October 2026
5A shared library of review templates for contracts and third parties
Build review procedures once in Configuration and reuse them across contracts and third parties. Each review gets a title and a criticality level, can be removed, and template edits can be pushed into reviews that are already open.
Multi-document AI Analyser
Today, the document analyser handles one PDF at a time. Reviewing a full evidence pack, policies, certifications, audit reports, means uploading, opening and analysing each file separately. A batch of 20 PDFs takes 20 repeats of the same action. Key Enhancements upload multiple PDFs at once: select or drag and drop several documents into the document analyser in one action, in the supplier portal and reviewer where available. one batch, one question set: all uploaded documents are analysed together against the same question set, instead of starting each one separately. progress while it runs: see overall batch progress and the status of each file, in progress, completed or failed. results matched per document: once processing finishes, results are shown document by document, so each output is clearly matched to its source PDF. single-document analysis still works: the existing one-at-a-time flow is unaffected. This cuts the manual effort of reviewing large evidence packs, turning 20 separate actions into one.
Assessment Review Agent: AI that reviews every submission before you do
Today, every AI capability in the platform waits to be asked. You request a risk profile, a sanctions report, an individuals analysis. Reviewing an assessment still means manually checking each answer against contract obligations, compliance frameworks, risk profiles, sanctions results and prior rounds, one question at a time. The Assessment Review Agent changes that. The moment a supplier submits an assessment, it reviews every question against that context on its own, and prepares a suggested outcome, approved, clarification needed, or action plan, before a reviewer ever opens the assessment. Key Enhancements runs automatically, not on request: the agent starts the moment an assessment is submitted. No one has to trigger it. checks against everything that matters: contract clauses, compliance framework controls, risk profiles, sanctions results, country risk and the third party's own assessment history. a suggestion for every question: each answer gets a proposed outcome and the reasoning behind it, so a reviewer starts from a head start instead of a blank page. re-checks after a clarification: when a supplier responds to a clarification request, the agent re-evaluates just that question instead of the whole assessment. human sign-off stays final: the agent only suggests. A reviewer takes every actual action, and nothing reaches a supplier or becomes a final outcome without a person approving it. rolled out gradually: available first to a pilot tenant, with each source of context switched on individually so the rollout can be tuned before wider release. This is more than a new report generator. It's the platform's first AI teammate, one that works continuously alongside your review process instead of waiting to be asked, while keeping every decision in human hands.
MCP: Chat with your own AI assistant connected to 3rdRisk
Finding data today means building filters on each page. This lets you connect an AI assistant instead, and ask it directly. Key Enhancements connect your own assistant: link a tool such as Claude Desktop or ChatGPT to 3rdRisk, authorizing it once through a consent screen. read and update your records: list, open, create and update third parties, issues, action plans and framework sections. Risks, contracts and assessments follow. your permissions apply: every request runs through the same permission checks, validation and access restrictions as the interface. Nothing is deleted through this route. the same filters you already use: each list can be narrowed by the same filters as its page in the platform. explicit access: a connection has to be granted permission to use this specifically, so an ordinary token cannot reach it.
One cockpit page bringing together everything about a contract
A single page per contract with its master data, notes, documents, issues, risks, assessments, reviews, subcontractors, internal controls, related contracts, and security posture, plus a full timeline. No more digging through a modal.
November 2026
5AI-written daily news summaries per third party and country
Get a summary of the past 24 hours of news for a third party, written overnight and ready when you open the record. Request a new one anytime, and countries get the same summary.
A self-service, editable Welcome screen for the assessment portal
Today, the Welcome screen a third party sees when they open an assessment is fixed in code. Changing it means a release, and seven customers already have their own hardcoded version to work around that. This turns the Welcome screen into an editable template, the same way assessment emails already work. Key Enhancements edit it yourself, like assessment emails: one version per language, English required, a live preview while typing, and a reset back to the default text. build with the same placeholders and blocks: third party, organization, inviting user, questionnaire list, contract list, expected completion date and contact details, the same ones already used in assessment emails. remove sections by leaving them out: the contract list, for example, is a block. Leave it out and neither the list nor its heading appears. add a video: paste a YouTube link and it plays on the Welcome screen, with a preview in the editor. rich text formatting: headings, bold, underline, bulleted and numbered lists, and links. existing custom versions carried over: the seven hardcoded customer versions move into this template as-is, so nobody loses what they have today. same permissions as other templates: who can view and edit it follows the same rules as mail and chat templates. This ends a pattern of one-off code changes for every customer that wants their own introduction, and puts the first thing a third party reads directly in the risk manager's hands.
Reviewers assigned per assessment, not per questionnaire
Assign the reviewer on the assessment itself. The reviewer can be changed while the assessment is in flight, but not removed once they've taken review actions.
Industry level news monitoring
The Industry tab now shows news for each industry, not just for individual third parties. Each row shows the latest news and how many separate articles it's based on. If several of your third parties in the same industry appear in the same article, it's only counted once. A new View news button opens the full list. This makes it easier to spot when a whole industry is in the news, instead of checking each third party one by one.
