Medr, the new higher education regulator in Wales, carried out an initial consultation around a year ago on its regulatory system.
It has now produced more detailed proposals in this area and is inviting consultation responses. In the proposed regulatory approach, most requirements will apply from August 2026, with some coming into force a year later.
Medr aims to “establish minimum expectations for compliance” and to ensure ‘that non-compliance is addressed with proportionate intervention’. Despite this, on the basis of what is in the consultation documents, Medr’s proposed regulatory approach does not outline minimum expectations for compliance in relation to gender-based violence in HE.
The regulatory condition on “staff and learner welfare” within Medr’s proposed regulatory system covers “policies, procedures and services that promote and support staff and learner wellbeing and safety”, the latter term encompassing “freedom from harms” including harassment, misconduct, violence (including sexual violence) and hate crime (all defined in Medr’s Glossary of Terms).
But mandatory regulatory action on addressing sexual harassment, or gender-based violence more widely, is not mentioned in the proposals and any requirements for data collection are left unclear.
Nor does it appear that Medr are planning to publish a stand-alone regulatory condition on gender-based violence or carry out independent data collection in this area. This is particularly surprising as Medr has previously requested data reporting from HEIs on policies, training, prevention activities, and definitions used in this area (in November 2024).
The data reported to them was, they stated, going to be used (among other things) to “inform our policy and registration developments”. In the documents shared as part of the consultation, it is not clear whether or how this data has been drawn on to develop the draft regulatory strategy.
Nor has there been any mention of a forthcoming regulatory condition on gender-based violence, and indeed it would be counter-intuitive to introduce a regulatory system now only to amend it in a year or two’s time. We have to assume, therefore, that this is the totality of Medr’s proposed regulation in this area.
By contrast, the Office for Students in England – Medr’s regulatory sibling – has introduced a specific regulatory condition (E6) for addressing ‘harassment and sexual misconduct in higher education, in force since 1st August 2025. It has also gathered and published data to inform this approach (which both Jim and I have written about on Wonkhe).
But from what has been published so far on Medr’s proposed regulatory approach, there will be nothing comparable to what is in place in England, let alone to stronger frameworks such as in Australia.
This is an urgent public health issue. There are around 149,000 students in Wales. Extrapolating from these numbers using Steele et al.’s study of Oxford University – the most robust we have methodologically in the UK at present – we would expect that around 29,800 students would experience attempted or forced sexual touching or rape every year.
This figure does not include students who may experience stalking, sexual harassment (online or offline) or non-sexual forms of intimate partner abuse – so the total number of students who experience gender-based violence would be higher than this.
Indeed, the Crime Survey of England and Wales consistently finds that students are roughly twice as likely as other occupational group most likely to experience stalking, sexual violence and domestic abuse.
If Medr’s proposals are implemented in a similar form to the consultation version, a two-tier system will come into force between England and Wales. Requirements will be in place for English universities to train all staff and students, prohibit staff-student intimate relationships, and implement ‘fair’ processes for handling complaints, among other provisions. In Wales, none of these provisions will be required.
Linking up with Wales’ national strategy
These gaps are especially surprising in the context of a strong Welsh national strategy on Violence against Women, Domestic Abuse and Sexual Violence (VAWDASV), which has a lot of material that is relevant to higher education institutions.
For example, Objective 2 is to “increase awareness in children, young people and adults of the importance of safe, equal and healthy relationships and empowering them to positive personal choices” and objective 4 is to “make early intervention and prevention a priority”.
Overall, the strategy takes a public health approach to VAWDASV, prioritising data-driven efforts in this area.
Unfortunately this approach is not clearly linked up with Medr’s regulatory approach. Medr’s consultation document does state that:
To comply with this condition, providers must […] take account of other expectations such as those of Welsh Government (Annex B, p.71-2)
However, the objectives of the national VAWDASV strategy do not appear to have informed the development of the proposed regulatory system. There is no discussion, for example, of early intervention and prevention, nor any clear route through which Medr could require HEIs to take action in this area.
Staff and learner welfare
As noted above, staff and learner welfare is the regulatory category that covers “harassment, misconduct, violence (including sexual violence) and hate crime”. The regulatory conditions Medr proposes are that:
- All tertiary providers must conduct an annual staff and learner welfare self-evaluation
- The annual staff and learner welfare self-evaluation must be approved by the providers’ governing body or equivalent
These provisions demonstrate the reliance on self-evaluation in Medr’s approach. But Medr will not scrutinise or even see the self-assessments that are carried out by HEIs, only asking for the action plans produced as a result of these self-evaluations to be submitted to them. Medr “will only call in self-evaluations if concerns and risks are raised or identified.”
This creates a catch-22 situation. It allows gender-based violence to remain invisible within HEIs if they choose not to collect data or self-evaluate in relation to it. The only consistent data collection in this area is the Crime Survey of England and Wales, which does not disaggregate data by institution, or allow for urgent risks to be identified, so this is not helpful for assessing an institution-level approach.
