T-NEX
Menu
DEEN
GRC provider register · Category 2 of 11

GRC software for risk analysis & internal controls:
27 providers with AI classification.

In short: The T-NEX GRC provider register lists 27 providers for risk analysis and internal control systems, as of 18 October 2026. Of these, 21 document specific AI functions (78%), most often for risk analysis. In Germany, Austria or Switzerland, 15 have a documented headquarters, ten of them in Germany.

By and Published: As of: · Category page of the GRC provider register Reviewed by Andreas Unruh and Christoph Gembruch, managing directors of T-NEX GmbH, on
Illustration: globe with networked GRC providers whose AI evidence flows into a checked provider register

Neither completeness nor a general suitability for banks is claimed. Providers are listed alphabetically. The order is not a performance rating.

All 682 GRC providers in the market overview · 379 European GRC providers

Publisher: T-NEX GmbH. Andreas Unruh and Christoph Gembruch are managing directors of T-NEX. This editorial market overview is based on vendor sources and specialist primary sources. It contains no ranking and is not based on a joint product test. The market overview covers 682 providers from GRC and adjacent specialist areas. Acquired brands and former product names are not counted separately. Methodology and sources

Context

What does software for risk analysis and the internal control system (ICS) cover?

Software for risk analysis and the internal control system (ICS) covers tools for risk inventories and risk assessment, often labelled enterprise risk management (ERM), for the internal control system with controls and control testing, and for reviewing access rights and segregation of duties (SoD). Several entries specialise in SAP access rights and segregation of duties. Relative to its size, no other category in the register has as many providers with a documented headquarters in Germany, Austria or Switzerland. Three of them are based in Switzerland, two in Austria.

  • No specific AI function in the sources checked: 6 entries
  • Documented AI use cases by topic, an entry can count more than once: Risk analysis (11) · Risk treatment proposals (8) · Audit and control tasks (8) · Document drafting (8) · Conversational queries of GRC content (6)
  • Documented headquarters in Europe: 20 of 27 providers, headquarters not separately checked: 4

Questions for the demo, derived from the five criteria of the comparison:

  • Can the risk assessment, control and test evidence be traced back to the original information?
  • Who may accept, change or reject an AI suggestion for risk treatment, and does the decision remain traceable?

What are the MaRisk rules for the risk inventory?

Under MaRisk AT 2.2 para. 1, senior management obtains an overview of the institution's risks, the overall risk profile, through a risk inventory carried out regularly and when there is cause. At least counterparty default, market, liquidity and operational risks are generally material; according to the explanatory note, ICT risks are part of operational risk and must be included explicitly. In the economic perspective, a materiality threshold of 5% of the risk coverage potential (Risikodeckungspotenzial) is accepted as appropriate.

What makes up a bank's internal control system?

In particular, rules on organisational structure and workflows, processes to identify, assess, manage, monitor and communicate risks, and an independent risk control function and an independent compliance function (Section 25a(1) KWG, MaRisk AT 4.3). AT 4.3.1 para. 1 requires incompatible activities to be carried out by different employees. In lending, trading and real estate business, appropriate procedures and safeguards must ensure segregation of duties where processing is ICT-supported (BTO para. 7). This is where access review tools come in.

Which MaRisk rules apply when AI assesses risks?

The relevant module is MaRisk AT 4.3.4 on the use of models; under para. 1 it expressly covers artificial intelligence and, according to the explanatory note, also models developed by a third party. The institution assesses appropriateness and suitability before use (para. 2), sets rules for using the results including overrides (para. 4) and validates regularly (para. 5); para. 6 requires sufficient explainability. Whether an AI suggestion in a GRC tool counts as a model is for the institution to assess case by case.

Which providers of GRC software for risk analysis & internal controls are headquartered in Germany, Austria or Switzerland?

Of the 27 providers, 15 have a documented headquarters in Germany, Austria or Switzerland: in Germany antares RiMIS, Auxilius.ai, CAQ AG, Ciqualia, ConSense, DextraData, Inspirient, parcIT, Soterion and Wehrspohn; in Austria Fecton and risk on mind; in Switzerland Abel Systems, OPTURE and Xiting. For four further providers, the headquarters has not been checked separately; they are not included in this list. Headquarters means the seat of the provider entity named in the entry, documented by the entry's location source (imprint, legal texts, official contact and company pages, occasionally official registers); it says nothing about ownership, hosting or data storage.

Regulatory framework.

  • Section 25a(1) KWG (German Banking Act): internal control procedures with an internal control system and an independent internal audit function (Source: gesetze-im-internet.de, in German)
  • MaRisk AT 2.2, AT 4.3 to 4.3.2 and BTO para. 7, BaFin Circular 06/2026 (BA): risk inventory, organisational structure and workflows, risk management and control processes, and segregation of duties in ICT-supported processing (Source: BaFin, in German)
  • MaRisk AT 4.3.4, BaFin Circular 06/2026 (BA): requirements for models including artificial intelligence, among them validation and explainability (Source: BaFin, in German)
  • Art. 9(4)(c) DORA (Regulation (EU) 2022/2554): access to information and ICT assets limited to what is required, with policies, procedures and controls for access rights (Source: EUR-Lex)

Further reading on t-nex.de: MaRisk 2026, Ninth MaRisk amendment, Replacing GRC spreadsheets and T-NEX for risk control teams.

