T-NEX
Menu
DEEN
GRC provider register · Category 8 of 11 · Part 1 of 2

GRC software for third-party risk, A to M:
33 providers with AI classification.

In short: Part 1 of 2 of the Third-party risk category: full entries for 33 of the 55 providers, alphabetically from A to M, as of 18 October 2026. Of these, 31 document specific AI functions (94%). In Germany, Austria or Switzerland, five have a documented headquarters, three of them in Germany.

By and Published: As of: · Subpage of the GRC provider register Reviewed by Andreas Unruh and Christoph Gembruch, managing directors of T-NEX GmbH, on
Illustration: globe with networked GRC providers whose AI evidence flows into a checked provider register

Neither completeness nor a general suitability for banks is claimed. Providers are listed alphabetically. The order is not a performance rating.

All 682 GRC providers in the market overview · 379 European GRC providers · Third-party risk category page (55)

Publisher: T-NEX GmbH. Andreas Unruh and Christoph Gembruch are managing directors of T-NEX. This editorial market overview is based on vendor sources and specialist primary sources. It contains no ranking and is not based on a joint product test. The market overview covers 682 providers from GRC and adjacent specialist areas. Acquired brands and former product names are not counted separately. Methodology and sources

Context, figures, review questions and the regulatory framework are on the Third-party & supply chain risk category page.

Entries from A to M: functions, AI classification and sources.

The assignment describes the offering considered, not all of the company's products. AI information names specific functions or limits of the public documentation. Scope of delivery, data storage and regional availability must be checked for each offering. Download provider overview as CSV (German), licensed under CC BY 4.0, credit “T-NEX GRC-Anbieterregister, t-nex.de”.

Is a provider missing or an entry out of date? Send us a note with a source via the contact form. Accepted changes are marked in the entry with the date they were checked.

