T-NEX
Menu
DEEN
GRC provider register · Category 8 of 11

GRC software for third-party risk:
55 providers with AI classification.

In short: The T-NEX GRC provider register lists 55 providers for outsourcing and third-party risk management (TPRM), as of 18 October 2026. Of these, 52 document specific AI functions (95%), most often for evaluating supplier evidence and responses as well as assessing suppliers and third parties. In Germany, Austria or Switzerland, seven have a documented headquarters, four of them in Germany.

By and Published: As of: · Category page of the GRC provider register Reviewed by Andreas Unruh and Christoph Gembruch, managing directors of T-NEX GmbH, on
Illustration: globe with networked GRC providers whose AI evidence flows into a checked provider register

Neither completeness nor a general suitability for banks is claimed. Providers are listed alphabetically. The order is not a performance rating.

All 682 GRC providers in the market overview · 379 European GRC providers

Publisher: T-NEX GmbH. Andreas Unruh and Christoph Gembruch are managing directors of T-NEX. This editorial market overview is based on vendor sources and specialist primary sources. It contains no ranking and is not based on a joint product test. The market overview covers 682 providers from GRC and adjacent specialist areas. Acquired brands and former product names are not counted separately. Methodology and sources

Context

What is TPRM software for third-party and supply chain risk?

Third-party or vendor risk management (TPRM) software follows service providers, suppliers and business partners from due diligence through questionnaires, evidence and ongoing monitoring until the relationship ends. For banks, this includes MaRisk AT 9 outsourcing management and ICT third-party risk management under Articles 28 to 30 DORA with the register of information. The United States accounts for 13 of the documented headquarters, more than any other country. Germany, Austria and Switzerland account for seven of the 55 providers.

  • No specific AI function in the sources checked: 2 entries
  • Only announced or in-development functions: 1 entry
  • Documented AI use cases by topic, an entry can count more than once: Evaluating supplier evidence and responses (26) · Assessing suppliers and third parties (17) · Drafting and answering questionnaires (13) · Ongoing monitoring of risk signals (13)
  • Documented headquarters in Europe: 22 of 55 providers, headquarters not separately checked: 15
  • Full entries on 2 alphabetical subpages

Questions for the demo, derived from the five criteria of the comparison:

  • How does a finding in a supplier assessment become a measure with an owner and a deadline?
  • Can a service provider's contract data, assessments and evidence be traced across all modules involved?
  • Do questionnaire answers prefilled by AI enter the supplier assessment only after someone confirms them, with the underlying evidence still visible?

How do the outsourcing register and the DORA register of information differ?

Mainly in their scope. The register of information under Article 28(3) DORA covers all contractual arrangements on ICT services provided by ICT third-party service providers and separates those supporting critical or important functions from the rest. Implementing Regulation (EU) 2024/2956 sets its templates. The outsourcing register under Section 25b(1) sentence 4 of the German Banking Act (KWG) records all material and non-material outsourcing arrangements. ICT services subject to Articles 28 to 30 DORA fall outside the outsourcing module under the explanatory note to MaRisk AT 9 para. 1.

Which contract terms are mandatory under DORA for critical or important functions?

Beyond the minimum content of every ICT contract under Article 30(2) DORA, paragraph 3 adds six items: full service level descriptions with precise quantitative and qualitative performance targets, notice periods and reporting obligations of the provider, requirements for its contingency plans and ICT security, participation in threat-led penetration testing (TLPT), the right to monitor its performance on an ongoing basis with unrestricted rights of access, inspection and audit, and exit strategies with a mandatory transition period. Six providers in this category document AI functions for contract clauses and obligations.

Which providers of GRC software for third-party risk are headquartered in Germany, Austria or Switzerland?

Of the 55 providers, seven have a documented headquarters in Germany, Austria or Switzerland: in Germany ISS Sopra Steria, Leno (aixom), LocateRisk and Orbiq; in Austria Fabasoft, KSV1870 CyberRisk Rating and Prewave. For 15 further providers, the headquarters has not been checked separately; they are not included in this list. Headquarters means the seat of the provider entity named in the entry, documented by the entry's location source (imprint, legal texts, official contact and company pages, occasionally official registers); it says nothing about ownership, hosting or data storage.

Regulatory framework.

  • Art. 28 to 30 DORA (Regulation (EU) 2022/2554): register of information, exit strategies, ICT concentration risk and minimum content of ICT contracts (Source: EUR-Lex)
  • Implementing Regulation (EU) 2024/2956: standard templates for the register of information (Source: EUR-Lex)
  • Section 25b KWG (German Banking Act): outsourcing register covering all material and non-material outsourcing (Source: gesetze-im-internet.de, in German)
  • MaRisk AT 9, BaFin Circular 06/2026 (BA): outsourcing outside the DORA third-party regime and central outsourcing management (Source: BaFin, in German)

Further reading on t-nex.de: Outsourcing and exit strategies under MaRisk and DORA, DORA register of information, and DORA for financial entities.

All 55 entries by subpage.

Each entry: name linking to the full entry, in brackets the ISO 3166 country code of the provider headquarters, where documented, and the AI status: AI evidenced = Specific AI functions documented; AI announced = Announced or in development; AI not evidenced = Not specifically documented in the source check; AI open = Source check still pending.

Is a provider missing or an entry out of date? Send us a note with a source via the contact form. Accepted changes are marked in the entry with the date they were checked.

Part 1: A to M

33 entries

Part 2: N to Z

22 entries

Publisher's own offering

T-NEX as publisher.

Register entry: T-NEX Banking Platform (DE, AI evidenced)

Service provider contracts are held in the Banking Platform's contract management with durations, notice periods, service levels and subcontractors, and contract management maintains the DORA register of information from them. The AI reads these details from the contract document with a reference to the relevant passage and checks whether the content required by Article 30 DORA is present. A missing clause becomes a gap with a responsible person. T-NEX Controlling covers the commercial side: there, contracts are linked to agreed annual amounts, purchase-order numbers and imported actual costs, and variances can be traced back to their source.

Register entry of the T-NEX Banking Platform (data as of 18 October 2026) · T-NEX Banking Platform · T-NEX Controlling