Vendor contract risk review that finds the missing audit, exit and subcontracting clauses before renewal, not at inspection
Missing audit, exit and subcontracting clauses fixed before renewal, not at inspection.
See one case, screen by screen ↓Third-Party Contract Review is vendor contract risk review for regulated groups: each vendor contract, with its amendments and schedules, checked for the clauses DORA Article 30, the US interagency guidance, GDPR Article 28 and your own policy require. Agents mark every required item covered, weak or missing with its citation, a second agent argues each mark, and each gap gets a drafted clause from your approved library. Counsel approves and signs every clause before a vendor sees it.
How to choose AI solutions for back-office and enterprise work →
Updated
DORA Article 30 lists nine terms every ICT contract must contain and six more for a service that supports a critical or important function. The US interagency guidance, GDPR Article 28 and your own third-party standard each add their own list. Today a lawyer or a risk analyst reads every agreement, amendment and schedule against a checklist in a spreadsheet. One clause can live in four places: a 2022 master agreement, a 2024 amendment that moved data to a second country, a service-level schedule and a data processing schedule. Reviewers read the base agreement and miss the amendment, or the reverse.
The hard calls are the ones a checklist cannot make. A GDPR sub-processor clause with a 14-day objection right looks like a subcontracting clause, but it covers personal data only and gives no approval or termination right. A 30-day transition period is an exit clause, but not one that lets you migrate a critical platform. An audit right for the customer and its auditors is not an audit right for the competent authority. Found at renewal, there is no time to negotiate; found at inspection, it is a finding — and the register of information carries the same error.
Estimated split, in hours, for one critical-function contract family reviewed by hand and with the solution. Our estimate, not a measured result.
Agents read every contract with its amendments, mark each required clause, argue each mark and draft the fixes; counsel decides and signs.
Kestrel & Vane Group runs 412 vendor contracts across three entities, under DORA, the US interagency guidance, GDPR Article 28 and its own standard. Corvane Cloud GmbH hosts LeaseOne, the platform behind lease servicing and payment execution, for €1,840,000 a year. Its notice date is 31 December 2026, 78 days away. Here is what happens, screen by screen, in the working solution.
Hannah's day opens on a short list, sorted by deadline: 7 items that need a person. The agents read Tessivo's business continuity clause at confidence 0.71, below 0.80, so they ask her to decide the mark. On Hollisgate's backup contract two agents disagree, and they say so. Overnight they read 6 new documents and re-checked 23 contracts against the new subcontracting standard.
“The agents disagree on 30(2)(d) data return: weak or covered by escrow? Your call.”
Filtered to the contracts behind a critical or important function, each row shows its regime, how many required items are covered, what is missing or weak, the notice date and who owns it. Corvane's hosting agreement, KV-ICT-0187, reads 11 of 15, with 2 missing and 2 weak, and is with counsel.
“Agents read every agreement, amendment and schedule; you decide what the marks mean.”
The intake agent groups 4 documents, 86 pages, into one contract family: the agreement, Amendment 1 and Schedules 2 and 4. The clause reader searches the 15 required items, finds 13 passages and records 2 as searched, not found. The judgement agent marks them, the challenger re-reads all 15 on its own, the drafting agent writes 4 clauses, the negotiation agent forecasts Corvane's pushback and the register agent checks the register row.
Hand-off to a person: “Package with counsel Elena Rossi · due 19 Oct · owner Hannah Lindqvist.”
The rail lists the 15 items: 11 covered, 2 weak, 2 missing. Hannah opens 30(3)(f). Clause 18.4 on page 31 gives a 30-day transition, policy KV-TPP-04 §7.2 needs at least 12 months for a critical function, and there is no duty to keep an exit plan. The agent adds that the group's own exit test puts a LeaseOne migration at 9 months. Confidence 0.94; the challenger agrees.
The judgement agent never decides on doubt: below 0.80, or in disagreement, the item goes to a person.
30(2)(b) is covered, but not by the agreement. Amendment No. 1 of 9 February 2024 deleted and replaced clause 6.1 (Frankfurt only) and named Frankfurt and Amsterdam for processing and storage, Kraków for support without storage, and 60 days' notice of any change. The rail cites Amendment 1, clause 3, page 2, and a strip shows what it supersedes.
“Amendment 1 cl. 3 supersedes Agreement cl. 6.1.”
30(2)(a) is missing: Schedule 1 describes the hosting service, but nothing says whether it may be subcontracted or on what terms. The challenger argued that Schedule 4 §7, the sub-processor clause, covers it. The argument was refuted on §7.1: it applies to the processing of personal data only, with a 14-day objection right and no approval or termination right. The challenger agreed after reading §7.1.
