Traditional TPRM Isn't Extinct. But Regulation Is Forcing It to Evolve

AI is playing an increasingly central role in this shift. It can continuously monitor supplier signals, flag emergingAI is playing an increasingly central role in this shift. It can continuously monitor supplier signals, flag emerging vulnerabilities and surface patterns across large supplier portfolios that would be impossible to track manually. Decision-making can rely on it more than before, and the volume of data TPRM teams are now expected to process makes that kind of support necessary, not optional.

But there is an important limitation. AI can tell an organization what is happening; it cannot decide, on its own, what that means for the business or what should happen next. That judgment still has to correspond with the organization's risk appetite, its culture and its capabilities. When processes are delegated to automation without keeping that judgment in view, organizations can lose their grip on them. The risk is not that AI gets something wrong; it is that organizations stop asking who is accountable for what it produces. That is why the design of these processes has to keep automation connected to the organizational framework it serves, rather than letting it replace it.
 

The Operational Gap Is Becoming the Real TPRM Challenge

This is where I think the TPRM market still has work to do.

Platforms have become increasingly good at collecting information, monitoring suppliers and identifying risk. Advisory services traditionally help organizations establish policies and frameworks.

But there is still a difficult layer between identifying a problem and resolving it.

Someone has to engage the supplier, understand the finding, request remediation, review the evidence, escalate delays and decide whether the remaining risk is acceptable.

Our recent analysis of the Danish TPRM market highlighted exactly this gap: organizations do not necessarily need another dashboard or another framework. Many need the operational capacity to run the process consistently from beginning to end.
 

Regulation Is Raising the Bar

Europe is leading this shift, but the rest of the world is following close behind, from Israel to the US. Regulation is converging on the same expectation, even as it plays out through different frameworks: third-party risk has to be managed, not just mapped. DORA makes ICT third-party risk part of operational resilience for financial entities, expecting them to maintain information on their ICT third-party arrangements and address contractual requirements, subcontracting and the risks tied to providers supporting critical or important functions.

NIS2 extends the same logic well beyond financial services, embedding supply-chain security into the cybersecurity risk-management measures required across a much broader range of critical and important sectors.

The Cyber Resilience Act adds a hard deadline on top of that: from September 11, 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe security incidents, with a first warning potentially due within 24 hours. And in February 2026, the EU's ICT Supply Chain Security Toolbox reinforced the same direction, with recommendations on critical supplier assessments, concentration risk, multi-vendor strategies and dependencies on high-risk suppliers.

The common thread is clear: identifying suppliers is no longer enough. Organizations need to understand their dependencies and have a practical way to manage the risks that come with them.

That timing matters from a TPRM perspective. If your product depends on third-party software or components, your ability to understand an incident and meet your own reporting obligations may depend on how quickly information reaches you from your suppliers.

It is therefore not enough to know who the supplier is. Organizations need to understand which dependencies are critical, define how vulnerabilities and incidents are communicated, establish clear escalation paths and, where necessary, reflect those expectations in supplier contracts.
 

The Next Evolution of TPRM

I still believe automation will play a major role in the future of TPRM.

AI can help analyze information, prioritize findings and reduce a significant amount of repetitive work. But the conclusion from last year remains just as relevant: automation requires structure.

What has changed is the urgency.

Regulation in general is pushing organizations toward a model where third-party risk needs to be understood continuously, responsibilities need to be clear and identified risks need to lead to action.

Perhaps that is the real evolution of TPRM. Not the disappearance of questionnaires or platforms, but a change in what we expect from them and how we harness them into organizational effectiveness.

The question is no longer only “Do we know where the risk is?”. It is increasingly “Who owns what happens next?”.