Sixth Circuit Decision on Third-Party Harassment Employer Liabili

If you manage people for a living, you already know the “third party” problem: your employees don’t just interact with coworkers. They deal with customers, patients, students, vendors, contractors, clients, and the occasional “sir, this is a Wendy’s” energy vampire. When that outsider crosses the line into harassment, the workplace still feels like your workplacebecause it is. And for years, the common legal question has been simple: if an employer knew or should have known about third-party harassment and didn’t act, can the employer be liable?

In August 2025, the U.S. Court of Appeals for the Sixth Circuit (covering Kentucky, Michigan, Ohio, and Tennessee) dropped a decision that made employment lawyers everywhere sit up straighter: for Title VII liability based on non-employee harassment, negligence may not be enough. Instead, the court said the employer must have intended the harassment to occur (or been substantially certain it would). That’s a major shift, and it’s already reshaping how people think about customer/client harassment claimsat least in the Sixth Circuit.

What the Sixth Circuit actually decided (in plain English)

The Sixth Circuit held that when the harasser is a non-employee (like a customer or client), Title VII liability doesn’t automatically follow the “knew or should have known” negligence standard many courts use for coworker harassment. Why? Because the employer generally can’t be held vicariously liable for someone who isn’t the employer’s agent.

Instead, the court framed third-party harassment as a question of direct employer discrimination: did the employer itself intentionally subject the employee to a sex-based hostile work environment by desiring the harassment or being substantially certain it would happen and allowing it anyway?

Translation: in the Sixth Circuit, a company’s sloppy response to customer harassment may be bad management, but it isn’t necessarily Title VII liability unless the employee can show the company intentionally let it happen.

The case that triggered the shift: a quick, concrete snapshot

The decision came in Bivens v. Zep, Inc.. The employee was a sales representative. During a visit to a client site (a motel), the manager allegedly locked the office door and asked her out. She said no, said she was married, and left. She later reported the incident to her supervisor. According to the court’s description, the supervisor reassigned the client so she wouldn’t have to interact with him again.

Not long after, the company did a workforce reduction tied to territory revenue and eliminated multiple roles, including hers. She sued, asserting (among other things) a hostile work environment based on the client’s conduct and retaliation.

The Sixth Circuit affirmed summary judgment for the employer. The headline wasn’t that the company’s response was perfect; it was the court’s reasoning: because the alleged harasser was a client and not an agent of the employer, the employee needed evidence the employer intended the harassment to occur. The record didn’t support that.

Why “agency” became the star of the show

Title VII is aimed at what an employer does. So when a supervisor harasses an employee, courts have long used agency principles to connect the supervisor’s intent to the employer. When a coworker harasses, employers can be liable if they were negligent in preventing or correcting it.

But a customer isn’t typically an “agent” of the company. The employer can’t write them up, suspend them, or fire them (unless you count banning them from the premises, which is the retail version of being “terminated for cause”). That missing control is exactly what the Sixth Circuit focused on.

Intent replaces negligence (for Title VII, in this circuit)

The court treated Title VII harassment as intentional discrimination and said non-employee harassment claims require proof the employer intended the unlawful result. It offered two practical paths an employee might use to prove intent:

• Desire: the employer wanted the harassment to happen (rare, but not impossible).
• Substantial certainty: the employer knew continued exposure would almost certainly cause more harassment and kept the employee in that situation anyway.

This matters because it narrows what “failure to act” means. Under a negligence approach, a slow or weak response can be enough if it’s unreasonable. Under the Sixth Circuit’s framing, the question becomes: did the employer’s choices effectively amount to an intentional decision to keep the harassment going?

How most courts have handled third-party harassment (and why the Sixth Circuit is different)

For decades, a common approachreflected in EEOC regulations and many appellate decisionshas been a negligence standard: if the employer knew or should have known about harassment by a non-employee and failed to take immediate and appropriate corrective action, the employer can be liable.

Many employers operationalized this into a simple rule: treat customer/vendor harassment like coworker harassmentinvestigate, document, stop it, prevent repeat behavior. That practice didn’t come out of nowhere; it grew from how courts evaluate whether an employer reasonably prevented and corrected harassment.

