FiorLab is Third-Party Risk Management Software for EU regulated buyers under DORA, EBA outsourcing guidelines, and the national variants (CBI Ireland, BaFin Germany, DNB Netherlands, ACPR France, CSSF Luxembourg). Registry-verified evidence, six-dimension scoring, immutable audit trail. Live in five minutes. Free Starter; published pricing from €329 per month.
Third-Party Risk Management Software — TPRM software, sometimes called a TPRM platform or a vendor risk management tool — is the operating system that procurement, compliance, and risk teams use to identify, assess, monitor, and exit the third parties their business depends on. In 2026 it is no longer an optional discipline. It is a regulator-mandated one.
Why the TPRM software category matters in 2026. DORA (Regulation (EU) 2022/2554) is enforced across all 27 EU member states with penalties up to €10 million or 2% of global annual turnover per incident. Article 28 mandates a Register of Information for every ICT third-party arrangement, ongoing monitoring with defined cadences, and evidence that will stand up at a supervisory review. The EBA outsourcing guidelines — with their national variants at the Central Bank of Ireland, BaFin (MaRisk 9th amendment), De Nederlandsche Bank, ACPR, and CSSF — apply the same discipline to critical outsourcing beyond ICT. NIS2 extends operational-resilience obligations to essential and important entities across seventeen sectors. GxP applies pharmaceutical-supply-chain discipline to contract manufacturers, contract testing labs, and clinical research organisations. CSRD adds ESG disclosure obligations that reach into the supplier base. The EU AI Act adds a further layer from 2 August 2026 for AI-embedded ICT suppliers.
What TPRM software has to do to keep up. The TPRM software category has been reset by DORA. Legacy TPRM platforms built around an annual questionnaire cycle cannot produce, on short notice, the evidence chain a supervisor asks for. Modern TPRM software has to onboard suppliers in minutes, verify company data live against public registries, cross-reference certifications against the accredited certification body, apply defensible staleness decay to every piece of evidence, and generate an auditor-readable report on demand. Self-declaration is not evidence. A questionnaire response that says "we hold ISO 27001" without the accreditation-body lookup is not evidence. A financial-strength score derived from a black-box AI model with no per-dimension source data is not evidence. FiorLab TPRM software treats every one of those failure modes as a design constraint, not an edge case.
Three steps from account creation to an audit-ready supplier assessment. No setup fees, no onboarding calls, no IT integration required.
CSV upload or manual entry. Company name, jurisdiction, registration number. FiorLab TPRM software resolves the record against CRO Ireland, UK Companies House, German Handelsregister, VIES (EU VAT), and GLEIF (Legal Entity Identifier) in real time. Duplicate detection runs against the platform-wide supplier index. Tenant separation is architectural — Buyer A's data never alters Buyer B's experience.
The TPRM platform scores every supplier across six dimensions: financial stability (Altman Z-Score, Piotroski F-Score), regulatory compliance (registry status, sanctions, PEP screening), ESG/sustainability (CSRD/ESRS-mapped), delivery performance, quality management (ISO 9001/14001/27001/45001/22000/50001/13485/27701/IATF 16949/AS9100 verified via IAF CertSearch), and innovation capability. The 5-tier verification multiplier (registry_verified 1.0× → self_declared 0.65×) disincentivises tick-box compliance.
A daily registry re-check cron re-verifies every supplier record on a 30-day cadence. Certifications older than 30 days are re-checked weekly against IAF CertSearch. Document staleness decays through five tiers. Anomaly detection surfaces six anomaly types across three severities. The output is a scored, auditor-readable PDF report with the per-dimension evidence chain, timestamps, and verification level attached — the artefact a supervisor asks for at review.
Everything else is a feature list. These six decide whether the TPRM platform is defensible at a supervisory review.
FiorLab TPRM software maps every ICT third-party arrangement to the DORA Article 28 Register of Information (Regulation (EU) 2022/2554 Article 28(3) and Commission Implementing Regulation (EU) 2024/2956). Contractual minimums under Article 30 are checkable per contract. Supervisor-readable evidence, exportable to XLSX and PDF, aligned to the same schema we publish open-source on GitHub.
Most TPRM platforms buy company data from Dun & Bradstreet or Bureau van Dijk, mark it as "verified", and move on. FiorLab TPRM software calls the source registry directly: CRO Ireland (services.cro.ie), Companies House UK, Handelsregister Germany, VIES, GLEIF, IAF CertSearch. Live data with a timestamp. Premium data partners (D&B, CreditSafe, EcoVadis) are integration-ready when the subscription warrants the cost.
Verification level is scored per dimension: registry_verified 1.0×, verified 0.95×, partially_verified 0.88×, unverified 0.80×, self_declared 0.65×. A registry-verified ISO 27001 certificate scores materially higher than a self-declared tick-box. TPRM software that treats those two the same is not auditor-defensible.