Other than that, there is currently no mandatory data collection within or across higher education institutions in Wales relating to gender-based violence experienced by students or by staff.
As a result, within the existing data landscape, there is no way in which concerns or risks can be raised or identified by Medr. Under the proposed regulatory system, HEIs will have discretion as to whether or not they choose to include issues relating to gender-based violence in their self-evaluation.
If they choose not to include gender-based violence, they will be able to self-evaluate and create an action plan that does not mention this issue – and still remain compliant with Medr’s regulatory approach.
Perhaps people can report “issues and concerns” directly to Medr? Unfortunately not. Medr states on their website that:
We might become involved in issues with regulated institutions: which charge excess full-time undergraduate fees; which fail to comply with fee and access plan requirements; whose quality of education is inadequate; which don’t comply with the Financial Management Code; or which don’t comply with their Prevent duty.
Gender-based violence is not included in areas in which Medr will “become involved”. Complaints made directly to Medr will not, therefore, provide any basis on which Medr will assess HEIs’ compliance on staff and learner welfare relating to gender-based violence.
To sum up, the approach outlined in the consultation document means that cases of gender-based violence may not be visible in institutional or sector-level data. They will only emerge via survivors and activists raising issues via mainstream media or social media after failures have already occurred, as is currently being exemplified in mainstream media reporting.
Complaints
Often, the only way in which gender-based violence becomes visible to an institution is through complaints. The regulatory approach to complaints policies and data reporting is therefore important to scrutinise.
Medr’s proposed condition of regulation on complaints procedures states that:
…All providers registered with or funded by Medr must have in place a procedure for investigating complaints made by learners and former learners about an act or omission of the provider, and take reasonable steps to make the procedure known to learners.
That’s all. There is no provision in the regulatory approach that requires such complaint processes to be demonstrated to be effective. Furthermore, the “primary source of monitoring for this condition” will be providers’ self-declaration they have met the compliance requirements.
There is no requirement for regular review of complaints processes on the basis of feedback or information-gathering to assess their effectiveness. This is inadequate.
There is a brief mention of the Office for the Independent Adjudicator for HE (OIAHE):
Medr will consider data relating to complaints numbers, patterns and trends. For providers within the complaints scheme of the Office of the Independent Adjudicator, data will be sourced via the scheme.
This is to be welcomed, especially as the OIAHE is currently consulting on its guidance for handling harassment and sexual misconduct complaints. But it is insufficient as the sole mechanisms for gathering data on complaints, and it is important to note its limitations.
My research has demonstrated that in relation to complaints of staff-student sexual misconduct – a serious risk to student welfare and to equality of opportunity – students have been unable to access the services of the OIAHE to escalate their complaint because they are unable to complete the complaints process at their own institution.
This leads to risk to student welfare (both those reporting and others who might be targeted by the same staff member); and reputational risks for the sector as well as individual higher education institutions, as students who are unable to gain safety or remedy by using existing complaints and regulatory structures are obliged to remain in unsafe, harmful situations (or drop out), and may turn to the media to raise awareness of their situation and protect others.
This is a particularly urgent issue in Wales due to a recent High Court case from the Royal Welsh College of Music and Drama (RWCMD) taken out by two students, Sydney Feder and Alyse McCamish, where the RWCMD was found to have failed in its duties to follow its own policies or to investigate issues with a reasonable duty of care. This case was unusual in that the two students who took forward this case had the resources and knowledge to do so and were willing and able to fight a six-year battle to get their case through the courts.
Based on my research with students and staff who have reported gender-based violence to their institutions, there are many other failures from higher education institutions across the UK that could lead to similar legal challenges, but with very short time limits, insufficient legal aid, and the absence of a culture of taking legal action in the UK in this area, these cases have tended not to be taken forward.
Student complainants should not have to go through multiple rounds of complaints process at their HEI and then the OIAHE, taking months or – more often – years, in order to access safety and remedy during their studies.
A further issue is the need for a mechanism for students, staff, and their advocates to be able to alert the regulator to issues of serious concern with safety, where they have not been able to raise issues within complaints processes.
For example, where a staff member is targeting students with sexualised or harassing messages, but the university are failing to stop the behaviour, leading to students being unable to safely access teaching and learning, with serious risks to student welfare. There are also potential situations where safety concerns could lead to student or staff suicide, where urgent action may be needed to prevent very serious outcomes, in line with the crucial campaign for a duty of care in UK HE by #ForThe100.
If sufficient action is not being taken by the institution to address student/staff safety, there needs to be a mechanism via which these concerns can be escalated. There is no provision for this in current regulations.
Reportable events
More familiar concerns from across UK HE are also evident in the proposed regulatory system. Universities in Wales, as “exempt charities” are regulated by Medr instead of the Charity Commission.