“Searched, not found — 4 documents, 86 pages searched for ‘subcontract’, ‘sub-contract’, ‘third party provider’, ‘delegate’, ‘assign’.”
For the weak audit clause the drafting agent replaces 14.2 with CL-AUD-05 v6 from clause library v12: access, inspection and audit for the customer, its appointee and any competent authority, with copies, on 30 days' notice. Two fallbacks counsel has pre-approved sit underneath. The negotiation agent rates pushback high: Corvane refused unrestricted on-site audit in KV-ICT-0098 (2023) and accepted a pooled audit with regulator access.
The drafting agent never sends anything, and marks any wording outside the library as new wording for counsel to write.
The package arrives in Elena's approvals with a 3-business-day clock: 4 clauses — new 9A subcontracting, new 16.5 threat-led testing, a replacement 14.2 audit clause and a replacement 18.4 exit clause. Each shows the passage, the gap it fixes, the inserted text, its fallbacks and the predicted pushback. For each one she can keep it as drafted, pick a fallback, edit it or reject it with a reason.
“Corvane accepted the same clause in the KV-ICT-0211 archive agreement (Jun 2025).”
Elena takes fallback 1 on the audit clause — pooled audit with regulator access kept in full — and the other three as drafted. She approves the package with A2, Approve with fallback, confirms she has read the governing passages and types her name. Had Hannah tried to approve it, the solution would have refused: a preparer cannot approve her own clauses.
“Refused: four-eyes — You prepared this package. A preparer cannot approve their own clauses.”
Marcus sends Amendment No. 2 to Corvane's head of contracts with a 15-business-day deadline, 4 November 2026 — weeks before the 31 December notice date. The register agent has already flagged the register row: it lists data storage in DE, while Amendment 1, clause 3.1, says DE and NL. One click fixes the row from the cited clause, one of 7 such mismatches across the register.
The register agent never submits; Pieter van Dalen, the DORA and outsourcing officer, exports and submits the register.
The same contract, seen by four of the people who carry it — what the work looked like, and what it looks like now.
Agents read every contract with its amendments, mark each required clause, argue each mark and draft the fixes; counsel decides and signs.
Picks up contracts and amendments from the contract system, the procurement suite and the contracts mailbox, groups each file into its contract family, classifies it — ICT or not, critical function or not, entity and regimes — and finds duplicates and missing referenced documents.
Finds each required item across the agreement, amendments and schedules, works out which text governs today, and cites document, section and page.
Decides covered, weak or missing against the regulation's test and the group's thresholds, explains why, and scores its confidence.
Re-reads each item on its own and argues the opposite case, recording whether it agrees or disagrees and on what evidence.
Drafts the fix for each gap from the approved clause library, with fallbacks, as an amendment package.
Predicts pushback from the vendor's past positions across the group's contracts, reads the vendor's redline when it returns, re-scores the contract and proposes the next round.
Writes register-of-information rows from cited clauses, reconciles the register against the contracts and runs the supervisor's 116 data checks.
Watches renewal notice dates and regulation changes, re-runs the requirements across the portfolio and schedules each fix before its notice date.
Approves every clause. The agents propose; a named person decides.
Ask about a contract, a clause, a vendor or the whole portfolio. Every answer cites the contract and page it came from, then opens the list or passage it is about.
Which critical contracts have no threat-led testing clause?
9 of the 38 contracts behind a critical or important function have no duty to take part in threat-led penetration testing (DORA Art 30(3)(d)): Corvane Cloud GmbH, Tessivo Identity Inc., Ledgerholm Systems Ltd, Faywater Cloud Services Ltd and 5 more. In Corvane's agreement the closest text is cl. 11.6, the provider's own yearly pen test, which is not TLPT. Each has CL-TLPT-01 v2 drafted.
Why is Corvane's exit clause weak?
Clause 18.4 gives a 30-day transition after termination. Group policy needs at least 12 months for a critical function, with an exit plan (KV-TPP-04 §7.2), in line with DORA Art 30(3)(f). Help after 30 days is charged at standard rates (cl. 18.5). The draft replaces 18.4 with 12 months and an exit plan within 90 days. Corvane accepted the same in 2025.
What changes if the subcontracting test applies to all ICT contracts?
Applying RTS (EU) 2025/532's conditions to every ICT contract of K&V Financial Services, not only the 38 critical ones, would add a gap to 41 contracts (33 weak, 8 missing). The nearest notice date among them is 2 Dec 2026. A campaign can be drafted from CL-SUB-02 v4 grouped by renewal date; Pieter van Dalen approves it before anything is sent.
