GRC software in Europe: 347 providers and selection guide

What the European register shows

The Europe selection contains 279 entries from EU states and 68 from European states outside the EU. The European non-EU locations represented are Iceland, Norway, Switzerland, Türkiye and the United Kingdom. The selection is based on the provider entity designated in each case. It is not a complete survey of all GRC companies operating in Europe.

“Documented” means that specific AI support is described in public vendor sources. Usable pilot, beta and integration functions are also included, with the respective restriction stated in the provider profile. Governance of AI alone is not sufficient for this status. Missing evidence is not proof of missing AI; no conclusions about performance quality can be drawn from the number.

Distribution by country

The figures describe the source status of our register. Countries with few entries are therefore not automatically small GRC markets. Locations in the worldwide register that have not yet been separately checked are not included in this analysis.

Distribution by specialist area

For this analysis, each provider group is assigned to exactly one editorial main category. A provider may cover further tasks. The categories are therefore not a complete function matrix; the specific coverage is given in the respective provider profile.

Check location, ownership, operation and AI separately

EU hosting alone does not answer the question of transfers to third countries. Remote access by a separate processor from a third country to personal data in the EU can also constitute a transfer. Conversely, a parent company outside the EU does not on its own document that a data transfer has taken place. Actual access and the legal framework must be considered together. The European Data Protection Board explains these constellations in its Guidelines 05/2021, examples 11 and 12.

Five review areas for provider selection

The following questions serve product-related selection. They are not a statement that the same legal obligations apply to every company and every piece of software.

Addition for banks

When subcontracting ICT services that support critical or important functions, the subcontractors and their role in the operating model must also be assessed. The European requirements explicitly distinguish between the location of the subcontractor or its parent company, the actual place of performance, and the places of processing and storage. The Delegated Regulation (EU) 2025/532, in particular Articles 1, 3 and 4, specifies this review in more detail.

A mention of DORA on a product page or a European location does not replace the assessment of the specific service and the contract. For the pre-selection, it should therefore first be established which function the institution wants to support with the software.

An AI demonstration with your own GRC case

A uniform test case makes providers comparable. Use an anonymised package consisting of an internal policy, several control descriptions, a piece of evidence and an identified deviation. Agree in advance which data may be processed and which functions are part of the product scope being demonstrated.

1. Trace the requirement: Have a relevant requirement derived from the documents. Check the reference, document version and subject-matter interpretation.
2. Map the control: Have an existing control suggested. Check the justification and whether unsuitable suggestions can be recognised and rejected.
3. Assess the evidence: Submit a deliberately outdated or incomplete piece of evidence. Check how the system handles uncertainty and missing information.
4. Prepare the action: Have a draft action created with responsibility and deadline. Check the separation between the AI suggestion and binding approval.
5. Check the report and export: Have the case summarised for management and exported including evidence, relationships and processing history.

Assess traceability, subject-matter correction, permissions and usability of the export. A fluently worded answer alone is not sufficient for these tasks. For the institution-wide context, the existing T-NEX integration review extends the test to risks, projects, costs and reports.

347 providers with documented European headquarters.

The links on the names lead to the respective entry in the complete register. There you will find functions, AI classification and product sources. The location source is linked directly here. T-NEX comes first; the countries and providers then follow in alphabetical order.

Download this Europe selection as a dataset: CSV for spreadsheet programs (German) · JSON with sources and AI classification (German). The exports contain the same providers and evidence statuses as this selection.

Questions on the European selection

Sources, counting method and limits.

For the AI comparison, each entry links to its function description in the main register. Specific AI evidence, use cases and availability limits are shown there. An AI governance function alone does not document an AI assistant.

This page contains 347 separately documented European provider entities from the worldwide dataset of 647 providers or provider groups. The European location review has not yet been completed for every existing provider. The figure therefore describes a documented subset and not a complete market size.

Location sources are provider imprints (legal notices), legal texts, official contact and company pages and, in individual cases, official registers. What is recorded is the provider entity designated there. Several products, former brands and acquired offerings do not increase the number of providers. A shared financial investor alone does not lead to independent software providers being merged.

Vendor information on functions is not the result of a joint product test. A registered office in the EU replaces neither the review of data storage nor that of the ownership structure. “Not separately checked” means an open review status, not the absence of a function or characteristic.

Product and source status: 15 October 2026. The methodology of the main register explains specialist categories, types of evidence and limits. Download the full dataset as CSV (German) · Download JSON (German).

Delegated Regulation (EU) 2025/532: subcontracting of ICT services supporting critical or important functions, in particular Articles 1, 3 and 4.

European Data Protection Board, Guidelines 05/2021, Version 2.0: interplay between territorial scope and international transfers, in particular examples 11 and 12.

Update of 15 October 2026: The register comprises 647 providers and provider groups. For 292 entries, a source review status more recent than 14 October 2026 is recorded. The individual review statuses and extensions are marked in the dataset; older source checks are not redated by this editorial update. Location and legal entity remain open where no sufficient source is available.

Editorial team and subject-matter contacts

The publisher of this register and editorially responsible for it is T-NEX GmbH. The contacts for GRC software are Andreas Unruh for software architecture and development, and Christoph Gembruch for IT governance and information security. Their profiles explain their professional experience and qualifications.

Inclusion is based on the linked vendor sources. You can submit notes on changed functions, company affiliations or incorrect information via the contact form for the editorial team . Please name the provider, the information concerned and a publicly accessible source.