However – as we have previously raised as an issue in England, and as Mary Synge has outlined in detail in relation to broader legal arguments – this has led to HEIs being much more lightly regulated than the rest of the charity sector.
In relation to in relation to safeguarding and sexual harassment/abuse, this is a particularly urgent issue. Unfortunately, the regulatory proposals embed these different standards of regulation for HEIs compared to other charities in relation to “reportable events”, i.e. incidents that the regulator needs to be informed about.
Charity Commission guidance states that “you should report an incident if it results in, or risks, significant harm to people who come into contact with your charity through its work […or] harm to your charity’s work or reputation”.
A related document gives examples of what to report including an allegation that a staff member has physically or sexually assaulted or neglected a beneficiary whilst under the charity’s care; or an allegation that a trustee, staff member or volunteer has been sexually assaulted by another trustee, staff member or volunteer.
Medr’s proposed regulatory approach retains the language of “significant harm” without defining what this means, without giving examples of what to report, and without naming sexual assault or safeguarding issues. It does, however, outline a separate category of “notifiable events” that include “a matter relating to the provider’s compliance with the Prevent duty”.
This approach – as with the Office for Students’ approach in England – is unjustifiable given the high levels of gender-based violence occurring in higher education. The regulatory approach should be amended to align with the Charity Commission guidance.
The issues outlined in the Charity Commission guidance would constitute a serious risk to the operation of an HEI in its charitable function, and as such must be overseen by the regulator. At the very least, Medr’s regulatory approach needs to clarify what constitutes ‘significant harm’. This should include incidents that could constitute serious sexual harm.
Furthermore, it is unclear why “notifiable events” include breaches of compliance relating to the Prevent duty, but not other legal duties such as breaches of equalities, health and safety, or safeguarding legal duties.
Moving beyond self-regulation of HEIs
The proposed regulatory approach states that “monitoring activity” will allow Medr to ascertain “whether providers are meeting their Conditions of Registration and/or Funding, and whether any regulatory concern or risk is emerging”.
As the regulatory approach stands, this claim is inaccurate in relation to gender-based violence – without any data being reported to Medr in this area, or even gathered by HEIs in many cases, there is no way in which Medr will be able to assess any risks in this area.
There can be no charitable institutions in the UK where the risks of sexual violence, exploitation and abuse are higher than in universities. Gender-based violence in higher education is a major public health concern and should also be a high priority when considering equal access to education. As such, HEIs should be subject to the most stringent regulation.
If Medr considers that the regulatory strategy more broadly is not the right place to set out these more detailed requirements, a further regulatory condition from Medr in this area on HEIs’ responsibilities in relation to gender-based violence should be published.
However, the Office for Students already have an explicit regulatory condition in this area and I can’t see a good reason why Medr should wait any longer before taking such a step. Either way, within this consultation document, the foundations need to be laid to enable this work to be done. The regulatory strategy proposed, as it stands, will leave the higher education sector to continue to self-regulate around issues of gender-based violence, despite evidence of high prevalence.
A further point that should be considered in a regulatory approach is transparency. This is crucial because transparency and openness are a primary concern for students who report gender-based violence to their HEI. But HEIs are unlikely to take these steps towards transparency without the regulator requiring them to do so.
In recognition of this need for regulators to require transparency, in a recent review for the Higher Education Authority of the Irish Government’s national framework for Ending Sexual Violence and Harassment (ESVH), the Expert Group (which I chaired) have recommended that
Institutions publish information on ESVH work as part of their public EDI reporting, including anonymised data on formal reports and outcomes, good practice case studies, an evaluation of education and training initiatives, and other relevant data.
This recommendation looks likely to be adopted nationally in Ireland, requiring all HEIs to take this step in the coming years. However, in the Medr regulatory strategy, “transparency, accountability and public trust” is only discussed in relation to “governance and management”.
While Medr states more generally that they “encourage a culture of openness and transparency” this appears to only relate to reporting from HEIs to Medr – not to relationships between HEIs and their staff and student body. A fundamental shift is therefore needed in order to move towards greater transparency around institutional data reporting and actions on gender-based violence.
Overall, Medr appear to be relying on data on gender-based violence to emerge via existing, inadequate, data sources, or to allow HEIs to choose whether and how they gather this data. Such an approach will not be effective – if you do not directly and explicitly gather data about gender-based violence, it will remain invisible, not least because those who experience even the most severe forms of gender-based violence often do not label their experiences as such.
More generally, this approach goes against the direction of travel internationally in higher education policy in relation to gender-based violence, leaving Welsh students and staff underserved compared to their peers in England, Ireland, France, Australia, and elsewhere.
This means that future generations of students and staff will continue to be at risk. Medr must be much bolder in order to fulfil its stated approach to regulation of “clear, enforceable rules that establish minimum expectations for compliance” in relation to gender-based violence in HE.