T-NEX
Menu
DEEN
GRC provider register · Category 1 of 11 · Part 2 of 5

GRC platforms & suites, C to E:
37 providers with AI classification.

In short: Part 2 of 5 of the Platforms & suites category: full entries for 37 of the 192 providers, alphabetically from C to E, as of 18 October 2026. Of these, 32 document specific AI functions (86%). In Germany, Austria or Switzerland, five have a documented headquarters, four of them in Germany.

By and Published: As of: · Subpage of the GRC provider register Reviewed by Andreas Unruh and Christoph Gembruch, managing directors of T-NEX GmbH, on
Illustration: globe with networked GRC providers whose AI evidence flows into a checked provider register

Neither completeness nor a general suitability for banks is claimed. Providers are listed alphabetically. The order is not a performance rating.

All 682 GRC providers in the market overview · 379 European GRC providers · Platforms & suites category page (192)

Publisher: T-NEX GmbH. Andreas Unruh and Christoph Gembruch are managing directors of T-NEX. This editorial market overview is based on vendor sources and specialist primary sources. It contains no ranking and is not based on a joint product test. The market overview covers 682 providers from GRC and adjacent specialist areas. Acquired brands and former product names are not counted separately. Methodology and sources

Context, figures, review questions and the regulatory framework are on the Cross-functional GRC platforms and suites category page.

Entries from C to E: functions, AI classification and sources.

The assignment describes the offering considered, not all of the company's products. AI information names specific functions or limits of the public documentation. Scope of delivery, data storage and regional availability must be checked for each offering. Download provider overview as CSV (German), licensed under CC BY 4.0, credit “T-NEX GRC-Anbieterregister, t-nex.de”.

Is a provider missing or an entry out of date? Send us a note with a source via the contact form. Accepted changes are marked in the entry with the date they were checked.