Third-party & supply chain risk: A to M

33 entries

Third-party & supply chain risk · A to M · 33 providers
Provider / productDocumented focusAI functions and classification
Abiton Ventures · Product: Maditon / Normiq · Headquarters: Sweden [1] · Abiton Ventures AB, Gothenburg, Sweden, No. 559576-3797 according to the Maditon terms and conditions. Normiq also names Abiton Ventures AB. · Abiton Ventures AB; Maditon; NormiqDocumented focus: Compliance assistant for smaller organisations with supplier documents, questionnaires and EU AI Act documentation. Maditon and Normiq are combined under the same provider entity.AI functions and classification: Maditon has AI analyse published supplier documents and prepare evidenced findings. The assistant drafts answers to security and data protection questionnaires from the organisation's own data. Humans review the drafts.[2] [1] [3] · Specific AI functions documented
Analyse supplier documents · Pre-fill security questionnaires · Draft compliance documentation
AI evidence: [2] [1] · Maditon offers sign-up and pricing plans; the EU AI Act module is described as live, GDPR/NIS2 to follow. Normiq is also attributed to Abiton; its current separate availability was not confirmed.
Source check: 2026-10-15
Aravo Intelligence First Platform · To the detailed profile Documented focus: Third-party life cycle, due diligence and multiple risk domains with shared supplier data.AI functions and classification: Aravo AI answers questions about third-party data, pre-fills assessments with source references and recommends corrective actions. Configurable agents also support risk-based processing within defined policies.[4] [5] · Specific AI functions documented
Query third-party data in natural language · Pre-fill assessments with source references · Recommend corrective actions
AI evidence: [5] · Documented by the vendor; agents and preferred language models configurable in AI Studio; no product test.
Source check: 2026-10-14
ArvexLab · Product: ArvexLab AI TPRM · Headquarters: United Kingdom [6] · Current legal notice: ArvexLab Ltd, London, United Kingdom, No. 17070015. It explicitly states a registered office outside the EU/EEA. · ArvexLab LtdDocumented focus: Supplier risk software for security documents, evidence, questionnaires and risk measures.AI functions and classification: AI extracts controls and evidence from audit reports, penetration tests and contracts with page references and confidence information. It pre-fills questionnaires and suggests further review or remediation work; approval remains with humans.[7] [6] [8] · Specific AI functions documented
Analyse supplier documents · Pre-fill questionnaires · Suggest risk measures
AI evidence: [7] · Product offered with demo and sign-up. No practical test of our own; check extraction quality and permitted actions on a specific document.
Source check: 2026-10-15
AsiaVerify · Product: AsiaVerify KYB / UBO / AML · Headquarters: Singapore [9] · UNSD Information Technology Pte Ltd, incorporated in Singapore since April 2019; current privacy page confirms the same operating company. · UNSD Information Technology Pte Ltd; AsiaVerifyDocumented focus: Company verification and ongoing monitoring of Asian business partners with register information, beneficial owners, sanctions and adverse media. Results support documented due diligence.AI functions and classification: AI-supported matching reduces irrelevant hits in compliance checks and supports focusing on risk-relevant corporate relationships.[10] [11] [9] · Specific AI functions documented
Match hits in company checks · Narrow down risk signals for due diligence
AI evidence: [10] · Commercial web portal and API offerings with demo and subscription plans. AI matching documented; model architecture and specific licence delineation not publicly checked.
Source check: 2026-10-15
Atlas Systems · Product: ComplyScore · Headquarters: USA [12] · ComplyScore; ComplyScore TPRMDocumented focus: ComplyScore by Atlas Systems supports the assessment and ongoing management of supplier risks. The software combines questionnaires with security evidence, audit findings and remediation measures. Analysts can check, edit and approve suggested findings. Approved measures are tracked with owners and deadlines; evidence references and approvals remain traceably documented.AI functions and classification: AI Control Review analyses supplier evidence such as SOC 2 reports, ISO certificates and policies, matches it against questionnaire answers and drafts findings and remediation measures. The documented workflow provides for review and approval by analysts.[13] [12] · Specific AI functions documented
Evidence matching · Drafting of audit findings · Suggested measures
AI evidence: [13] · Documented by the vendor; with human review and approval; not tested in practice.
Source check: 2026-10-14
Auditive · Product: Auditive Risk Automation · Headquarters: USA [14] · Official indexed Customer Agreement explicitly names Auditive, Inc. as a Delaware corporation. Direct retrieval of the PDF was unsuccessful; the contract text was readable in the search index. · Auditive, Inc.; Supplier Questionnaire Copilot; auditive.aiDocumented focus: Auditive supports the onboarding, assessment and ongoing monitoring of third parties. The platform bundles supplier data, security evidence and questionnaires for risk and procurement teams. Reusable trust profiles provide information for reviews. Companies can align assessments with their requirements and bring together evidence for internal approvals, collaboration with partners and later audits.AI functions and classification: The Supplier Questionnaire Copilot uses AI to create answers to security questionnaires from existing controls and evidence and aligns them with the respective frameworks.[15] [16] [14] · Specific AI functions documented
Answer security questionnaires from controls and evidence
AI evidence: [16] · Documented by the vendor; agree the pricing plan and module scope offered. No product test.
Source check: 2026-10-14
Bitsight Vendor Risk ManagementDocumented focus: Supplier inventory, assessment and ongoing monitoring combine questionnaires and documents with external cyber risk data.AI functions and classification: Bitsight Framework Intelligence uses AI to extract controls and evidence from supplier documents, map them to security frameworks and prepare structured gap analyses.[17] [18] [19] · Specific AI functions documented
