A self-service, editable Welcome screen for the assessment portal
Today, the Welcome screen a third party sees when they open an assessment is fixed in code. Changing it means a release, and seven customers already have their own hardcoded version to work around that. This turns the Welcome screen into an editable template, the same way assessment emails already work. Key Enhancements edit it yourself, like assessment emails: one version per language, English required, a live preview while typing, and a reset back to the default text. build with the same placeholders and blocks: third party, organization, inviting user, questionnaire list, contract list, expected completion date and contact details, the same ones already used in assessment emails. remove sections by leaving them out: the contract list, for example, is a block. Leave it out and neither the list nor its heading appears. add a video: paste a YouTube link and it plays on the Welcome screen, with a preview in the editor. rich text formatting: headings, bold, underline, bulleted and numbered lists, and links. existing custom versions carried over: the seven hardcoded customer versions move into this template as-is, so nobody loses what they have today. same permissions as other templates: who can view and edit it follows the same rules as mail and chat templates. This ends a pattern of one-off code changes for every customer that wants their own introduction, and puts the first thing a third party reads directly in the risk manager's hands.
Assessment Review Agent: AI that reviews every submission before you do
Today, every AI capability in the platform waits to be asked. You request a risk profile, a sanctions report, an individuals analysis. Reviewing an assessment still means manually checking each answer against contract obligations, compliance frameworks, risk profiles, sanctions results and prior rounds, one question at a time. The Assessment Review Agent changes that. The moment a supplier submits an assessment, it reviews every question against that context on its own, and prepares a suggested outcome, approved, clarification needed, or action plan, before a reviewer ever opens the assessment. Key Enhancements runs automatically, not on request: the agent starts the moment an assessment is submitted. No one has to trigger it. checks against everything that matters: contract clauses, compliance framework controls, risk profiles, sanctions results, country risk and the third party's own assessment history. a suggestion for every question: each answer gets a proposed outcome and the reasoning behind it, so a reviewer starts from a head start instead of a blank page. re-checks after a clarification: when a supplier responds to a clarification request, the agent re-evaluates just that question instead of the whole assessment. human sign-off stays final: the agent only suggests. A reviewer takes every actual action, and nothing reaches a supplier or becomes a final outcome without a person approving it. rolled out gradually: available first to a pilot tenant, with each source of context switched on individually so the rollout can be tuned before wider release. This is more than a new report generator. It's the platform's first AI teammate, one that works continuously alongside your review process instead of waiting to be asked, while keeping every decision in human hands.
Reviewers assigned per assessment, not per questionnaire
Assign the reviewer on the assessment itself. The reviewer can be changed while the assessment is in flight, but not removed once they've taken review actions.
AI-written daily news summaries per third party and country
Get a summary of the past 24 hours of news for a third party, written overnight and ready when you open the record. Request a new one anytime, and countries get the same summary.
Industry level news monitoring
The Industry tab now shows news for each industry, not just for individual third parties. Each row shows the latest news and how many separate articles it's based on. If several of your third parties in the same industry appear in the same article, it's only counted once. A new View news button opens the full list. This makes it easier to spot when a whole industry is in the news, instead of checking each third party one by one.
A shared library of review templates for contracts and third parties
Build review procedures once in Configuration and reuse them across contracts and third parties. Each review gets a title and a criticality level, can be removed, and template edits can be pushed into reviews that are already open.
