For a long time, supplier management was mainly a Procurement matter: a tender, a contract, anonboarding questionnaire, then a renewal a few years later. Third-party riskoften came down to an Excel file and a box ticked at onboarding.
In 2026, that model nolonger holds. Organizations have never depended so heavily on external providers (cloud, SaaS, managed services, business process outsourcing, AIvendors), and EU law draws a simple conclusion: you can outsource an activity, but not the responsibility that comes with it.
For Risk,Compliance, Security, Procurement and Audit functions, the question is nolonger who your suppliers are, but whether you can demonstrate at any time thatyou control the risks they bring to your organization.
What has changed
1. Third-party risk has become an explicit regulatory obligation
• Financial sector: DORA (Regulation (EU) 2022/2554), applicable since 17 January 2025, devotes an entire chapter to ICT third-partyrisk (Articles 28 to 30):
– a register of information covering all contractual arrangements for ICT services (Art. 28(3)), whose format is set by Implementing Regulation (EU) 2024/2956;
– a risk assessment before entering into a contract (Art. 28(4));
– exit strategies for services supporting critical functions (Art. 28(8));
– an assessment of concentration risk (Art. 29);
– minimum contractual provisions (Art. 30).
The policy on ICT third-party service providersis further specified by Delegated Regulation (EU) 2024/1773. In addition, the European Supervisory Authorities directly oversee ICT providers designated ascritical (Art. 31 et seq.). These texts come on top of the EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02).
• Beyond financial services: NIS2 (Directive (EU) 2022/2555) makes supplychain security a mandatory cybersecurity risk-management measure (Art.21(2)(d)). Entities must take into account the vulnerabilities specific to each s upplier and the quality of its cybersecurity practices (Art. 21(3)).Management bodies must approve these measures and are accountable for them (Art. 20).
• Personal data: the GDPR (Regulation (EU) 2016/679) has longrequired organizations to use only processors that provide sufficientguarantees, to govern the relationship by contract, to control sub-processors(Art. 28), and to manage transfers outside the EU (Art. 44 et seq.).
Each of these textslooks at your third parties from a different angle, but they all demand thesame thing: know, assess, contract, monitor and document.
2. Responsibility travels up the chain, then back down
• Cyber Resilience Act (Regulation (EU) 2024/2847): since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents within 24 hours (Art.14). They must also exercise due diligence on components sourced from thirdparties (Art. 13(5)). If your software supplier is in scope, its ability toalert you in time becomes part of your own control environment.
• AI Act (Regulation (EU) 2024/1689): organizations using AI systems supplied by third parties have obligations of their own (Art.26). Transparency obligations (Art. 50) apply from 2 December 2026, while those for high-risk systems have been pushed back to December 2027 and August 2028 bythe Digital Omnibus.
• Due diligence: the CSDDD (Directive (EU) 2024/1760), substantially reworked by the Omnibus I directive, will only apply to large companies from 2029. But it confirms a long-term trend: responsibility extends across the chain of activities.
• Anti-money laundering: the AMLR (Regulation (EU) 2024/1624),applicable from July 2027, harmonizes customer due diligence rules, including when relying on third parties to perform them.
3. Point-in-timeassessments are no longer enough
A questionnaire completed at onboarding is a snapshot of a supplier at a given moment. DORA, however, requires monitoring throughout the contractual relationship, and NIS2 expects risk management to be continuously reassessed. Between two annual reviews, a provider can lose a certification, suffer an incident, change ownership, subcontract in turn or see its service levels deteriorate.
The new challenges
Concentration risk. A handful of major cloud and software providers are everywhere. DORA now requires this riskto be explicitly identified and assessed (Art. 29): a failure at one of them can hit several critical functions and several entities of the same group atonce.
Cascading subcontracting. Your third parties have third parties of their own. DORA specifically governs the subcontracting of ICT services supporting critical functions, and the GDPR governs sub-processors (Art. 28(2) and (4)). The real risk often sits at tier 2or 3, where visibility is lowest.
Questionnaire fatigue. Suppliers receive dozens of redundant questionnaires, one per regulation and per client,and answer them more and more mechanically. Sending ever more questions is nota strategy.
Fragmented information. The contract sits with Procurement, the SLAs with the business, the certifications with Security, the incidents with IT, the audit findings with Internal Audit.When it is time to produce the DORA register or answer a regulator, everything has to be pieced together, and when a provider fails, it takes days to assess the impact.
Six decisions you can'tafford to miss in 2026
1. Build a single third-party repository.
Every supplier needs a single reference record: administrative data, services provided, contracts andamendments, SLAs, internal relationship owners, data and assets handled, business processes and information systems involved. This is the foundation of the DORA register of information, the GDPR processor register and the NIS2 supplychain map. Three different requirements, but one source of truth is enough.
