This is just the beginning
Here is the latest edition of the agenda. As we approach the event, we will be adding speakers and sessions to enhance your experience. To stay informed, please register your interest
Wednesday - Morning June 3, 2026
8:00 am - 8:50 am
Registration and breakfast
8:50 am - 9:00 am
Chair’s opening remarks
Moderator
9:00 am - 9:45 am
DORA IN PRACTICE: FROM REGULATORY INTENT TO OPERATIONAL REALITY – PANEL DISCUSSION
Where DORA implementation is breaking down in practice and how firms are translating regulatory expectation into scalable, defensible operating models
- Moving from static lists to dynamic, risk‑based inventories of third‑ and Nth‑party providers
- Designing and executing meaningful operational resilience tests across complex, multi‑vendor and chain‑outsourcing scenarios
- Consistently meeting DORA’s tight incident reporting timelines when information sits across multiple providers and jurisdictions
- Retrofitting DORA requirements into legacy contracts, SLAs and governance structures without disrupting critical services
9:45 am - 10:30 am
DATA QUALITY AND VISIBILITY: BUILDING TRUSTED FOUNDATIONS FOR TPRM AND RESILIENCE – PANEL DISCUSSION
How fragmented data is undermining TPRM and how firms are building real-time visibility to support decisions and resilience
- Fixing fragmented vendor inventories and incomplete data sets
- Improving tagging and mapping between services, processes, and suppliers
- Reconciling multiple internal data sources for regulatory reporting
- Enabling real-time visibility during incidents and disruptions
- Moving from data collection to decision-enabling insight sa
10:30 am - 11:00 am
Morning refreshment break and networking
11:00 am - 11:35 am
HIDDEN AI IN THE SUPPLY CHAIN: EXPOSURE, BLIND SPOTS AND CONTROL CHALLENGES
How undocumented and embedded AI across third- and Nth-party ecosystems is creating invisible risk
- Identifying undisclosed AI usage across vendors and sub-vendors
- Assessing vendor AI models with limited documentation or transparency
- Managing risks around data leakage, bias, and automated decision-making
- Strengthening contractual protections and governance for unknown AI deployment
- Building visibility and accountability across AI-enabled supply chains
11:35 am - 12:10 pm
THIRD-PARTY RISK IN A SAAS WORLD: WHO REALLY OWNS THE RISK
Exploring whether traditional third-party risk approaches are still fit for purpose in a highly interconnected, technology-driven ecosystem
- The shift from outsourcing services to outsourcing critical capabilities and its implications for risk ownership
- The growing complexity of third-, fourth-, and nth-party ecosystems, and the challenges in maintaining visibility
- The illusion of risk transfer vs. the reality of retained accountability
- Limitations of traditional TPRM approaches
- Concentration risk in SaaS and cloud providers and its potential systemic impact
- The need to move toward continuous, intelligence-led risk monitoring
- Embedding third-party risk into broader operational resilience and enterprise risk frameworks
- The increasing gap between contractual assurance and real-world resilience
12:10 pm - 12:55 pm
CYBER RISK IN AN AI-DRIVEN ECOSYSTEM: EXPANDING ATTACK SURFACES ACROSS THIRD AND NTH PARTIES – PANEL DISCUSSION
How cloud, APIs, and AI are expanding cyber exposure across interconnected ecosystems and why traditional controls are no longer sufficient
- How cloud connectivity, APIs, and AI workflows expand third- and Nth-party attack surfaces
- The cyber and operational risks introduced by vendor AI adoption
- The growing sophistication and professionalisation of threat actors
- Failures driven by patching, updates, and configuration changes across third and fourth parties
- Strengthening cyber resilience across interconnected vendor environments
Thursday June 4, 2026
8:00 am - 8:50 am
Registration and breakfast
8:50 am - 9:00 am
Chair’s opening remarks
9:00 am - 9:35 am
GEOPOLICITCAL DISRUPTION - KEYNOTE
Managing exposure, concentration, and dependencies in an evolving global landscape
- Identifying and responding to geopolitical disruption in third-party relationships
- Managing concentration risk and dependencies across regions and alliances
- Assessing the impact of state actions, sanctions, trade controls, and nation-state cyber activity on third parties
- Accessing reliable geopolitical intelligence to support effective monitoring and decision-making
9:35 am - 10:10 am