Cross-functional GRC platforms and suites: C to E

37 entries

Cross-functional GRC platforms and suites · C to E · 37 providers
Provider / productDocumented focusAI functions and classification
C1Risk · Product: C1RiskDocumented focus: Links risks, compliance requirements, controls, evidence, assets and supplier data. Changes to these relationships can be evaluated and transferred into workflows.AI functions and classification: C1Risk describes AI-supported mapping of controls to compliance frameworks and cross-framework control matching in order to reduce duplicate compliance work.[1] [2] · Specific AI functions documented
Mapping controls to compliance frameworks · Cross-framework control matching
AI evidence: [2] [1] · Documented by the vendor; no product test.
Source check: 2026-10-14
calQrisk · Product: calQrisk GRC · GreenFeetDocumented focus: Brings together risks, controls, compliance obligations and audit findings. Control tests, measures and reports are supplemented by operational resilience and third-party management.AI functions and classification: The announcement checked describes AI for ongoing evaluation of governance, risk and compliance information as a development in the FCA sandbox programme. An already available product function is not documented in it.[3] [4]Announced or in development
Interpret GRC information continuously (in development) · Create responsibility-related assurance for senior managers (in development)
AI evidence: [4] · Development project according to announcement of 22 July 2026; general availability not documented; no product test.
Source check: 2026-10-14
Cerivo · Product: Cerivo · Headquarters: Denmark [5] · Cerivo ApS, Copenhagen N, Denmark; register number 45706133. Legal text also names the operating brands ComplyCloud, Wired Relations, RISMA Systems and Openli with a Danish address. · ComplyCloud; RISMA Systems; Wired Relations; OpenliDocumented focus: Bundles data protection, information security and governance and risk management. Comply, Control and Govern connect, for example, processing activities, data subject requests, ISMS and control evidence.AI functions and classification: No specific AI work step of the Cerivo GRC platform is documented in the source check. Support for the AI Act and training on building external assistants are to be distinguished from this.[6] [7] [8] [9] [10]Not specifically documented in the source check
Current product presentation and official search results for Cerivo, ComplyCloud and RISMA checked. Statements on governance of AI not counted as AI in the product.
Sources checked: [6] [8] [9] [10] · AI availability in the GRC platform not specifically documented in the source check.
Source check: 2026-10-14
Cerpent · Product: Cerpent GRC / Ophidia AI · Headquarters: USA [11] · The self-maintained vendor profile explicitly names New Castle, Delaware, USA, as headquarters and additionally locations in Baku and Almaty. The website refers to the company as Cerpent Inc. · Cerpent Inc.; Ophidia AIDocumented focus: Cerpent connects risks, controls, assets and audit evidence for banks, insurers and other regulated organisations. Responsibilities, control testing, measures and reports are managed in a shared GRC platform.AI functions and classification: Ophidia AI analyses structured GRC data, detects risk patterns and control gaps and suggests risk ratings and control mappings. The vendor names historical data and industry benchmarks as the basis; control evidence is also examined for anomalies.[12] [13] [14] [11] · Specific AI functions documented
Detect risk patterns and control gaps · Suggest risk ratings and control mappings · Flag anomalies in control evidence
AI evidence: [12] [14] · Commercial offering with individual demo and organisation-specific implementation. The pricing page lists Ophidia functions within the platform scope offered; not tested by us.
Source check: 2026-10-15
CERRIX · Product: CERRIX GRC · Headquarters: Netherlands [15] · CERRIX BV; registered office The Hague, Netherlands; VAT NL854381351B01. · RulerDocumented focus: Connects risk registers, control tests, compliance evidence and audits with third parties and incidents. Shared responsibilities and reports support several lines of defence.AI functions and classification: CERRIX describes dialogue-based queries of GRC data and report creation via a connected AI agent.[16] · Specific AI functions documented
Query GRC data in dialogue · Create GRC reports via AI agents
AI evidence: [16] · Documented by the vendor; agree the specific licence and implementation scope. No product test.
Source check: 2026-10-14
Checka · Product: Checka GRC / Autopilot · Headquarters: Colombia [17] · Data protection controller of the provider project: Ingrith Dayana Malaver Botía, natural person based in Bucaramanga, Colombia. No already registered corporation documented. · CHECKA; Checka Autopilot; Ingrith Dayana Malaver BotíaDocumented focus: GRC platform for risks, information assets, controls, statement of applicability, internal audits and suppliers. Links assessments, measures and traceable changes.AI functions and classification: AI generates context-specific risks, controls and action plans. The Autopilot links data queries and suggestions and requests confirmation before creating or changing entries.[18] [17] · Specific AI functions documented
Draft risks and controls · Suggest action plans · Query and edit GRC data in natural language
AI evidence: [18] · Product page describes available modules and offers a demo. Early-stage provider project: the privacy page describes the company's formalisation as still being set up; not all AI audit reports are complete.
Source check: 2026-10-15
CoAudit Group · Product: Sentinelys · Headquarters: France [19] · Sentinelys; CoAudit Pro; CoRisk; FDU ConseilDocumented focus: Sentinelys connects risk management, internal controls, audit and compliance campaigns on a shared database. Organisational units, control libraries, questionnaires and action plans can be linked with one another. The French vendor offers both SaaS and operation in the customer's own infrastructure and addresses, among others, banks and insurers.AI functions and classification: Sentinelys mentions an AI aid for onboarding. Specific AI support for risk analysis, controls, compliance or audit is not documented in the source check.[20] [19]Not specifically documented in the source check