Draft the Q3 report for the management body
Drafted in four sections: coverage, open gaps, remediation and the register. Every number comes from decided items. 355 of 412 contracts are fully covered (86%), and 20 of 38 critical contracts carry all 15 DORA items. Pieter van Dalen signs it.
13 screens from the working solution, on its sample data. Pick one to see it large.
What the agents may decide alone, what counts as weak and how long each step may take are settings, and every change is on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| Hand to a person below this confidence | 0.80 | 0.60 to 0.95, in steps of 0.05 |
| Minimum exit transition, critical function | 12 months (policy KV-TPP-04 §7.2) | 3 to 24 months, in steps of 1; shorter is weak |
| Maximum audit notice | 30 days (policy KV-TPP-04 §6.1) | 5 to 90 days, in steps of 5; longer is weak |
| Renewal alert window | 90 days | 30 to 180 days, in steps of 10 |
| Counsel approval | 3 business days | 2 · 3 · 5 business days |
| Vendor response | 15 business days | 10 · 15 · 20 business days |
| Escalation to the DORA and outsourcing officer | after 20 business days | after 15 · 20 · 25 business days |
| Fallbacks below policy also need the DORA and outsourcing officer | On | On · Off |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (Regulation (EU) 2022/2554, Art 30(2) and 30(3) — nine items for every ICT contract and six more for critical or important functions). Regulations named for context: Delegated Regulation (EU) 2025/532, Implementing Regulation (EU) 2024/2956, Interagency Guidance on Third-Party Relationships, 88 FR 37920 (2023). People, companies, contracts and addresses named on this page are fictional — characters and sample data in the working solution.
Third-Party Contract Review is vendor contract risk review for regulated groups: each vendor contract, with its amendments and schedules, checked for the clauses DORA Article 30, the US interagency guidance, GDPR Article 28 and your own policy require. Agents mark every required item covered, weak or missing with its citation, a second agent argues each mark, and each gap gets a drafted clause from your approved library. Counsel approves and signs every clause before a vendor sees it.
For a contract behind a critical or important function it lists all 15 items — the nine of Article 30(2) and the six of Article 30(3) — and tests each against the regulation and your thresholds, such as a 12-month minimum exit transition or 30 days' maximum audit notice. A clause that exists but falls short is marked weak, not covered. Contracts for other ICT services get the nine items of Article 30(2).
The whole contract family. The intake agent groups the agreement, amendments, schedules and data processing agreement, and the clause reader works out which text governs today. In the demo, Amendment No. 1 replaced the agreement's location clause, and the rail cites the amendment and shows what it superseded.
Usually not. A sub-processor clause covers personal data, often with only an objection right. RTS (EU) 2025/532 needs conditions on subcontracting the service itself, approval of material changes and a termination right. The solution tests for those, which is why the same contract can show 8 of 8 under GDPR Article 28 and still miss the DORA subcontracting item.
Yes. The register agent writes each field from a cited clause, flags where the register and the signed contract disagree — in the demo, 7 rows, such as a data location listed as DE where the amendment says DE and NL — and runs the supervisor's 116 data checks. Each mismatch is fixed from its clause. The DORA and outsourcing officer exports and submits the register.
Yes. Requirements are set per regime: DORA for critical and other ICT services, the 2023 US interagency guidance, GDPR Article 28 and your group's third-party standard. Switching the regime recalculates the rail on the same documents, and a regime that does not apply to the contracting entity says so instead of scoring it.
Yes. The agents mark, argue and draft; people decide. Anything below 0.80 confidence or in disagreement goes to a person, counsel approves and signs every clause before it reaches a vendor, a preparer cannot approve their own package, and only the DORA and outsourcing officer can accept a risk or change a requirement. The agents never send, agree terms or submit.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your regimes and group policy, your clause library, your map of critical functions and the systems your contracts live in — and it goes live once every quality gate has passed. First-time setup includes a trial on 20 contracts your lawyers have already reviewed by hand, compared item by item before go-live.
Exceptions weighed and every user-entity control owned before the SOX year-end test.
1-min demoSupply Chain Due DiligenceDetained goods released with a trace to the raw material, every link proved.
1-min demoSupplier Sanctions ScreeningNo payment reaches a supplier blocked through its owners; every alert brings its evidence.
1-min demoWe'll run Third-Party Contract Review on a sample of your own contract families against the regimes you report under.