All 27 entries: functions, AI classification and sources.

The assignment describes the offering considered, not all of the company's products. AI information names specific functions or limits of the public documentation. Scope of delivery, data storage and regional availability must be checked for each offering. Download provider overview as CSV (German), licensed under CC BY 4.0, credit “T-NEX GRC-Anbieterregister, t-nex.de”.

Is a provider missing or an entry out of date? Send us a note with a source via the contact form. Accepted changes are marked in the entry with the date they were checked.

Risk analysis & internal controls

27 entries

Risk analysis & internal controls · 27 providers
Provider / productDocumented focusAI functions and classification
Abel Systems · Product: QM-Pilot · Headquarters: Switzerland [1] · QM-Pilot; Abel Systems Uwe AbelDocumented focus: QM-Pilot combines process and document management with a separate module for opportunities, enterprise risks and ICS risks. Organisations can configure assessments, link risks with processes and assign measures and recurring control tasks. The software documents controls, reminds owners and provides risk portfolios as well as reports for audits and internal management.AI functions and classification: QM-Pilot describes an AI chat over existing processes and documents, draft texts for process descriptions and the analysis of recorded content for assessing risks and opportunities.[2] [3] [4] [1] · Specific AI functions documented
Query own processes and documents · Draft process descriptions · Analyse risks and opportunities
AI evidence: [4] · Documented by the vendor for QM-Pilot 4.0; role approval and activation required, Azure region contractually specified. No product test.
Source check: 2026-10-14
antares RiMIS · To the detailed profile · Headquarters: Germany [5] · antares Informations-Systeme GmbH; Geislingen an der Steige; HRB 540982, Ulm Local Court.Documented focus: antares RiMIS combines qualitative and quantitative risk assessment with simulation, measures and approval status.AI functions and classification: The RiMIS AI assistant suggests risk areas based on industry, business model and company context. Further AI aids support the wording and translation of risk information.[6] [7] · Specific AI functions documented
Identify company-specific risks · Word risk information · Translate risk texts
AI evidence: [6] · Documented by the vendor; translation via DeepL integration described; no product test.
Source check: 2026-10-14
Auxilius.ai · Product: Auxilius · Headquarters: Germany [8] · The legal notice names Auxilius.ai GmbH, Unterföhring, HRB 304917. Not to be confused with the clinical finance offering of the same name. · Auxilius.ai GmbH; not Auxilius Clinical Finance (auxilius.co)Documented focus: Auxilius.ai supports the ongoing monitoring of internal controls. Control coverage is linked with risks and corporate objectives; anomalies and evidence are intended to become available to owners promptly.AI functions and classification: Agents create and maintain monitoring scripts for controls. They adapt monitoring to processes, local units and changed rules; the scripts generated are described as repeatable and versioned.[9] [10] [8] · Specific AI functions documented
Create scripts for control monitoring · Adapt monitoring when rules change · Assess control coverage
AI evidence: [9] [10] · The vendor names first enterprise customers in regulated industries; a demo with the customer's own data is offered. Validate scripts and business rules before adoption.
Source check: 2026-10-15
Avertro · Product: CyberHQ / Avertro Intelligence · Headquarters: Australia [11] · CyberHQ; Avertro Intelligence; Avertro Pty LtdDocumented focus: CyberHQ supports the management of cyber risks on the basis of controls, business services and modelled loss scenarios. The platform translates technical risks into financial impacts and presents options for action for risk owners. Scenario comparisons and investment assessments help prioritise security measures; reports link control gaps with decisions at management level.AI functions and classification: Avertro documents AI-supported threat and scenario modelling as well as recommendations for investments in risk reduction. The Monte Carlo simulation, also described, is not counted here as an AI function across the board.[12] [11] · Specific AI functions documented
Risk scenario modelling · Recommendations for risk reduction · Prioritisation of investments
AI evidence: [12] · Documented by the vendor; not tested in practice.
Source check: 2026-10-14
CAQ AG · Product: CAQ.Net; QAM.Net; Risk.Net; embedded AI · Headquarters: Germany [13] · The legal notice names CAQ AG Factory Systems in Rheinböllen, Bad Kreuznach Local Court HRB 4194. · CAQ AG Factory Systems; CAQ.Net; QAM.Net; Risk.Net; CAQ.Net embedded AIDocumented focus: CAQ.Net combines quality management with audits, risk analyses and measures. QAM.Net supports audit processes; Risk.Net manages, among other things, FMEA, risk matrices and root-cause analyses.AI functions and classification: Embedded AI assistants generate audit questions from documents, suggest causes for Ishikawa analyses and draft procedural instructions. Results are provided in the respective specialist module for review and further processing.[14] [15] [13] · Specific AI functions documented
Generate audit questions · Analyse causes of risks and defects · Draft procedural instructions
AI evidence: [14] · According to the vendor, included in the current release for customers with a valid maintenance contract. Separate API access to a compatible AI provider or a separate partner service is required.
Source check: 2026-10-15
Ciqualia · Product: Complaica · Headquarters: Germany [16] · Complaica; Compliance Aspekte (former product domain redirects to Complaica)Documented focus: Complaica links requirements from different frameworks with processes, assets, risks and control tasks. Risk assessments and treatment measures are given responsibilities, deadlines and status information. Audit planning, findings and effectiveness reviews accompany implementation; reports support, among other things, statements of applicability and data protection documentation. The former product domain Compliance Aspekte now leads to a Complaica page of the provider Ciqualia.AI functions and classification: Complaica connects AI assistants to the GRC data via MCP. They answer status questions, pre-word measures and summarise cases; access is subject to user permissions.[17] [18] [19] [16] [20] · Specific AI functions documented