Vendor page and targeted domain search checked; training AI without a documented GRC work step not included in the AI function filter.
Sources checked: [20] · No specific AI availability can be derived from the sources checked.
Source check: 2026-10-14
Compilo · Product: Compilo.ai · Headquarters: Sweden [21] · Privacy policy names Tech brows AB, Org. No. 559434-1967, Stockholm, as operator of Compilo. · Tech brows AB; Tech Brows AB; Compilo.aiDocumented focus: Compilo bundles data protection, security requirements, contracts, suppliers, risks and evidence. The described work areas include records of processing activities, impact assessments, control evidence and action plans.AI functions and classification: The provider describes AI-supported document analysis and compliance reports. The assistant creates drafts for data protection impact assessments and data processing agreements and supports supplier assessments and the identification of NIS2 gaps.[22] [21] · Specific AI functions documented
Draft data protection impact assessments · Analyse compliance documents · Support supplier assessments · Create compliance reports
AI evidence: [22] [21] · Access and demo are offered on request. Confirm specific modules, AI scope and approval processes before procurement.
Source check: 2026-10-15
Complyance · Product: Complyance Enterprise GRC; Core AI; Controls AI Agents · Headquarters: United Kingdom [23] · Securely Technology Limited; Complyance US Inc.Documented focus: Complyance connects internal controls, risks, policies, evidence and third parties in a GRC platform. Controls receive defined test criteria; identified gaps are processed as measures with owners and deadlines. Built-in AI suggests control and evidence mappings. Supplementary agents check incoming evidence, explain anomalies and support follow-up through to remediation.AI functions and classification: Documented by the vendor: Core AI recommends existing evidence for controls, maps suitable controls to risks and drafts treatment or improvement measures. Additional Controls AI Agents check evidence against defined criteria, justify anomalies and create assigned measures.[24] [25] [26] [23] [27] · Specific AI functions documented
Map evidence to controls · Review control evidence · Link risks and controls · Draft treatment measures
AI evidence: [25] [24] [26] · According to the vendor, Core AI is included by default in every deployment and can be switched off; specialised AI Agents are offered as optional add-on functions. Documented by the vendor, not tested in practice.
Source check: 2026-10-14
Compyl · Product: CompylDocumented focus: Connects governance, risks, compliance, supplier assessments and audit reports. Controls, integrations and current evidence form a shared programme status.AI functions and classification: Compyl describes AI for policy drafts, questionnaire answers, supplier assessments and natural-language queries of the organisation's own GRC data. Results are submitted for human review.[28] [29] · Specific AI functions documented
Draft policies · Pre-fill security questionnaires · Prepare supplier assessments · Query GRC data in dialogue
AI evidence: [28] · Documented by the vendor; the separate Agent Library is labelled as Coming Soon. Not tested in practice.
Source check: 2026-10-14
Confidata · Product: Confidata GRC / IA Assessora · Headquarters: Brazil [30] · KNOW FOREVER TECNOLOGIA LTDA, CNPJ 61.231.772/0001-29, São Paulo. Terms of use dated 05.10.2026 confirm a change of name with unchanged CNPJ. · KNOW FOREVER TECNOLOGIA LTDA; KNOW FOREVER SERVIÇOS EDUCACIONAIS LTDA; Confidata IA AssessoraDocumented focus: GRC platform for data protection, enterprise risks, third parties, compliance programmes and audits with a focus on Brazilian requirements. Connects assessments, controls, tasks and evidence.AI functions and classification: The context-specific AI assistant suggests controls and priorities, creates policy drafts and analyses supplier contracts against regulatory frameworks. Suggestions use the data and open tasks of the respective organisation.[31] [32] [33] [30] · Specific AI functions documented
Suggest controls and priorities · Draft policies · Check supplier contracts for compliance
AI evidence: [32] · Commercial modular SaaS offering with demo; according to the pricing page, IA Assessora is included in every module combination. Additional AI automation is a separate module area.
Source check: 2026-10-15
Continuum GRC · Product: A.ITAM / AITAMBot · Headquarters: USA [34] · A.ITAM; AITAMBot; IT Audit Machine; ITAMDocumented focus: Continuum GRC bundles risk management, control testing, audit evidence and policies in A.ITAM. The platform supports several compliance frameworks as well as topics such as supplier risks, data protection and internal controls. Shared evidence and mappings facilitate parallel audits. Policy processes with versioning and approvals supplement the management of risks and controls within the same software.AI functions and classification: The product FAQ describes AITAMBot for evidence collection, control mapping, risk detection and report creation. The vendor information on AI support was documented, but neither the degree of automation nor the quality of the results generated was tested in practice.[35] [34] · Specific AI functions documented
Control mapping · Evidence collection · Risk detection · Draft reports
AI evidence: [35] · Documented by the vendor; AITAMBot is described as part of the platform offered; not tested in practice.
Source check: 2026-10-14
Copla · Product: Copla GRC Platform · Headquarters: Lithuania [36] · Cyber upgrade, UAB; CyberUpgrade; CoplaDocumented focus: Copla connects compliance, risk management, supplier reviews and information security in a shared platform. Risks, controls, evidence and responsibilities are linked with one another. Document approvals, version management and an audit area support ongoing implementation. In addition to the software, CISO services are part of the offering; subject-matter assessments therefore remain part of a supported process.AI functions and classification: The AI creates company-specific policies from operational information and aligns the drafts with framework requirements. Documents are linked with controls, risks and assets and then reviewed and approved.[37] [38] [36] [39] · Specific AI functions documented
