T-NEX
Menu
DEEN
GRC provider register · Category 1 of 11

GRC platforms & suites:
192 providers with AI classification.

In short: The T-NEX GRC provider register lists 192 providers for cross-functional GRC platforms and suites, as of 18 October 2026. Of these, 154 document specific AI functions (80%), most often for analysing or recording risks as well as natural-language queries. In Germany, Austria or Switzerland, 24 have a documented headquarters, 16 of them in Germany.

By and Published: As of: · Category page of the GRC provider register Reviewed by Andreas Unruh and Christoph Gembruch, managing directors of T-NEX GmbH, on
Illustration: globe with networked GRC providers whose AI evidence flows into a checked provider register

Neither completeness nor a general suitability for banks is claimed. T-NEX is listed first as publisher; other providers follow alphabetically within each group. The order is not a performance rating.

All 682 GRC providers in the market overview · 379 European GRC providers

Publisher: T-NEX GmbH. Andreas Unruh and Christoph Gembruch are managing directors of T-NEX. This editorial market overview is based on vendor sources and specialist primary sources. It contains no ranking and is not based on a joint product test. The market overview covers 682 providers from GRC and adjacent specialist areas. Acquired brands and former product names are not counted separately. Methodology and sources

Context

What counts as a GRC platform or suite?

The register files software as a platform when it covers several governance, risk and compliance (GRC) disciplines in one product or product family, for example risk management, internal controls, compliance management and internal audit. The market also calls these offerings enterprise GRC (EGRC) or integrated risk management (IRM). No category in the register is larger. Besides Germany, the most common documented home countries are the United States with 16 entries and the United Kingdom with 15.

  • No specific AI function in the sources checked: 36 entries
  • Only announced or in-development functions: 1 entry
  • Source check pending: 1 entry
  • Documented AI use cases by topic, an entry can count more than once: Analysing or recording risks (44) · Natural-language queries (38) · Control mapping (37) · Audit work (33) · Gap analysis (32)
  • Documented headquarters in Europe: 91 of 192 providers, headquarters not separately checked: 61
  • Full entries on 5 alphabetical subpages

Questions for the demo, derived from the five criteria of the comparison:

  • Does a case remain recognisable when a confirmed gap becomes a measure and the measure becomes a project, and which data is carried over?
  • Which modules actually share one data model, and which are only connected through interfaces?
  • Which modules does the first implementation step need, and what does the same scope cost, including in-house maintenance?

Is a cloud-based GRC platform outsourcing under MaRisk?

As a rule, a cloud GRC platform falls under ICT third-party risk management under DORA rather than under the MaRisk outsourcing module AT 9. The explanatory note to MaRisk AT 9 para. 1 (Circular 06/2026) expressly excludes ICT services subject to Articles 28 to 30 DORA from the scope of AT 9. The contract then belongs in the register of information under Art. 28(3) DORA. Whether the platform supports a critical or important function is for the institution to assess before signing (Art. 28(4)(a) DORA).

Can you tell from a platform provider's headquarters where the data is stored?

No. The register documents the headquarters of the provider entity, not hosting or ownership; even for the 16 platforms with a documented headquarters in Germany, it says nothing about where data is stored. Where data is processed and stored is a matter for the contract: Art. 30(2)(b) DORA requires the regions or countries of service provision and data processing, including the storage location, and advance notice if the provider intends to change these locations.

Does missing AI evidence mean that a platform has no AI?

Not necessarily. The finding describes the public vendor sources that were checked, not the product itself; among the platforms it applies to 36 entries. When assessing such an offering, ask for a demonstration of any claimed AI function on a case of your own and clarify whether it is part of the licensed scope and where the AI runs.

Which providers of GRC platforms & suites are headquartered in Germany, Austria or Switzerland?

Of the 192 providers, 24 have a documented headquarters in Germany, Austria or Switzerland: in Germany T-NEX Banking Platform (the publisher's product), Athereon, Cybervize, deveca, DISS-CO, Durava, F24 TopEase, focus-GRC, GBTEC GRC Management, ibi systems iris, Kopexa, NEXIS, SAP GRC, Schleupen R2C, VamiSec (Vami Group) and Volaris (intellior / IMS PREMIUM); in Austria ADOGRC, AKARION, CRISAM GRC, KRAL and TogetherSecure; in Switzerland Acuna, Avalon Technology Solutions and SwissGRC Platform / GRC Toolbox. For 61 further providers, the headquarters has not been checked separately; they are not included in this list. Headquarters means the seat of the provider entity named in the entry, documented by the entry's location source (imprint, legal texts, official contact and company pages, occasionally official registers); it says nothing about ownership, hosting or data storage.

Regulatory framework.

  • Art. 28 to 30 DORA (Regulation (EU) 2022/2554): pre-contract assessment, register of information and minimum content of contracts for ICT services (Source: EUR-Lex)
  • MaRisk AT 9 para. 1, BaFin Circular 06/2026 (BA): under the explanatory note, ICT services subject to Articles 28 to 30 DORA fall outside the outsourcing module (Source: BaFin, in German)
  • Section 25a(1) KWG (German Banking Act): proper business organisation with risk management, an internal control system and internal audit (Source: gesetze-im-internet.de, in German)

Further reading on t-nex.de: GRC software selection criteria, DORA register of information, Outsourcing and DORA, GRC software business case, and T-NEX for management boards and decision-makers.

All 192 entries by subpage.

Each entry: name linking to the full entry, in brackets the ISO 3166 country code of the provider headquarters, where documented, and the AI status: AI evidenced = Specific AI functions documented; AI announced = Announced or in development; AI not evidenced = Not specifically documented in the source check; AI open = Source check still pending.

Is a provider missing or an entry out of date? Send us a note with a source via the contact form. Accepted changes are marked in the entry with the date they were checked.

Part 1: Digits to B

33 entries

Part 2: C to E

37 entries

Part 3: F to M

37 entries

Part 4: N to R

43 entries

Part 5: S to Z

42 entries

Publisher's own offering

T-NEX as publisher.

Register entry: T-NEX Banking Platform (DE, AI evidenced)

The T-NEX Banking Platform runs controlling, reporting, compliance, risk management, project portfolio management and fraud detection on a shared data model. Application, process, contract and infrastructure management and a strategy module work on the same data model, each with AI functions. BCM and information security are also handled in these modules. A risk stays linked to its origin, such as a budget variance or a confirmed fraud case. T-NEX configures triggers, handovers and approvals around the institution's processes. The chatbot, document AI and workflows use centrally defined model access and permitted data, while business decisions remain with the designated roles. Institutions can start with individual modules.

Register entry of the T-NEX Banking Platform (data as of 18 October 2026) · T-NEX Banking Platform