Extract control evidence from SOC reports and questionnaires · Map evidence and controls to security frameworks · Create structured gap analyses for audit and third-party review
AI evidence: [19] [18] · Function documented by the vendor within Bitsight Continuous Monitoring; supported frameworks are listed on the product page. No product test.
Source check: 2026-10-14
Black Kite · Product: Black Kite · Former name: NormShieldDocumented focus: Analyses externally detectable cyber risks of suppliers and other dependencies. Ongoing monitoring and risk assessments support the prioritisation of reviews and measures.AI functions and classification: With Assess AI, Black Kite describes the analysis of supplier documents, mapping to control frameworks and validation of supplier responses for third-party risk management.[20] [21] · Specific AI functions documented
Analysis of supplier documents · Mapping to control frameworks · Review of supplier responses
AI evidence: [20] · Functions documented by the vendor in the Assess offering; check the specific contractual scope. No product test.
Source check: 2026-10-14
Certa · Product: Third Party Operating System · Opinr is the former name.Documented focus: Orchestrates onboarding, screening, due diligence, approvals and monitoring of third parties. Business rules and audit trails connect the specialist departments involved.AI functions and classification: Certa AI converts policies into configurable review workflows, reads documents for questionnaire drafts and analyses third-party risks from due diligence documents. The agents described also support reasoned handling of screening hits.[22] [23] · Specific AI functions documented
Convert policies into review workflows · Questionnaire drafts from documents · Analysis of third-party risks
AI evidence: [23] · Documented by the vendor; clarify specific agents, configuration and approval rules in the offer. Not tested in practice.
Source check: 2026-10-14
CHEVORA · Product: Business Verification / Due Diligence · Headquarters: Estonia [24] · CHEVORA OÜ, Tallinn, Estonia; registration number 17237686 according to the terms of use. · CHEVORA OÜDocumented focus: Specialist in counterparty checks, register and sanctions information and structured due diligence reports. No full TPRM life cycle claimed.AI functions and classification: Language models extract structured facts from sources and support linguistic preparation. According to the methodology, risk assessments and check results are produced in a deterministic layer; these decisions are not LLM judgements.[25] [26] [24] · Specific AI functions documented
Extract facts for counterparty checks · Prepare check information in written form
AI evidence: [25] [26] · Individual products offered with ordering and an account. Country coverage and depth of checks apply per product; extended capabilities are partly available for pre-order and are not counted across the board as available.
Source check: 2026-10-15
Conitiv · Product: Conitiv Datahub · Headquarters: France [27] · Conitiv SAS, RCS Aix-en-Provence 938381183; registered office in Aix-les-Milles, France. · Conitiv SASDocumented focus: Platform for supplier and third-party risks with credit, cyber and ESG ratings as well as compliance questionnaires.AI functions and classification: Proprietary AI models support risk scores; generative AI creates reports and recommendations for action on third parties. The contract terms point out that LLM outputs are probabilistic.[28] [27] · Specific AI functions documented
Assess third-party risks · Create supplier reports · Monitor risk signals
AI evidence: [28] · Commercial Datahub service; supplementary human audit services are to be considered separately.
Source check: 2026-10-15
Conveyor · Product: ConveyorAI / Clear · Headquarters: USA [29] · Current privacy policy names Conveyor, Inc. as a Delaware corporation and its US headquarters. · Conveyor, Inc.; ConveyorAI; Sue; Clear by Conveyor; Conveyor TPRMDocumented focus: Conveyor combines the handling of security questionnaires with an approved knowledge base and a Trust Center. Answers can be traced back to underlying documents and reviewed before being shared. The supplementary product Clear collects supplier evidence and creates risk assessments; sources, review dates and changes remain traceable in the supplier portfolio.AI functions and classification: ConveyorAI drafts answers to security questionnaires with sources and a confidence estimate. The Clear agent reads supplier evidence, detects outdated information and gaps and creates risk assessments for human decision-making.[30] [31] [29] [32] [33] · Specific AI functions documented
Answer security questionnaires with sources · Analyse supplier evidence · Detect gaps and outdated evidence · Create supplier risk assessments
AI evidence: [30] [31] · ConveyorAI documented by the vendor. Clear is described as a usable separate offering with activation on application for qualified TPRM users; no general open access assured. No product test.
Source check: 2026-10-14
Coverbase · Product: Coverbase TPRM and Risk Assessment Copilot · Headquarters: USA [34] · The privacy policy names Coverbase Inc. with a contact address in San Francisco, California. · Coverbase Inc.; Coverbase.aiDocumented focus: Coverbase combines supplier onboarding, third-party assessments, ongoing monitoring, findings and contractual obligations in a shared workflow.AI functions and classification: According to the provider, the Risk Assessment Copilot analyses questionnaires, contracts and evidence against the customer's own controls. It detects exceptions and drafts follow-up questions. Further AI functions extract contractual obligations and support the preparation of supplier assessments.[35] [34] [36] · Specific AI functions documented
Check questionnaires and evidence against controls · Prepare exceptions and follow-up questions · Extract contractual obligations
AI evidence: [35] · Demo, product documentation and customer case studies are published. The scope of the individual assessment and monitoring modules must be confirmed contractually.
Source check: 2026-10-15
