--- sourceDocument: australia Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/australia/delta-zurich-australia Release : - australia ft:locale : - en-US ft:publication_title : - australia Combined Product Files ft:clusterId : - delta3az bundleId : - delta3az --- # Combined Third-party Risk Management release notes for upgrades from Zurich to Australia # Combined Third-party Risk Management release notes for upgrades from Zurich to Australia {#ariaid-title1} Release version: Australia Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 25 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined Third-party Risk Management Release Notes for Upgrades from Zurich to Australia This consolidated guide provides essential information for ServiceNow customers upgrading Third-party Risk Management (TPRM) from Zurich to Australia releases. It includes upgrade instructions, new features, changes, deprecations, and activation details to help ensure a smooth transition and maximize the benefits of the latest TPRM capabilities. Show full answer Show less ## Upgrade Guidance * **Sequential Upgrades Required:** VRM users upgrading to TPRM must perform upgrades sequentially through each release version (e.g., Xanadu to Yokohama to Zurich to Australia) to avoid data inconsistencies and functionality issues. * **Smart Assessment Engine (SAE):** Available from version 21.0.x by enabling the `snvdrriskasmt.saeenabled` property. SAE replaces the legacy assessment engine with an improved experience. This change is irreversible and should be tested in non-production environments first. * **Data Migration:** After upgrading to version 21.0.3, the Industry field in the Company table is migrated to a new `tprmindustry` column. Customers must review and update customizations referencing this field. * **Role Changes:** From version 22.3.3, the `grcbusinessuser` and `grcreader` roles are no longer inherited by TPRM roles. Some users may require manual role reassignment. * **Enhanced Read-Only Field Protections:** Zurich release introduced backend changes for enhanced security on read-only fields, maintaining backward compatibility but requiring review of affected fields. ## New Features * **Document Management System (DMS):** Introduced in version 21.1.x, DMS provides a centralized repository to manage third-party documents with metadata, version control, and permissions, improving audit readiness and evidence tracking. * **Register of Information (RoI) Enhancements:** Supports regulator-ready report packages compliant with EU DORA, including validation frameworks that check data formats and provide detailed validation reports. * **Smart Assessment Engine Enhancements:** Improved navigation, question organization, auto-save, standardized risk rating scales, bulk template migration, and support for internal/external assessments accessible through GRC and third-party portals. * **AI and Automation:** Australia Patch 5 rebrands Now Assist as ServiceNow Otto for TPRM, adding support for multiple AI models (Google Gemini 3.5 Flash, OpenAI GPT 5.1, GPT 5.4 mini), AI-assisted questionnaire pre-fill, and generative AI-driven issue recommendations to reduce manual effort. * **Software Bill of Materials (SBOM) Support:** Enables collection and management of SBOM data for regulatory compliance when required SBOM applications are installed. * **Updated Standardized Information Gathering (SIG) Questionnaires for 2026:** Expanded coverage of security and privacy frameworks with new templates, while existing versions remain supported. * **TPRM Template Versioning:** Allows managing Smart Assessment Engine template versions to ensure in-flight assessments remain consistent. * **DORA Reporting Improvements:** Includes automatic cascading updates of ICT service types to supply chains, duplicate record detection and warnings, LEI validation against GLEIF database, and support for currency conversion and expense aggregation in reports. * **Unified Content Management:** Centralized repository for managing Smart Assessment Engine questionnaire templates in the Vendor Management Workspace. * **Coral Theme:** Introduced as the default UI theme with optional dark mode, improving user experience across Vendor Management Workspace, portals, and mobile. ## Key Changes * Vendor Management Workspace navigation changed from horizontal tabs to a vertical panel organizing related lists for clearer workflows. * Terminology updates: Assessments renamed as Internal or External assessments, Tier-level renamed as Risk rating, and other field renames to improve clarity. * Role-based access: Feature-specific roles introduced for vendor risk admins, assessment reviewers, and external responders, replacing administrator role inheritance for TPRM features. * Third-party elements now linked to a single third party, simplifying due diligence workflows. * Assessment notifications consolidated to reduce email volume, with configurable preferences. * Improvements in third-party portal behavior, including comments saving and issue indicator visibility only after submission. ## Deprecations and Removals * Legacy AI models deprecated in favor of newer open-weight models like Gemma 4; older models remain for existing configurations but are unavailable for new development. * Removal of direct inheritance of roles `grcbusinessuser` and `grcreader` by TPRM roles. * Deprecated fields such as `scoringrule` and `scoringruleref` removed from assessment forms; customizations must be updated accordingly. * Support for assessments using entities has been discontinued. Consolidated page of all release notes for Third-party Risk Management from Zurich to Australia. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family Third-party Risk Management release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Zurich to Australia. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading Third-party Risk Management to Australia Before you upgrade to Australia, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-thirdpartyriskmanagement-summary__entry__2} | Release | Release notes | |-|-| | Zurich | Upgrade information : If you're a VRM user upgrading to TPRM and upgrading to Vancouver or a later release from an earlier release, you must run each upgrade sequentially to ensure that fix scripts run correctly. For example, you must upgrade from Utah to Vancouver, Vancouver to Washington DC, and so on. If the scripts don't run in the correct order, you can get data inconsistencies, broken functionalities, and conflicts. After upgrading to version 21.0.x, you can enable the Smart Assessment Engine (SAE) by setting the Smart Assessment Engine enabled (sn_vdr_risk_asmt.sae_enabled) property. After setting this property, Smart Assessment Engine (SAE) becomes the default assessment engine and replaces the legacy experience. The transition isn't reversible. Warning: Set this property in your non-production instances and conduct thorough testing before changing your production instances. Failure to do so may result in unexpected issues. For more information on upgrading from VRM to TPRM and the differences between the Smart and Classic Assessment engines, see [Third-party Risk Management upgrade information](https://www.servicenow.com/docs/access?context=grc-tprm-upgrade-info&family=zurich&ft:locale=en-US). For existing TPRM customers, after upgrading to version 21.0.3, data from the Industry column in the Company \[core_company\] table is automatically migrated to the tprm_industry column. Migration can take several hours depending on the number of records in the Company \[core_company\] table. After migration, a system log message confirms that the migration is complete. Review the Company \[core_company\] table content and update any customizations referencing the Industry field to use tprm_industry. After verifying the migration and updating customizations, you can drop the Industry column. The Zurich release introduces enhanced protections for read‑only fields across the ServiceNow AI Platform®. These changes include a new "read_only_option" field with granular control levels, including "strict_read_only" and "client_script_modifiable". The changes occur in the back end and maintain backward‑compatible behavior. This update helps strengthen your instance security while preserving the flexibility you need. Refer to [KB2718122](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2718122) for additional technical details on how to identify affected fields and adjust their settings. | | Australia | Upgrade information : If you're a VRM user upgrading to TPRM and upgrading to Australia from an earlier release, you must run each upgrade sequentially to ensure that fix scripts run correctly. For example, you must upgrade from Xanadu to Yokohama, Yokohama to Zurich, and so on. If the scripts don't run in the correct order, you can get data inconsistencies, broken functionalities, and conflicts. After upgrading to version 21.0.x, you can enable the Smart Assessment Engine (SAE) by setting the Smart Assessment Engine enabled (sn_vdr_risk_asmt.sae_enabled) property. After setting this property, Smart Assessment Engine (SAE) is set to the default assessment engine and replaces the legacy experience. The transition is irreversible. Warning: Set this property in your non-production instances and conduct thorough testing before changing your production instances. Failure to do so can result in unexpected issues. For more information on upgrading from VRM to TPRM and the differences between the Smart and Classic Assessment engines, see [Third-party Risk Management upgrade information](https://www.servicenow.com/docs/access?context=grc-tprm-upgrade-info&family=australia&ft:locale=en-US). For existing TPRM customers, after upgrading to version 21.0.3, data from the Industry column in the Company \[core_company\] table is automatically migrated to the tprm_industry column. Migration can take several hours depending on the number of records in the Company \[core_company\] table. After migration, a system log message confirms that the migration is complete. Review the Company \[core_company\] table content. Update any customizations that reference the Industry field to use tprm_industry. After verifying the migration and updating customizations, you can drop the Industry column. After upgrading to version 22.3.3, the `grc_business_user` and `grc_reader` roles are no longer directly inherited by TPRM roles. During upgrade, most users are automatically migrated to new feature‑specific roles. Users with custom role combinations may not be migrated automatically and require manual review before the grace period ends. | [ ] ## New features Between your current release family and Australia, new features were introduced for Third-party Risk Management. {#dfrn3-thirdpartyriskmanagement-summary__entry__8} | Release | Release notes | |-|-| | Zurich | [ServiceNow Otto for Third-party Risk Management (TPRM) release notes](https://www.servicenow.com/docs/access?context=now-assist-for-tprm-rn&family=zurich&ft:locale=en-US) : Review the ServiceNow Otto for Third-party Risk Management (TPRM) release notes for full descriptions of the features. [Use the Document Management System](https://www.servicenow.com/docs/access?context=tprm-dms&family=zurich&ft:locale=en-US) : Starting with version 21.1.x, you can use the Document Management System (DMS) in TPRM, which provides a centralized repository for storing, organizing, and managing third-party documents throughout the vendor life cycle. It can be used by third-party risk managers \[sn_vdr_risk_asmt.vendor_manager\], third-party assessors \[sn_vdr_risk_asmt.vendor_assessor\], and third parties to upload, categorize, track, and review documents with metadata, version control, and access permissions. This feature streamlines evidence tracking, reduces duplication, and improves audit readiness by enabling document reuse across assessments, contracts, issues, and tasks. For information on Now Assist skills for TPRM and Document Management, see [ServiceNow Otto for Third-party Risk Management (TPRM) release