Drafts of company-specific compliance policies · Alignment of policies with framework requirements
AI evidence: [38] · Software documented by the vendor with CISO support and approval workflows; agree the specific contractual scope. No product test.
Source check: 2026-10-14
Corporater · To the detailed profile · Headquarters: Norway [40] · Corporater AS; explicit headquarters Stavanger, Norway; international regional companies listed separately.Documented focus: Governance, performance, risk and compliance in a digital organisational model.AI functions and classification: The integrated assistant TIVA supports recording risks and incidents, processing compliance tasks and triggering workflows in natural language.[41] [42] · Specific AI functions documented
Risk recording · Incident recording · Compliance tasks · Workflow actions
AI evidence: [42] · According to the provider, selected AI functions require Corporater UnifAI. The actual scope depends on the configured solution and the permissions set up.
Source check: 2026-10-14
CRISAM GRC · To the detailed profile · Headquarters: Austria [43] · Provider CALPANA business consulting GmbH, Linz, company register 261730y. German subsidiary in Hamburg additionally listed; no inference about the main provider drawn from its address.Documented focus: Methodical risk management, multi-compliance, information security, ICS, BCM and audit.AI functions and classification: CRISAM AI Risk Assistance suggests context-specific risks, suitable measures and controls. The extension also describes regulatory relevance notes and AI-supported supplier risk analyses.[44] [45] · Specific AI functions documented
Risk identification · Measure suggestions · Control recommendations · Supplier risk analysis
AI evidence: [45] · Extension of the CRISAM GRC platform documented by the vendor; predefined or customer-specific models configurable. No product test.
Source check: 2026-10-14
CShift · Product: Fidureon · Headquarters: Sweden [46] · Vendor names CShift AB, Org. No. 559375-6108, with an address in Gothenburg. Fidureon is its product and is not counted separately. · CShift AB; FidureonDocumented focus: Fidureon connects requirements, controls, risks, suppliers and evidence with data protection and security registers. Consultancies can manage several customer workspaces and document assessments with findings and measures.AI functions and classification: The assistant answers questions about the organisation's own risks and controls. AI suggests mappings of imported controls, evaluates documents for readiness assessments and creates suggested measures. Agent actions are logged; the permitted degree of automation is configurable.[47] [46] [48] · Specific AI functions documented
Map controls to requirements · Assess compliance documents · Query risk and control inventory · Suggest measures
AI evidence: [47] · Subscription with demo and set-up customer workspaces. The AI process designer is explicitly experimental; not every automation is an AI function.
Source check: 2026-10-15
cSquare GRC · Product: cSquare; Fibo · Headquarters: USA [49] · Partner source names JNN Group, Inc. in Pasadena; terms of use name cSquare GRC, Inc. Clarify the contractual partner specifically. Counted as one provider group. · c²; cSquare GRC, Inc.; JNN Group, Inc.Documented focus: cSquare connects compliance requirements, controls and evidence across several frameworks. RegGenome provides structured regulatory content; access is intended via the user interface and integrations.AI functions and classification: Fibo creates suggestions, drafts, summaries and analyses. The partner documentation describes AI-supported gap analyses, policy creation and control mapping with regulatory source data.[49] [50] [51] · Specific AI functions documented
Analyse compliance gaps · Draft policies · Map controls to regulatory requirements
AI evidence: [49] [50] · Partner source states availability of the RegGenome integration from Q2 2026 for enterprise customers and implementation partners. AI outputs must be reviewed on subject-matter grounds.
Source check: 2026-10-15
CURADocumented focus: CURA bundles enterprise risks, compliance, internal audit, incidents and business continuity on a configurable platform.AI functions and classification: CURA describes AI and machine learning for risk forecasts from internal and external data, scenario simulations and suggestions for countermeasures. Results depend on data and model assumptions.[52] [53] · Specific AI functions documented
Forecast risk events · Simulate risk scenarios · Suggest countermeasures
AI evidence: [53] · Documented by the vendor; no product test.
Source check: 2026-10-14
CyberArrow · Product: CyberArrow GRC · Headquarters: United Arab Emirates [54] · The vendor describes Dubai as its starting point and base for expansion. Further international offices are listed; the location information does not automatically determine the legal entity of a specific contract. · CyberArrow GRC; EBDAADocumented focus: CyberArrow GRC connects risk assessments, compliance requirements, policies, internal controls and audit evidence. Integrations support the ongoing capture of control information and the preparation of audits. The platform covers several security and governance frameworks and provides status information for subject-matter owners, management and auditors in shared workflows.AI functions and classification: CyberArrow explicitly describes an AI-supported gap analysis that identifies missing controls and suggests suitable remediation.[55] [56] [54] [57] [58] [59] · Specific AI functions documented
Identify missing controls · Suggest remediation for control gaps
AI evidence: [56] · Function of CyberArrow GRC documented by the vendor; model and licence package not specified in more detail. No product test.
Source check: 2026-10-14
Cybervize · Product: OdySecure / OdySecure Navigator · Headquarters: Germany [60] · Cybervize Operations GmbH, Düsseldorf, HRB 101821; legal notice also names Cybervize Consulting GmbH, HRB 101465. Counted as one provider group. · Cybervize Operations GmbH; Cybervize Consulting GmbH; OdySecure; OdySecure NavigatorDocumented focus: OdySecure connects ISMS, assessments, business continuity, third-party risk and awareness. Risks, measures, controls, approvals and evidence access shared organisational data.AI functions and classification: The available Navigator answers governance questions from the data of the customer's own tenant, for example on the largest risks and audit readiness. Answers name sources and key figures and take read permissions into account; missing data is flagged.[61] [60] · Specific AI functions documented
