Rebuilt for every submission
Each filing season, the register is pieced together again from contracts, emails and spreadsheets.
A register your examiner can read as it stands
Montro keeps your register of information and third-party records current, with an owner and a decision on every change, so every entry carries the decision your examiner will ask about. No rebuilding the file each quarter.
The Problem
The register is right on the day it is filed
Suppliers change between submissions. The record usually catches up at the next deadline.
A finding with no outcome
A change logged but never closed shows the firm knew, and leaves no trace of what it did.
One supplier, several records
The same supplier sits in DORA, GDPR and NIS2 files, kept by different teams in different shapes.
How Montro helps
From scattered files to one record you can file from
Three steps that keep your third-party records ready between submissions.
One intake
Six records from the same source
Register of information, material third-party register, record of processing, supply-chain records, AI inventory and control evidence.
Changes
Each change confirmed at source
Raised with its source, confirmed by the supplier and mapped to the articles it affects.
Decisions
Every finding reaches an outcome
Actioned, accepted with a reason, rejected or not a finding. You file it; Montro keeps it true.
One change, start to finish
From a supplier change to an answer your examiner can read
A supplier adds AI to a tool you already approved. Here is how that change becomes evidence.
The change
The supplier switches on an AI feature inside a product your firm already uses.
The candidate
Montro raises it with its source and maps it to the AI Act, GDPR and DORA articles it touches.
The confirmation
The supplier confirms the change, so your team is not acting on a guess.
The decision
The owner decides: actioned, accepted with a reason, rejected or not a finding.
The record
Every register the change touches is updated, with the decision trail attached.
Capabilities
What Montro does for your third-party records
Three things that matter when your examiner asks for the register.
Register of information, ready to file
Contracts, functions supported, criticality, substitutability, exit plans and annual expense, kept for your xBRL-CSV submission under DORA Article 28(3).
UK material third parties
For UK firms, the material third-party register under FCA PS26/2 and PRA PS7/26, in force from 18 March 2027, kept from the same intake.
Decision log
A trail your examiner can follow
Each entry carries who decided, when and on what evidence. Dormant suppliers are re-tiered, not removed, so the record stays complete while the review load drops.
Keep reading
The rest of your governance team
The record you answer for is built with three colleagues. See what it gives each of them.
For CISOs
Security posture across the same suppliers you report on, with exceptions raised for a decision.
Read more
For DPOs
The record of processing, kept from the same intake as your register of information.
Read more
For IT Directors
New tools reviewed against a filled-in catalogue entry before they reach your register.
Read moreQuestions
What Heads of Compliance ask before they rely on the register.
No. You file it; Montro keeps it true. The register of information is kept ready for your xBRL-CSV submission, and your team reviews and submits it in your own process.
Your people. Montro raises each change with its source and the supplier confirms it, but nothing enters the register until the owner you assign has decided.
Yes. You get a roll-up of supplier posture with the exceptions that need attention, and the decision trail behind each entry if anyone asks how you got there.
In the EU, on AWS in Frankfurt. Customer data does not leave the EU. Montro is pen-tested, and ISO 27001 certification is in progress. We do not sell or share your supplier data.
Yes. EU firms get the DORA, GDPR, NIS2 and EU AI Act records. UK firms get the material third-party register under FCA PS26/2 and PRA PS7/26, and UK GDPR. A UK firm with EU entities can keep both from one intake.
See it on your own suppliers
A read-only connection, about an hour to set up, and a named person who can say yes to a decision.
Priced to scope — never per seat, never per supplier. Upgrade only when the evidence earns it.