notes](https://www.servicenow.com/docs/access?context=now-assist-for-tprm-rn&family=zurich&ft:locale=en-US) and [Now Assist in Document Intelligence release notes](https://www.servicenow.com/docs/access?context=now-assist-document-intelligence-rn&family=zurich&ft:locale=en-US). [Register of information regulatory packages](https://www.servicenow.com/docs/access?context=tprm-dora-roi&family=zurich&ft:locale=en-US) : After upgrading the Digital Resilience Third-party Information Register application to version 21.1.x, third-party assessors \[sn_vdr_risk_asmt.vendor_assessor\] can now generate regulator-ready Register of Information packages using the Plain-CSV Report Package option on the download page. The ZIP file includes metadata and report folders structured to regulator specifications, with file names containing LEI, entity ID, and release version. This format helps ensure EU DORA compliance and supports automated validation workflows. You can follow the user guide on the Download/Upload request page for suggested steps and permissions. [Validation framework for RoI](https://www.servicenow.com/docs/access?context=tprm-validation-roi&family=zurich&ft:locale=en-US) : After upgrading the Digital Resilience Third-party Information Register application to version 21.1.x, third-party risk managers \[sn_vdr_risk_asmt.vendor_manager\] can now validate downloaded Register of Information packages using the Plain-CSV Report Package option on the download page against requirements. File format, structure, encoding, naming conventions, and field-level data are validated across multiple tables. If any validation warnings are detected, a validation report is automatically attached, including mappings to regulator fields such as Template Code, Row Code, and Column Code. Validation reports include real-world field labels, rule expressions, and record identifiers. You can cross-reference validation errors using a downloadable Excel master template that mirrors the CSV structure, making it easier to locate and address issues. Additional enhancements include support for "Not applicable" values, enforcement of file size limits, and clearer error messages for malformed data. [New sn_vdr_risk_asmt.sae_enabled property](https://www.servicenow.com/docs/access?context=tprm-properties-configure&family=zurich&ft:locale=en-US) : Use the new and improved Smart Assessment experience after you upgrade to version 21.0.x and set the Smart Assessment Engine enabled (sn_vdr_risk_asmt.sae_enabled) property. [Smart Assessment Engine](https://www.servicenow.com/docs/access?context=tprm-sae-using&family=zurich&ft:locale=en-US) : Create Smart Assessment Engine assessments for your organization: * Enhanced navigation: Use the improved navigation for a better user experience. * Assessment support: Conduct assessments for both internal and external parties. TPRM questionnaire templates include additional attributes such as the risk area and the option to include previous responses, which aren't available in SAE. TPRM templates must be created directly within the Vendor Management Workspace to ensure that they include the necessary attributes. * Organize questions: Group questions into subsections for better organization. * Add attachments: Attach the files directly to the individual questions. * Add reference information: Add reference information to a questionnaire template to help ensure that assessors can access the information they need while responding. * Filter questions: Quickly identify and filter unanswered questions. * Auto-save for questionnaires: Auto-save each question automatically after changes are made to them. * Standardized risk rating scale definition: Define the risk rating scales at the template level for both internal and external assessments. * Assessment duration: Define the duration of an assessment when creating a questionnaire template. * Combine assessments: Respond to questionnaires by using the same SAE template in a single, streamlined view. * Bulk template migration: Migrate classic templates in bulk to the Smart Assessment format. To ensure the templates work correctly in TPRM, you must migrate them by using the Third-party Risk Management application. * Risk score normalization: Standardize the risk scores for a consistent evaluation. * Support for the GRC and third-party portals: Use the GRC portal to access and complete internal assessments and the third-party portal to complete external assessments. | | Australia | [Extended AI model support for Now Assist for TPRM](https://www.servicenow.com/docs/access?context=supporting-information-now-assist-tprm&family=australia&ft:locale=en-US) : After upgrading to version 22.3.4, ServiceNow Otto for Third-party Risk Management (TPRM) supports Google Gemini 3.5 Flash, OpenAI GPT 5.1, and OpenAI GPT 5.4 mini models in addition to previously supported models. Model availability depends on your ServiceNow Otto for Third-party Risk Management (TPRM) subscription, providing greater flexibility when selecting the AI model that meets your requirements. [AI-assisted questionnaire pre-fill](https://www.servicenow.com/docs/access?context=tprm-dms-sae&family=australia&ft:locale=en-US) : After upgrading to version 22.3.3 and activating the ServiceNow Otto for Third-party Risk Management (TPRM) application, you can use uploaded documents and responses from previous assessments to generate suggested questionnaire responses with source citations. For internal assessments, the snc_internal role is required. For external assessments, primary contacts can complete all assessment response actions; secondary contacts must be assigned read and write access. [Software Bill of Materials (SBOM) support](https://www.servicenow.com/docs/access?context=tprm-sbom-exploring&family=australia&ft:locale=en-US) : After upgrading to version 22.3.2 and installing the required SBOM applications, if you have the third-party risk manager role \[sn_vdr_risk_asmt.vendor_risk_manager\] or third-party risk assessor role \[sn_vdr_risk_asmt.vendor_risk_assessor\], you can collect