Predictive Risk Profile
Hello, it would be great if a possibility would exist in the Predictive Risk profile to : - Have a focussed Security Risk Profile that collects infomration on open source OWASP Tools and available sources, Like: 1. Cloudflare URL scanner Radar/ URLSCAN.io / (to have detected technologiies and security warnings) 2. Shodan.io (main observations of the URL) 3. Cert.sh to have Certificate infos 4. Collect Trust Center information (to analyze a set of main existing documents to better align ascoring with evidence) An Subdomain listing and detection where as well Login pages and Exposure can be seen. This section could be called URL and Domain Risk Profile or Security public Risk Profile Alterantively if the predictive Risk Profile could be run with a Focus and Context: Security focussed/ Economic Focusses/ Compliance Focussed etc. Regards
Archiving & Restoring
Key Enhancements archive across the platform: third parties, contracts, action plans, risks, issues and finished assessments can all be archived, using the same action and the same behaviour everywhere. hidden, not lost: an archived record leaves the default overview and stops counting toward open-item indicators and dashboard figures. All its data, links and history stay intact, and an "is archived" filter brings it back into view. still in your exports: archived records remain in Excel exports and are marked as archived, so an export stays a complete record. you see what will happen: archiving a third party tells you first how many contracts and action plans go with it, how many of those contracts are still active, and whether it has child third parties. connected records handled deliberately: contracts and action plans belonging to the third party are archived with it. Contracts where it is only a subcontractor stay active. Child third parties are never archived, and you choose whether they stay attached or are detached. Linked issues, risks and assessments are left exactly as they are. all or nothing: if any part of an archive cannot be completed, nothing is archived and you are told why. names never disappear: a record that links to an archived third party shows that third party's real name marked as archived, instead of a blank field. archiving is reversible: restore a third party, contract or action plan from the same menu you archived it from, with everything intact. A contract can be restored while its third party is still archived. restore a user yourself: bring back an archived user without contacting support. Their roles and access return if they were not transferred to someone else; if they were, the user comes back able to sign in and an administrator reassigns the rest. delete your own scheduled assessments: remove a schedule you no longer need, rather than raising a request.
API - Connecting Systems
If your suppliers, contracts or users are maintained in another system, you can keep 3rdRisk in step with it automatically instead of anyone retyping the same information twice. That connection now follows exactly the same rules as working in the platform by hand. Key Enhancements the same result either way: a record created or changed through the connection is checked the same way, and ends up the same, as one entered in the platform. read what you need: pull records out to feed your own reporting, warehouse or internal tools. change everything or just one field: send a complete record, or only what has changed. clearer errors: when something is rejected, the response names the fields you sent, so your team can see what to correct. available now: third parties, risks, action plans, frameworks, controls, issues, users and your organisation structure. coming next: contracts, assessments, questions, and AI risk and country risk profiles, followed by documents, schedules, questionnaires, sanctions and news monitoring.
MCP: Chat with your own AI assistant connected to 3rdRisk
Finding data today means building filters on each page. This lets you connect an AI assistant instead, and ask it directly. Key Enhancements connect your own assistant: link a tool such as Claude Desktop or ChatGPT to 3rdRisk, authorizing it once through a consent screen. read and update your records: list, open, create and update third parties, issues, action plans and framework sections. Risks, contracts and assessments follow. your permissions apply: every request runs through the same permission checks, validation and access restrictions as the interface. Nothing is deleted through this route. the same filters you already use: each list can be narrowed by the same filters as its page in the platform. explicit access: a connection has to be granted permission to use this specifically, so an ordinary token cannot reach it.
Sorting & Filtering Consistency
To make lists behave predictably wherever a user happens to be working, sorting and filtering will be standardised across every module in the platform. Today each list carries its own subset of sortable columns and its own incomplete filter set, so knowledge gained on one page does not transfer to the next and finding records depends on which page you are on. Key Enhancements full column sorting: every column where sorting is meaningful becomes sortable ascending and descending, across third parties, contracts, ecosystem assessments, questionnaires, schedules, risks, frameworks, controls, issues, action plans and control assessments. custom field filtering: custom fields can be marked as filterable and then used to narrow third party and contract lists on empty, not empty, or matching values, with multiple conditions combined. complete filter sets: filters missing today are added per module, including treatment, contract, risk officer, reporter and specific measures on the risk register, framework section, manager and risk officer on frameworks, and frequency, tags and scheduled items on the schedule page. presence filters: quick checks for records that have action plans, issues, controls or measures, so coverage gaps are visible without opening records. aligned internal control filters: one consistent set across the controls page, all four assessment stages and the dashboard, including correction of two filters that are currently mislabelled or broken. case-insensitive matching: filter searches return the same results regardless of capitalisation, so "erp" finds "ERP". This update will reduce the time users spend locating records, make list behaviour predictable from one module to the next, and remove a source of silently incorrect exports.
One cockpit page bringing together everything about a contract
A single page per contract with its master data, notes, documents, issues, risks, assessments, reviews, subcontractors, internal controls, related contracts, and security posture, plus a full timeline. No more digging through a modal.
