison or an unlimited fine, with a presumption that courts impose a criminal behaviour order. It also scraps the £200 threshold that had downgraded low-value shop theft.

Scotland shows what a dedicated offence can surface. Police there have recorded more than 11,700 assaults on retail workers since a similar law took effect in 2021. But a criminal offence deals with an assault after it has happened. The employment duty asks what the business did beforehand.

What “all reasonable steps” is likely to mean

There is no statutory checklist yet. But existing Equality and Human Rights Commission guidance on sexual harassment, and the advice employment lawyers are now giving clients, point to five things a tribunal is likely to look for:

1. A risk assessment for each role and location. Where and when does abuse happen? Late shifts, licensed premises, lone working, age-restricted sales and complaint handling all raise the risk.
2. A clear policy that names third-party harassment. It should be communicated to staff and, where practical, to customers through signage, terms of entry or service standards.
3. Simple reporting and proper records. Staff need an easy way to report verbal abuse as well as violence, and managers need to show they acted on reports, from banning orders to police referrals.
4. Practical training for frontline staff and their managers. Staff need to recognise escalation early, defuse it, set boundaries and keep themselves safe. Managers need to know how to respond and record.
5. Support after an incident, and a review of what happened. Each incident should feed back into the risk assessment.

The common thread is evidence. A policy that sits in a shared drive, or a 20-minute e-learning module nobody remembers, will be hard to defend as “all” reasonable steps.

Why training is where most employers fall short

Training is the step most employers believe they have covered, and the one most likely to fail scrutiny. At Stand2, a UK conflict management and de-escalation training provider that has trained more than 150,000 people over 25 years, we see the same gaps repeatedly.

It is generic rather than built around the role. A pub door supervisor, a pharmacy counter assistant and a council housing officer face different risks. Effective training starts from the risk assessment and rehearses the situations staff actually meet, such as refusing a sale, enforcing a policy or telling a customer “no”.

It is matched to the wrong level of risk. Most customer-facing staff need de-escalation skills for verbal aggression. Where there is a foreseeable risk of physical harm, staff also need personal safety skills to protect themselves and withdraw safely. Physical intervention should be reserved for roles that genuinely require it, such as security teams. Getting this wrong either leaves staff exposed or encourages them into confrontations they should avoid.

It is awareness, not practice. Under pressure, people fall back on what they have rehearsed. Scenario-based practice of the actual words, body language and exit routes is what changes behaviour on a busy Saturday afternoon.

Managers are left out. Supervisors set the tone, handle escalations and decide what gets recorded. If they have not been trained, frontline training rarely sticks.

Nobody keeps the evidence. Employers should be able to show who was trained, when, and how the content maps to the risks they identified. That record is what turns good intentions into a defensible position.

From bad luck to management failure

Until now, a shop worker racially abused by a customer, or a receptionist sexually harassed by a visitor, has had little legal route against their employer. From 30 October, that changes. An incident that once looked like bad luck can now be argued as a management failure.

The businesses best placed are not the ones with the most cameras. They are the ones that can show a tribunal a risk assessment, a policy, a reporting system and role-specific training, all joined up. In sectors where recruiting and keeping staff is already hard, the same steps also protect something harder to replace than stock: experienced people who feel safe enough to stay.

 

Paul Brennan is Managing Director of Stand2, a UK specialist in conflict management, de-escalation and personal safety training for organisations whose staff deal with the public. Stand2 works across healthcare, local government, transport, education, retail and leisure, and has been London Ambulance Service’s conflict resolution training provider since 2010.