Query risks in natural language · Explain audit readiness on the basis of own data · Provide sources for governance answers
AI evidence: [61] · Navigator explicitly described as available. More advanced acting AI agents are in the design partner programme and not yet generally available. Implementation and module scope are agreed.
Source check: 2026-10-15
CypherOn · Product: Observa · Headquarters: Czechia [62] · The contractual terms name a sole trader operating in Prague as operator under the CypherOn brand; a corporation or s.r.o. is not inferred from this. · CypherOn; Observa; Waldemar KučeraDocumented focus: Observa is a GRC platform for security and compliance teams with asset management, risk register, gap analyses, policies and supplier management. It supports, among other things, Czech cyber security requirements as well as European frameworks. An integrated assistant makes company data and regulatory content accessible. Access can be limited per module; prepared changes are logged after human confirmation.AI functions and classification: The Observa assistant answers risk and compliance questions from released company data, explains regulatory requirements and creates risk or management summaries. New risk and other GRC records are submitted for confirmation before being written.[63] [64] [62] [65] · Specific AI functions documented
Answer risk and compliance questions on company data · Explain regulatory requirements with sources · Summarise risks for management reports · Prepare GRC records for human confirmation
AI evidence: [64] [63] · AI is assigned to the Enterprise plan; usage budget and module permissions apply. Information on the AI scope in the free trial is inconsistent and therefore not assured. No product test.
Source check: 2026-10-14
Decision Focus · Product: Decision Focus GRC · Headquarters: Denmark [66] · The vendor page explicitly names headquarters in Denmark; the contact page names Banevænget 13, 3460 Birkerød. No statement on hosting or ownership structure derived from the headquarters. · LinkGRCDocumented focus: Configurable GRC platform with audit planning, audit execution, measures and reports. Audit work is connected with risk and control frameworks as well as compliance and resilience.AI functions and classification: The AI tools suggest additional risks and controls, answer questions about policies and check documents against GRC data for possible compliance gaps. Suggestions are based on configured assessment criteria.[66] [67] [68] [69] · Specific AI functions documented
Suggest risks and controls · Query policies and regulatory texts · Flag compliance gaps · Summarise GRC records
AI evidence: [68] [69] · Documented by the vendor; AI models and specifications are configured for the organisation. Writing by Intelligence only after approval. Not tested in practice.
Source check: 2026-10-14
DELTA RM · Product: DELTA RM GRC & RMIS · Headquarters: France [70] · Delta Risk ManagementDocumented focus: DELTA RM combines enterprise risk management with incidents, insurance, prevention, internal control system and internal audit. Risks can be tracked via assessments, key figures and action plans. The insurance link supplements the classic GRC perspective, particularly in the joint management of risks, losses and cover.AI functions and classification: DELTA RM describes AI agents that evaluate insurance documents, detect missing claims documents, assess control evidence and draft compliance reports.[71] [72] [70] [73] · Specific AI functions documented
Evaluate insurance and claims documents · Assess control evidence · Draft compliance reports
AI evidence: [71] · Documented by the vendor; agree the specific licence and implementation scope. No product test.
Source check: 2026-10-14
deveca · Product: deveca · Headquarters: Germany [74] · Provider identification: Kevin Carter (deveca GRC), c/o MDC#deveca, Welserstraße 3, Dietmannsried, Germany. No GmbH or other undocumented legal form added. Geography checked on 15.10.2026; no inference of hosting or owners from the headquarters.Documented focus: Bundles ISMS, IT and business risks, measures, data protection and whistleblowing cases in a multi-tenant platform.AI functions and classification: deveca describes AI for checking evidence, identifying gaps in framework matching and drafting records of processing activities and data protection impact assessments.[75] [74] · Specific AI functions documented
Review evidence · Identify framework gaps · Create RoPA drafts · Create DPIA drafts
AI evidence: [75] · Documented by the vendor; DORA, SOC 2 and PCI DSS are still listed as Coming Soon on the same page; no product test.
Source check: 2026-10-14
DigitalXForce · Product: DigitalXForce TRiSCM / AI JedAI / XForce GPT · Headquarters: USA [76] · The vendor website names a contact address in Irving, Texas, USA. The structured organisational data confirms the country US. This replaces the previous sole location evidence via LinkedIn; register and ownership checks remain separate from this. · DigitalXForce Corporation; AI JedAI; XForce GPTDocumented focus: Platform for GRC, ongoing control testing, cyber risks, third parties and compliance evidence.AI functions and classification: AI JedAI analyses control evidence and recommends remediation measures. XForce GPT creates risk descriptions and board reports; further AI functions support supplier documents and policies.[77] [78] [79] [76] · Specific AI functions documented
Analyse control evidence · Recommend remediation measures · Create risk and board reports
AI evidence: [77] [78] · Current commercial offering with demo; DigitalXForce Lite is offered as a hosted variant.
Source check: 2026-10-15
Diligent One · To the detailed profile · 3rdRiskDocumented focus: Board work, audit, risk and compliance with reports for management and supervisory bodies.AI functions and classification: AI Risk Essentials identifies and compares strategic and operational risks on the basis of public company reports. Further Diligent AI functions condense board documents and support the preparation and follow-up of committee meetings.[80] [81] [82] [83] · Specific AI functions documented