Query compliance status through dialogue · Pre-word measures · Summarise GRC cases
AI evidence: [18] · Can be optionally activated; local or cloud AI client via the bundled MCP server. Not tested in practice.
Source check: 2026-10-14
ConSense · Product: ConSense GRC · Headquarters: Germany [21] · ConSense GRC; ConSense IMS; ConSense PORTAL; ConSense GmbHDocumented focus: ConSense GRC combines governance, risk management and compliance with integrated information security management. Requirements and risks are linked with business processes, responsibilities and measures. Versioning and approvals support policy work; audits, dashboards and escalation workflows accompany monitoring. The fields of application named include ISO 27001, IT-Grundschutz, NIS2 and TISAX as well as internal company requirements.AI functions and classification: ConSense AI searches documents and processes on the basis of natural-language questions, generates process diagrams from documents and suggests measures for task lists. Further functions support texts and training content.[22] [23] [24] [21] [25] · Specific AI functions documented
Research in documents and processes · Document-based process creation · Recommendations for measures · Creation of training content
AI evidence: [24] · Only in the hosted ConSense PORTAL, not on-premises and not yet for GxP. AI research and speech-to-text free of charge after accepting the terms; further functions require a named-user licence. No product test.
Source check: 2026-10-14
DextraData · Product: GRASP German GRC · Headquarters: Germany [26] · GRASP; German GRC; DextraData GRC Technologies GmbHDocumented focus: GRASP brings together information security, data protection, business continuity and internal audits in a common platform. Risks are linked with controls, measures, responsibilities and evidence; for ISO 27001 the statement of applicability can be edited. Audit planning and findings as well as business impact analyses and recovery planning complement cross-departmental management and reporting within the company.AI functions and classification: GRASP describes an AI chatbot for subject-matter and application questions as well as photo analysis for audit-relevant risks. Identified findings are documented and can serve as the basis for action plans.[27] [28] [26] [29] [30] · Specific AI functions documented
Answer GRC subject-matter questions · Detect audit-relevant risks in photos · Document findings and derive action plans
AI evidence: [30] · Documented by the vendor; no product test.
Source check: 2026-10-14
Dylogy · Product: Dylogy AI Agents · Headquarters: France [31] · Dylogy is an offering of Novaa Tech SAS, RCS Lyon 949191399, France. · Novaa Tech SAS; DylogyDocumented focus: Document-based review platform with explicit workflows for compliance, audit and internal controls.AI functions and classification: AI agents classify documents, extract facts and check them against business rules. In the compliance workflow, gaps in procedures, reports and regulatory guidelines are identified and evidenced results are produced.[32] [33] [31] · Specific AI functions documented
Review internal controls · Identify regulatory documentation gaps · Produce review results with supporting evidence
AI evidence: [32] [33] · Offered commercially via demo; configurable business rules and agents.
Source check: 2026-10-15
Fecton · Product: easyGRC · Headquarters: Austria [34] · Fecton Softwarevertrieb GmbH; easyGRCDocumented focus: easyGRC from Fecton includes modules for internal controls, tax controls and risk management. The software links processes, risks and controls, imports existing risk inventories and manages recurring assessments and control tasks. Documented results, action monitoring and dashboards support internal audit and corporate management. Groupware connections involve control performers via existing working environments.AI functions and classification: No specific AI work step is documented in the sources checked for easyGRC. Automated controls, reminders and risk assessments are not classified as AI functions without AI evidence.[35] [36] [37] [34] [38]Not specifically documented in the source check
Product overview and ICS page read; vendor domain searched for KI as well as AI/artificial intelligence. No specific AI product function found.
Sources checked: [35] [36] [37] · AI availability not specifically documented in the source check.
Source check: 2026-10-14
GOAT Risk · To the detailed profile Documented focus: Risk registers, control assessments, key figures, incidents and measures with customisable templates and reports.AI functions and classification: For GOAT Risk, no specific AI work step was evidenced in the product page checked or in the targeted vendor search. General articles about AI in risk management do not document an integrated product function.[39] [40] [41]Not specifically documented in the source check
Product scope and official AI context article read; no negative statement about AI being fundamentally absent.
Sources checked: [39] [41] · No specific AI work step documented in the source check; no statement about the absence of AI.
Source check: 2026-10-14
GRC Solutions · Product: smartGRC; AI Agents · Headquarters: Poland [42] · The vendor names GRC Solutions Sp. z o.o. as licence holder and GRC Advisory Sp. z o.o. as a sister consultancy with offices in Wrocław and Kraków. Both are listed here together as one provider. · GRC Solutions Sp. z o.o.; GRC Advisory Sp. z o.o.; smartGRC; Security & Compliance ExpertDocumented focus: smartGRC supports the management of SAP authorisations, segregation of duties, emergency access and access reviews. The software combines risk assessment, role maintenance, approvals and documented measures for dealing with authorisation conflicts.AI functions and classification: The provider describes AI-supported prioritisation of SoD conflicts and suggestions for risk treatment. The recommendations take usage data and business context into account; decisions and justifications are intended to remain traceable. The agents page distinguishes between functions already available and ongoing development.[43] [42] · Specific AI functions documented
