Most workplace harassment policies were written for a situation that is rapidly becoming the exception. Two colleagues, one incident, inside a building the employer controls.
Almost nothing about that description still holds, and the legal position is moving faster than the paperwork.
WHAT CHANGES THIS AUTUMN
From October, UK employers carry liability for harassment of their staff by people they do not employ. Customers, clients, patients, contractors, delegates, members of the public. Liability attaches from the first incident, with a duty to demonstrate that all reasonable steps were taken to prevent it.
Read that again with an operational eye. The behaviour you are now responsible for preventing is being performed by people who are not on your systems, not in your training programme, not subject to your disciplinary process and, in many cases, not identifiable.
Every internal mechanism an organisation owns points inward. The exposure now points outward.
THE SECOND THING HAPPENING AT THE SAME TIME
Manipulated images and synthetic video have started appearing in workplace disputes.
The scenario is no longer speculative. An employee is targeted with material that is entirely fabricated and entirely convincing. The harm is real, immediate and reputational. The artefact evidencing it never happened.
This breaks the standard investigatory approach in a specific way. Investigations are built to establish what occurred by examining what was produced. When the thing produced is synthetic, examining it more carefully does not help, and the burden lands on the person least equipped to carry it. The employee is asked to prove a negative about material they did not create, while it circulates.
Organisations that handle this well will be the ones who understood in advance that authenticity is now a question rather than an assumption.
THE PERIMETER PROBLEM
Put the two together and the position is uncomfortable.
The behaviour generating the liability increasingly originates outside the perimeter. The evidence may be synthetic. The duty is preventative. And the primary instrument most organisations have is a reporting channel that only activates when somebody inside decides to file.
A speak-up system is a good thing and I would not remove one. But it is worth being clear about what kind of instrument it is. It is a lagging indicator. It tells you what somebody was eventually willing to say, after weighing whether it would cost them their standing, their team relationships or their next promotion.
Coercive dynamics are specifically designed to make that calculation come out the wrong way. So the environments generating the most harm are frequently the ones generating the fewest reports, and a quiet inbox reads identically whether you are safe or whether people have concluded there is no point.
WHAT A PREVENTATIVE DUTY ACTUALLY IMPLIES
Prevention has to operate before the report, because after the report is by definition too late to have prevented anything.
That is a substantial reframe for most HR functions, whose entire instrumentation is built around case handling. Case handling is responsive work performed excellently. The duty has moved upstream of it.
What sits upstream is pattern. Not a single incident, which may be ambiguous and is often deniable, but the shape that repeats. Repeated departures from one team. A pattern in exit interviews that nobody aggregates because each one was handled individually. Third-party complaints that were resolved politely, one at a time, without anybody asking whether the same client keeps appearing.
Every one of those is legible before anybody files anything, to an organisation that has decided to look.
THE QUESTION FOR OCTOBER
It is not whether your reporting channel is good. Yours may be excellent.
It is whether anything in your organisation is capable of seeing a pattern before an employee has to carry the personal cost of becoming the person who spoke up.
If the honest answer is that nothing does, that is not a failure of intent. It is simply what happens when the instrument you built for a responsive duty is asked to satisfy a preventative one.
The organisations that come through this well will be the ones who noticed the mismatch while there was still time to do something about it, rather than at the point where somebody external asks what they could have known and when.
