The last hour of the night is now a legal question
Hospitality lone working is judged by a tougher standard. Since 30 October 2026, pubs, bars, restaurants and hotels can be liable when a customer harasses a member of staff, unless the employer can show it took all reasonable steps to prevent it. The shift where that defence is hardest to prove is the one where a single worker closes up alone.
The law is not new in principle. Since October 2024, employers have had a duty to take reasonable steps to prevent sexual harassment, including by customers. What changed on 30 October is how high the bar sits, and how many kinds of harassment it covers. Our guide to the Worker Protection Act 2023 duty explains the starting point.
Summary: Since 30 October 2026, hospitality employers must take all reasonable steps to prevent sexual harassment and can be liable for customer harassment linked to protected characteristics (Employment Rights Act 2025). Venues where staff close, cash up or travel home alone should assess that risk, record incidents and give staff a fast, discreet alarm.
Key Takeaways
- Sections 20 and 21 of the Employment Rights Act 2025 came into force on 30 October 2026 under SI 2026/1065, made on 1 October 2026.
- Employers must take “all reasonable steps” to prevent sexual harassment, up from “reasonable steps” under the Worker Protection Act 2023.
- Employers can be liable for harassment by third parties, such as customers and guests, related to protected characteristics including sex, race, religion or belief, sexual orientation and disability, and this can be a standalone tribunal claim.
- The Equality and Human Rights Commission (EHRC) checklist on preventing sexual harassment, originally written for hospitality, works through actions before, during and after each shift and identifies lone working as a higher-risk situation.
- Employment tribunal claims now have a six-month time limit for most claims, from 1 October 2026.
What changed on 30 October 2026
The Employment Rights Act 2025 amended the Equality Act 2010 in two ways that land squarely on hospitality. The Employment Rights Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/1065) brought sections 20, 21 and 22 into force on 30 October 2026.
Section 20 strengthened the duty created by the Worker Protection (Amendment of Equality Act 2010) Act 2023. Employers must now take “all reasonable steps”, not just “reasonable steps”, to prevent sexual harassment of their employees. Where a tribunal upholds a sexual harassment claim and finds the employer breached this duty, it can still increase compensation by up to 25%.
Section 21 goes further. An employer is treated as permitting harassment where a third party, meaning anyone who is not the employer or a colleague, harasses an employee in the course of their employment and the employer failed to take all reasonable steps to prevent it. For a pub or restaurant, the third party is usually a customer, a guest, a supplier or a contractor.
This third-party liability is not limited to sexual harassment. It covers harassment related to relevant protected characteristics, including sex, race, religion or belief, sexual orientation and disability. Racist abuse from a guest at the bar, or a homophobic remark from a table, can now ground a claim against the venue itself.
What this means for hospitality employers: “the customer did it, not us” is no longer a defence on its own. The question is what you did, in writing, before it happened.
Why hospitality sits at the sharp end
Hospitality combines almost every factor that raises third-party risk: alcohol, late hours, close contact with the public, and a workforce that is often young, part-time or new to the job.
The evidence on scale is older than it should be, which is itself telling. A Unite survey reported in 2018 found that around nine in ten hospitality workers had experienced sexual harassment at work (preliminary findings). A University of Strathclyde study found that 95% of hospitality workers witnessed or experienced abuse during the first year of the COVID-19 pandemic, with around three quarters of it coming from customers. More recently, UKHospitality told Parliament in May 2025 that 13% of its members had reported an increase in abuse incidents compared with the previous year.
None of these figures isolates hospitality lone working, and no UK dataset does. But the pattern is consistent: the risk comes overwhelmingly from customers, and much of it goes unreported because staff feel it is part of the job.
What this means for hospitality employers: if your venue has no incident data, that is not evidence of no incidents. It is more likely evidence of no reporting route.
The lone working moments that need assessing
Most hospitality shifts are not lone shifts, so hospitality lone working is easy to overlook. The risk concentrates in specific moments, and those are the moments a tribunal is likely to ask about:
- Closing up. One bartender stacking chairs, clearing the last table of regulars, and locking the door behind them.
- Cashing up. Counting takings alone in a back office, often visible from the street.
- Opening early. A chef or porter arriving before anyone else to take deliveries.
- Hotel night shifts. A single night porter or receptionist responsible for the whole building.
- Room service and housekeeping. Staff entering a guest’s room alone, with the door closed behind them.
- Getting home. Leaving after midnight when public transport has stopped.
General aggression in these moments, such as a drunk customer refusing to leave, falls under the Health and Safety at Work etc. Act 1974 and the Management of Health and Safety at Work Regulations 1999, which require a risk assessment and proportionate controls. Harassment linked to a protected characteristic falls under the Equality Act 2010 as amended. A good assessment covers both, because the same lone closing shift carries both risks. See our lone worker compliance guide for the wider health and safety duties.
What this means for hospitality employers: map your rota against these moments. Every shift where one person is alone with the public, or alone in the building, is part of your duty of care and needs its own controls.
What “all reasonable steps” could look like in a venue
The government has power under section 22 to define “reasonable steps” in regulations, but these are not expected before 2027. In the meantime, the best guide is the EHRC’s 8-step guidance and its checklist and action plan, first developed with UKHospitality. It works through the shift in three stages:
Before the shift
- Rota with risk in mind, avoiding new or very young staff closing alone where possible.
- Brief staff on the venue’s policy, including that customers who harass staff will be refused service.
- Make sure every worker knows how to report an incident and how to raise an alarm.
During the shift
- Display a clear zero-tolerance message to customers.
- Agree a code word or signal so staff can ask for help discreetly.