CRITICAL THIRD-PARTY DESIGNATIONS & CTPP UNCERTAINTY
Preparing for designation, capital impact and regulatory expectations
- Outlining emerging EU critical third-party regimes
- Managing uncertainty around designation lists, timing, and criteria, while maintaining readiness
- Assessing implications for governance and oversight models
- Operationalising designation requirements and demonstrating sustained compliance under supervisory scrutiny
10:10 am - 10:35 am
MONITORING & ENHANCING RESILIENCE
Embedding operational resilience through continuous monitoring and scenario testing
- Moving beyond static assessments to real-time monitoring of critical vendors
- Conducting scenario testing to validate impact tolerance and recovery strategies
- Integrating external threat intelligence with internal operational data
- Detecting early warning indications of incidents and strengthening cross-functional responses
10:35 am - 10:55 am
Morning refreshment break and networking
10:55 am - 11:45 am
SUPPLY CHAIN COMPLEXITY AND DEPENDENCY – PANEL DISCUSSION
Systemic risk in interconnected ecosystems
- Recognising how failures cascade across supply chains
- Applying cross-industry lessons to anticipate complex supplier and infrastructure risks
- Assessing systemic risks created by shared infrastructure
- Evaluating interdependencies between suppliers and sectors to uncover hidden vulnerabilities
11:45 am - 12:35 pm
CONCENTRATION RISK THROUGH THE NTH PARTY LANDSCAPE – PANEL DISCUSSION
Managing risk propagation beyond direct contracts
- Mapping fourth, fifth and Nth-party dependencies to identify where a single supplier creates a critical concentration point
- Understanding risk propagation across multi-tier supply chains
- Identifying concentration risks within shared cloud infrastructure and service hubs
- Managing accountability and implementing mitigation strategies for risks beyond direct contracts
12:35 Luncheon Roundtables:
ESG Risk Thresholds
Geopolitical Risk Integration
Intragroup Risk Proportionality
Supply Chain Cyber Resilience
 | Mikko Venermo,Head of Supplier Management, Lloyds Banking Group |
Thursday - part2 June 4, 2026
1:35 pm - 2:25 pm
DECONSTRUCTED PANEL DISCUSSION
Roundtable moderators reconvene on stage to share key tensions, disagreements and insights from lunch discussions
2:25 pm - 3:00 pm
STEP-IN RISK & STRESSED EXIT PLANNING
How firms interpret and implement step-in requirements within TPRM frameworks
- Interpreting new step-in risk requirements and when firms are expected to intervene
- Identifying suppliers and scenarios that may trigger intervention or stressed exit
- Designing stressed exit strategies that work under disruption
- Exploring Escrow arrangements across services and assets
3:00 pm - 3:35 pm
CAPABILITY, CAPACITY AND THE ROLE OF THE HUMAN IN MODERN TPRM
Keeping people, processes and tools aligned with expectations
- Assessing organisational capability gaps in TPRM and AI oversight
- Balancing automation with skilled human oversight
- Strengthening tool adoption to embed technology intro daily processes
- Keeping first-line teams aligned with regulatory and operational expectations
3:35 pm - 3:55 pm
Afternoon refreshment break and networking
3:55 pm - 4:45 pm
COMPLIANCE VS COST – PANEL DISCUSSION
Balancing regulatory expectations with business reality
- Understanding how enforcement severity and penalties influence compliance priorities
- Evaluating trade-offs between risk mitigation, revenue and operational efficiency
- Developing frameworks to allocate TPRM resources based on risk and cost impact
- Communicating rationale and decisions to management, regulators, and stakeholders
4:45 pm - 5:35 pm
THE FUTURE OF TPRM – PANEL DISCUSSION
How innovation is reshaping third-party risk management
- Identifying signs of market fragility, over-reliance and unsustainable supplier models
- Assessing the impact of supplier failure and market consolidation on critical services
- Anticipating supervisory and regulatory response to market disruption and systemic risk
- Repositioning TPRM from a compliance function to a strategic enterprise risk control
5:35 pm - 5:45 pm
Chair’s closing remarks
5:45 pm
End of Vendor & Third Party Risk Europe 2026
Do you have any questions regarding the event?
Any inquiries regarding joining the agenda, the speaker lineup, and agenda, please get in touch with the producer of the event producer[@]cefpro.com or call us at +44 (0)207 164 6582 for more information