CyberVadis · Product: Third-Party Cyber Risk Management (TPCRM) / Evidence-Based Assessment · Headquarters: France [37] · The website's legal information names CyberVadis SAS with head office at 43 avenue de la Grande Armée, 75116 Paris, registered with the R.C.S. Paris under 840 381 925. No inference about hosting or owners from the registered office. · CyberVadis SAS; Cybervadis; cybervadis.comDocumented focus: Third parties can be organised by criticality; CyberVadis detects certificates available online such as ISO 27001, SOC 2 and TISAX and monitors suppliers' external attack surface. In evidence-based assessments, CyberVadis analysts review questionnaire answers and evidence; the result is a scorecard and an improvement plan. For DORA, third parties can be tagged and tiered; according to the vendor, an assessment does not in itself certify NIS2 or DORA compliance.AI functions and classification: The AI prefill documented in the help centre supports assessed suppliers with the questionnaire: an in-house AI engine analyses uploaded information security documents, selects answer options for matching controls and attaches the corresponding evidence. The supplier reviews and confirms every prefilled answer; the score is based on CyberVadis analysts' review of the answers and evidence.[38] [39] [40] [41] [42] [37] · Specific AI functions documented
Analyse supplier documents · Pre-fill security questionnaires · Map evidence to controls
AI evidence: [42] · According to the help centre article of 15 June 2026, an optional function in the supplier questionnaire that can be skipped after qualification and run again whenever a new document is uploaded; it does not affect scoring. No product test.
Source check: 2026-10-18
DueSphere AI · Product: Corporate Supply Chain Due Diligence Dashboard · Headquarters: Hong Kong [43] · Hong Kong Companies Registry: DueSphere AI Limited, BRN 78976423, incorporated 20.10.2025. HKU TEC attributes the supply chain due diligence platform of the same name to this company; the provider states it was founded in October 2025. · DueSphere AI Limited; DueSphere AI; PoBotDocumented focus: Platform for ongoing review of labour and human rights risks in supply chains. Brings together anonymised worker reports, compliance documents, cases and supplier relationships for review and remediation.AI functions and classification: AI analyses reports as well as documents or images and creates summaries for human case review. The dashboard shows patterns, violations and affected suppliers over time.[44] [45] [46] [47] [43] [48] · Specific AI functions documented
Analyse worker reports for supply chain reviews · Summarise compliance documents · Prepare risk cases for human review
AI evidence: [44] [48] · Product demo, paid trial plan and enterprise offering published. The public demo does not evidence comprehensive production readiness; project scope needs to be clarified.
Source check: 2026-10-15
Dun & Bradstreet · Product: D&B Risk Analytics – Supplier Intelligence · Headquarters: USA [49] · The LEI entry of Dun & Bradstreet, Inc. gives its headquarters as 5335 Gate Parkway, Jacksonville, Florida, USA. The German legal notice names Dun & Bradstreet Deutschland GmbH, Frankfurt am Main, HRB 134984; no European provider location is derived from this, and no statement is made about hosting. · D&B; Dun & Bradstreet, Inc.; Dun & Bradstreet Holdings, Inc.; Dun & Bradstreet Deutschland GmbH; D&B Supplier Intelligence; D&B Risk Analytics; D&B.AI; dnb.comDocumented focus: D&B Risk Analytics – Supplier Intelligence combines predictive risk scores with company and risk data, segments the supplier portfolio by risk and performance and monitors changes on an ongoing basis. The application brings together screening against sanctions, watch and PEP lists and adverse media, UBO data, supplier surveys and standardised onboarding and due diligence rules with an audit trail.AI functions and classification: D&B describes embedded AI and natural-language interaction that surface risk signals, summaries and portfolio context and help prioritise risks. Agentic workflows are intended to reduce false positives in restricted party screening, and AI-enabled analyses evaluate UBO data on ownership structures; the product page does not explicitly mention specialist confirmation of AI results.[50] [51] [52] [49] [53] [54] · Specific AI functions documented
Query third-party data in natural language · Prioritise third-party risks · Check screening hits for possible false alarms · Analyse ownership structures
AI evidence: [50] [51] · Licensed product with embedded agents, copilots and natural-language interfaces; demo on request. The pages checked do not state separate licence terms for the AI functions; no product test.
Source check: 2026-10-18
Enlighta · Product: Enlighta TPRM and Vendor Governance · Headquarters: USA [55] · The contact page names San Ramon, California. Not to be confused with the Canadian health/biotechnology company of the same name. · Enlighta Inc.; Enlighta Spice; Govern ML; Genie ChatbotDocumented focus: Enlighta connects third-party risks with contractual obligations, supplier performance, evidence and ongoing governance. The workflow ranges from onboarding and due diligence to monitoring and termination of the relationship.AI functions and classification: According to the vendor, AI compares contract clauses and service commitments with internal standards, checks supplier documents for gaps and assesses evidence against controls. Further functions classify adverse news and support risk assessments.[56] [57] [55] [58] · Specific AI functions documented
Compare contract clauses and SLAs · Check supplier evidence for gaps · Classify risk alerts
AI evidence: [56] [57] · Commercial platform with demo offering and specific AI modules. Confirm module access, models and configuration of the evidence review in the offer.
Source check: 2026-10-15
Ethixbase360 · Product: Third Party Risk Management Platform · Tcompliance belongs to the provider group.Documented focus: Supports third parties from onboarding to the termination of a relationship. Combines risk review, due diligence, training and approvals for integrity and supply chain issues.AI functions and classification: Ethixbase360 documents AI-supported screening checks with human involvement. The support is intended to reduce false positive hits and escalate genuinely relevant risks for further assessment; the specific evidence also lies in the managed services offering.[59] [60] [61] [62] [63] · Specific AI functions documented
Check screening hits for possible false alarms · Highlight relevant third-party risks for human assessment
AI evidence: [61] [62] · Documented by the vendor; AI-supported review explicitly described in the offering with analyst support. Not assumed to be a self-service function included across the board in every platform package; no product test.
Source check: 2026-10-14