and manage SBOM data to support regulatory disclosure requirements. [Standardized Information Gathering (SIG) 2026 questionnaires](https://www.servicenow.com/docs/access?context=tprm-sig-use-and-support&family=australia&ft:locale=en-US) : After upgrading to version 22.3.0, if you have the third-party risk manager role \[sn_vdr_risk_asmt.vendor_risk_manager\], you can use updated SIG Full, SIG Core, and SIG Lite templates for 2026 with expanded coverage across major security and privacy frameworks. Existing SIG questionnaire versions remain available. In‑flight assessments aren't affected. [Smart Assessment template versioning](https://www.servicenow.com/docs/access?context=tprm-sae-using&family=australia&ft:locale=en-US) : After upgrading to version 22.3.3, if you have the third-party risk manager role \[sn_vdr_risk_asmt.vendor_risk_manager\], you can manage SAE template lifecycles using explicit versioning so that in-flight assessments use the version that was active when they were created. [Legal Entity Identifier (LEI) validation for DORA reporting](https://www.servicenow.com/docs/access?context=tprm-valid-lei&family=australia&ft:locale=en-US) : After upgrading the Digital Resilience Third-party Information Register application to version 22.3.1, if you have the third-party risk manager role \[sn_vdr_risk_asmt.vendor_risk_manager\], you can validate Legal Entity Identifier codes against the GLEIF database to support regulatory accuracy in Register of Information reporting. For descriptions of validation results and report columns, see [Level 4 LEI Validation Report columns](https://www.servicenow.com/docs/access?context=tprm-lei-validation-report&family=australia&ft:locale=en-US). [Generate TPRM issue recommendations](https://www.servicenow.com/docs/access?context=create-recommendation-tprm-issue&family=australia&ft:locale=en-US) : After upgrading to version 22.0.8 if you have the third‑party assessment reviewer role \[sn_vdr_risk_asmt.vendor_assessment_reviewer\] and have installed the ServiceNow Otto for Third-party Risk Management (TPRM) application, you can use generative AI to automatically identify and recommend issues based on assessment responses. The TPRM issue management recommendation skill recommends issues with rationalized summaries. Recommended issues are presented for review and are created as standard TPRM issues only after user confirmation. [Generate aggregate regulatory reports in local currencies](https://www.servicenow.com/docs/access?context=tprm-dora-currency-aggregation&family=australia&ft:locale=en-US) : After upgrading the Digital Resilience Third-party Information Register application to version 22.0.3, third‑party risk (TPR) managers \[sn_vdr_risk_asmt.vendor_manager\] can standardize annual expense values during Register of Information report generation by enabling currency conversion and third‑party total expense aggregation. To support this process, the generated reporting package includes summary and detail reports that indicate successful conversions, aggregation results, and any skipped providers. [Centralized repository for TPRM SAE templates](https://www.servicenow.com/docs/access?context=tprm-integrating-ucm&family=australia&ft:locale=en-US) : After upgrading to version 22.0.2 and installing the Unified Content Management application, TPR managers \[sn_vdr_risk_asmt.vendor_risk_manager\] can help ensure consistent and comprehensive assessments by activating and updating ready‑to‑use Smart Assessment Engine questionnaire templates through a single, managed repository in the Vendor Management Workspace. | [ ] ## Changes Between your current release family and Australia, some changes were made to existing Third-party Risk Management features. {#dfrn3-thirdpartyriskmanagement-summary__entry__14} | Release | Release notes | |-|-| | Zurich | [Vertical navigation in the Vendor Management Workspace](https://www.servicenow.com/docs/access?context=tprm-monitoring-tpr&family=zurich&ft:locale=en-US) : Starting with version 21.1.x, the legacy horizontal tab-based layout in the Vendor Management Workspace has been replaced with a structured vertical navigation panel with groups of related lists, organizing access to third-party records, assessments, and performance pages in a way that supports clearer workflows and is consistently available to all internal users. [Third-party information register download option renamed to Excel master template](https://www.servicenow.com/docs/access?context=tprm-excel-upload-download-request&family=zurich&ft:locale=en-US) : Starting with version 21.1.x, the option to download the Third-party Information Register is renamed to Excel Master Template. This change improves clarity and aligns with regulator terminology. [DPM business validation rules and properties](https://www.servicenow.com/docs/access?context=tprm-validation-roi&family=zurich&ft:locale=en-US) : Starting with version 21.1.x, the DPM business validation rules and report.json, reportPackage.json, FrameworkCodeModuleVersion properties are now included. These modules enable Third-party risk admins \[sn_vdr_risk_asmt.vendor_admin\] to view and maintain validation logic and configuration settings for CSV reporting and automated validation. [Choice field for ICT third-party service provider identification](https://www.servicenow.com/docs/access?context=tprm-drtp-reg-contract&family=zurich&ft:locale=en-US) : Starting with version 21.1.x, the field Type of code to identify the ICT third-party service provider is now updated to be a choice field in the Digital Resilience Third-party Information Register in the contract record. This update aligns the field with regulator-defined options for selecting identification systems when creating new providers. In the Specific Information section of the contract record, the field is read-only and auto-populated based on upstream selections, such as the third-party or engagement record. [Risk areas extended to internal assessments](https://www.servicenow.com/docs/access?context=create-sae-q-template&family=zurich&ft:locale=en-US) : Starting