Third-Party Risk Management - February 20, 2026 - 202602.1.0 (Winter Release)

General Availability

New Delete Contract & Delete Engagement APIs

Added the Delete Contract and Delete Engagement APIs to enable external systems and integrations to remove contracts and engagements programmatically. This enhancement allows you to manage the lifecycle of these entities through external integrations while maintaining proper authorization and data integrity.

Enhanced Contracts & Engagements Data Models

Data models for various Contracts and Engagements APIs have been enhanced to add the following new objects and parameters:

• Updated the Create Engagement API to include the vendorType object containing the id, value, and valueKey parameters within the vendor object of the request.

• Updated the Get Engagement, Create Engagement, Update Engagement, Modify Engagement, and Search Engagements APIs to include the vendorType object containing the id, value, and valueKey parameters within the vendor object of the response.

• Updated the Search Contracts and Search Engagements APIs to include the redacted parameter within the response.

• Updated the Get Contract Schema and Get Engagement Schema APIs to include the optionsByDomain and formulaByDomain parameters within the response.

• Updated the Get Contract Schema and Get Engagement Schema APIs to include the optionListUrl, optionType, permissions, and applicationUrl parameters within the optionMetadata object of the response.

These updates enhance Contracts and Engagements APIs with improved vendor type visibility, redaction awareness, and schema metadata that enable more accurate data handling and simplify downstream reporting.

Fixed

• Resolved an issue that prevented users from saving changes to contract details when the Contract cost field was set to 0.

• Resolved an issue that caused some vendor records to be stuck between workflow stages which blocked further stage progression and workflow rule execution.

• Enhancements have been made to improve performance when processing complex workflow and routing rule configurations for vendors and engagements. Validation to flag archived or deleted workflows and data, such as attributes, response options, organizations, etc., is now only applied ahead of time when a configuration contains 20 rules or fewer. When more than 20 rules are present, validation will be completed only when the rule details are expanded.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Third-Party Risk Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

The following enhancements have been made to the DORA export report's template tabs:

• The Total annual expense or estimated cost of the ICT third-party service provider (Vendor) field in Template 05.01 now dynamically calculates based on the details supplied for the Legal Entity performing the extraction. This allows organizations to report on the costs associated with ICT service providers in the value chain as an indicator of the material dependency on a service provider or value chain.

• All relevant External Legal Entities linked to an engagement are now captured in Template 01.02. This provides complete cross-entity engagement visibility and supports accurate multi-entity reporting under DORA.

• Reporting of Parent Undertaking of each vendor is now supported in Template 05.01. This improves transparency of corporate ownership structures and supports regulatory reporting requirements for DORA by allowing users to identify and report on the parent organization of any ICT third-party service provider.

• Tag and trace overarching contractual relationships in Template 02.01 for improved reporting on hierarchical contract structures. This captures the overarching contract's arrangement reference number on the attribute Overarching Contractual Arrangement Reference Number on the child or subsequent contract.

For more information, see Step 2: Define Relationships.

AI Auto-Responses for Assessments

Automatically fill out assessments based on past assessments or scanned documents with the AI auto-responses for assessments feature set, which includes AI Doc Scanner and AI Inventory Analysis.

This change was introduced in the Winter release and communicated for Assessment Automation in the release notes, but it also applies to Third-Party Risk Management and has been retroactively added to the release notes.

For more information, see Leveraging AI Auto-Responses for Assessments.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.