In 2023, a large European bank discovered that a critical technology vendor it had been engaged with for seven years had been under a regulatory investigation in another jurisdiction for almost eighteen months. The information was publicly available. The investigation had been documented in regulatory filings, referenced in trade press, and flagged in the vendor's own corporate disclosures. But nothing in the bank's vendor management process had surfaced it. The vendor sailed through its annual questionnaire review, scored within acceptable parameters on all automated metrics, and continued to hold contracts covering core banking infrastructure — right up until the investigation became material and the relationship had to be unwound at considerable operational cost.
This is not an edge case. It is a predictable outcome of the way most enterprise due diligence programmes are architected: point-in-time, self-reported, and dependent on human analysts to manually track signals that a well-designed AI system would have surfaced in hours. The question enterprise risk leaders should be asking is not whether their current due diligence process is working. It is whether it is designed to work in a world where vendor portfolios number in the hundreds, risk signals move at the speed of news, and regulators expect continuous — not periodic — oversight.
Crest Intelligence provides a practical starting point for risk teams evaluating what an AI-native due diligence programme looks like in practice — from initial screening to continuous monitoring across your entire third-party ecosystem.
The Diligence Deficit: Why Traditional Programmes Are Failing Enterprise Risk Leaders
Vendor due diligence, as most enterprises currently practise it, rests on two assumptions that are increasingly untenable. The first is that vendors will accurately disclose material risks in response to questionnaires. The second is that the annual or semi-annual review cycle captures risk conditions that are, in reality, dynamic and continuous. Neither assumption holds under scrutiny.
Vendors completing risk questionnaires are not adversarial by nature, but they have obvious incentives to present themselves favourably. When a question touches on cybersecurity posture, financial stability, or regulatory standing, the response reflects the vendor's own interpretation of the situation — filtered through legal review, commercial relationships, and the natural human tendency to frame ambiguity positively. A vendor facing early-stage financial pressure may not disclose this. A vendor with an outstanding regulatory inquiry may note it in general terms without conveying its potential materiality. The gap between what questionnaires reveal and what independent due diligence would surface is structurally significant.
The periodic assessment model compounds the problem. A vendor assessed as low-risk in January may have experienced a leadership change, a data breach, a financial covenant breach, or an adverse regulatory event by October — and none of this will appear in the risk record until the next scheduled review. The Financial Stability Board has repeatedly highlighted this temporal gap as a systemic vulnerability in third-party oversight frameworks, noting that material vendor risk events frequently occur between formal assessment cycles without being detected until they have already caused harm.
Regulators have taken note. The EU's Digital Operational Resilience Act (DORA), in force since January 2025, requires financial entities to maintain continuous oversight of ICT third-party service providers — a standard that periodic questionnaire cycles cannot satisfy. The UK's FCA has similarly emphasised that firms should have ongoing visibility into the risk status of material third parties, not merely evidence of periodic review. The US Office of the Comptroller of the Currency has made third-party oversight a supervisory priority for consecutive examination cycles. In each jurisdiction, the regulatory direction of travel is the same: from periodic to continuous, from self-reported to independently verified, from reactive to predictive.
The Six Risk Domains Every Enterprise Due Diligence Programme Must Cover
Comprehensive vendor due diligence is not a single check — it is a structured assessment across multiple risk dimensions, each of which can carry independent material consequences. Enterprise programmes that focus on only one or two domains — typically cybersecurity and compliance — routinely miss risk that would be visible in others. The following six domains define the full scope of a mature due diligence programme.
Financial Health and Solvency
Solvency indicators, credit signals, cash flow analysis, and concentration risk. A vendor's financial trajectory is often the earliest available predictor of operational disruption — and the least monitored dimension in most TPRM programmes. AI-driven financial monitoring can detect distress signals weeks or months before they become visible in formal disclosures.
Regulatory and Compliance Standing
Sanctions list screening, politically exposed persons checks, adverse regulatory actions, and alignment with applicable frameworks — NIST CSF, ISO 27001, SOC 2, DORA, MAS TRM Guidelines, or sector-specific regimes. This domain requires both structured assessment at onboarding and continuous watchlist monitoring across the relationship lifecycle.
Cybersecurity Posture
External attack surface exposure, vulnerability disclosures, security certifications, data breach history, and security programme maturity. For technology vendors and those with access to enterprise data or systems, cybersecurity due diligence is a non-negotiable domain — and one where AI-assisted evidence validation has significantly raised the quality of assessments.
