GATEKEEPER AI AGENTS
Vendor Inherent Risk Assessment Agent.
Every new vendor needs a risk rating before anyone can decide how much due diligence to ask for.
The Vendor Inherent Risk Assessment Agent recommends a rating from the onboarding answers, so your team confirms it and moves on.
See it in action.
HOW IT WORKS
How the Vendor Inherent Risk Assessment Agent works.
Answers submitted.
The onboarding or scoping questions on the card are completed, describing what the vendor will do, the data it will handle and the access it needs.
Dimensions assessed.
The agent assesses 13 risk dimensions, including personal data, system access, criticality, regulated activity, payments, data location, AI use and contract value.
Gaps treated with caution.
Where a question about data, access or criticality has no answer, the agent treats it as if the answer could be Yes and says so.
Rating applied.
Set rules produce a recommended rating of Critical, High, Medium or Low, which the agent compares with any existing rating or tier on the card.
Structured output.
Findings are summarised with the recommended rating, the main drivers, a table showing how each dimension affects the rating and any unanswered questions.
Due diligence suggested.
The agent suggests due diligence matched to the drivers, such as a security questionnaire and SOC 2 report for system access, or a DPA for personal data, for a person to confirm.
FAQ
Frequently asked questions.
What does the Vendor Inherent Risk Assessment Agent assess?
The Vendor Inherent Risk Assessment Agent assesses the risk a vendor or service carries before any controls are applied, using the answers and documents on the card. It looks at 13 dimensions, including:
-
Personal, special category and financial data
-
Confidential business data
-
Access to your systems or network
-
Business criticality and regulated activity
-
Payments, hosting, data location and offshore delivery
- AI use, customer-facing work, site access, substitutability, value and term
How does it decide between Critical, High, Medium and Low?
The Vendor Inherent Risk Assessment Agent applies set rules. Critical covers special category or large-scale personal data with system access, support for an important business service or regulated function, or handling payments or customer funds. High covers personal or confidential data, system access, customer-facing work or offshore processing. Medium and Low cover limited data and lower value.
What if the vendor already has a risk rating?
Where the card already shows a risk rating or tier, the Vendor Inherent Risk Assessment Agent states it and whether its own assessment agrees. The agent never recommends lowering an existing rating without a clear reason.
Do MarketIQ ratings change the result?
MarketIQ ratings and Smart Form scores on the card appear in the risk drivers table. They inform the Vendor Inherent Risk Assessment Agent’s assessment, but the agent does not use them on their own to set the inherent rating.
Can we use our own risk tier names?
Yes. The Vendor Inherent Risk Assessment Agent gives its recommendation on a Critical, High, Medium and Low scale, and you map that scale to your own tier names. Every rating is a recommendation for a person to confirm.
Does it set the final risk rating?
No. The Vendor Inherent Risk Assessment Agent recommends a rating and explains the drivers. A person on your risk team confirms the rating as part of your vendor risk and compliance process.
What are the configuration options?
Tailor the Agent to your organisation’s resilience requirements rather than a generic checklist, including:
-
Risk dimensions assessed
-
Rating rules
-
Tier names
-
Suggested due diligence by driver
- Review outputs
How does Agent automation compare with a manual process?
Without Agent automation, teams read every onboarding answer and work out a risk rating by hand.
-
Ratings vary depending on who does the assessment.
-
Unanswered questions about data or access can be read as No.
-
Due diligence requests are decided case by case.
With Agent automation, a recommended rating is ready as soon as the onboarding answers are complete.
-
Every vendor is assessed against the same dimensions.
-
Unanswered questions are flagged rather than assumed safe.
-
Due diligence is matched to the risk drivers.
With Gatekeeper’s Agentic AI, routine tasks are completed up to 95% faster.
Is there an audit trail?
Every Agent action is recorded in Gatekeeper with a timestamp, including the criteria applied, decision made, supporting evidence and reasoning where applicable.
This creates a searchable record of how each outcome was reached, supporting compliance verification, internal review and audit requirements.
How is my data kept secure and compliant?
Your data stays within Gatekeeper while the Agent performs its work. Actions, decisions and supporting evidence are logged, creating a clear audit trail.
The Agent operates within the permissions, playbooks and authority controls you configure.
Data handling follows Gatekeeper’s enterprise security standards, including SOC 2 Type II compliance and GDPR requirements.
one unified record
Every capability, unified.
One system of truth.
Customer and vendor contracts, obligations, and renewals in one record.
See spend against contract.
Contract value sits next to what is actually being spent.
No single point of failure.
Contract knowledge lives in the platform, so nothing is lost when someone changes role or leaves.
Draft from approved templates.
Every agreement starts from language Legal already trusts.
Keep control of the clause library.
Guard-railed templates keep off-policy wording from going out.
Nothing renews unnoticed.
Every renewal date tracked, with owners and reminders set automatically.
Expert insight & opinion
Related AI agents.
Gatekeeper's agents work as a single, connected team, handing off to one another across the lifecycle rather than running in isolation like bolted-on point tools.