Prioritise SoD conflicts · Suggest risk treatment · Analyse authorisation roles · Document reasons for decisions
AI evidence: [43] · Existing platform with demo; the AI catalogue explicitly contains both available functions and functions in development. Confirm the availability of individual agents before procurement.
Source check: 2026-10-15
Ideagen Risk ManagementDocumented focus: Risk monitoring with strategic objectives and audit integration; broader portfolio for quality, EHS and compliance.AI functions and classification: Mazlan AI supports risk analyses, drafts root-cause analyses and audit findings, prepares corrective actions and compiles audit evidence. Critical steps require approval.[44] [45] · Specific AI functions documented
Analyse risks and causes · Draft audit findings · Prepare corrective actions · Compile audit evidence
AI evidence: [45] · Documented by the vendor within the Ideagen platform; roles and approval thresholds configurable. Check coverage in the respective licensed product; no product test.
Source check: 2026-10-14
Inclus · Product: Inclus; Inclus AI · Headquarters: Finland [46] · The privacy policy names Inclus Ltd with an address in Espoo, Finland. A collaboration with Deloitte is described as a partnership, not as an acquisition. · Inclus Ltd; Inclus AIDocumented focus: Inclus supports collaborative risk identification, assessments, analyses and action planning. Enterprise and project risks can be worked on with contributions from different specialist departments and prepared for management reports.AI functions and classification: Embedded AI supplements the identification of risks and uncertainties, suggests measures and risk treatments and drafts management summaries. Organisation-specific prompts as well as risk and future scenarios are also documented.[47] [46] [48] · Specific AI functions documented
Identify risks · Suggest risk treatment · Draft management summaries · Investigate risk scenarios
AI evidence: [47] · Existing commercial software with demo; AI function packages are listed in the price list. Check the scope of services for each offering.
Source check: 2026-10-15
Inspirient · Product: Automated Analytics Engine / Money Laundering Detection · Headquarters: Germany [49] · Inspirient GmbH, Lietzenburger Straße 107, Berlin. · Inspirient GmbH; Inspirient Automated Analytics EngineDocumented focus: Automated analytics platform with a documented use case for money laundering and fraud detection. Data analysis, prioritisation of alerts and explanations support risk-related investigations.AI functions and classification: The platform combines fraud-specific reasoning, anomaly detection and machine learning to uncover known and new patterns. Results are visualised and explained in text.[50] [49] · Specific AI functions documented
Detect anomalies and fraud patterns · Prioritise AML alerts · Explain analysis results
AI evidence: [50] · The use case is offered with a feasibility study. Broad analytics platform; no standalone, complete AML case management is claimed.
Source check: 2026-10-15
Nooga · Product: Nooga Risk; Nooga Navigator · Headquarters: Sweden [51] · The privacy policy names Nooga Solutions i Sverige AB and a contact address in Stockholm. The product history names @Scale and Solidify. · Nooga Solutions i Sverige AB; Nooga Solutions AB; Nooga Risk; Nooga Navigator; Nooga Scale; @ScaleDocumented focus: Nooga Risk integrates risks, treatment and approvals into Azure DevOps work items. Nooga Navigator adds access to internal governance documents and GRC knowledge.AI functions and classification: The optional AI searches for matching risks in the existing register and suggests causes and impacts in the context of a work item. Navigator additionally describes document-based answers as well as help with drafting and reviewing governance content.[52] [53] [51] · Specific AI functions documented
Find matching risks in the register · Suggest risk causes and impacts · Evaluate governance documents
AI evidence: [52] [53] [51] · Nooga Risk offers optional AI after organisational activation. Navigator is explicitly marked as Early Access with pilot registration; general availability of all Navigator functions is not assumed.
Source check: 2026-10-15
OPTURE · Product: OPTURE GRC / RegOS · Headquarters: Switzerland [54] · OPTURE AG; OPTURE GmbH; OPTURE RegOSDocumented focus: OPTURE GRC brings together risk management, internal control systems and compliance on a common data basis. The modules support quantitative risk assessments, approvals, control cycles and questionnaires for surveying compliance status. Risks, controls and evidence are linked and reported in consolidated form. Supplementary modules address, among other things, information security, data protection, audit management and AI governance.AI functions and classification: OPTURE documents a GRC platform and AI governance. The AI transparency page relates in particular to principles and AI-generated website content; a specific AI GRC work step is not documented in the sources checked.[55] [54] [56] [57]Not specifically documented in the source check
AI content on the website, AI Act management and simulation are not in themselves evidence of AI assistance; no evidence of the absence of AI.
Sources checked: [55] [57] · No specific AI function in GRC documented in the sources checked.
Source check: 2026-10-14
Oversight · Product: Oversight Finance Risk Intelligence / Oversight Actions · Headquarters: USA [58] · The contact page names Oversight, Inc. with an address in Atlanta, Georgia, USA. · Oversight Systems; Oversight Inc.; Oversight Actions; Finance Risk IntelligenceDocumented focus: Oversight monitors financial controls in procurement, expenses, corporate cards and supplier transactions. The software supports control and internal audit teams in detecting policy violations, unusual payment transactions and recurring process weaknesses.AI functions and classification: AI models analyse transaction patterns and prioritise potential errors, misuse or fraud indicators. Oversight Actions adds summaries, suggested actions and case assignment as well as pre-approved processes within defined policies, thresholds and escalation rules.[59] [60] [58] [61] · Specific AI functions documented