with version 21.1.x, if you have the third-party risk admin \[sn_vdr_risk_asmt.vendor_admin\] role, you can now configure risk areas with weighted questions and scored responses for internal assessments using the Smart Assessment Engine in the Vendor Management Workspace. Risk scores can be aggregated at the engagement level using customizable methods such as max, min, or average, and mapped to risk ratings based on business rules. Risk managers can override system-generated ratings with required justification, enabling expert judgment and helping ensure transparency in risk decisions. [Smart Assessment Engine advanced plugins](https://www.servicenow.com/docs/access?context=tprm-migrate-asmnt-sae&family=zurich&ft:locale=en-US) : Starting with version 21.1.x, the following Smart Assessment Engine advanced plugins are automatically installed: Post Assessment Actions for Smart Assessments \[com.sn_smart_imp_auto and com.sn_impact_fwk\] and Advanced Response Automation for Smart assessments \[sn_smart_resp_auto\]. The Post Assessment Actions for Smart Assessments plugin lets Third-party risk admins \[sn_vdr_risk_asmt.vendor_admin\] automate follow-up tasks, like notifications or workflow launches, after an assessment is completed. The Advanced Response Automation for Smart Assessments plugin automatically fills in assessment responses based on prior data or logic, streamlining and standardizing the assessment process. Feature-specific administrator role enhancements : Starting with version 21.1.x, if you have a feature admin role you can now complete tasks that were initially reserved for users with the broader administrator role. * Assign sn_vdr_risk_asmt.vendor_risk_admin to users who need to configure and manage vendor risk features. * Assign sn_vdr_risk_asmt.vendor_assessment_reviewer to users who perform assessments, manage dashboards, and require operational access. * Assign sn_vdr_risk_asmt.external_assessment_responder to users who need access to the third-party portal and to complete assessments. Note: Administrator privileges no longer grant access to TPRM features. Users must be assigned an appropriate feature-specific role to access relevant functionality. Read-only field enhancements : Starting with version 21.1.x, the following Third-party Risk Management plugins have security enhancements for read-only fields in this release: * Third-party Risk Due Diligence \[com.sn_tprm_onboarding\] * Third-party Risk Management \[com.sn_vdr_risk_asmt\] * GRC: Vendor Portal \[com.sn_grc_vendor_portal\] * GRC: Profiles \[com.sn_grc\] * GRC: Compliance Assessment \[com.sn_comp_asmt\] * GRC: SIG Questionnaire Integration \[com.sn_sig_asmt\] * GRC: Performance Analytics Premium Integration \[com.sn_grc_pa\] * Vendor Risk Management integration with EcoVadis \[com.sn_app_grc_ecovadis\] * ITAM applications \[com.snc.vendor_core\] [Fourth-party assessment support in SAE](https://www.servicenow.com/docs/access?context=tprm-monitor-fourth-parties&family=zurich&ft:locale=en-US) : Starting with version 21.1.x, Fourth-party assessments are now supported after you enable the Smart Assessment Engine enabled (sn_vdr_risk_asmt.sae_enabled) property. Global TPRM changes : * Assessments and Third-party assessments are now renamed as External assessments. * Tiering assessments are now renamed as Internal assessments. * The Tier-level column is now renamed as Risk rating. * The Tiering assessors column is now renamed as Respondents. * The Owner field is now renamed as Assigned to on the internal assessment, external assessment, tiering assessment, and due diligence request forms. [Changes made to the list view in Vendor Management Workspace](https://www.servicenow.com/docs/access?context=tprm-ws-list-page&family=zurich&ft:locale=en-US) : * The Assessment setup section has been added. From this section, you can create assessment templates, Smart Assessment questionnaire templates, and issue generation rules. * The Questionnaire requests section has been added. * The Tiering assessments and Inherent risk questionnaires (IRQ) are combined in the Internal assessments section. Changes made to internal assessment pages : * Tier-level scales are renamed as Scales. * Tiering assessment schedule and Schedules are combined and renamed as Assessment schedule. Changes made to assessment related lists : * Assessment instances is renamed as Questionnaire requests. * Questionnaires is renamed as Questionnaire templates. * Document requests is renamed as Document templates. * Fourth-party questionnaires is renamed as Fourth-party templates. * Repeating assessments is renamed as Assessment scheduling. [Smart Assessment integration changes](https://www.servicenow.com/docs/access?context=tprm-sae-using&family=zurich&ft:locale=en-US) : * The Assessment engine column has been added to the Internal and External assessment list views in Vendor Management Workspace. You can track the assessment type as you transition to using the Smart Assessment Engine for all active questionnaires. * The Assessment engine field has been added to related forms for internal risk assessments, external risk assessments, and assessment templates. * The Support smart assessment column has been added to the Assessment templates and Issue generation rules list views. * The original TPRM Classification field has been replaced with the Purpose field on all assessment templates. * The external assessment status Responses received is now Submitted to third party when SAE is enabled. * The external assessment status Returned is now In progress when SAE is enabled. [Changes made to Digital Resilience Third-party Information Register contract records in Vendor Management Workspace](https://www.servicenow.com/docs/access?context=tprm-drtp-reg-contract&family=zurich&ft:locale=en-US) : The General info related list has now been renamed as Details and the following related lists have been added: * Entities signing contract to use service * Entities making use of services * Entities providing services * Third parties signing