Operational Resilience
Sub-contractor dependencies (fourth-party exposure), geographic concentration, single points of failure, business continuity and disaster recovery plans, and capacity constraints. Supply chain concentration risk — dependence on a small number of vendors or a single geography for critical inputs — has become a board-level concern following a series of major disruptions over the past five years.
Adverse Media and Reputational Signals
Continuous news and media monitoring for fraud, litigation, management misconduct, ESG controversies, and reputational incidents. Adverse media intelligence is one of the highest-value applications of AI in vendor due diligence — AI can monitor thousands of sources across multiple languages simultaneously, surfacing signals that no manual team could track at equivalent coverage.
Corporate Structure and Ownership
Beneficial ownership transparency, group structure complexity, change-of-control events, and ultimate beneficial owner screening. Ownership changes can introduce new risk — a vendor acquired by a sanctions-exposed entity, or where a new beneficial owner has adverse associations, presents risks that the vendor's operational profile would not reveal.
The challenge for most organisations is not knowing that these domains exist — it is achieving consistent, proportionate coverage across a vendor portfolio that may number in the hundreds or thousands. Risk-tiered due diligence — where the depth of assessment in each domain is calibrated to the vendor's classification — is the standard answer. But tiering only works if the monitoring infrastructure can sustain the intensity required for critical vendors while efficiently handling high-volume lower-tier screening. This is precisely where AI-native platforms deliver their most significant operational leverage.
Where AI Fundamentally Changes the Due Diligence Model
Artificial intelligence has been applied to vendor risk management in various forms for several years — primarily in the form of rule-based automation, predictive risk scoring, and natural language processing for questionnaire analysis. These are incremental improvements to a fundamentally manual model. The shift that is currently under way is more significant: the move from AI-assisted due diligence to AI-driven due diligence, in which intelligent agents autonomously manage entire workflow sequences rather than supporting individual tasks.
In a traditional due diligence workflow, a risk analyst might spend four to six hours on a single vendor assessment: identifying the relevant data sources, submitting information requests, waiting for responses, chasing outstanding documents, cross-referencing the responses against registry data and adverse media, synthesising findings into a risk narrative, and populating the assessment record. Multiply this across hundreds of vendors, and the operational demand becomes the binding constraint on programme coverage and quality. Most TPRM programmes compromise on depth precisely because they run out of analyst capacity.
AI-driven platforms address this constraint directly. The agentic AI capabilities now available in purpose-built TPRM platforms can autonomously execute the data-intensive phases of due diligence — querying corporate registries, screening against sanctions and watchlists, monitoring adverse media across hundreds of sources in real time, extracting and validating financial signals, and synthesising multi-source risk profiles — without human intervention at each step. What takes an analyst six hours can be completed by an AI agent in minutes, and at a scale and coverage breadth that manual processes cannot approximate.
Crest's agentic AI workflows automate evidence collection, vendor engagement, and continuous monitoring — giving your risk team high-quality intelligence at a scale that manual processes cannot match. Explore how it works for your programme.
The distinction between AI assistance and agentic AI is important. An AI-assisted workflow still depends on humans to initiate each step, review each output, and trigger the next action. An agentic AI workflow deploys autonomous agents that can plan and execute sequences of actions — send a due diligence request, follow up on non-response after a defined interval, validate the received evidence, flag anomalies for human review, and update the vendor risk record — within defined boundaries and governance rules. Human-in-the-loop oversight remains central: risk professionals set the decision thresholds, review high-priority findings, and make consequential judgements. But the agent handles the volume and velocity of process execution that previously consumed most of the analyst's available time.
What an Agentic AI Due Diligence Workflow Looks Like in Practice
Understanding the practical mechanics of an agentic AI due diligence workflow helps risk leaders evaluate what is actually achievable — and what governance structures are required to deploy it responsibly. The following describes a representative workflow for a critical-tier vendor onboarding assessment, designed around human-in-the-loop governance principles.
When a new critical vendor is flagged for onboarding, the agentic AI platform initiates a structured engagement workflow. It identifies the relevant due diligence scope based on the vendor's classification, risk tier, and the regulatory frameworks applicable to the engagement. It sends an AI-generated, context-specific information request to the vendor contact — tailored to the vendor's industry, size, and the specific risk domains most relevant to the proposed relationship.
Simultaneously, the AI agents begin independent data enrichment: querying corporate registry sources to verify legal entity status, ownership structure, and incorporation details; running the vendor against sanctions lists and watchlists maintained by OFAC, the UN, the EU, FATF-aligned jurisdictions, and sector-specific regulators; scanning adverse media sources across multiple languages for the vendor's legal entity, key management personnel, and associated group entities; and pulling available financial indicators from public filings and credit intelligence sources.
