Three hundred senior HR professionals were asked this summer whether they could evidence taking all reasonable steps to prevent sexual harassment, if somebody challenged them today. Ninety-one per cent said they could. When the same survey looked at what was actually in place, around half could point to a clear reporting process and about a third had measures specifically designed to prevent retaliation.
The distance between those two numbers is the most expensive gap in UK workplace compliance this year, and almost nobody is measuring it inside their own organisation.
I want to be precise about what that gap is, because it is not incompetence and it is not indifference. The people answering that survey were not exaggerating. They were describing a genuine internal state. They had policies. They had run training. They meant every word of it. What they did not have was the thing the duty actually asks for, which is not sincerity but evidence.
WHAT “ALL REASONABLE STEPS” ACTUALLY ASKS OF YOU
The wording moved from reasonable steps to all reasonable steps, and that reads like a small tightening. It is not. It is a change of category.
Reasonable steps invites a defence built on proportionality. You did a sensible amount, given your size, your sector and your resources. All reasonable steps invites something closer to an audit. It asks what else you could have done, and why you did not do it. The burden shifts from demonstrating good faith to demonstrating exhaustiveness.
It is also, and this is the part most organisations have not absorbed, a preventative duty rather than a responsive one. It is not primarily concerned with how well you handled the complaint. It is concerned with what you did before there was a complaint to handle.
The timing makes this harder than it needs to be. The duty tightens in October. The regulations that will define what all reasonable steps actually means in practice are not expected until 2027. So organisations are being asked to build evidence now, against a standard that has not finished being written. Anyone waiting for the definitive checklist will be waiting on the wrong side of the deadline.
WHY CONFIDENCE IS THE WRONG INSTRUMENT
Confidence is generated by intention and effort. You wrote the policy. You booked the training. You care about this, visibly and genuinely. Every one of those produces a feeling of being covered.
Evidence is generated by something else entirely. It is generated by a record that a third party can read and follow without you in the room to explain it.
These two faculties feel similar from the inside and are completely different in a tribunal. I have watched capable, decent organisations discover the difference at the worst possible moment, which is the moment somebody external asks what you knew and when you could have known it.
The uncomfortable truth in that survey is not that nine in ten were wrong about their organisations. It is that nine in ten had no instrument for finding out.
THE THREE QUESTIONS A POLICY CANNOT ANSWER
When this is tested, the questions are narrower and more forensic than most preparation anticipates.
What did you know. Not what was reported, which is a much smaller category. What was visible to anyone in your organisation who was paying attention.
When could you have known it. This is the question that catches people. There is almost always a period between the first legible sign and the eventual complaint, and that period is where the duty lives.
What did you do between those two moments. If the honest answer is nothing, because nothing had been formally reported yet, then the reporting system is functioning exactly as designed and the duty has still not been met.
A policy document answers none of these. A training register answers none of these. They evidence that you took a step, not that you took all reasonable steps.
WHAT CHANGES WHEN YOU TREAT THIS AS EVIDENCE RATHER THAN COMPLIANCE
You stop confusing activity with prevention. A busy compliance calendar feels like protection and generates almost no defensible record. Once you are asking what this would look like to somebody reading it cold, the calendar reorganises itself around what leaves a trace.
Your reporting inbox stops being your only instrument. Reports are a lagging indicator, and coercive dynamics are specifically designed to suppress them. An organisation with very few reports may be safe, or may be frightened, and the inbox alone cannot distinguish between the two. That distinction is the whole question.
You can account for the space between incidents. Most of what matters happens in that space. Treating it as empty is what produces the gap between confidence and evidence in the first place.
Documentation becomes a method rather than a filing cabinet. A checklist can be superseded by the standard it was written for, which is a real risk when the defining regulations are still two years out. A documented method survives that, because a method shows how you decided, not just what you ticked.
HOW TO TEST YOUR OWN POSITION BEFORE OCTOBER
Put one question to your leadership team this month, and insist on a specific answer rather than a reassuring one. If we had to produce it tomorrow, what would the evidence actually look like?
Then follow it with three more. Who in this organisation is responsible for noticing a pattern that nobody has formally reported. What would they be looking at. And if they noticed something next week, where would that observation be recorded so that it still exists in eighteen months.
If those questions produce a name, a source and a location, you are in a stronger position than most. If they produce a policy document, you have found your gap, and you have found it while there is still time to close it.
THE STANDARD NOBODY HAS WRITTEN YET
The organisations that come through this well will not be the ones with the best policies. They will be the ones who understood early that the duty is about seeing, not about filing, and who built something capable of seeing before anyone made them.
Everybody else will find out what their evidence looks like at the same time as the tribunal does.