contract to provide services * Third-party engagements signing contract * ICT service supply chains * Assessments of the ICT services Coral theme : Coral is now the default theme for Vendor Management Workspace, portal, and mobile experiences. This theme provides a fresh look and feel, featuring brand-neutral illustrations to enhance your user experience. A dark theme option is available for web and mobile experiences. Note: When you're upgrading from Xanadu or Yokohama to Zurich with version 20.1.x of the GRC: Vendor Portal, the application UI themes might not match. The Vendor Management Workspace uses the Polaris theme by default, and the Third-party portal uses the Coral theme by default. Upgrading to Xanadu or Yokohama with version 20.1.x of the GRC: Vendor Portal results in both the Vendor Management Workspace and Third-party portal using the Polaris theme. Upgrading to version 21.x or higher results in both the Vendor Management Workspace and Third-party portal using the Coral UI theme. [Enhanced contract records for Digital Resilience Third-party Information Register in Vendor Management Workspace](https://www.servicenow.com/docs/access?context=tprm-drtp-reg-contract&family=zurich&ft:locale=en-US) : If you have the third-party assessor role \[sn_vdr_risk_asmt.vendor_assessor\], you can now associate multiple entities with a single contract record. This association indicates that all entities have signed the contract and are providing services that are associated with the contract. You can also configure contracts that are based on the supply chain and assessment, upload contract records, and generate reports in Microsoft Excel. To better track these entities and help ensure compliance with Digital Operational Resilience Management (DORA) regulations, related lists have been added to the existing contract records, and existing fields have been reorganized for better usability. | | Australia | [Australia Patch 5](https://www.servicenow.com/docs/access?context=australia-patch-5&family=australia&ft:locale=en-US) : Starting with Australia Patch 5, Now Assist for Third-party Risk Management is now ServiceNow Otto® for TPRM. Your product entitlements remain unchanged. Check your entitlements to determine your access to specific features. [Default AI model for issue recommendation skill](https://www.servicenow.com/docs/access?context=supporting-information-now-assist-tprm&family=australia&ft:locale=en-US) : After upgrading to version 22.3.4, the issue recommendation skill in ServiceNow Otto for Third-party Risk Management (TPRM) uses Azure OpenAI gpt-4-5-mini as the default model. This update changes the default model for issue recommendations. You can select alternative models, including the newly supported Google Gemini 3.5 Flash, OpenAI GPT 5.1, and OpenAI GPT 5.4 mini, based on your requirements. [Large language models on the ServiceNow AI Platform](https://www.servicenow.com/docs/access?context=exploring-large-language-models&family=australia&ft:locale=en-US) : The Now LLM Service is no longer the default model provider for new or inactive AI assets. A third-party LLM is now selected by default, while existing configurations using the Now LLM Service continue unchanged. The Now LLM Service is still available for manual selection. [Improved handling of skipped conditional questions in SAE assessments](https://www.servicenow.com/docs/access?context=tprm-sae-using&family=australia&ft:locale=en-US) : After upgrading to version 22.3.3, Smart Assessment Engine assessments hide conditional questions that are skipped based on response logic. Sections that contain skipped questions are visually de‑emphasized, and assessments render in a continuous scroll layout.This change affects the assessment review experience only and does not change assessment logic, scoring, or response data. [Comments field in the third‑party portal saves when you leave the field](https://www.servicenow.com/docs/access?context=vendor-portal&family=australia&ft:locale=en-US) : After upgrading to version 22.3.2, the comments field in the third‑party portal saves when you leave the field rather than on every keystroke. [Issue indicators in the third-party portal shown only after submission](https://www.servicenow.com/docs/access?context=vendor-portal&family=australia&ft:locale=en-US) : After upgrading to version 22.3.2, issue indicators appear in the third‑party portal only after an issue is submitted to the third party and the Visible in third‑party portal field is selected. Previously, indicators were visible before submission when the field was selected. [Consolidated assessment email notifications](https://www.servicenow.com/docs/access?context=set_sys_props_for_email&family=australia&ft:locale=en-US) : After upgrading to version 22.3.3, external assessment‑related email notifications are sent as a single consolidated summary instead of individual per‑event messages. Users can configure notification frequency, detail level, and delivery channel in their notification preferences. Multi‑language templates are available. [Assessment count mechanism updated in the third-party portal](https://www.servicenow.com/docs/access?context=vendor-portal&family=australia&ft:locale=en-US) : After upgrading to version 22.3.3, engagement assessment counts in the third-party portal include only active, pending, and in‑progress assessments. Previously, counts included inactive and canceled assessments. [Inactive metrics excluded when copying assessment responses](https://www.servicenow.com/docs/access?context=tprm-assessing-tpr&family=australia&ft:locale=en-US) : After upgrading to version 22.3.3, inactive and retired metrics are excluded when copying responses between assessments. Previously, copying responses could include inactive metrics, causing scoring errors. [Type of ICT services changes cascade to supply chain in DORA reporting](https://www.servicenow.com/docs/access?context=tprm-drtp-reg-contract&family=australia&ft:locale=en-US) : After upgrading the Digital Resilience Third-party Information Register