Fabasoft · Product: Fabasoft Dora · Headquarters: Austria [64] · The legal notice names Fabasoft International Services GmbH, Honauerstraße 4, 4020 Linz, Austria, FN 271303a, Linz Regional Court, as media owner; headquarters documented, no statement on hosting derived from the headquarters. · Fabasoft Dora; Fabasoft DORA; Fabasoft International Services GmbH; Fabasoft AG; fabasoft.comDocumented focus: Fabasoft Dora covers outsourcing and ICT third-party service provider management under DORA. The register of information under the DORA ITS and the outsourcing register under the EBA Guidelines are generated with automatic report validation; workflows with templates for risk assessments and exit strategies manage initial and recurring reviews. Due diligence documents and contract negotiations with ICT third-party service providers are handled via data rooms in the Fabasoft Cloud.AI functions and classification: AI check catalogues analyse ICT contracts against the minimum contractual content required by DORA; the AI identifies the risks they contain and highlights them. An AI chat answers questions on contract content with source references, and the AI summarises contracts in different languages. Supplementary agreements go through a digital approval process that involves the responsible persons depending on the contract.[65] [66] [67] [68] [69] [64] · Specific AI functions documented
Check ICT contracts against DORA minimum contractual content · Highlight contract risks · Answer questions on contract content with source references · Summarise contract content
AI evidence: [65] [67] [69] · Documented by the vendor; according to the product page, data is stored in Austria, Germany or Switzerland as chosen. According to the product news of 25 March 2026, the further development of supplier questionnaires with AI, for example for the automated checking of answers, is on the roadmap and is not documented as an available function; no product test.
Source check: 2026-10-18
Gatekeeper · Product: Vendor & Contract Lifecycle Management / DORA Compliance Agent · Headquarters: Jersey [74] · The terms of service name Gatekeeper Ltd, Les Niemes, St. Peter, Jersey, as the address for legal notices; the contracting party is the Gatekeeper entity named in the order form. No statement on hosting or owners. · Gatekeeper Ltd; Gatekeeper UK Group Ltd; Gatekeeper Canada Inc.; Gatekeeper US LLC; gatekeeperhq.comDocumented focus: Gatekeeper combines vendor risk and compliance management with contract lifecycle management in one record per vendor. Vendors are screened before the contract is signed and monitored continuously afterwards; due diligence findings are carried into the contract as a clause, condition or tracked obligation. For financial services firms, the vendor lists DORA, FCA and PRA requirements and APRA CPS 230, among others, as frameworks covered.AI functions and classification: The DORA Compliance Agent checks DORA assessments submitted by ICT service providers against configurable criteria and flags gaps as well as missing controls, for example in incident reporting or resilience testing. Further agents extract key details from SOC 2 reports as well as contractual obligations and assign vendors to risk tiers. According to the vendor, agent decisions are logged and can be overridden.[75] [76] [77] [78] [79] [74] · Specific AI functions documented
Check DORA assessments from ICT providers for gaps · Extract details from SOC 2 reports · Classify supplier risks with AI support · Extract contractual obligations
AI evidence: [76] [77] [78] · According to the pricing page, the Gatekeeper AI Suite with the full agent library is included in all three plans, which are sized by the number of third parties and workflows; documented by the vendor, no product test.
Source check: 2026-10-18
Hatfield.ai · Product: Hatfield AI Third-Party Risk Management · Headquarters: USA [80] · The company's own profile names St. Petersburg, Florida, USA, as headquarters. Not to be equated with other companies named Hatfield; the exact name of the legal entity is not separately confirmed. · Hatfield AI; Hatfield.ai TPRM; Hatfield AdvisoryDocumented focus: Hatfield.ai targets its TPRM platform at financial institutions. It combines supplier information, risk assessments, ongoing monitoring and regulatory classification. The consulting services offered in addition are not counted as further software providers.AI functions and classification: The provider describes AI-based matching of supplier identities and automated assessments. NLP models analyse negative coverage; further agents link financial, legal and cyber risk signals. On this basis, risk profiles are updated and follow-up reviews are triggered based on predefined thresholds.[81] [82] [83] [84] [80] · Specific AI functions documented
Match supplier identities and reduce duplicates · Prepare third-party assessments · Analyse risk signals for ongoing supplier monitoring
AI evidence: [80] [82] · The company page explicitly invites demos and participation as a beta customer. Functions are specifically described, but this does not evidence general production availability. Confirm the contracting entity and the modules actually activated.
Source check: 2026-10-15
HICX · Product: Supplier ManagementDocumented focus: Combines supplier master data and onboarding with validation, compliance and risk review. Suitable for processes across multiple regions and ERP systems.AI functions and classification: HICX documents AI agents for supplier compliance: they check documents and validation data, monitor supplier risks and generate supplier reports or ESG summaries.[85] [86] · Specific AI functions documented
Check supplier documents and compliance information · Monitor supplier risks · Draft supplier and ESG reports
AI evidence: [86] · Documented by the vendor; agree the specific licence and implementation scope. No product test.
Source check: 2026-10-14
Innova Ibérica · Product: Innova GRC; Innova Suppliers · Headquarters: Spain [87] · Legal notice names 115INNOVA24H S.L., CIF B91812511, with registered office in Seville and commercial register details. · 115INNOVA24H S.L.; Innova Suppliers; Innova GRC; Innova Ethics; Innova Check; Innova LearnDocumented focus: Innova Ibérica offers GRC, whistleblowing and compliance applications. Innova Suppliers combines supplier qualification and customer due diligence with documents, questionnaires, risk assessments, approvals and ongoing monitoring.AI functions and classification: Innova Suppliers extracts and checks document content with AI, generates questionnaires from requirements and suggests assessments. The AI can also draft a risk dossier on the third party. Responsible staff review the suggestions and decide on approval.[88] [89] [87] · Specific AI functions documented