Bulk field updates that replace one-at-a-time editing
To cut down repeated manual editing, bulk actions expand from starting assessments and generating risk profiles to updating fields across many records at once. Today you can act on a selection in a few ways, but any actual edit still happens one record at a time. Key Enhancements bulk field updates: available on third parties, contracts, ecosystem assessments and controls. Select the records, choose Update fields, and set the new values once. stepped flow: confirm the records you picked, choose which fields to change, then enter the values. Add or remove records inside the flow, so a mis-click on the overview doesn't send you back to the start. sensible field list: only fields that make sense across several records are offered. Names, addresses, contact details and financial values stay per record. Custom fields are included. checked before writing: values are validated before anything is saved, so a mistake changes nothing. runs in the background: work happens in batches so you can carry on, and you're told in the platform and by email when it finishes. failures you can retry: if some records fail, you're told how many, and can reopen the flow with just those. full audit trail: every record changed is written to the audit log exactly as a single edit would be. LEI lookup for DORA: find and fill LEI numbers for DORA third parties, matched by name and filled only where the registered name matches. more bulk actions: archive internal control assessments, cancel or archive external form submissions, create a default contract for third parties without one, and invite users from a spreadsheet instead of one at a time. Permission to update is checked for each record, not once for the whole selection. This removes hours of repeated editing for teams managing large portfolios, and makes routine changes safe to apply at scale.
December 2026
3Sorting & Filtering Consistency
To make lists behave predictably wherever a user happens to be working, sorting and filtering will be standardised across every module in the platform. Today each list carries its own subset of sortable columns and its own incomplete filter set, so knowledge gained on one page does not transfer to the next and finding records depends on which page you are on. Key Enhancements full column sorting: every column where sorting is meaningful becomes sortable ascending and descending, across third parties, contracts, ecosystem assessments, questionnaires, schedules, risks, frameworks, controls, issues, action plans and control assessments. custom field filtering: custom fields can be marked as filterable and then used to narrow third party and contract lists on empty, not empty, or matching values, with multiple conditions combined. complete filter sets: filters missing today are added per module, including treatment, contract, risk officer, reporter and specific measures on the risk register, framework section, manager and risk officer on frameworks, and frequency, tags and scheduled items on the schedule page. presence filters: quick checks for records that have action plans, issues, controls or measures, so coverage gaps are visible without opening records. aligned internal control filters: one consistent set across the controls page, all four assessment stages and the dashboard, including correction of two filters that are currently mislabelled or broken. case-insensitive matching: filter searches return the same results regardless of capitalisation, so "erp" finds "ERP". This update will reduce the time users spend locating records, make list behaviour predictable from one module to the next, and remove a source of silently incorrect exports.
Archiving & Restoring
Key Enhancements archive across the platform: third parties, contracts, action plans, risks, issues and finished assessments can all be archived, using the same action and the same behaviour everywhere. hidden, not lost: an archived record leaves the default overview and stops counting toward open-item indicators and dashboard figures. All its data, links and history stay intact, and an "is archived" filter brings it back into view. still in your exports: archived records remain in Excel exports and are marked as archived, so an export stays a complete record. you see what will happen: archiving a third party tells you first how many contracts and action plans go with it, how many of those contracts are still active, and whether it has child third parties. connected records handled deliberately: contracts and action plans belonging to the third party are archived with it. Contracts where it is only a subcontractor stay active. Child third parties are never archived, and you choose whether they stay attached or are detached. Linked issues, risks and assessments are left exactly as they are. all or nothing: if any part of an archive cannot be completed, nothing is archived and you are told why. names never disappear: a record that links to an archived third party shows that third party's real name marked as archived, instead of a blank field. archiving is reversible: restore a third party, contract or action plan from the same menu you archived it from, with everything intact. A contract can be restored while its third party is still archived. restore a user yourself: bring back an archived user without contacting support. Their roles and access return if they were not transferred to someone else; if they were, the user comes back able to sign in and an administrator reassigns the rest. delete your own scheduled assessments: remove a schedule you no longer need, rather than raising a request.
API - Connecting Systems
If your suppliers, contracts or users are maintained in another system, you can keep 3rdRisk in step with it automatically instead of anyone retyping the same information twice. That connection now follows exactly the same rules as working in the platform by hand. Key Enhancements the same result either way: a record created or changed through the connection is checked the same way, and ends up the same, as one entered in the platform. read what you need: pull records out to feed your own reporting, warehouse or internal tools. change everything or just one field: send a complete record, or only what has changed. clearer errors: when something is rejected, the response names the fields you sent, so your team can see what to correct. available now: third parties, risks, action plans, frameworks, controls, issues, users and your organisation structure. coming next: contracts, assessments, questions, and AI risk and country risk profiles, followed by documents, schedules, questionnaires, sanctions and news monitoring.
January 2027
No issues scheduled for January 2027