application to version 22.3.1, when the Type of ICT services value is updated on a Contractual Arrangements -- Specific Information (B.02.02) record, the ICT service supply chain (B.05.02) is now updated automatically. If a Type of ICT services value is removed from a Specific Information record, the corresponding supply chain records for Rank 1 and higher ranks are also deleted automatically. Previously, Rank 1 supply chain records were generated when the Specific Information record was first created, but subsequent changes or removals did not propagate to the supply chain, requiring manual correction. [Duplicate contractual arrangements detected and warned in DORA Register of Information](https://www.servicenow.com/docs/access?context=tprm-drtp-reg-contract&family=australia&ft:locale=en-US) : After upgrading the Digital Resilience Third-party Information Register application to version 22.3.1, duplicate records in the Contractual Arrangements -- Specific Information (B.02.02) table are now detected and handled across three scenarios. When saving a contractual arrangement from the UI, a business rule checks eight composite key fields and blocks the save if a duplicate is found. During Excel upload, duplicate rows are rejected and logged to the upload error report. During CSV package download, duplicate rows in B.02.02 are flagged in the DORA request record's error log; duplicates are warned but not removed from the generated CSV. [Duplicate supply chain rows warned during DORA CSV package download](https://www.servicenow.com/docs/access?context=tprm-drtp-roi-packages&family=australia&ft:locale=en-US) : After upgrading the Digital Resilience Third-party Information Register application to version 22.3.1, during CSV package download, duplicate rows in the ICT service supply chains (B.05.02) table are now detected and a warning is added to the request record. This applies to both Rank 1 supply chain records, which are auto-generated from Specific Information records, and higher-ranked records. Additionally, when the Storage of data field is set to No on a contractual arrangement, associated location field values are now cleared automatically. [ServiceNow product tiers](https://www.servicenow.com/docs/access?context=ai-native-sku-overview&family=australia&ft:locale=en-US) : The ServiceNow AI Platform now brings you a new AI experience with three licensing tiers available: * Foundation: AI basics to deliver insights * Advanced: AI to boost productivity across relevant use cases * Prime: Act autonomously with all AI assets, and create your own Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents. [Fields added to Create New Excel download/upload request form](https://www.servicenow.com/docs/access?context=tprm-create-report-aggregate-expenses&family=australia&ft:locale=en-US) : After upgrading the Digital Resilience Third-party Information Register application to version 22.0.3, the Enable currency conversion and Enable third‑party total expense aggregation fields are available on the Excel download/upload request page. When creating Excel Master Template or Plain‑CSV Reporting Package requests, you can configure these options directly on the form. [TPRM Unified content management page](https://www.servicenow.com/docs/access?context=tprm-ws-ucm-page&family=australia&ft:locale=en-US) : After upgrading to version 22.0.2 and installing the Unified Content Management application, the unified content management module is available in the Vendor Management Workspace. [Simplified third-party element process](https://www.servicenow.com/docs/access?context=tprm-workflow-in-workspace&family=australia&ft:locale=en-US) : After upgrading to version 22.0.1, third‑party elements are now linked to a single third party and can no longer be shared across third parties. Scoring rollups calculate results from element‑level assessments rather than entity records. | [ ] ## Removed Between your current release family and Australia, some Third-party Risk Management features or functionality were removed. {#dfrn3-thirdpartyriskmanagement-summary__entry__20} | Release | Release notes | |-|-| | Zurich | No updates for this release. | | Australia | No updates for this release. | [ ] ## Deprecations Between your current release family and Australia, some Third-party Risk Management features or functionality were deprecated. {#dfrn3-thirdpartyriskmanagement-summary__entry__26} | Release | Release notes | |-|-| | Zurich | Starting with the September 2026 release, Gemma 4 joins our growing portfolio of open-weight models available through Now LLM Service. We're committed to bringing you the latest industry advancements while maintaining sovereignty-focused options, all hosted and governed by ServiceNow with the infrastructure and data protections you rely on today. Older models will remain available for existing published AI skills, agents, and agentic workflows, but will no longer be available for new development or configuration. For details, see the [KB3066214: ServiceNow Otto Model Upgrades](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3066214) article in the Now Support Knowledge Base. | | Australia | Starting with the September 2026 release, Gemma 4 joins our growing portfolio of open-weight models available through Now LLM Service. We're committed to bringing you the latest industry advancements while maintaining sovereignty-focused options, all hosted and governed by ServiceNow with the infrastructure and data protections you rely on today. Older models will remain available for existing published AI skills, agents, and agentic workflows, but will no longer be available for new development or configuration. For details, see the [KB3066214: ServiceNow Otto Model Upgrades](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3066214) article in the Now Support Knowledge Base. * The `grc_business_user` and `grc_reader` roles are no longer directly inherited by TPRM roles. * The `scoring_rule` and `scoring_rule_ref` fields are removed from assessment forms and UI sections. Custom scripts