2. Tier third parties bycriticality and dependency, not by spend.
DORA singles out providers supporting critical or important functions, and that is where theenhanced requirements apply (Art. 30(3) provisions, exit strategies, concentration assessment). A small provider with access to your customer data is riskier than a large office supplies vendor. Focus your effort where it isjustified.
3. Link every third party to yourrisks, processes and obligations.
The real question is not "is this supplier risky?" but "what stops, and which obligationis at stake, if it fails?". Linking each third party to the processes it supports, the assets it accesses, the risks it carries and the regulatory and contractual requirements that apply to it is what makes it possible to test the exit strategy and assess the concentration risk required by DORA.
4. Pool assessments across frameworks.
A single well-designed questionnaire can cover DORA, NIS2 (Art. 21), ISO 27001 and the GDPR (Art. 28and 32), and even ESG and AML requirements. Analyze responses automatically to surface gaps, and make sure each gap feeds a risk assessment, an action plan or a compensating control. A questionnaire that leads nowhere has achieved nothing.
5. Move from annual reviews to continuous monitoring.
Continuously track what changes a third party's risk profile: contract expiry dates, certification renewals (ISO 27001, SOC 2, HDS, PCI-DSS), insurance certificates, business continuity and disaster recovery plans, SLA indicators, incidents. Define in advance the events that trigger a reassessment: a major incident, a regulatory change, a change in the provider's business, a significant contract amendment, deteriorating indicators. With the notification deadlines of DORA, NIS2 and theCRA, information has to flow in hours, not weeks.
6. Make third-party riskd emonstrable.
Authorities can request the register of information at any time (DORA, Art. 28(3)). NIS2 management bodies must be able to justify the measures they approved (Art. 20). Data protection authorities can demand proof of a processor's guarantees. The third-party map, inherent and residual risk assessments, controls performed, gaps and action plan progress must be available immediately, not rebuilt by hand.
Turning third-party risk into a resilience lever
Managed well, third-party risk goes beyond regulatory constraint. It helps you choose better partners, negotiate more protective contracts, anticipate failures and durablystrengthen operational resilience.
That is the approach behind the TPRM module of the Oxial GRC platform. Designed as across-functional module, it builds on the repositories already in place in the platform (entities, processes, risks, controls, compliance, audits and actions) instead of creating yet another silo. Each third party gets a 360° view: contracts,SLAs, data and assets handled, impacted processes, associated risks, incidents,controls, due diligence questionnaires, action plans and audit engagements, all connected through dynamic links.
Assessment campaigns are fully configurable (DORA, NIS2, ISO 27001, GDPR, ESG, AML/CFT or internal frameworks), and their results feed directly into risk assessments and action plans. Dedicated controlplans for critical third parties, automated alerts and workflows, and event-driven reassessments ensure continuous monitoring. Management cockpits give business lines and Risk, Compliance, Security, Procurement and Audit functions a shared, documented and demonstrable view of their exposure.
To discuss how Oxial helps organizations regain control of their third-party ecosystem, get in touch with us.
EU regulatory reference points: third-party risk
DORA
Regulation (EU) 2022/2554
Art. 28 (register, pre-contract assessment, exit), Art. 29 (concentration), Art. 30 (contractual provisions), Art. 31 et seq. (oversight of critical ICT providers)
17 January 2025
DORA – implementing texts
Delegated Regulation (EU) 2024/1773; Implementing Regulation (EU) 2024/2956
Policy on ICT third-party providers; register of information templates
In force
NIS2
Directive (EU) 2022/2555
Art. 20 (governance), Art. 21(2)(d) and 21(3) (supply chain security)
Transposition due 17 October 2024; uneven across Member States
GDPR
Regulation (EU) 2016/679
Art. 28 (processors and sub-processors), Art. 32 (security), Art. 44 et seq. (transfers)
Since 2018
Cyber Resilience Act
Regulation (EU) 2024/2847
Art. 13(5) (due diligence on third-party components), Art. 14 (24-hour reporting)
Reporting: 11 September 2026; full obligations: 11 December 2027
AI Act
Regulation (EU) 2024/1689
Art. 26 (deployer obligations), Art. 50 (transparency)
Art. 50: 2 December 2026; high-risk: December 2027 / August 2028
AMLR
Regulation (EU) 2024/1624
Customer due diligence, reliance on third parties
10 July 2027
CSDDD (amended by Omnibus I)
Directive (EU) 2024/1760
Due diligence across the chain of activities
2029
EBA Guidelines
EBA/GL/2019/02
Outsourcing arrangements in the banking sector
In force