Risk identification · Risk benchmarking · Condense committee documents
AI evidence: [83] [81] · Risk Essentials and the AI functions for committee work belong to different Diligent products. Check product and licence scope separately; no blanket evidence of the availability of all AI functions in every Diligent One installation.
Source check: 2026-10-14
Dimeri · Product: GRC platform / AI Assistant · Headquarters: South Africa [84] · Dimeri (Pty) Ltd; contact address 9 Lena Ahrens Road, Glenwood, Durban, South Africa. · Dimeri (Pty) LtdDocumented focus: Platform for enterprise risks, compliance, internal audit, governance and third parties. Offered for companies and consultancies with separate customer workspaces.AI functions and classification: The AI assistant uses linked controls, audit history and frameworks for justified risk assessments. It drafts referenced controls, prioritises regulatory changes, answers questions from policies and evidence and prepares audit packages.[85] [86] [84] · Specific AI functions documented
Assess risks with justification · Draft controls with framework reference · Evaluate compliance gaps and evidence
AI evidence: [86] · Free workspace and demo publicly offered; the assistant is described as an existing function.
Source check: 2026-10-15
DISS-CO · Product: Smart Integrity Platform (SIP) · Headquarters: Germany [87] · Legal notice names DISS-CO GmbH in Wedel, HRB 17964 PI. The privacy policy additionally uses the place name Hamburg; assignment to Germany is consistent. · DISS-CO GmbH; Smart Integrity Platform; SIP; diss-co.techDocumented focus: The Smart Integrity Platform bundles whistleblowing cases, complaints, third-party due diligence, risks and compliance reports. Further modules support due diligence obligations and information security requirements.AI functions and classification: DISS-CO describes AI for categorising reports, analysing adverse media reports as well as for gap analyses and control mapping. Multi-stage AI workflows are intended to support recurring compliance tasks.[88] [87] · Specific AI functions documented
Categorise reports and complaints · Analyse adverse media reports · Map controls · Analyse compliance gaps
AI evidence: [88] · Demo and modular product offerings available. Agree AI modules, approvals and, where applicable, on-premises operation separately; automation rates not independently verified.
Source check: 2026-10-15
Dmaze · Product: Dmaze · Headquarters: Norway [89] · Proactima Solutions AS; Proactima; UXRiskDocumented focus: Dmaze is a configurable platform for risk management, information security, compliance and audits. Templates structure assessments, controls, evidence and measures with assigned responsibilities. Further areas of application include data protection, quality management and business continuity. For evaluation, the provider offers a Power BI connector as well as reports in Office formats and an interface for integrating other systems.AI functions and classification: Dmaze suggests risks as well as suitable controls and measures from project contexts. For incidents, the vendor mentions support with causes and preventive measures; saving requires a user decision.[90] [91] [92] · Specific AI functions documented
Suggest risks from project descriptions · Recommend controls and mitigation measures · Suggest causes and prevention for incidents
AI evidence: [91] · Documented by the vendor as integrated suggestions; acceptance or editing by users. Not tested in practice.
Source check: 2026-10-14
DotCoAi · Product: DotCoAi GRC Platform · Headquarters: Singapore [93] · Contact page names an office in Singapore. The terms of use name DotCo Pte. Ltd., in the contact section differently DotCoAi Pte. Ltd.; confirm the exact contracting company during procurement. Both names are counted once. · DotCo Pte. Ltd.; DotCoAi Pte. Ltd.Documented focus: DotCoAi connects risk management, compliance, internal audit and supplier reviews with an additional module for AI governance. Audit planning, working papers, findings and measures are managed together.AI functions and classification: The product page describes AI for prioritising risk-based audit plans and for preparing working papers from connected systems and previous audits. This documents AI functions within internal audit, beyond the governance of AI systems.[94] [95] [93] · Specific AI functions documented
Prioritise audit plans on a risk basis · Prepare working papers from existing audit data · Create audit reports from working papers
AI evidence: [94] · The vendor offers SaaS subscriptions and a demo. Functional scope and performance were not tested by us.
Source check: 2026-10-15
Durava · Product: Durava GRC · Headquarters: Germany [96] · Durava GmbHDocumented focus: Durava combines internal audit, internal controls, risk management and compliance in one platform. Requirements, controls and evidence are linked to one another; findings feed into the assessment of control effectiveness. Audit planning, action tracking and information security management complete the scope. Suggestions from document analysis are reviewed by the responsible persons before they are adopted.AI functions and classification: The AI extracts controls from policies and process descriptions, compares regulatory requirements with existing evidence and flags gaps with source references. The vendor additionally documents suggestions for risk assessments. Results are provided for human review.[97] [96] · Specific AI functions documented
Extract controls from documents · Match requirements and evidence · Show compliance gaps with source references · Suggest risk assessments
AI evidence: [97] · Documented by the vendor; not tested in practice
Source check: 2026-10-14
