GRC software for EHS, quality & ESG:
33 providers with AI classification.

What lies behind EHS, quality and ESG software?

EHS stands for environment, health and safety, and together with quality management it is often called QHSE. Software in this category handles risk assessments, incidents, audits and corrective and preventive actions (CAPA), runs ISO management systems and collects ESG (environmental, social and governance) data for sustainability reports and supplier checks. Only seven providers here document AI for ESG data and sustainability reports, for example draft answers on qualitative data points of the European Sustainability Reporting Standards (ESRS). For supplier risk and supplier evidence the figure is seven.

• No specific AI function in the sources checked: 2 entries
• Only announced or in-development functions: 1 entry
• Documented AI use cases by topic, an entry can count more than once: Audit evidence, findings and reports (8) · Analysing incidents and safety events (7) · Obligations and deadlines from permits and regulations (7) · Checking and drafting quality and compliance documents (6)
• Documented headquarters in Europe: 23 of 33 providers, headquarters not separately checked: 9

Questions for the demo, derived from the five criteria of the comparison:

• Is an incident or audit finding closed in the tool only once the corrective action has been evidenced?
• Do reports on quality, environment or ESG show their data cut-off date and the assessments behind them?

Where must banks take ESG risks into account under Section 26c KWG?

In strategy, risk inventory, stress tests, resources and remuneration (Section 26c(1) and (4) KWG). The risk strategy includes an ESG risk plan with quantifiable targets and metrics that monitors and manages these risks over the short, medium and long term, the latter covering at least ten years (Section 26d(1)). Small and non-complex institutions, and institutions comparable to them, may describe their targets and procedures purely qualitatively and, until 31 December 2029, limit the plan to financial risks related to environmental risks, in particular climate risks.

How do banks reflect environmental risks in stress tests?

Material environmental risks must be part of stress testing, supplemented by resilience analyses over a long time horizon (MaRisk AT 4.3.3 para. 7, Circular 06/2026). In these resilience analyses a reference scenario should be set against at least one adverse alternative scenario. The results feed into the business model analysis and the strategy. According to the explanatory notes, institutions may use simplified methods such as sensitivity analyses and small institutions may use qualitative approaches; for the analysis of long-term resilience, all institutions may rely on qualitative approaches. Under Section 26c(4) no. 4 KWG, institutions also test the long-term resilience of their business model with ESG scenarios based on those developed by recognised international organisations.

Which providers of GRC software for EHS, quality & ESG are headquartered in Germany, Austria or Switzerland?

Of the 33 providers, eight have a documented headquarters in Germany, Austria or Switzerland: in Germany Envoria, IntegrityNext, Metrikflow, osapiens, Plan A (Diginex), Quentic, right. based on science and VERSO. For nine further providers, the headquarters has not been checked separately; they are not included in this list. Headquarters means the seat of the provider entity named in the entry, documented by the entry's location source (imprint, legal texts, official contact and company pages, occasionally official registers); it says nothing about ownership, hosting or data storage.

Regulatory framework.

• Section 26c KWG (German Banking Act): ESG risks in strategy, risk inventory, stress tests, resources and remuneration (Source: gesetze-im-internet.de, in German)
• Section 26d KWG (German Banking Act): ESG risk plan with quantifiable targets and metrics, monitoring and management over the short, medium and long term of at least ten years (Source: gesetze-im-internet.de, in German)
• MaRisk AT 2.2 para. 3 and AT 4.3.3 para. 7, BaFin Circular 06/2026 (BA): ESG risks in the risk inventory, internal control system, strategy and reporting, environmental risks in stress tests and resilience analyses, implementation of EBA Guidelines EBA/GL/2025/01 and EBA/GL/2025/04 insofar as they concern risk management (explanatory note to AT 1 para. 2) (Source: BaFin, in German)
• Sections 1, 3 and 10 LkSG (German Supply Chain Due Diligence Act): human rights and environmental due diligence in the supply chain for companies with, as a rule, at least 1,000 employees in Germany, ongoing documentation kept for at least seven years (Source: gesetze-im-internet.de, in German)
• Sections 5 and 6 ArbSchG (German Occupational Safety and Health Act): risk assessment including mental stress, documentation of outcome, measures and review, recording of accidents causing death or more than three days' incapacity for work (Source: gesetze-im-internet.de, in German)

Further reading on t-nex.de: Ninth MaRisk amendment, EBA guidelines for German banks, Regulatory roadmap 2026 to 2028 and T-NEX for risk control teams.