RiskXchange Launches The Agency: An AI Workforce for Third-Party Risk

LONDON - Oct. 2, 2026 - PRLog -- RiskXchange, the London-based third-party risk management (TPRM) and cyber risk intelligence provider, has launched The Agency, an AI-native platform powered by 32 specialised AI agents working as one risk team. The Agency operates across the vendor lifecycle, from onboarding and assessment to continuous monitoring, remediation, compliance reporting and offboarding.

Unlike traditional TPRM workflows that rely heavily on spreadsheets, questionnaires and periodic assessments, The Agency uses AI agents to execute work continuously, while allowing organisations to determine the level of human control.

32 AI Agents. One TPRM Team.

Five lead agents manage key areas of the vendor lifecycle, supported by 27 specialised sub-agents.

NOVA manages vendor onboarding, discovery, firmographics, chasing and offboarding.

ARIA delivers document and questionnaire intelligence, including questionnaire pre-population.

REX provides continuous external risk intelligence across digital footprints, breach feeds and fourth parties.

TARA manages continuous monitoring, risk tiering, remediation and compliance gap analysis.

VANCE produces board-grade regulatory and compliance reporting from live data with an immutable audit trail.

"The next evolution of TPRM isn't AI that helps people do the same work faster. It's AI agents capable of doing the work continuously, with humans deciding where and when they want control. That's the shift The Agency represents: from AI-assisted to agentic TPRM."

Darren Craig, Founder and CEO, RiskXchange

Measurable impact

ARIA pre-populates up to 94% of questionnaire answers against 157 Universal Controls, while NOVA eliminates up to 85% of manual effort across onboarding, chasing and offboarding. TARA can produce compliance gap analysis and remediation roadmaps in under 24 hours, while REX continuously monitors external risk using intelligence covering more than 5 million companies.

Autonomy with control

Organisations can choose between Manual, Assisted and Autonomous modes, determining how much control is given to the AI agents and changing that level at any time.

"Risk doesn't operate quarterly, so risk management can't either. A supplier's exposure can change overnight. The future of TPRM is continuous – continuously assessing, monitoring and responding as risk changes."

Darren Craig, Founder and CEO, RiskXchange

Built for regulated industries

The Agency supports frameworks and regulations including DORA, NIS2, ISO 27001, NIST CSF, PCI DSS, SOC 2 Type II, APRA CPS 230, ADHICS, GDPR and FCA requirements.

The Agency is available now. RiskXchange is inviting organisations to select ten vendors and deploy The Agency against them, receiving a sample SnapShot, REX brief and DORA gap report based on real vendor data before making any commitment.

RiskXchange website:http://www.riskxchange.co