The Institute of Chartered Accountants described it as the biggest change to UK employment law in a generation. ACAS has published updated guidance. Law firms across the country are advising clients to prepare now. And yet, most companies' compliance training hasn't changed at all.
The Employment Rights Act 2025 received Royal Assent in December and is being implemented in phases throughout 2026 and 2027. The changes coming into effect from October 2026 are particularly significant — and they carry direct implications for how organisations design, deliver, and evidence their workplace training.
This isn't a niche legal update. It affects every employer in the UK with staff who interact with colleagues, clients, or the public. Which is to say: all of them.
What's changing — and why training is at the centre of it
The most consequential change for training teams is the shift from "reasonable steps" to "all reasonable steps" in the employer's duty to prevent harassment. One word. Significant legal difference.
Under the current standard, employers need to demonstrate they took reasonable steps to prevent harassment in the workplace. In practice, this has often been satisfied by an annual eLearning module and a signed policy acknowledgement. A tick in a box. Training completed. Risk managed.
From October 2026, the standard tightens. Employers must show they took all reasonable steps. That means a tribunal will ask not just whether training existed, but whether it was effective, current, role-appropriate, and genuinely designed to equip people to handle real situations — not just demonstrate that something was delivered.
The Act also reintroduces employer liability for third-party harassment. If a customer, client, supplier, or contractor harasses an employee and the employer hasn't taken all reasonable steps to prevent it, the employer is liable. This is particularly significant for hospitality, retail, healthcare, financial services, and any business where staff regularly interact with people outside the organisation.
Alongside this, the tribunal time limit for bringing claims doubles from three months to six months. And whistleblowing protections now explicitly cover sexual harassment disclosures. The exposure is wider, the window is longer, and the scrutiny on what employers actually did — not just what they said they did — is sharper than ever.
Why tick-box training won't meet the new standard
Here's where this becomes a learning design problem, not just a legal one.
The current model of compliance training in most organisations looks something like this: an annual eLearning module, typically 20 to 40 minutes long, covering the legal basics. Staff click through a series of slides, answer a short quiz, and receive a completion certificate. The certificate goes on file. HR can report 95% completion. Everyone moves on.
Recent research found that 45% of employees describe their compliance training as "disconnected from real situations." And a Fair Work Commission case that made headlines earlier this year saw an employee dismissal overturned because the training was ruled "unfit for purpose" — the commission found it had "all the hallmarks of a tick-and-flick exercise designed to demonstrate compliance" rather than meaningfully prepare employees.
Under the new standard, a completion certificate dated months before an incident won't demonstrate that an organisation took all reasonable steps. If anything, it demonstrates the opposite — that the organisation prioritised a record of completion over genuine readiness.
The legal experts advising on the Act are explicit about what this means in practice. Skillcast, one of the UK's leading compliance training specialists, has stated that the Act challenges how seriously organisations take responsibility for workplace conditions, and that compliance readiness is not a one-off policy refresh but an ongoing shift in behaviours, workflows, and evidence. ACAS guidance emphasises that managers and staff must understand the changes and how they affect day-to-day practice — targeted training is essential, not optional.
What compliance training now needs to look like
The shift is from information delivery to behaviour change. That's a fundamental redesign, not an update to existing content.
Effective compliance training under the new standard needs to be scenario-based. Not "here are the definitions of harassment" but "here is a situation you might face — what do you do?" People need to practise responding to difficult situations before they encounter them, not just read about them.
It needs to be role-specific. A manager's obligations under the new Act are different from an individual contributor's. A customer-facing employee in retail needs different preparation than someone in a back-office function. Training that treats everyone the same doesn't prepare anyone properly.
It needs to be regular and evidenced. An annual module is no longer sufficient to demonstrate ongoing readiness. Organisations need to show that training is refreshed, that it responds to new risks as they emerge, and that there's a clear record of what was delivered, when, and to whom.
It needs to include assessment that tests judgement, not just recall. A quiz that asks "which of the following is a protected characteristic?" tests memory. A scenario that asks "your colleague overhears a client making an inappropriate comment to a junior team member — what should they do?" tests readiness. The second is what the new standard demands.
And it needs to be designed by people who understand adult learning — how to structure content so it actually changes behaviour, not just transfers information. This is instructional design, and it's the piece that most organisations' compliance training is missing.
Six months is less time than it sounds
October 2026 is six months away. For organisations that need to redesign their compliance training from a tick-box exercise to a genuinely effective programme, six months is a tight but achievable timeline — if the work starts now.
The scope of what's needed will vary by organisation. A company with 50 employees and minimal client-facing roles may need a focused, well-designed programme that can be built in weeks. A larger organisation with multiple locations, customer-facing teams, and complex reporting structures will need a more comprehensive approach — potentially including role-specific modules, manager training, third-party harassment scenarios, and an ongoing reinforcement plan.
Either way, the work is the same: audit what you currently have, identify the gaps against the new standard, design training that's built for behaviour change rather than box-ticking, and implement it with enough time for your people to complete it before October.
Where LearnFrame fits
Compliance training redesign is one of the most direct services we offer at LearnFrame — and one of the most immediately impactful.
We design and build compliance training programmes that are scenario-based, role-specific, and structured around how adults actually learn and retain information. We don't produce generic modules. We work with each organisation to understand their roles, their risk profile, and their culture, and we build training that's tailored to their actual workplace — not a one-size-fits-all slide deck.
Our production model — combining strategic direction from Dublin with a dedicated development team — means we deliver at a pace and price point that makes this feasible for mid-sized organisations, not just enterprises with six-figure training budgets. A well-designed compliance programme for a company of 100 to 300 employees can typically be built in six to eight weeks.
For organisations that need broader strategic support — someone to assess the full picture across onboarding, compliance, skills development, and knowledge management — our founder Paul Robinson also works as a fractional L&D executive with scaling businesses. That's a conversation about the whole learning and development function, not just one programme.
If you're a UK employer and you haven't yet reviewed your compliance training against the new Employment Rights Act requirements, the time to start is now — not in September.
We'd welcome that conversation.