As vendor-submitted documentation arrives, AI agents validate it against defined standards — checking certifications for validity and scope, cross-referencing policy documents against assessment criteria, and flagging discrepancies or gaps for human review. Where evidence is missing, the AI initiates automated follow-up within a defined response window. Where anomalies are detected — a certification that has lapsed, a disclosed sub-contractor that appears on a watchlist, a financial indicator that diverges from sector norms — the AI escalates to the responsible risk analyst with a structured finding summary.
The outcome of this workflow is a structured vendor risk profile — populated from both self-reported and independently verified sources, flagged for human review on any high-priority finding — in a fraction of the time that manual processing would require. The risk analyst's role shifts from data collector to decision-maker: reviewing AI-generated intelligence, applying professional judgement to borderline cases, and approving or escalating the onboarding recommendation.
Six Steps to Rebuild Your Due Diligence Programme Around AI-Driven Intelligence
Rebuilding a due diligence programme around agentic AI is not primarily a technology decision — it is an operating model decision that requires alignment across risk, procurement, legal, and technology functions. The following framework provides a practical path for enterprise risk teams at various stages of maturity. See also Crest's end-to-end vendor risk governance framework for a broader view of how due diligence fits within the full vendor lifecycle.
Audit Your Current Workflow for Automation Potential
Map every manual step in your due diligence process and classify each as rule-based (strong automation candidate), judgement-intensive (human-led, AI-supported), or decision-critical (human decision required). This mapping defines the automation boundary for your agentic AI deployment.
Calibrate Tiering and Assessment Scope
Define vendor tiers by risk level and map the due diligence scope and monitoring intensity to each. Critical vendors receive deep, multi-domain assessment with continuous monitoring. Lower tiers receive proportionate, AI-accelerated screening. Without rigorous tiering, even the best AI platform will be deployed inefficiently.
Connect Live Data Sources
Configure your platform to ingest real-time data relevant to each risk domain: corporate registry feeds, sanctions and watchlist updates, adverse media, financial distress signals, cybersecurity vulnerability databases, and ESG controversy monitoring. The quality of AI-generated risk intelligence is directly dependent on the breadth and freshness of its data inputs.
Deploy Agentic Workflows for Evidence Collection
Use agentic AI to automate vendor engagement: initiating information requests, chasing outstanding responses, validating submitted documents against standards, and escalating anomalies for human review. AI-assisted evidence collection typically reduces questionnaire cycle times by 40–60% while improving response completeness.
Embed Human-in-the-Loop Governance
Define the decision points where human review is mandatory — onboarding approval for critical vendors, escalated findings, exception handling — and ensure these are enforced in the platform workflow. Document every AI action and human decision for audit purposes. Regulators across DORA, FCA, and MAS jurisdictions will expect to see this governance trail.
Transition to Continuous Due Diligence
Replace the annual reassessment cycle with continuous monitoring that automatically flags material changes to vendor risk profiles. Set severity thresholds for immediate escalation — financial distress signals, sanctions changes, high-confidence adverse media — and lower-priority flags for periodic batch review. The goal is a risk record that reflects current conditions at all times, not a snapshot from the last formal review.
The Cybersecurity and Infrastructure Security Agency (CISA) has published guidance emphasising that supply chain risk management requires continuous vigilance — a principle that applies equally to the financial, operational, and reputational dimensions of vendor due diligence. The enterprise risk teams that are building AI-driven programmes today are not ahead of the curve on technology — they are ahead of the curve on regulatory readiness, because the direction of travel in every major jurisdiction is toward the continuous, evidence-based oversight model that AI-native TPRM platforms are designed to deliver.
Key Takeaways for Enterprise Risk Leaders
- Traditional vendor due diligence — periodic, self-reported, questionnaire-centric — has a structural gap between what it captures and what enterprise risk management requires. Regulators in the EU, UK, US, and Singapore are explicitly moving beyond periodic oversight as the acceptable standard.
- Comprehensive due diligence covers six risk domains: financial health, regulatory standing, cybersecurity posture, operational resilience, adverse media, and corporate structure. Most programmes cover two or three. AI-native platforms enable all six at scale.
- Agentic AI changes the operating model for vendor due diligence — deploying autonomous agents for data collection, evidence validation, and continuous monitoring, with human-in-the-loop governance at decision points. Assessment cycle times typically fall by 40–60%.