EasyAudit · Product: EasyAudit / AI Compliance Officer · Headquarters: Canada [98] · The vendor press kit names Toronto, Ontario, as headquarters. The current terms of use name EasyAudit Inc.; the choice of Delaware law stated there is not interpreted as a different company seat. · EasyAudit Inc.; AI Compliance OfficerDocumented focus: EasyAudit combines a compliance platform with assisted delivery by compliance professionals. Controls, evidence, policies, risks and actions are managed for several audit frameworks in one shared programme.AI functions and classification: The AI Compliance Officer drafts policies and documentation from company data, suggests controls and prepares remediation actions. Documents are assigned to the matching controls in context. Answers draw on linked programme data; binding statements and publications require human approval.[99] [100] [101] [98] · Specific AI functions documented
Draft policies from programme data · Assign documents to relevant controls · Prepare remediation actions from compliance gaps
AI evidence: [99] [100] · Commercial offering with a demo and an assisted compliance programme. The software is part of this offering; no independently tested evidence of performance is available.
Source check: 2026-10-15
Empliance Technologies · Product: OneSecure / GIA · Headquarters: India [102] · Empliance Technologies Pvt. Ltd.; the current vendor page names Gurugram as headquarters and a further office in Mumbai. The legal text names the operating company. · Empliance Technologies Private Limited; Empliance Technologies Pvt. Ltd.; OneSecure; GIA; OneVision; OneMerchantDocumented focus: GRC platform for risks, controls, policies, evidence and audits with a focus on regulated Indian companies. Complementary products and consulting services cover third-party and merchant processes.AI functions and classification: The AI agent GIA analyses evidence gaps and assigns artefacts to relevant controls. A Policy Reviewer checks policies for completeness, regulatory mapping, duplications and outdated content.[102] [103] [104] · Specific AI functions documented
Analyse evidence gaps · Assign artefacts to controls · Check policies for gaps
AI evidence: [103] · The platform and complementary specialist services are offered commercially with a demo. Specific GIA agents, licence scope and productive use must be confirmed in the offer.
Source check: 2026-10-15
Empowered Systems · Product: Connected Risk · Connected Risk; AutoAudit; Empowered ESGDocumented focus: Connects GRC data, analyses, reports and collaboration. Document management, versioning and relationships between business objects support traceable governance and risk processes.AI functions and classification: The Connected Risk pages checked describe GRC workflows and the governance of models. General articles on AI in GRC do not document a specific, integrated AI work step of the product.[105] [106] [107]Not specifically documented in the source check
Product and domain search; governance of AI not equated with the product's own AI support.
Sources checked: [105] [106] [107] · No specific AI function documented in the sources checked.
Source check: 2026-10-14
eramba · Headquarters: United Kingdom [108] · Eramba Limited, Companies House 09524547, active; registered office 71–75 Shelton Street, London. The provider website lists the same London office and additionally an office in Bratislava. Country classification follows the registered provider legal entity. Geography checked on 15.10.2026; no inference about hosting or owners from the registered office.Documented focus: Open GRC software covering risks, internal controls, compliance, policies, incidents and data protection; Community and Enterprise offerings.AI functions and classification: The MCP connection links eramba to a language model of the user's own choosing. Documented uses are queries of GRC data, checking policies against requirements and deriving risk profiles from assessments.[109] [110] [111] [112] [108] [113] · Specific AI functions documented
Query GRC data in natural language · Check policies against requirements · Evaluate assessment results into risk profiles
AI evidence: [111] [112] · MCP connection with the user's own LLM provider; release 3.31.0 documented. The learning guide still contains an experimental release note; confirm availability per instance. No product test.
Source check: 2026-10-14
ESG Innova Group · Product: GRCTools; ISOTools; ESGTools; HSETools · Headquarters: Spain [114] · GRCTools; ISOTools; ESGTools; HSETools; Proyectos y Consultoría de Innovación Tecnológica S.L.Documented focus: The GRCTools product line supports governance, enterprise risk and regulatory compliance. The portfolio includes, among other things, information security, third-party risk and event and incident management. The complementary lines ISOTools, ESGTools and HSETools connect these tasks with management systems, sustainability and occupational health and safety within the same provider group.AI functions and classification: GRCTools mentions AI in indexed product information. The specific functional check remains open: an accessible sustainability page describes automation, while current platform, ERM and brochure content cannot be retrieved reliably.[115] [116] [117] [114] [118] [119] [120]Source check still open
Sustainability page and indexed official GRI description read. Search metadata and page bodies of differing currency, as well as timeouts of the central sources, prevent the final AI check.
Sources checked: [119] [120] · Detailed check open; central product pages and brochure not reachable when retrieved.
Source check: 2026-10-14
Euraika · Product: Euraika GRC; Euraika AI Assistant · Headquarters: Belgium [121] · The legal notice names Euraika BV, Leuvenselaan 13 in Tienen, Belgium, and KBO/BCE 1033.543.413. · Euraika BV; Euraika GRC; Aegis; aegis.euraika.netDocumented focus: Euraika GRC connects risks, controls, policies, supplier assessments and evidence with audit and data protection workflows. The platform supports European security and compliance frameworks including the Belgian CyFun.AI functions and classification: The assistant answers questions on the basis of organisation-specific data with source references. AI suggests risk treatments, analyses supplier gaps, improves policies and drafts answers to security questionnaires. Suggestions and agent runs are reviewed by humans.[122] [121] [123] · Specific AI functions documented
Supplement risks and actions · Analyse supplier gaps · Revise policies · Answer security questionnaires · Query compliance data with sources
AI evidence: [122] · Offered as a platform with trial access and a demo; AI quotas and additional functions depend on the pricing plan. No automatic compliance approval.
Source check: 2026-10-15

