One Company, Two Rules: Third-Party Harassment After Bivens v. Zep

If you employ people in more than one state, start here: the Sixth Circuit’s decision in Bivens v. Zep, Inc. should not change a word of your harassment policy. Build to the strictest standard that can reach you, and the circuit split below becomes someone else’s problem.

The split is real. In Bivens v. Zep, Inc., 147 F.4th 635 (6th Cir. 2025), the court held that an employer is liable under Title VII for harassment by a customer or other non-employee only if the employer “desired to cause” the harassment or was “substantially certain” it would result from the employer’s own actions. A sales representative visiting a client was locked in an office and propositioned. She reported it, her supervisor reassigned the account, and the court affirmed summary judgment for the employer.

Everyone else runs on negligence. The EEOC’s regulation, 29 C.F.R. § 1604.11(e), imposes liability where an employer knows or should have known of non-employee harassment and fails to take immediate and appropriate corrective action.

The First, Second, Eighth, Ninth, Tenth, and Eleventh Circuits apply some version of that rule. The Sixth Circuit, invoking Loper Bright Enterprises v. Raimondo, 603 U.S. 369 (2024), found the EEOC’s reading neither binding nor persuasive, and said it would not “lose any sleep” over standing nearly alone. In April 2026, the Supreme Court denied review. This is a fixture now, not a phase.

So why should a multi-state employer ignore the friendlier rule? Four reasons.

Geography.

Bivens only binds Kentucky, Michigan, Ohio, and Tennessee. Nowhere else. A company headquartered in Columbus does not get the Sixth Circuit’s standard for its New Jersey sales force.

State law.

Bivens construes Title VII and nothing more. New Jersey’s Division on Civil Rights reads the Law Against Discrimination to require an employer to take reasonable steps against hostile-environment harassment it knew or should have known about. That is negligence, it reaches third parties, and it binds every New Jersey employer regardless of headcount. A company too small for Title VII is fully exposed under the LAD.

The EEOC.

The agency has not moved. It still investigates and litigates on a negligence theory.

Bivens itself.

It is not a shield even in Ohio. The panel signaled that an employer who hears a complaint and sends the employee back anyway may well be “substantially certain” that harassment will recur. Intent is a higher bar, not an unreachable one.

The compliance program that satisfies every standard is the one you should already have: policies that expressly cover customers, clients, vendors, and patients; reporting channels employees actually use; managers trained to escalate rather than to answer that the customer is always right; contemporaneous documentation of each complaint and each response; and harassment terms in your third-party contracts.

Zep won because it acted promptly. It would have won under the negligence standard too. The employers who end up litigating over which test applies are usually the ones who did nothing at all.