Detect anomalous expenses and control violations · Prioritise review cases by risk · Support measures under defined approval rules
AI evidence: [59] [60] · Live product platform with customer access and a demo offering. Oversight Actions was introduced in June 2026; automated actions require customer-specific policies and approvals.
Source check: 2026-10-15
parcIT · Product: okular ORM / okular PROKORISK · Headquarters: Germany [62] · The legal notice names parcIT GmbH, Erftstraße 15, 50672 Cologne, Germany, with its registered office in Cologne (Cologne Local Court, HRB 67455); no statement on hosting is derived from this. · parcIT GmbH; parcit.de; okular ORM; agree21ORM; okular PROKORISK; PROKORISK; Softwaresuite okular (VR-Control, R-Control)Documented focus: okular ORM supports banks in managing operational risks with self-assessment, a loss event database, a KRI early warning system and standard reports. Monte Carlo simulation is used to determine value at risk and expected loss and to evaluate stress scenarios; the results can be transferred to risk-bearing capacity in SIMON. In the ICS module, controls are documented and assessed for adequacy and effectiveness; for companies that do not operate a financial institution, parcIT offers the okular PROKORISK software.AI functions and classification: No specific AI work step was documented on the pages and in the flyer checked for okular ORM and okular PROKORISK. Monte Carlo simulation, automated KRI monitoring and a general company statement on AI without reference to the products are not sufficient as AI evidence.[63] [64] [65] [62] [66] [67]Not specifically documented in the source check
Product pages for okular ORM and PROKORISK, the advisory package flyer and the company page on the digitalisation of bank management read; targeted website search for AI terms. The general AI statement at company level is not attributed to either product.
Sources checked: [63] [64] [65] [67] · No specific AI work step documented in the source check; no statement about the absence of AI.
Source check: 2026-10-18
Pathlock · Product: Pathlock Nexus / Continuous Controls Monitoring · Greenlight Technologies; Appsian; Security Weaver; CSI Tools; SAST Solutions; Xpandion; QSoftwareDocumented focus: Pathlock combines authorisation reviews with the monitoring of internal controls in business applications. The documented scope includes segregation of duties, access recertification, control testing and the handling of identified deviations. Continuous Controls Monitoring also captures transactions actually executed and provides an audit trail for investigation and remediation. The focus is on application-related control risks.AI functions and classification: Pathlock Nexus describes AI for analysing transaction, identity and access patterns and for creating governance workflows. Pathlock IQ answers governance and risk questions from the connected application data.[68] [69] [70] [71] [72] [73] · Specific AI functions documented
Analysis of transaction and access risks · Answers to governance questions · Support with governance workflows
AI evidence: [70] [73] · Documented by the vendor; no product test.
Source check: 2026-10-14
RIMIKS XDocumented focus: RIMIKS X from Funk: risk recording, ICS, measures, approvals and quantitative aggregation.AI functions and classification: The RIMIKS X product page checked describes risk assessment, reports, workflows and internal controls. A specific AI work step is not documented there or in the targeted vendor search.[74] [75]Not specifically documented in the source check
Product page and ICS description checked, targeted search for RIMIKS X/AI. Automated workflows alone are not AI evidence.
Sources checked: [74] [75] · No specific available AI support documented in the source check; no product test.
Source check: 2026-10-14
risk on mind · Product: rismo · Headquarters: Austria [76] · rismo; risk on mind GmbHDocumented focus: rismo is the risk management software from risk on mind for industrial companies and organisations with multiple sites. It records risks and questionnaire answers, visualises likelihood and impact and links assessments with measures, responsibilities and deadlines. Customisable risk categories and automatically generated reports support management vis-à-vis management boards, supervisory bodies and insurers.AI functions and classification: rismo describes AI for rating site risks on the basis of statistical data and individual questionnaire answers. This produces comparable risk profiles and an AI Score for risk assessment.[77] [78] [76] · Specific AI functions documented
Pre-assess site risks from type of operation and location · Incorporate questionnaire answers into risk profiles and assessments
AI evidence: [77] · Documented by the vendor; statistical pre-assessment and comprehensive assessment differ in the scope of data. Not tested in practice.
Source check: 2026-10-14
Soterion · Product: Soterion GRC Suite · Headquarters: Germany [79] · The German provider entity Soterion Technologies GmbH in Leinfelden-Echterdingen is documented. No statement about the headquarters or control of the international group is derived from this. · Soterion Technologies GmbH; Access Risk Manager; Continuous Controls ManagerDocumented focus: Soterion supports the management of authorisation and control risks in SAP systems. In addition to access conflicts, Continuous Controls Manager checks whether incompatible activities were actually carried out on the same document. Identified cases are passed to owners via workflow; status, follow-ups, comments and files document further processing for audits.AI functions and classification: No specific AI function was documented in the source check for Continuous Controls Manager. The documented continuous control and automated monitoring of SAP data alone are not counted as AI evidence.[80] [81] [79]Not specifically documented in the source check