Analyse supplier documents · Draft questionnaires · Suggest assessments · Summarise third-party risks
AI evidence: [89] · Offered as SaaS with demo. The AI evidence relates specifically to Innova Suppliers; it is not attributed across the board to every module. Transaction pattern detection is explicitly described on the product page as a rule-based calculation.
Source check: 2026-10-15
interos.ai · Product: Supply Chain Risk ManagementDocumented focus: Maps multi-tier supply chains and monitors risks beyond direct suppliers. Supports procurement, compliance and preparation for disruptions.AI functions and classification: AI and language processing uncover multi-tier supplier networks and dependencies. The platform assesses suppliers against multiple risk types and monitors changes.[90] [91] [92] · Specific AI functions documented
Uncover supplier networks and dependencies · Assess suppliers against multiple risk types · Monitor risks continuously
AI evidence: [92] · Documented by the vendor; no product test.
Source check: 2026-10-14
ISS Sopra Steria · Product: DORIA / ISS Reporting Suite · Headquarters: Germany [93] · The legal notice names ISS Software GmbH, Hans-Henny-Jahnn-Weg 29, Hamburg, commercial register Hamburg HR B 81595. Geography checked on 18.10.2026; no inference about hosting or owners from the registered office. · ISS Software GmbH; ISS Software; DORIA; ISS Reporting Suite; iss.soprasteria.deDocumented focus: DORIA extends the ISS Reporting Suite reporting platform with the maintenance and reporting of the DORA register of information to supervisory authorities such as BaFin and FMA at entity, sub-consolidated and consolidated level. Data are imported via interfaces or entered manually, validated through plausibility checks and output as an XBRL reporting file; the basic version comprises 15 reporting forms, authorisations, multi-client capability, historisation and logging.AI functions and classification: No specific AI work step was documented in the official DORIA sources checked. The validation through plausibility checks, data import via interfaces and command-line automation described are not in themselves sufficient as AI evidence.[94] [95] [96] [93]Not specifically documented in the source check
Product page, linked product flyer and Regulatory Reporting overview page checked; the website search for AI terms returned no hits. Plausibility checks and command-line automation not counted as AI; no product test.
Sources checked: [94] [95] [96] · No specific AI work step documented in the vendor material checked; no statement about the absence of AI.
Source check: 2026-10-18
KSV1870 CyberRisk Rating · Product: CyberRisk Manager / DORA-Modul · Headquarters: Austria [97] · The legal notice of the product website names KSV1870 Nimbusec GmbH, Kaisergasse 16b, 4020 Linz, Austria (company register no. FN 394170m, Linz commercial register court); no statement on hosting or further owners is derived from this. · CyberRisk Rating by KSV1870; CyberRisk Manager; KSV1870 Nimbusec GmbH; Nimbusec; cyberrisk-rating.at; KSV1870 Holding AG; Kreditschutzverband von 1870Documented focus: The CyberRisk Manager serves third-party cyber risk management in accordance with NIS, NIS2 and DORA: users prioritise suppliers by importance and likelihood of cyber risks, view stored evidence and the WebRisk Indicator, and request evidence or commission CyberRisk Ratings based on the scheme of the Kompetenzzentrum Sicheres Österreich (KSÖ). A DORA module supports the collection of supplier and sub-supplier data for the register of information, with export in line with the ESMA template.AI functions and classification: No specific AI work step was documented in the vendor sources checked for CyberRisk Manager, Rating and the DORA module. According to the vendor, ratings are based on a professionally reviewed self-assessment; to-do lists and the WebRisk Indicator are not AI evidence.[98] [99] [100] [101] [97] [102]Not specifically documented in the source check
Product pages, the DORA module page, the brochures “Neuerungen & Updates 2023/24” and “Das DORA Modul”, the CyberRisk Report 2026 and the Nimbusec website checked; AI mentions in the report concern scheme requirements and the threat landscape, not a product function.
Sources checked: [98] [99] [100] [101] · No specific AI work step documented in the vendor material checked; no statement about the absence of AI.
Source check: 2026-10-18
Leno (aixom) · Product: Leno Third-Parties / Leno Contracts / Leno Security & Resilience · Headquarters: Germany [103] · The legal notice names aixom GmbH, Stockholmer Platz 1, 70173 Stuttgart, HRB 794103, Local Court of Stuttgart; headquarters documented, no statement on hosting or owners. · aixom GmbH; LeanMind GmbH (frühere Firma); Leno GRC; Leno TPRM; Leno CLM; Leno ISR; leno.de; aixom.de; Tendry (weiteres aixom-Produkt)Documented focus: With Leno Third-Parties, users manage outsourcing arrangements, ICT services and sub-outsourcing under DORA, the EBA Guidelines and MaRisk, from capture and classification through criticality and materiality assessment, due diligence and exit planning to monitoring with KPIs and KRIs. Registers of information and outsourcing registers are produced for a reporting date, outsourcing notifications exported as XML; Leno Contracts and Leno Security & Resilience add contract management, information security and BCM.AI functions and classification: Leno Third-Parties optionally captures service descriptions with AI support and classifies services with AI support under DORA, the EBA Guidelines and MaRisk. An integrated AI checks service provider contracts for minimum regulatory content and identifies gaps; in Leno Contracts, AI extracts parties, durations, deadlines and amounts into data fields that users can adjust.[104] [105] [106] [107] [103] [108] · Specific AI functions documented
Capture service descriptions · Classify services under DORA, EBA Guidelines and MaRisk · Check service provider contracts for minimum regulatory content · Extract contract data from documents
AI evidence: [104] [105] · Documented by the vendor for the web-based cloud platform; free live demo on request, licence and module requirements of the AI functions not stated; no product test.
Source check: 2026-10-18