Altman Z-Score (bankruptcy prediction: working capital, retained earnings, EBIT, market value of equity, sales — over total assets). Piotroski F-Score (nine binary signals across profitability, leverage, liquidity, operating efficiency). Cross-checked against registry filings (annual returns, abridged accounts). Null financials score 0 ("not disclosed"), not 100. A leveraged supplier with a positive headline P&L but Piotroski F = 2 is flagged before the quarter turns.
Six anomaly types across three severities. Score volatility, registry-status drift, certification expiry cliff, financial-signal reversal, sanctions-list additions, unexpected sub-processor changes. Every anomaly is surfaced in the assessment output with a timestamp and a link back to the source event. TPRM software that produces one score per year cannot see these.
Who-did-what-when logging on every material action. Assessment run, score change, document upload, contract signature, subscription change, admin action. Full compliance audit trail under DORA Article 28 ongoing-monitoring obligations. Available in the Professional plan and above. The trail is the artefact your supervisor asks for; the TPRM platform generates it as a side-effect of normal operation.
Comparison rows are based on publicly available product documentation, official websites, and analyst coverage as of 22 July 2026. To request a correction, email hello@fiorlab.com.
| FiorLab TPRM | OneTrust Vendor Risk | ServiceNow VRM | |
|---|---|---|---|
| HQ jurisdiction | Ireland (EU) | USA | USA |
| Data residency | EU-hosted, EU-native | Regional, contract-negotiated | Regional, contract-negotiated |
| Published pricing | Free + from €329/mo | Contact sales | Contact sales |
| Free tier | Up to 5 suppliers | Demo only | Demo only |
| Time to first assessment | ~5 minutes | Weeks (deployment + SOW) | Months (professional services) |
| DORA Article 28 evidence, native | Yes — schema published | Module, questionnaire-driven | Module, workflow-driven |
| EU registry integrations | 5 live (CRO, CH, HR, VIES, GLEIF) + IAF | D&B / Bureau van Dijk partner data | D&B partner data |
| 6-dimension scoring, native | Yes — deterministic, rules-based | Configurable, questionnaire-weighted | Configurable, workflow-weighted |
Generic GRC platforms are horizontal — one suite covers privacy, IT risk, internal audit, vendor risk, business continuity, and a dozen other modules. Vendor Risk is one tile in the menu. Purpose-built TPRM software is vertical — it does one job, and it does it against the specific EU regulatory framework your business is exposed to. If your primary need is a DORA-defensible supplier evidence chain, a TPRM platform will move faster and cost less than a GRC-suite Vendor Risk module. If your primary need is enterprise-wide GRC across ten domains, that is a different buy.
FiorLab is built for procurement, compliance, and risk teams at regulated mid-market European companies. Below are the buyer archetypes we see most often.
Running onboarding, RFP, and contract cycles for 25–500 active suppliers. Need a TPRM platform that reduces manual questionnaire chase and produces an audit-ready evidence chain per supplier.
Owning DORA Article 28 Register of Information, EBA outsourcing filings, GxP supplier qualifications, or CSRD supplier-scope reporting. Need TPRM software that maps directly to the regulator's framework, not a generic questionnaire library.
Watching supplier concentration risk, sub-outsourcing chains, and financial-early-warning signals. Need a TPRM platform with anomaly detection and a rolling monitoring cadence — not annual point-in-time scoring.
Owning GDPR sub-processor registers, data-transfer impact assessments, and DPA lifecycle. Need TPRM software that surfaces jurisdictional posture, sub-processor changes, and tenant-isolated data on EU-hosted infrastructure.
Sector fit. Regulated mid-market companies (200–2,000 employees) in financial services (banks, insurers, asset managers, fintechs), life sciences (pharma, biotech, medical devices), manufacturing (with CSRD and GxP exposure), critical infrastructure (NIS2 scope), and any organisation preparing for DORA Article 28 supervisory review. Buyers headquartered in Ireland, Germany, the Netherlands, France, Luxembourg, and the wider EU.
Four tiers, published. Start free, upgrade when you're ready. No sales-call gate on the first score.
Standard pricing applies. DORA enforcement, EBA Outsourcing Guidelines, and national NCAs (CBI, BaFin, DNB, ACPR, CSSF) are already operative. We do not subsidise procrastination.
Explore the platform
For growing procurement teams
€329/mo billed annually
For regulated industries
€649/mo billed annually
For large organisations
Tailored to your requirements
14-day money-back guarantee on annual plans. Cancel monthly any time. All paid plans include a 14-day free trial. No credit card required.
Third-Party Risk Management Software (TPRM software) is the tooling that procurement, compliance, and risk teams use to identify, assess, monitor, and exit third-party suppliers under regulatory obligations. Modern TPRM software covers onboarding, risk scoring, evidence collection, ongoing monitoring, incident tracking, and exit planning. In the EU, the reference frameworks are DORA Article 28 for ICT third parties in financial services, the EBA outsourcing guidelines with national variants (CBI Ireland, BaFin Germany, DNB Netherlands, ACPR France, CSSF Luxembourg), NIS2 for critical infrastructure, GxP for pharmaceutical supply chains, and CSRD for sustainability disclosure. FiorLab TPRM software is EU-native, deterministic, and built on registry-verified evidence.