Official product page read and targeted vendor search for AI/artificial intelligence carried out; no specific description of an AI function found.
Sources checked: [80] · No specific AI work step documented in the source check; no statement about the absence of AI.
Source check: 2026-10-14
Staple AI · Product: Staple / AI Contextual Verification · Headquarters: Singapore [82] · Staple AI Pte. Ltd., 33A Pagoda Street, Singapore 059192 according to the provider. · Staple AI Pte. Ltd.; StapleDocumented focus: Document platform for checking incoming financial data with validation, anomaly alerts, evidence chains and controlled further processing. Compliance teams can trace decisions back to the source document.AI functions and classification: AI interprets extracted financial data in context, distinguishes values read from values derived, and shows justifications and supporting evidence for human confirmation or escalation.[82] [83] · Specific AI functions documented
Check financial data in context · Submit uncertain document values for review · Show justifications for data controls
AI evidence: [83] · Commercial offering with a demo based on the customer's own documents; productive applications in the finance and insurance sector described.
Source check: 2026-10-15
Vose Software · Product: Pelican IRM / Pelican Risk Register / ModelRisk / Tamara · Headquarters: Belgium [84] · The legal notice names Vose Software BV, Kompasplein 14, 9000 Ghent, Belgium, as the company behind the trading name Vose Software, VAT no. BE0895601691; no statement on hosting or owners. · Vose Software BV; vosesoftware.com; Pelican IRM; Pelican Integrated Risk Management; Pelican Risk Register; ModelRisk; Tamara; ModelChoice; Archer Insight WorkbenchDocumented focus: Pelican IRM builds on the Pelican Risk Register, simulates and aggregates financial exposure by entity and compares it with risk tolerance thresholds; it covers bowtie analyses, control effects, third-party dependencies and FAIR-style cyber risk analyses. ModelRisk is a Monte Carlo add-in for Excel, and Tamara analyses cost and schedule risks of projects. The vendor distinguishes the Risk Register from GRC systems and maps its tools to IDW PS 340 n.F.AI functions and classification: Through the open-source ModelRisk MCP server, AI assistants such as Claude, Cursor or Zed build Monte Carlo models in Excel through dialogue and run simulations; according to the project documentation, they check models against Vose's methodology rules and summarise results for management. Every change remains a preview until users approve it; no AI work step is documented for Pelican.[85] [86] [87] [88] [89] [84] · Specific AI functions documented
Build and simulate risk models through dialogue · Check risk models against methodology rules · Draft management summaries
AI evidence: [87] [88] · The MCP server is MIT-licensed and requires Windows, Excel 2019 or later, a licensed ModelRisk add-in and the user's own MCP-capable AI assistant; not tested in practice.
Source check: 2026-10-18
Wehrspohn · Product: Enterprise Risk Explorer / Risk Kit / Noesis Risk / Credit Risk Explorer / Market Risk Explorer · Headquarters: Germany [90] · The legal notice names Wehrspohn GmbH & Co. KG, Otterstadter Straße 50, 68219 Mannheim (HRA 700676, Mannheim Local Court); no statement on hosting or owners. · Wehrspohn GmbH & Co. KG; Wehrspohn Risk Management; wehrspohn.de; ERE; Calculation ManagerDocumented focus: The Enterprise Risk Explorer covers the ERM process with guided assessments by risk owners, measures, reporting and monitoring; individual risks are aggregated by Monte Carlo simulation and evaluated against risk-bearing capacity. Risk Kit adds Monte Carlo simulation to Excel, the Credit Risk Explorer, described for banks, calculates value at risk and RAROC among other things, and the Market Risk Explorer combines simulation with stress tests and backtesting.AI functions and classification: With the Risk Kit Skill, Claude, Microsoft Copilot or ChatGPT build a Monte Carlo model in Excel from a natural-language description; Risk Kit runs the simulation and users evaluate the results. According to the vendor, in a prototype Noesis Risk turns risk interviews into structured fields, produces briefings with sources per risk and flags assessment fields that deviate from current findings.[91] [92] [93] [94] [95] [96] · Specific AI functions documented
Build Monte Carlo risk models through dialogue · Turn risk interviews into structured fields (prototype) · Produce source-based briefings per risk (prototype) · Check risk assessments against current findings (prototype)
AI evidence: [93] [94] · Skill shipped with Risk Kit 9.0 and, according to the vendor, also usable with a trial licence; it requires an external AI assistant whose use of skills is restricted by plan or Office display language. According to the vendor, the Noesis use cases have been implemented in a prototype and shown in a demo; general availability not documented; no product test.
Source check: 2026-10-18
Xiting · Product: Xiting Lynera · Headquarters: Switzerland [97] · The contact page names Xiting AG in Schöfflisdorf, Switzerland, as well as separate subsidiaries in other countries. These are not counted multiple times here. · Xiting AG; Xiting GmbH; LyneraDocumented focus: Xiting Lynera manages SAP rule sets, risks, business functions and compensating controls in a central portal. The software supports the governance and maintenance of segregation-of-duties rules as well as exchange with existing GRC and authorisation solutions.AI functions and classification: The vendor describes AI support for risk definitions, classification, assessment and the maintenance of rule sets. Mapping of regulatory requirements is also presented, but is still marked as an upcoming function in the product FAQ.[98] [99] [97] · Specific AI functions documented
Define SoD risks · Classify authorisation risks · Support risk assessment · Maintain rule sets
AI evidence: [98] [99] · Lynera was presented in 2026 in an Essential version; a demo is offered. Professional and extended AI functions have been announced. Regulatory mapping still on the roadmap according to the FAQ; confirm the exact scope of the version.
Source check: 2026-10-15
Publisher's own offering