Sources.

The numbers in square brackets refer to this list. It is numbered consecutively for this page.

  1. C1Risk: main source, AI evidence checked 14.10.2026
  2. C1Risk: vendor source, AI evidence checked 14.10.2026
  3. calQrisk: main source checked 14.10.2026
  4. calQrisk: vendor source, AI announcement checked 14.10.2026
  5. Cerivo: headquarters evidence checked 14.10.2026
  6. Cerivo: main source checked 14.10.2026
  7. Cerivo: vendor source checked 14.10.2026
  8. Cerivo: vendor source checked 14.10.2026
  9. Cerivo: vendor source checked 14.10.2026
  10. Cerivo: vendor source checked 14.10.2026
  11. Cerpent: vendor source, headquarters evidence checked 15.10.2026
  12. Cerpent: main source, AI evidence checked 15.10.2026
  13. Cerpent: vendor source checked 15.10.2026
  14. Cerpent: vendor source, AI evidence checked 15.10.2026
  15. CERRIX: headquarters evidence checked 14.10.2026
  16. CERRIX: main source, AI evidence checked 14.10.2026
  17. Checka: vendor source, headquarters evidence checked 15.10.2026
  18. Checka: main source, AI evidence checked 15.10.2026
  19. CoAudit Group: vendor source, headquarters evidence checked 14.10.2026
  20. CoAudit Group: main source checked 14.10.2026
  21. Compilo: vendor source, AI evidence, headquarters evidence checked 15.10.2026
  22. Compilo: main source, AI evidence checked 15.10.2026
  23. Complyance: vendor source, headquarters evidence checked 14.10.2026
  24. Complyance: main source, AI evidence checked 14.10.2026
  25. Complyance: vendor source, AI evidence checked 14.10.2026
  26. Complyance: vendor source, AI evidence checked 14.10.2026
  27. Complyance: vendor source checked 14.10.2026
  28. Compyl: main source, AI evidence checked 14.10.2026
  29. Compyl: vendor source checked 14.10.2026
  30. Confidata: vendor source, headquarters evidence checked 15.10.2026
  31. Confidata: main source checked 15.10.2026
  32. Confidata: vendor source, AI evidence checked 15.10.2026
  33. Confidata: vendor source checked 15.10.2026
  34. Continuum GRC: vendor source, headquarters evidence checked 14.10.2026
  35. Continuum GRC: main source, AI evidence checked 14.10.2026
  36. Copla: vendor source, headquarters evidence checked 14.10.2026
  37. Copla: main source checked 14.10.2026
  38. Copla: vendor source, AI evidence checked 14.10.2026
  39. Copla: vendor source checked 14.10.2026
  40. Corporater: headquarters evidence checked 14.10.2026
  41. Corporater: Business Management Platform Corporater · vendor source, checked 14.10.2026
  42. Corporater AI Corporater · vendor description · retrieved/checked 13.10.2026
  43. CRISAM GRC: headquarters evidence checked 14.10.2026
  44. CRISAM: risk management and integrated GRC platform CRISAM · vendor source, checked 14.10.2026
  45. CRISAM AI Risk Assistance CRISAM · vendor source, AI evidence, checked 14.10.2026
  46. CShift: vendor source, headquarters evidence checked 15.10.2026
  47. CShift: main source, AI evidence checked 15.10.2026
  48. CShift: vendor source checked 15.10.2026
  49. cSquare GRC: main source, AI evidence, headquarters evidence checked 15.10.2026
  50. cSquare GRC: vendor source, AI evidence checked 15.10.2026
  51. cSquare GRC: vendor source checked 15.10.2026
  52. CURA: GRC platform and solutions CURA · vendor source, checked 14.10.2026
  53. CURA: Predictive Analytics CURA · vendor source, AI evidence, checked 14.10.2026
  54. CyberArrow: vendor source, headquarters evidence checked 14.10.2026
  55. CyberArrow: main source checked 14.10.2026
  56. CyberArrow: vendor source, AI evidence checked 14.10.2026
  57. CyberArrow: vendor source checked 14.10.2026
  58. CyberArrow: vendor source checked 14.10.2026
  59. CyberArrow: vendor source checked 14.10.2026
  60. Cybervize: vendor source, headquarters evidence checked 15.10.2026
  61. Cybervize: main source, AI evidence checked 15.10.2026
  62. CypherOn: vendor source, headquarters evidence checked 14.10.2026
  63. CypherOn: main source, AI evidence checked 14.10.2026
  64. CypherOn: vendor source, AI evidence checked 14.10.2026
  65. CypherOn: vendor source checked 14.10.2026
  66. Decision Focus: main source, headquarters evidence checked 14.10.2026
  67. Decision Focus: vendor source checked 14.10.2026
  68. Decision Focus: vendor source, AI evidence checked 14.10.2026
  69. Decision Focus: vendor source, AI evidence checked 14.10.2026
  70. DELTA RM: vendor source, headquarters evidence checked 14.10.2026
  71. DELTA RM: main source, AI evidence checked 14.10.2026
  72. DELTA RM: vendor source checked 14.10.2026
  73. DELTA RM: vendor source checked 14.10.2026
  74. deveca: vendor source, headquarters evidence checked 14.10.2026
  75. deveca: main source, AI evidence checked 14.10.2026
  76. DigitalXForce: vendor source, headquarters evidence checked 15.10.2026
  77. DigitalXForce: main source, AI evidence checked 15.10.2026
  78. DigitalXForce: vendor source, AI evidence checked 15.10.2026
  79. DigitalXForce: vendor source checked 15.10.2026
  80. Diligent One Platform Diligent · vendor source, checked 14.10.2026
  81. Diligent AI Diligent · vendor source, AI evidence, checked 14.10.2026
  82. Diligent One: vendor source checked 14.10.2026
  83. Diligent One: vendor source, AI evidence checked 14.10.2026
  84. Dimeri: vendor source, headquarters evidence checked 15.10.2026
  85. Dimeri: main source checked 15.10.2026
  86. Dimeri: vendor source, AI evidence checked 15.10.2026
  87. DISS-CO: vendor source, headquarters evidence checked 15.10.2026
  88. DISS-CO: main source, AI evidence checked 15.10.2026
  89. Dmaze: headquarters evidence checked 14.10.2026
  90. Dmaze: main source checked 14.10.2026
  91. Dmaze: vendor source, AI evidence checked 14.10.2026
  92. Dmaze: vendor source checked 14.10.2026
  93. DotCoAi: vendor source, headquarters evidence checked 15.10.2026
  94. DotCoAi: main source, AI evidence checked 15.10.2026
  95. DotCoAi: vendor source checked 15.10.2026
  96. Durava: vendor source, headquarters evidence checked 14.10.2026
  97. Durava: main source, AI evidence checked 14.10.2026
  98. EasyAudit: vendor source, headquarters evidence checked 15.10.2026
  99. EasyAudit: main source, AI evidence checked 15.10.2026
  100. EasyAudit: vendor source, AI evidence checked 15.10.2026
  101. EasyAudit: vendor source checked 15.10.2026
  102. Empliance Technologies: main source, headquarters evidence checked 15.10.2026
  103. Empliance Technologies: vendor source, AI evidence checked 15.10.2026
  104. Empliance Technologies: vendor source checked 15.10.2026
  105. Empowered Systems: main source checked 14.10.2026
  106. Empowered Systems: vendor source checked 14.10.2026
  107. Empowered Systems: vendor source checked 14.10.2026
  108. eramba: register entry, headquarters evidence checked 14.10.2026
  109. eramba: Open and Enterprise GRC eramba · vendor source, checked 14.10.2026
  110. eramba: module and LLM documentation eramba · vendor source, checked 14.10.2026
  111. eramba: vendor source, AI evidence checked 14.10.2026
  112. eramba: vendor source, AI evidence checked 14.10.2026
  113. eramba: vendor source checked 14.10.2026
  114. ESG Innova Group: vendor source, headquarters evidence checked 14.10.2026
  115. ESG Innova Group: main source source check pending, as of 14.10.2026
  116. ESG Innova Group: vendor source source check pending, as of 14.10.2026
  117. ESG Innova Group: vendor source source check pending, as of 14.10.2026
  118. ESG Innova Group: vendor source source check pending, as of 14.10.2026
  119. ESG Innova Group: vendor source checked 14.10.2026
  120. ESG Innova Group: vendor source checked 14.10.2026
  121. Euraika: vendor source, headquarters evidence checked 15.10.2026
  122. Euraika: main source, AI evidence checked 15.10.2026
  123. Euraika: vendor source checked 15.10.2026
Back to top