The Sixth Circuit acknowledged that its approach diverges from the dominant negligence framework used elsewhere. That divergence is the whole point: it creates a sharper geographic split in how third-party harassment claims may be litigated depending on where the case is filed.

So… are employers in the Sixth Circuit “off the hook” now?

No. Not legally, not practically, and definitely not reputationally.

1) The ruling is narrow, and lawsuits rarely stay in one neat box

Even if Title VII third-party harassment claims face a higher bar in the Sixth Circuit, employers can still face: state civil rights claims, tort claims in certain fact patterns, contractual issues (especially with staffing agencies and vendor agreements), and regulatory problems (think safety and workplace violence risk). Plus, retaliation claims live in the real world: if someone reports harassment and later gets disciplined or terminated, the timeline can become an exhibit all by itself.

2) “Intent” can be argued from patterns, not just smoking guns

Employers should not read “intent” as “only if we wrote it down in an email titled ‘Let’s Harass People.’” A plaintiff may try to prove substantial certainty by pointing to repeated complaints, predictable ongoing exposure, a refusal to separate the employee from the harasser, and management statements like “Just smile, that’s how he ishe spends a lot here.”

3) Multi-state employers still have to play the highest standard game

If you operate across multiple circuits, compliance is not a choose-your-own-adventure novel. Most companies will still adopt procedures that satisfy the negligence standard, because employees, customers, and plaintiffs’ lawyers do not neatly restrict themselves to one jurisdiction’s comfort zone.

What smart employers should do anyway (a practical playbook)

Whether you’re in the Sixth Circuit or not, the best prevention strategy looks similarbecause it’s built for real life, not just courtroom theories. Here’s a field-tested approach that reduces harm to employees and reduces legal risk.

Build “third-party harassment” into your policies (explicitly)

• State clearly that harassment by customers, vendors, contractors, patients, and visitors is prohibited.
• Define reporting options (multiple channels, not just “tell your manager” in case the manager is the bottleneck).
• Explain that business goals never outweigh employee safety and dignity (yes, even if the customer is “important”).

Train managers on the hardest moment: the first report

Most failures happen right after the reportwhen someone shrugs, improvises, or tries to “keep the peace.” Managers should learn to do three things fast:

• Stabilize: separate the employee from the harasser and ensure immediate safety.
• Record: document what was reported (who, what, where, when) without cross-examining the employee like it’s a TV drama.
• Escalate: involve HR/legal/safety depending on severity, and do it consistently.

Use a menu of corrective actions (and pick the one that actually stops it)

• Reassign the account, rotate coverage, or move the employee away from the harasser.
• Set boundaries with the customer/vendor: written warnings, conduct expectations, “one more incident and you’re out.”
• Remove the third party from the premises, end the contract, or ban access when necessary.
• For healthcare/education settings, add controls: chaperones, rooming protocols, security escorts, scheduling changes.

Document “why this is reasonable” in real time

Documentation isn’t about building a villain scrapbook. It’s about showing you took the problem seriously, acted promptly, and chose an intervention designed to stop recurrence. If a case ever gets litigated, your memory will not be admitted as Exhibit Abut your contemporaneous notes might.

What employees should know (without turning this into a spy movie)

If you’re the person experiencing harassment from a customer or client, you shouldn’t have to become your own compliance departmentbut a few steps help:

• Report early and clearly, using the channels in the policy (or HR if the manager is unresponsive).
• Write down basics: date/time, location, what was said/done, who witnessed it, and how you responded.
• Ask what the safety plan is for future interactions (coverage changes, escorts, reassignment, boundaries).
• If you’re threatened or restrained, treat it as a safety incident, not just “harassment.”

The bigger backdrop: EEOC guidance is shifting, but the core duties aren’t

The Sixth Circuit’s decision leaned heavily into the idea that courtsnot agenciesultimately interpret Title VII’s substantive meaning. That debate has been especially active since the Supreme Court’s decision in Loper Bright (2024) narrowed judicial deference to agency interpretations.