- Give the person closing up a reliable way to summon help that does not depend on making a phone call.
After the shift
- Debrief, log any incidents and follow up with the employee.
- Plan safe travel home for late finishes.
- Review incident records regularly and update the risk assessment.
The EHRC checklist includes a monitoring log, and the principle behind it is important: tribunals will look for evidence that steps were taken and reviewed, not just written into a handbook. The cost of an employment tribunal harassment claim is one reason to keep that record.
Do your staff close up alone? See how The Sentry gives hospitality teams a discreet panic alarm, check-ins and a dated incident record. Book a free demo.
What this means for hospitality employers: the strongest “all reasonable steps” defence is a paper trail built shift by shift. Start that record now, before the first claim tests it.
How The Sentry helps hospitality teams
The Sentry is a smartphone-only lone worker safety app designed for staff who are alone with the public or alone on premises. For hospitality, the most useful features are:
- Panic alarms from the home screen. A one-touch widget raises an alarm with no unlocking the phone, no opening the app (the phone itself must already be unlocked). A silent alarm records audio and video without alerting the customer; a loud alarm sounds a siren and records video. See what UK lone workers need from panic alarm apps.
- Instant alerts with live location. The duty manager, the licensee or a colleague nearby receives the alert with the worker’s location on a map and can mark themselves as responding.
- Check-in timer for closing and the journey home. A worker starts a timed check-in when locking up, cashing up or leaving the building. If they do not check in, it escalates automatically.
- Fake incoming call. A genuine native ringtone gives staff a natural reason to step away from a customer who will not take the hint.
- Anonymous incident reporting. Staff can log a remark, a touch or an abusive customer with notes, photos, time and location. Reports can be submitted anonymously and leave no trace on the device, supporting the EHRC’s emphasis on safe, accessible reporting.
- Friends & Family licences. Three free licences per staff member let a worker share their journey home with someone they trust.
- Manager portal. A dated record across every site, giving owners and area managers the evidence of lone worker protection that a tribunal would expect to see.
An honest note on response. The Sentry alerts the people you nominate; it is not a monitored alarm receiving centre service with direct police dispatch. It works best where a manager, colleague or door supervisor can reach the worker quickly, and staff should still call 999 in an emergency.
You can see how the app fits pubs, bars, restaurants and hotels on our page for the lone worker app for hospitality and late-night venues. For the same harassment duty on single-staffed shop shifts, read our retail lone worker safety guide, or explore the retail and high street sector.
Martyn’s Law is next
Larger venues have a second deadline coming. The Terrorism (Protection of Premises) Act 2025, known as Martyn’s Law, received Royal Assent on 3 April 2025 and is expected to come into force in spring 2027, with the Security Industry Authority (SIA) as regulator. Premises expected to hold 200 or more people will need public protection procedures covering evacuation, invacuation, lockdown and communication.
Martyn’s Law is about terrorism preparedness, not lone working. But both regimes reward the same habits: knowing who is on site, being able to raise an alert quickly and keeping records.
What this means for hospitality employers: if your venue is in scope for Martyn’s Law, build your staff alerting and incident logging once, in a way that serves both duties.
Key dates
- 26 October 2024: Worker Protection Act 2023 duty to take reasonable steps to prevent sexual harassment came into force.
- 1 October 2026: employment tribunal time limit rose from three to six months for most claims.
- 30 October 2026: “all reasonable steps” sexual harassment duty and third-party harassment liability took effect (SI 2026/1065).
- Spring 2027 (expected): Martyn’s Law comes into force, subject to confirmation by the Home Office.
- 2027 (expected): regulations on what counts as “all reasonable steps”.
Frequently Asked Questions
Is a pub liable if a customer harasses a member of staff? Since 30 October 2026, potentially yes. Section 21 of the Employment Rights Act 2025 makes an employer liable where a third party, such as a customer, harasses an employee in the course of their employment and the employer failed to take all reasonable steps to prevent it. The employer’s defence is to show it did take all reasonable steps, so policies, training and incident records matter.
Does the new duty only cover sexual harassment? No. The “all reasonable steps” prevention duty in section 20 concerns sexual harassment, but the third-party liability in section 21 covers harassment related to relevant protected characteristics, including race, religion or belief, sexual orientation and disability as well as sex. General aggression with no link to a protected characteristic remains a health and safety matter under the Health and Safety at Work etc. Act 1974.
Can staff close a bar or restaurant alone? There is no legal ban on hospitality lone working. The Management of Health and Safety at Work Regulations 1999 require you to assess the risk and put proportionate controls in place. For a lone closing shift, that is likely to include rota decisions, a way to summon help, a check-in when locking up and a plan for getting home safely.
What is the EHRC hospitality checklist? It is a checklist and action plan for preventing sexual harassment, published by the Equality and Human Rights Commission and first developed with UKHospitality. It sets out steps to take before, during and after a shift, includes third-party risks and lone working, and comes with a monitoring log so employers can record what they have done. It is a sensible starting point for an “all reasonable steps” approach.
How does a lone worker app help with the new harassment duty? A lone worker app such as The Sentry supports several steps an employer is likely to be judged on: a fast, discreet way to raise an alarm, recorded evidence, a private reporting route and a dated record of incidents. It does not replace your policy, risk assessment or training, but it helps show those steps working in practice. Staff should still call 999 in an emergency.
Stuart Evans
Ready to protect your team? The duty that took effect on 30 October is tested on the shifts where one person is left to close up, which makes hospitality lone working a board-level question. The Sentry gives your hospitality staff a discreet alarm and gives you the record that shows you took every reasonable step. Book a free demo → | See pricing →