- The quality of AI-generated risk intelligence depends on data source breadth and freshness. Platforms that ingest real-time feeds across financial, regulatory, media, and cybersecurity domains deliver materially better intelligence than those relying on static or infrequently updated databases.
- Risk-tiered due diligence remains the correct model for large portfolios — AI enables proportionate coverage at scale, ensuring critical vendors receive deep monitoring while lower-tier vendors are screened efficiently without compromising overall programme quality.
- Human-in-the-loop governance is not a constraint on AI autonomy — it is the governance architecture that makes AI-driven due diligence auditable, defensible, and regulatorily compliant.
Frequently Asked Questions
Vendor due diligence is the structured process of evaluating a third party's financial health, operational capability, compliance posture, cybersecurity controls, and reputational standing before entering — or continuing — a business relationship. It matters for enterprise risk management because third-party failures are one of the most common sources of material operational, financial, and reputational loss for large organisations. Regulators across major jurisdictions — including the UK's FCA, the EU under DORA, the US OCC, and MAS in Singapore — have formalised due diligence requirements and hold organisations accountable for the risk carried by their vendors. Insufficient due diligence at onboarding, and the absence of ongoing review, has been cited as a contributing factor in a significant proportion of enterprise data breaches, compliance failures, and supply chain disruptions over the past decade. Robust due diligence is not a one-time gate — it is an ongoing discipline.
Agentic AI improves vendor due diligence by deploying autonomous agents that can execute multi-step data gathering and analysis tasks without manual intervention at each step. In a traditional workflow, risk analysts spend a significant portion of their time on data collection: requesting documents, chasing non-responsive vendors, searching corporate registries, reviewing adverse media, and cross-referencing sanctions lists. Agentic AI platforms can perform all of these tasks autonomously — initiating vendor outreach, validating submitted documentation against known standards, querying live data sources for financial and regulatory signals, and synthesising findings into structured risk profiles. The result is a dramatic reduction in cycle time — from weeks to days for initial due diligence — and a material improvement in coverage, since AI agents can monitor a breadth of sources that no manual team can match at scale. Human-in-the-loop governance remains central: risk professionals review AI-generated findings, make consequential decisions, and sign off on outcomes — but the labour-intensive data work is handled by the AI.
Comprehensive vendor due diligence in 2026 should cover at least six risk domains. Financial health: solvency indicators, credit signals, financial statement analysis, and concentration risk. Regulatory and compliance standing: sanctions list screening, politically exposed persons checks, adverse regulatory actions, and alignment with frameworks relevant to your sector. Cybersecurity posture: external attack surface analysis, vulnerability disclosures, data breach history, and security certifications. Operational resilience: sub-contractor dependencies, geographic concentration, business continuity plans, and fourth-party exposure. Adverse media and reputational signals: news monitoring for fraud, litigation, management misconduct, or ESG controversies. Corporate structure and ownership: beneficial ownership transparency, group structure complexity, and change-of-control events. Mature programmes address all six domains continuously — not just at onboarding.
Initial vendor due diligence is the point-in-time assessment conducted before or at the start of a vendor relationship. It establishes a baseline risk profile and determines whether the relationship should proceed under what contractual safeguards. Continuous vendor monitoring is the ongoing process of tracking changes to that risk profile over the life of the relationship. Because risk conditions change constantly — a vendor can be financially sound at onboarding and under distress eighteen months later — periodic reassessment alone is structurally insufficient. Continuous monitoring uses live data feeds, AI-driven signal detection, and automated alerting to surface material risk changes between formal review cycles. Leading enterprise programmes treat initial due diligence and continuous monitoring as two phases of a single integrated discipline rather than separate activities managed by different teams.
Enterprises managing large vendor portfolios — typically hundreds to thousands of third parties — cannot apply the same depth of due diligence to every vendor without overwhelming their risk teams. The standard approach is risk-tiered due diligence: vendors are classified by the risk they represent based on factors including data access, system integration depth, regulatory criticality, revenue dependency, and sub-contractor exposure. Critical or tier-one vendors receive the deepest due diligence across all six risk domains, with frequent reassessment and real-time continuous monitoring. Tier-two vendors receive substantive but proportionate assessment. Tier-three vendors undergo lighter-touch screening. AI-native TPRM platforms support this model by automating tiering logic, scaling due diligence depth proportionately, and ensuring that ongoing monitoring intensity matches each vendor's risk classification — making comprehensive programme coverage operationally feasible even for very large portfolios.