It’s also worth noting that the EEOC’s detailed 2024 harassment guidance became politically and legally contested, and as of January 2026 the EEOC voted to rescind it. That rescission does not erase Title VII or decades of harassment case law; it removes one major interpretive roadmap the agency had provided. Meanwhile, EEOC regulations like the long-standing provision addressing non-employee harassment remain part of the compliance landscape, even as courts debate their weight.

In other words: the guidance may come and go, but employers still have to prevent and correct harassment because (1) it’s required by law in many contexts and jurisdictions, and (2) it’s the bare minimum for a workplace that wants to keep good people.

Conclusion: treat this decision as a warning label, not a permission slip

The Sixth Circuit’s third-party harassment decision changes the legal framing for Title VII claims in its jurisdiction: plaintiffs may need to show the employer intended the harassment, not merely that the employer handled it poorly. But if your compliance strategy becomes “great, we can ignore customers now,” you’ve misunderstood both risk and reality.

The safest pathlegally and culturallyis still the same: take reports seriously, act promptly, stop the behavior, and make sure the employee doesn’t have to choose between their paycheck and their dignity. Because the “customer is always right” motto was never meant to be a harassment policy.

Experiences related to third-party harassment (real-world patterns employers keep running into)

Third-party harassment cases often look tidy on paper“customer said X, employer did Y”but in workplaces they unfold messier, with split-second decisions and competing pressures. Across industries, a few repeat patterns show up so often they might as well have season tickets.

Retail and hospitality: A server gets cornered by a regular who “tips well,” a cashier gets comments about their body, or a hotel front-desk worker gets late-night propositions framed as jokes. The hardest part is that the harassment rides on top of the job itself: your employee is expected to be friendly, stay present, and keep the interaction going. The fix that works best is usually the least dramatic: empower staff to tag in a manager immediately, move the employee off the interaction, and set a firm boundary with the customer (“You can shop here, but you can’t talk to employees that way”). The fix that backfires is “Just ignore him” or “That’s not worth losing the sale,” because it silently teaches everyone that revenue outranks respect.

Healthcare: Nurses and aides sometimes face groping, explicit comments, or stalking behavior from patients or visitors. The operational challenge is obvious: you can’t always “fire” a patient, and staffing realities can trap the same caregiver in the same room. The most effective approaches tend to be procedural: chaperone rules, room-entry protocols, visitor restrictions, security involvement, and staffing plans that reduce repeated exposure. The biggest mistake is treating predictable repeat conduct like an unavoidable feature of the job. Even when an organization can’t eliminate risk, it can usually reduce itand documenting those steps matters.

Client services and sales: Harassment often shows up behind closed doors: on-site meetings, conferences, ride-alongs, or “quick discussions” that are anything but. The awkward truth is that the employee is frequently alone, the client relationship is valuable, and everyone worries about “causing a problem.” The best-managed teams plan for this before it happens: travel buddy systems for certain settings, meeting-in-public policies, check-in expectations, and leadership messaging that losing one problematic account is cheaper than losing good employees. The worst-managed teams wait until after the incident and then negotiate with the employee’s safety like it’s a budget line item.

Schools and universities: When the third party is a student, patient, or member of the public, the response often needs coordination across HR, legal, and operations. These settings teach a key lesson: sometimes “corrective action” isn’t a single punishment; it’s a safety plan that prevents repeat contact while respecting the environment’s rules. That can mean schedule changes, no-contact directives, monitored interactions, or removing access privileges. What tends to fail is the “we’ll see if it happens again” approachbecause if the risk is foreseeable, waiting can look like acceptance.

Remote and virtual work: Third-party harassment didn’t retire when offices went hybrid; it learned video conferencing. Employees report inappropriate comments in client calls, repeated after-hours messages, or harassment through collaboration tools. The best responses mirror in-person best practices: preserve evidence, set boundaries in writing, adjust who attends calls, and escalate to the third party’s management when needed. A common misstep is treating digital harassment as less “real” because no one was physically present. The impact on the employee is still real, and so is the duty to address it.

Put simply, the most effective organizations treat third-party harassment as both a people problem and a process problem. They don’t rely on hero managers improvising in the moment; they build systems that make the right response the easy response. And that’s the kind of “experience” that holds up everywhere in the Sixth Circuit, outside it, and in the court of employee retention (which, for the record, is always in session).