DORA (Regulation (EU) 2022/2554) is enforced across all 27 EU member states with penalties up to €10 million or 2% of global annual turnover per incident. Article 28 mandates a Register of Information for every ICT third-party arrangement, ongoing monitoring with defined cadences, and supervisor-defensible evidence. Article 30 sets contractual minimums. Article 28(4) allows supervisors to require the buyer to produce, at short notice, the evidence chain behind any supplier risk decision. Legacy TPRM software built for annual questionnaire cycles cannot produce that evidence on demand. DORA has effectively rewritten the TPRM software requirements list for any EU financial-services buyer, and the EBA non-ICT TPRM guideline, currently in draft, is expected to apply the same discipline to non-ICT critical outsourcing.
Generic GRC platforms (OneTrust Vendor Risk, ServiceNow VRM, Archer) are US-headquartered, priced at €50K–200K per year, take months to deploy, rely on partner data for company verification (Dun & Bradstreet, Bureau van Dijk), and treat DORA as one of many regulatory modules. FiorLab TPRM software is Irish-registered (CRO 813471), EU-hosted, published pricing from €329 per month, live in five minutes, and verifies supplier data live against five EU registries (CRO Ireland, Companies House UK, Handelsregister Germany, VIES, GLEIF) plus IAF CertSearch for ISO certifications. FiorLab is a purpose-built TPRM platform for EU regulated buyers, not a GRC suite with a TPRM module.
FiorLab TPRM software verifies supplier data live against CRO Ireland (services.cro.ie), UK Companies House, German Handelsregister, VIES (EU VAT validation), GLEIF (Legal Entity Identifier global lookup), and IAF CertSearch (ISO 9001/14001/27001/45001/22000/50001/13485/27701/IATF 16949/AS9100 verification against the global accredited-body database). French Infogreffe is on the roadmap. Premium data partners (Dun & Bradstreet, CreditSafe, EcoVadis) are integration-ready when buyer subscriptions warrant the cost. The free registry layer is sufficient for the regulator-defensible baseline that DORA Article 28 requires.
Yes. FiorLab TPRM software covers DORA and EBA outsourcing (financial services), GxP (pharmaceutical), CSRD (sustainability disclosure), NIS2 (critical infrastructure), MiFID II (investment services), and the EU AI Act (from 2 August 2026, general-purpose AI transparency obligations under Article 50 and penalty ceilings under Article 101). Assessment types are configurable per supplier — a bank running a DORA Article 28 assessment on a cloud provider and a pharma buyer running a GxP assessment on a contract manufacturer use the same TPRM platform, the same 6-dimension scoring engine, and the same evidence chain. Only the regulatory-mapping layer changes.
Under five minutes for the first supplier from account creation to a scored assessment. Sign up, add the supplier via CSV or manual entry, and the TPRM platform runs the six-dimension assessment immediately. Registry verification is real-time. IAF CertSearch verification is auto-triggered on compliance-form save when a selected certification is registry-checkable. The PDF report — per-dimension breakdown, verification details, staleness signals, evidence chain — is generated on demand. No setup fees, no onboarding calls, no IT integration required to reach an audit-ready assessment on day one.
FiorLab operates SOC 2 controls, an ISO 27001 aligned control framework, a CAIQ v4.0 self-assessment, and inherits SOC 2 / ISO 27001 / PCI DSS / EU Code of Conduct / BSI C5 certifications from the underlying EU-hosted cloud infrastructure. A third-party penetration test was completed in March 2026 with 18 of 18 findings closed across CRITICAL/HIGH/MEDIUM/LOW severities. Full details, including sub-processor list, GDPR DPA, EU data residency attestation, and security FAQ, are on our Trust Center. Data is EU-hosted; customers own their data.
FiorLab TPRM software has four published tiers. Starter is free for up to 5 suppliers. Growth is €399 per month or €329 per month billed annually, up to 25 suppliers. Professional is €799 per month or €649 per month billed annually, up to 100 suppliers, and includes DORA, EBA national variants (CBI, BaFin, DNB, ACPR, CSSF), GxP assessments, contract T&C intelligence, and priority support. Enterprise is custom pricing with unlimited suppliers, SSO/SAML, dedicated account manager, and API access. All paid plans include a 14-day money-back guarantee on annual plans; monthly plans cancel any time. Standard pricing applies. We do not subsidise procrastination.
No credit card. Live in five minutes. Up to 5 suppliers on the free Starter plan, full 6-dimension scoring, registry verification, audit-ready PDF reports. EU-hosted TPRM software; customers own their data.
Start Your Assessment