LocateRisk · Product: Geschäftspartner-Risikomanagement / Vendor Risk Management; SecurePlus · Headquarters: Germany [109] · The legal notice names LocateRisk GmbH, Heinrich-Hertz Str. 6, 64295 Darmstadt (Darmstadt Local Court, HRB 100470); no statement on hosting or owners is derived from this. · LocateRisk GmbH; locaterisk.com; SecurePlusDocumented focus: LocateRisk assesses the IT security posture of suppliers, service providers and business partners using non-invasive scans of externally reachable IT and digital questionnaires, for example on GDPR, NIS2, DORA, TISAX and ISO 27001, and monitors it at selectable intervals. The results feed into risk and compliance scores and a dashboard with classification by criticality; the same platform also assesses the externally visible IT of the user's own organisation.AI functions and classification: The AI-supported AI Helper explains vulnerabilities and systems in context in the IT security analysis, supports the risk assessment and recommends specific remediation steps. The pages checked describe no review or approval step for the AI output and do not explicitly state its use in supplier assessments.[110] [111] [112] [113] [114] [109] · Specific AI functions documented
Explain vulnerabilities in context · Support the risk assessment of vulnerabilities · Recommend corrective actions
AI evidence: [113] [114] · The AI Helper is part of the optional SecurePlus add-on package; according to the vendor, data is processed only after consent and in anonymised form via the Microsoft Azure OpenAI Service in the Sweden region. No product test.
Source check: 2026-10-18
Lysta · Product: Lysta Third-Party Intelligence · Headquarters: France [115] · Company Lysta, RCS Bordeaux 984648048; registered address in Bordeaux, France. · LystaDocumented focus: Platform for investigating and monitoring companies, suppliers, subcontractors and business partners.AI functions and classification: AI analyses relationships between companies and executives and supports the detection of dependencies and the assessment of third-party risks. Document review and public risk signals complement the workflow.[116] [117] [115] · Specific AI functions documented
Analyse supplier interconnections · Detect concentration risks · Monitor critical third parties
AI evidence: [116] [117] · Offered commercially as a web platform and API with demo.
Source check: 2026-10-15
Magnitude · Product: Magnitude TPRM Platform · Headquarters: USA [118] · The launch announcement published by the provider names San Francisco as headquarters. The website footer names Magnitude Platforms, Inc.; not to be confused with the coding provider of the same name at magnitude.dev. · Magnitude Platforms, Inc.; Magnitude TPRM; magnitude.aiDocumented focus: Magnitude supports the third-party risk life cycle, including onboarding, assessment, monitoring, tracking of measures and dependencies on further supplier tiers.AI functions and classification: The product page describes specialised AI agents for document collection, control analysis and risk classification. Further agents prepare recommendations and management reports and handle follow-up questions and measures with suppliers.[119] [120] [121] [118] · Specific AI functions documented
Analyse supplier evidence and controls · Prioritise third-party risks · Prepare risk reports and measures
AI evidence: [119] · Live demo offered; the provider's own launch announcement already describes customers in production. Check deployment limits, approvals and the available scope of agents specifically.
Source check: 2026-10-15
Mastercard · Product: RiskRecon · RiskRecon is listed once under Mastercard. Whistic is an independent partner and remains separate.Documented focus: RiskRecon monitors the externally visible cyber security posture of service providers and suppliers. Security findings, risk ratings and remediation plans support ongoing third-party assessment.AI functions and classification: RiskRecon Assessments Powered by Whistic uses AI to answer security questionnaires, summarise supplier documents and SOC 2 reports and analyse information for third-party assessments.[122] [123] [124] · Specific AI functions documented
Generate suggested answers for security questionnaires · Summarise supplier and SOC 2 reports · Analyse evidence for third-party assessments
AI evidence: [124] [123] · Documented by the vendor in the integrated offering RiskRecon Assessments Powered by Whistic; according to the product page, the licence scope depends on the number of assessments. No product test.
Source check: 2026-10-14
Moody's · Product: Moody's for Compliance / Orbis / Grid · Headquarters: USA [125] · The terms of use name Moody's Analytics, Inc. and/or its affiliates as owner and operator of the websites and the legal department of Moody's Corporation, 7 World Trade Center, 250 Greenwich Street, New York, as contact; no statement on hosting. · Moody's Corporation; Moody's Analytics, Inc.; Moody's for Compliance; Orbis; Orbis for Compliance; Grid; Grid for Screening; Entity Verification API; Due Diligence Agent; Maxsight; PassFort; kompany; 360kompany AG; Bureau van Dijk; BvD; moodys.comDocumented focus: Moody's for Compliance brings together onboarding, due diligence, screening and event-driven monitoring of customers, suppliers and other third parties in configurable, policy-based workflows with case management, approvals and audit logs. For risk assessment, Moody's combines ownership and corporate hierarchy data from Orbis, sanctions, watchlist, PEP and adverse media profiles from Grid, and registry data via the Entity Verification API. The assessment can also include suppliers' suppliers.AI functions and classification: Moody's for Compliance includes AI agents for tasks such as screening and due diligence reports. The Due Diligence Agent automates parts of research and report drafting from Moody's data and curated external sources and adds source citations to reports; analysts review the conclusions and remain responsible for them. In adverse media screening, AI is intended to prioritise matches by name and content screening.[126] [127] [128] [129] [125] [130] · Specific AI functions documented
Consolidate due diligence research · Draft due diligence reports with source citations · Prioritise adverse media
AI evidence: [127] [128] [129] · Platform with demo request and interactive product tour; according to the vendor, the AI agents work with humans in the loop, and their licensing scope is not described in the material checked.
Source check: 2026-10-18