Bulk field updates that replace one-at-a-time editing
To cut down repeated manual editing, bulk actions expand from starting assessments and generating risk profiles to updating fields across many records at once. Today you can act on a selection in a few ways, but any actual edit still happens one record at a time. Key Enhancements bulk field updates: available on third parties, contracts, ecosystem assessments and controls. Select the records, choose Update fields, and set the new values once. stepped flow: confirm the records you picked, choose which fields to change, then enter the values. Add or remove records inside the flow, so a mis-click on the overview doesn't send you back to the start. sensible field list: only fields that make sense across several records are offered. Names, addresses, contact details and financial values stay per record. Custom fields are included. checked before writing: values are validated before anything is saved, so a mistake changes nothing. runs in the background: work happens in batches so you can carry on, and you're told in the platform and by email when it finishes. failures you can retry: if some records fail, you're told how many, and can reopen the flow with just those. full audit trail: every record changed is written to the audit log exactly as a single edit would be. LEI lookup for DORA: find and fill LEI numbers for DORA third parties, matched by name and filled only where the registered name matches. more bulk actions: archive internal control assessments, cancel or archive external form submissions, create a default contract for third parties without one, and invite users from a spreadsheet instead of one at a time. Permission to update is checked for each record, not once for the whole selection. This removes hours of repeated editing for teams managing large portfolios, and makes routine changes safe to apply at scale.
An AI-suggested hierarchy revealing your suppliers' suppliers
Today the catalogue lists the companies you contract with, but says little about who they depend on, so risk sitting one step further out stays invisible until something breaks. This update shows supply chain relationships as a hierarchy, and AI proposes the suppliers your third parties are likely to depend on. Key Enhancements hierarchy in the catalogue: direct suppliers are listed on their own, each showing how many sub-suppliers sit beneath it. expandable rows: expand a supplier to see its sub-suppliers nested underneath, instead of flattened into one long list. shared suppliers shown everywhere they apply: a supplier serving more than one of your third parties appears under each of them. AI-proposed suppliers: AI suggests the sub-suppliers your third parties are likely to depend on, with a reason and a source behind each suggestion. contained until reviewed: proposals arrive marked Identified and stay out of assessment recipients, dropdowns, and every other list until you decide on them. accept or dismiss: accept a proposal and it becomes a third party you can monitor, inheriting its stakeholders from the supplier above it. Dismiss it and it disappears. Requires AI enabled for your tenant. This extends visibility one tier beyond your direct suppliers, turning tier mapping from manual research into a quick review of what AI has already found.
Pre-view submitted external registration form
Once the external registration form is approved by assigned approvers, the next step is registering the third-party in the third-party catalogue. However, certain data (for example, the nature of the relationship based on which the location of the third party within the organisation can be determined) is not visible since the external form (once submitted) cannot be viewed by the coordinator. Having the possibility to view the pre-submitted data or having the “custom fields” tab visible with the data pre-filled from the external form when creating a third party would help a lot.
Enable direct navigation from Messages to related Issues and Action Plans
From the Messages tab (see attachment), I would like to be able to directly click through to the referenced issue or action plan. This would allow users to open the related item immediately, without having to search for or open it manually.
Request for External Questionnaires' exportability
We kindly request that you consider implementing a functionality allowing EQ submitters to export their completed answers. This feature would significantly support our intermediaries in reviewing their submissions and ensure greater efficiency and transparency during the due diligence process. This feature has been requested by a number of our intermediaries. Many thanks!
Request: Enable shared filters (filter sets) that can be saved and reused by all users.
Users should be able to create and save predefined filter sets with standard settings (e.g. period, type, status). When creating a filter set, a user can select an option to share it with others, so everyone can apply the same filters with one click. Value: Consistent reporting and analysis Less manual work and fewer errors Faster insights and better collaboration
Feature Request: Temporary / Deputy Risk Owner
We would like to request the ability to assign a Temporary (Deputy) Risk Owner within 3rdRisk for a defined period of time (vacation etc). Requirement: The Primary Risk Owner remains unchanged A Temporary / Deputy Risk Owner can be assigned. The assignment is valid from date X to date Y. The temporary role activates and deactivates automatically based on the selected dates. During the active period: The deputy receives all notifications and alerts. New issues and tasks are also assigned/visible to the deputy. The deputy can manage and update issues. All actions remain fully audit logged. Benefits: No permanent ownership changes. No manual reassignment of issues. Fully audit-proof (“who was responsible when”). Ensures business continuity during short absences (1–2 weeks).