T-NEX as publisher.

Register entry: T-NEX Banking Platform (DE, AI evidenced)

Mapping in T-NEX Compliance allows requirements from several regulations to be assigned to the same framework control. A requirement holds its rationale, source reference and expected control measure, and the assessment form adds implementation steps and linked internal evidence. AI assessments count as proposals, which the responsible person can override. In process management, controls of the internal control system and operational risks are attached to the process they belong to. The T-NEX AI Risk Manager shows a risk register, controls with effectiveness metrics and AI rating proposals that the owner reviews.

Register entry of the T-NEX Banking Platform (data as of 18 October 2026) · T-NEX Compliance · T-NEX AI Risk Manager

Sources.

The numbers in square brackets refer to this list. It is numbered consecutively for this page.

  1. Abel Systems: vendor source, headquarters evidence checked 14.10.2026
  2. Abel Systems: main source checked 14.10.2026
  3. Abel Systems: vendor source checked 14.10.2026
  4. Abel Systems: vendor source, AI evidence checked 14.10.2026
  5. antares RiMIS: headquarters evidence checked 14.10.2026
  6. antares RiMIS: risk management software and AI functions antares · vendor source, AI evidence, checked 14.10.2026
  7. antares Informations-Systeme: company antares · vendor source, checked 14.10.2026
  8. Auxilius.ai: vendor source, headquarters evidence checked 15.10.2026
  9. Auxilius.ai: main source, AI evidence checked 15.10.2026
  10. Auxilius.ai: vendor source, AI evidence checked 15.10.2026
  11. Avertro: vendor source, headquarters evidence checked 14.10.2026
  12. Avertro: main source, AI evidence checked 14.10.2026
  13. CAQ AG: vendor source, headquarters evidence checked 15.10.2026
  14. CAQ AG: main source, AI evidence checked 15.10.2026
  15. CAQ AG: vendor source checked 15.10.2026
  16. Ciqualia: vendor source, headquarters evidence checked 14.10.2026
  17. Ciqualia: main source checked 14.10.2026
  18. Ciqualia: vendor source, AI evidence checked 14.10.2026
  19. Ciqualia: vendor source checked 14.10.2026
  20. Ciqualia: vendor source checked 14.10.2026
  21. ConSense: vendor source, headquarters evidence checked 14.10.2026
  22. ConSense: main source checked 14.10.2026
  23. ConSense: vendor source checked 14.10.2026
  24. ConSense: vendor source, AI evidence checked 14.10.2026
  25. ConSense: vendor source checked 14.10.2026
  26. DextraData: vendor source, headquarters evidence checked 14.10.2026
  27. DextraData: main source checked 14.10.2026
  28. DextraData: vendor source checked 14.10.2026
  29. DextraData: vendor source checked 14.10.2026
  30. DextraData: vendor source, AI evidence checked 14.10.2026
  31. Dylogy: vendor source, headquarters evidence checked 15.10.2026
  32. Dylogy: main source, AI evidence checked 15.10.2026
  33. Dylogy: vendor source, AI evidence checked 15.10.2026
  34. Fecton: vendor source, headquarters evidence checked 14.10.2026
  35. Fecton: main source checked 14.10.2026
  36. Fecton: vendor source checked 14.10.2026
  37. Fecton: vendor source checked 14.10.2026
  38. Fecton: vendor source checked 14.10.2026
  39. GOAT Risk: functions and packages GOAT Risk · vendor source, checked 14.10.2026
  40. GOAT Risk: FAQ GOAT Risk · vendor source, checked 14.10.2026
  41. GOAT Risk: vendor source checked 14.10.2026