Sources.

The numbers in square brackets refer to this list. It is numbered consecutively for this page.

  1. Abiton Ventures: vendor source, AI evidence, headquarters evidence checked 15.10.2026
  2. Abiton Ventures: main source, AI evidence checked 15.10.2026
  3. Abiton Ventures: vendor source checked 15.10.2026
  4. Aravo: Intelligence First Platform Aravo · vendor source, checked 14.10.2026
  5. Aravo: Artificial Intelligence for TPRM Aravo · vendor source, AI evidence, checked 14.10.2026
  6. ArvexLab: vendor source, headquarters evidence checked 15.10.2026
  7. ArvexLab: main source, AI evidence checked 15.10.2026
  8. ArvexLab: vendor source checked 15.10.2026
  9. AsiaVerify: vendor source, headquarters evidence checked 15.10.2026
  10. AsiaVerify: main source, AI evidence checked 15.10.2026
  11. AsiaVerify: vendor source checked 15.10.2026
  12. Atlas Systems: vendor source, headquarters evidence checked 14.10.2026
  13. Atlas Systems: main source, AI evidence checked 14.10.2026
  14. Auditive: vendor source, headquarters evidence checked 14.10.2026
  15. Auditive: main source checked 14.10.2026
  16. Auditive: vendor source, AI evidence checked 14.10.2026
  17. Bitsight: Vendor Risk Management Bitsight · vendor source, checked 14.10.2026
  18. Bitsight: Framework Intelligence Bitsight · vendor source, AI evidence, checked 14.10.2026
  19. Bitsight Vendor Risk Management: vendor source, AI evidence checked 14.10.2026
  20. Black Kite: main source, AI evidence checked 14.10.2026
  21. Black Kite: vendor source checked 14.10.2026
  22. Certa: main source checked 14.10.2026
  23. Certa: vendor source, AI evidence checked 14.10.2026
  24. CHEVORA: vendor source, headquarters evidence checked 15.10.2026
  25. CHEVORA: main source, AI evidence checked 15.10.2026
  26. CHEVORA: vendor source, AI evidence checked 15.10.2026
  27. Conitiv: vendor source, headquarters evidence checked 15.10.2026
  28. Conitiv: main source, AI evidence checked 15.10.2026
  29. Conveyor: vendor source, headquarters evidence checked 14.10.2026
  30. Conveyor: main source, AI evidence checked 14.10.2026
  31. Conveyor: vendor source, AI evidence checked 14.10.2026
  32. Conveyor: vendor source checked 14.10.2026
  33. Conveyor: vendor source checked 14.10.2026
  34. Coverbase: vendor source, headquarters evidence checked 15.10.2026
  35. Coverbase: main source, AI evidence checked 15.10.2026
  36. Coverbase: vendor source checked 15.10.2026
  37. CyberVadis: vendor source, headquarters evidence checked 18.10.2026
  38. CyberVadis: main source checked 18.10.2026
  39. CyberVadis: vendor source checked 18.10.2026
  40. CyberVadis: vendor source checked 18.10.2026
  41. CyberVadis: vendor source checked 18.10.2026
  42. CyberVadis: vendor source, AI evidence checked 18.10.2026
  43. DueSphere AI: vendor source, headquarters evidence checked 15.10.2026
  44. DueSphere AI: main source, AI evidence checked 15.10.2026
  45. DueSphere AI: vendor source checked 15.10.2026
  46. DueSphere AI: vendor source checked 15.10.2026
  47. DueSphere AI: vendor source checked 15.10.2026
  48. DueSphere AI: vendor source, AI evidence checked 15.10.2026
  49. Dun & Bradstreet: register entry, headquarters evidence checked 18.10.2026
  50. Dun & Bradstreet: main source, AI evidence checked 18.10.2026
  51. Dun & Bradstreet: vendor source, AI evidence checked 18.10.2026
  52. Dun & Bradstreet: vendor source checked 18.10.2026
  53. Dun & Bradstreet: vendor source checked 18.10.2026
  54. Dun & Bradstreet: vendor source checked 18.10.2026
  55. Enlighta: vendor source, headquarters evidence checked 15.10.2026
  56. Enlighta: main source, AI evidence checked 15.10.2026
  57. Enlighta: vendor source, AI evidence checked 15.10.2026
  58. Enlighta: vendor source checked 15.10.2026
  59. Ethixbase360: main source checked 14.10.2026
  60. Ethixbase360: vendor source checked 14.10.2026
  61. Ethixbase360: vendor source, AI evidence checked 14.10.2026
  62. Ethixbase360: vendor source, AI evidence checked 14.10.2026
  63. Ethixbase360: vendor source checked 14.10.2026
  64. Fabasoft: vendor source, headquarters evidence checked 18.10.2026
  65. Fabasoft: main source, AI evidence checked 18.10.2026
  66. Fabasoft: vendor source checked 18.10.2026
  67. Fabasoft: vendor source, AI evidence checked 18.10.2026
  68. Fabasoft: vendor source checked 18.10.2026
  69. Fabasoft: vendor source, AI evidence checked 18.10.2026
  70. Galink: register entry, headquarters evidence checked 15.10.2026
  71. Galink: main source, AI evidence checked 15.10.2026
  72. Galink: register entry checked 15.10.2026
  73. Galink: vendor source checked 15.10.2026
  74. Gatekeeper: vendor source, headquarters evidence checked 18.10.2026
  75. Gatekeeper: main source checked 18.10.2026
  76. Gatekeeper: vendor source, AI evidence checked 18.10.2026
  77. Gatekeeper: vendor source, AI evidence checked 18.10.2026
  78. Gatekeeper: vendor source, AI evidence checked 18.10.2026
  79. Gatekeeper: vendor source checked 18.10.2026
  80. Hatfield.ai: vendor source, AI evidence, headquarters evidence checked 15.10.2026
  81. Hatfield.ai: main source checked 15.10.2026
  82. Hatfield.ai: vendor source, AI evidence checked 15.10.2026
  83. Hatfield.ai: vendor source checked 15.10.2026
  84. Hatfield.ai: vendor source checked 15.10.2026
  85. HICX: main source checked 14.10.2026
  86. HICX: vendor source, AI evidence checked 14.10.2026
  87. Innova Ibérica: vendor source, headquarters evidence checked 15.10.2026
  88. Innova Ibérica: main source checked 15.10.2026
  89. Innova Ibérica: vendor source, AI evidence checked 15.10.2026
  90. interos.ai: main source checked 14.10.2026
  91. interos.ai: vendor source checked 14.10.2026
  92. interos.ai: vendor source, AI evidence checked 14.10.2026
  93. ISS Sopra Steria: vendor source, headquarters evidence checked 18.10.2026
  94. ISS Sopra Steria: main source checked 18.10.2026
  95. ISS Sopra Steria: vendor source checked 18.10.2026
  96. ISS Sopra Steria: vendor source checked 18.10.2026
  97. KSV1870 CyberRisk Rating: vendor source, headquarters evidence checked 18.10.2026
  98. KSV1870 CyberRisk Rating: main source checked 18.10.2026
  99. KSV1870 CyberRisk Rating: vendor source checked 18.10.2026
  100. KSV1870 CyberRisk Rating: vendor source checked 18.10.2026
  101. KSV1870 CyberRisk Rating: vendor source checked 18.10.2026
  102. KSV1870 CyberRisk Rating: vendor source checked 18.10.2026
  103. Leno (aixom): vendor source, headquarters evidence checked 18.10.2026
  104. Leno (aixom): main source, AI evidence checked 18.10.2026
  105. Leno (aixom): vendor source, AI evidence checked 18.10.2026
  106. Leno (aixom): vendor source checked 18.10.2026
  107. Leno (aixom): vendor source checked 18.10.2026
  108. Leno (aixom): register entry checked 18.10.2026
  109. LocateRisk: vendor source, headquarters evidence checked 18.10.2026
  110. LocateRisk: main source checked 18.10.2026
  111. LocateRisk: vendor source checked 18.10.2026
  112. LocateRisk: vendor source checked 18.10.2026
  113. LocateRisk: vendor source, AI evidence checked 18.10.2026
  114. LocateRisk: vendor source, AI evidence checked 18.10.2026
  115. Lysta: vendor source, headquarters evidence checked 15.10.2026
  116. Lysta: main source, AI evidence checked 15.10.2026
  117. Lysta: vendor source, AI evidence checked 15.10.2026
  118. Magnitude: vendor source, headquarters evidence checked 15.10.2026
  119. Magnitude: main source, AI evidence checked 15.10.2026
  120. Magnitude: vendor source checked 15.10.2026
  121. Magnitude: vendor source checked 15.10.2026
  122. Mastercard: main source checked 14.10.2026
  123. Mastercard: vendor source, AI evidence checked 14.10.2026
  124. Mastercard: vendor source, AI evidence checked 14.10.2026
  125. Moody's: vendor source, headquarters evidence checked 18.10.2026
  126. Moody's: main source checked 18.10.2026
  127. Moody's: vendor source, AI evidence checked 18.10.2026
  128. Moody's: vendor source, AI evidence checked 18.10.2026
  129. Moody's: vendor source, AI evidence checked 18.10.2026
  130. Moody's: vendor source checked 18.10.2026
Back to top