Beyond the Checklist: GenAI-Driven Third-Party Risk Assessments & Due Diligence

Third-party risk management (TPRM) has become a strategic priority for firms amid escalating regulatory expectations and operational dependencies. We explore the current state of due diligence and risk assessments within TPRM, the challenges firms face in a fast-evolving threat landscape, and how AI-driven approaches can transform traditional models into scalable, intelligent solutions.

Landmark frameworks such as the EU’s Digital Operational Resilience Act (DORA) and the UK’s SS2/21 and forthcoming Critical Third Parties policy, as well as interagency guidance in the US, have redefined the regulatory landscape.

In the UK, finalized policies on third-party and incident reporting are expected in 2025. The UK guidance is expected to align closely with DORA and the EBA’s outsourcing guidelines. This trend is reflected with the European Banking Authority’s Draft Guidelines on the sound management of third-party risk (EBA/CP/2025/12), published for consultation in July 2025. Similarly, the European Central Bank has elevated TPRM, including cloud outsourcing, to a supervisory priority, with designations of Critical Third Parties expected across both the UK and EU.

This sustained regulatory momentum has reinforced TPRM as a vital capability, requiring firms to invest in robust due diligence and risk assessment practices. The risks of inaction are no longer hypothetical: reputational damage, regulatory penalties, and operational disruptions are all real consequences.

"Third party risk management, including cloud outsourcing, is high on our list of supervisory priorities for ‘24-’26, and we expect banks to establish robust outsourcing-risk arrangements to prevent disruptions to critical services." Elizabeth McCaul, Member of ECB board¹

There have been several high-profile incidents involving third parties, most recently CrowdStrike, where an update rolled out affected millions of devices across the globe. Firms across many sectors were impacted and led to flights being cancelled, investment trading halted, and disruption to healthcare systems.

The rise of cloud services has also raised regulatory concerns of systemic concentration risks coming from a large proportion of cloud services being provided by a small number of firms such as Amazon or Microsoft. The continued growth of cloud services and the heavy reliance of firms on third parties, brings these risks into sharp focus for firms to investing time and resources to enhance their TPRM capabilities and operating models.

^{1 https://www.bankingsupervision.europa.eu/press/speeches/date/2024/html/ssm.sp241018~e103a2dab4.en.html}

Download the full white paper to access:

1. Why focus on due diligence and risk assessments?

2. Today's key challenges

3. How to respond: role of AI and implementation strategies

4. Selecting the right GenAI strategies

5. Unlocking real value from AI

6. How Capco can help