or integrations that reference these fields must be updated. * Assessments using entities are no longer supported. | [ ] ## Activation information Review information on how to activate Third-party Risk Management. {#dfrn3-thirdpartyriskmanagement-summary__entry__32} | Release | Release notes | |-|-| | Zurich | Activation information : Install Third-party Risk Management by requesting it from ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=zurich&ft:locale=en-US). Important: Third-party Risk Management is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | | Australia | Activation information : Install Third-party Risk Management by requesting it from ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) to view all the available apps, and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=australia&ft:locale=en-US). Note: Third-party Risk Management is available in ServiceNow Store. For details, see the "Activation information" section of these release notes. | [ ] ## Additional requirements If any additional requirements were introduced or changed for Third-party Risk Management we have noted them here. {#dfrn3-thirdpartyriskmanagement-summary__entry__38} | Release | Release notes | |-|-| | Zurich | No updates for this release. | | Australia | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for Third-party Risk Management we have noted them here. {#dfrn3-thirdpartyriskmanagement-summary__entry__44} | Release | Release notes | |-|-| | Zurich | No updates for this release. | | Australia | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for Third-party Risk Management, such as specific requirements or compliance levels. {#dfrn3-thirdpartyriskmanagement-summary__entry__50} | Release | Release notes | |-|-| | Zurich | Accessibility information : Dark theme : The new Coral theme includes a dark theme option for the Vendor Management Workspace and mobile experiences. This option is commonly used to alleviate eye strain and improve readability. | | Australia | Accessibility information : The Vendor Management Workspace and the third-party portal include accessibility improvements in this release, including improved color contrast, enhanced focus indicators, skip navigation links, and full keyboard navigation. | [ ] ## Localization information If there are specific localization considerations for Third-party Risk Management we have noted them here. {#dfrn3-thirdpartyriskmanagement-summary__entry__56} | Release | Release notes | |-|-| | Zurich | No updates for this release. | | Australia | Localization information : Third-party portal strings are externalized and translated for supported languages. Newly introduced features may have incomplete translations. | [ ] ## Highlight information If there are specific highlight considerations for Third-party Risk Management we have noted them here. {#dfrn3-thirdpartyriskmanagement-summary__entry__62} | Release | Release notes | |-|-| | Zurich | * Use the Document Management system in TPRM to centralize third-party documentation in a searchable repository with metadata, and versioning, access controls. * Use vertical navigation in the Vendor Management Workspace through a customizable panel grouped by related lists for improved access to third-party records, assessments, and performance pages. * Configure risk areas with weighted questions and scored responses for internal assessments using the Smart Assessment Engine in the Vendor Management Workspace. * Use the latest Smart Assessment Engine questionnaire templates to perform internal and external assessments. * Use the enhanced Digital Resilience Third-party Information Register features in the Vendor Management Workspace. See [Third-party Risk Management](https://www.servicenow.com/docs/access?context=third-party-risk-mgt-landing-page&family=zurich&ft:locale=en-US) for more information. | | Australia | [Australia Patch 5](https://www.servicenow.com/docs/access?context=australia-patch-5&family=australia&ft:locale=en-US) Starting with Australia Patch 5, Now Assist for Third-party Risk Management is now ServiceNow Otto® for TPRM. Your product entitlements remain unchanged. Check your entitlements to determine your access to specific features. * Reduce manual data entry by using AI to pre‑fill questionnaires for third-party contacts and business owners. * Use updated Standardized Information Gathering (SIG) questionnaire content for 2026. * Automate Software Bill of Materials (SBOM) collection, integration, and vulnerability correlation with Unified Security Exposure Management (USEM) integration. * Manage SAE assessment template versions to prevent changes from affecting in‑flight assessments. * Add question-level comments and follow-up capabilities during SAE reviews. * Maintain DORA Register of Information accuracy with automatic supply chain cascading updates and duplicate record detection for contractual arrangement and supply chain tables. * Validate Legal Entity Identifier (LEI) codes against the GLEIF database during Register of Information reporting to identify format errors, checksum failures, and inactive or unissued entities. * Enhance DORA Register of Information reporting with optional currency conversion and third‑party expense aggregation to generate consistent, regulator‑ready reports. * Review the simplified third‑party elements process in the due diligence workflow. * Access the unified content management module in the Vendor Management Workspace to view a centralized library of smart assessment templates. [Australia Patch 1](https://www.servicenow.com/docs/access?context=australia-patch-1&family=australia&ft:locale=en-US) Review the updated AI experience with three licensing tiers. See [Third-party Risk Management](https://www.servicenow.com/docs/access?context=third-party-risk-mgt-landing-page&family=australia&ft:locale=en-US) for more information. [Early availability](https://www.servicenow.com/docs/access?context=australia-all-other-fixes&family=australia&ft:locale=en-US) Use generative AI to recommend TPRM issues for reviewer validation. | [ ]