  42. GRC Solutions: vendor source, headquarters evidence checked 15.10.2026
  43. GRC Solutions: main source, AI evidence checked 15.10.2026
  44. Ideagen Risk Management Ideagen · vendor source, checked 14.10.2026
  45. Ideagen Mazlan AI Ideagen · vendor source, AI evidence, checked 14.10.2026
  46. Inclus: vendor source, headquarters evidence checked 15.10.2026
  47. Inclus: main source, AI evidence checked 15.10.2026
  48. Inclus: vendor source checked 15.10.2026
  49. Inspirient: vendor source, headquarters evidence checked 15.10.2026
  50. Inspirient: main source, AI evidence checked 15.10.2026
  51. Nooga: vendor source, AI evidence, headquarters evidence checked 15.10.2026
  52. Nooga: main source, AI evidence checked 15.10.2026
  53. Nooga: vendor source, AI evidence checked 15.10.2026
  54. OPTURE: vendor source, headquarters evidence checked 14.10.2026
  55. OPTURE: main source checked 14.10.2026
  56. OPTURE: vendor source checked 14.10.2026
  57. OPTURE: vendor source checked 14.10.2026
  58. Oversight: vendor source, headquarters evidence checked 15.10.2026
  59. Oversight: main source, AI evidence checked 15.10.2026
  60. Oversight: vendor source, AI evidence checked 15.10.2026
  61. Oversight: vendor source checked 15.10.2026
  62. parcIT: vendor source, headquarters evidence checked 18.10.2026
  63. parcIT: main source checked 18.10.2026
  64. parcIT: vendor source checked 18.10.2026
  65. parcIT: vendor source checked 18.10.2026
  66. parcIT: vendor source checked 18.10.2026
  67. parcIT: vendor source checked 18.10.2026
  68. Pathlock: main source checked 14.10.2026
  69. Pathlock: vendor source checked 14.10.2026
  70. Pathlock: vendor source, AI evidence checked 14.10.2026
  71. Pathlock: vendor source checked 14.10.2026
  72. Pathlock: vendor source checked 14.10.2026
  73. Pathlock: vendor source, AI evidence checked 14.10.2026
  74. Funk: risk management software RIMIKS X Funk · vendor source, checked 14.10.2026
  75. RIMIKS X: vendor source checked 14.10.2026
  76. risk on mind: vendor source, headquarters evidence checked 14.10.2026
  77. risk on mind: main source, AI evidence checked 14.10.2026
  78. risk on mind: vendor source checked 14.10.2026
  79. Soterion: vendor source, headquarters evidence checked 14.10.2026
  80. Soterion: main source checked 14.10.2026
  81. Soterion: vendor source checked 14.10.2026
  82. Staple AI: main source, headquarters evidence checked 15.10.2026
  83. Staple AI: vendor source, AI evidence checked 15.10.2026
  84. Vose Software: vendor source, headquarters evidence checked 18.10.2026
  85. Vose Software: main source checked 18.10.2026
  86. Vose Software: vendor source checked 18.10.2026
  87. Vose Software: vendor source, AI evidence checked 18.10.2026
  88. Vose Software: vendor source, AI evidence checked 18.10.2026
  89. Vose Software: vendor source checked 18.10.2026
  90. Wehrspohn: headquarters evidence checked 18.10.2026
  91. Wehrspohn: main source checked 18.10.2026
  92. Wehrspohn: vendor source checked 18.10.2026
  93. Wehrspohn: vendor source, AI evidence checked 18.10.2026
  94. Wehrspohn: vendor source, AI evidence checked 18.10.2026
  95. Wehrspohn: vendor source checked 18.10.2026
  96. Wehrspohn: vendor source checked 18.10.2026
  97. Xiting: vendor source, headquarters evidence checked 15.10.2026
  98. Xiting: main source, AI evidence checked 15.10.2026
  99. Xiting: vendor source, AI evidence checked 15.10.2026
Back to top