Ideas for partnerships and vendor-management teams
Notes on governing vendors, contracts, and AI agents — for the teams that own the relationship, not just the paperwork.
What's new in Granur: November 2026
Ask Granur answers questions about your contracts and vendors, AI reads every contract for risky clauses, and Trust status shows where each vendor stands. Plus AI use tracked on every vendor, a renewal wizard, business reviews your vendors can prepare for, and a 72-hour clock for vendor incidents.
Your customers must now document you: new Norwegian rules for tech and AI suppliers
DORA, the Digital Security Act and GDPR already require Norwegian banks, energy companies and others to document every supplier, including the AI behind them. NIS2 and the AI Act are next. Here's what your customers will ask, and how to be the supplier that's easy to approve.
Your vendors added AI. Did anyone tell you?
Most AI doesn't enter your company through a purchase order. It arrives in a product update from a vendor you approved years ago. Here's why your usual checks miss it, six things to do about it this quarter, and a clause and questionnaire you can use straight away.
The vendor nobody vetted
Two of 2026's most damaging breaches — Canva's and Trezor's — trace back not to the company under attack, but to a small vendor several tiers removed from it. A closer look at why the vendor that actually gets you is rarely the one you reviewed, with the sources to prove it.
Why partnerships teams need Granur to govern vendors and AI agents
Partnerships teams are now the front door for vendors and AI agents alike. Here's why that's become a security and policy problem — and what governing it well actually requires.
US AI laws for companies that buy AI tools: what to ask your vendors
There's no single federal AI law, but state and city rules already reach companies that simply use AI, especially in hiring and other decisions about people. Here's what buyers need to know, and what to ask vendors.
How to review a vendor's SOC 2 report: what to actually look for
Asking a vendor "do you have a SOC 2?" tells you almost nothing. Here's how to read the report itself: type, scope, opinion, exceptions, and the controls that are your responsibility.
The EU AI Act for companies that buy AI: what to ask your vendors
Most companies won't build AI systems, but almost all of them will buy them. Here's what the EU AI Act means for you as a buyer, and the questions to ask before you approve an AI tool or agent.
Third-party risk management for SaaS vendors: a practical checklist
Every SaaS tool you add is a third party with access to your data. Here's a practical third-party risk management process for US companies, from intake to offboarding, without a team of analysts.
NIS2 supplier security: a practical checklist for your vendor list
NIS2 makes supply chain security your responsibility, not just your vendors'. Here's what that means in practice for procurement, legal and security teams, and a checklist to work through.
How to stop vendor contracts from auto-renewing without anyone noticing
Auto-renewal clauses quietly cost companies money every year. Here's why renewals get missed, and a simple system for catching every notice deadline before it passes.
See vendor and agent governance in Granur
One pipeline for every vendor and agent, with infosec, legal, and business review built in.