Glossary term
Vendor matrix
Also: Vendor comparison matrix, Weighted vendor comparison
A structured comparison of vendor options across weighted criteria, showing scores, evidence per cell and an aggregate result. A good vendor matrix separates dealbreakers from weighted criteria and makes every score traceable to a source.
The default vendor matrix is a spreadsheet with columns for vendors, rows for criteria and a weight per row. Done well, this compresses a complex decision into a single readable view. Done badly, it smuggles in unverifiable claims and invites backsolving toward a preferred vendor.
A defensible vendor matrix has four properties: explicit weights that sum to a fixed total, evidence per score that links to a source document or interview note, dealbreakers stored separately as binary filters, and sensitivity analysis that shows how robust the ranking is to weight changes.
In practice
The matrix is the analytical core of a decision memo. In regulated scopes (DORA Art. 28, NIS2 Art. 21), the matrix is the evidence that the vendor-selection process was structured rather than opportunistic.
Related terms
Decision memo
A short structured document that captures why a decision was made, the options considered, the criteria and trade-offs, the stakeholders involved and the accepted risks. A good decision memo is auditable months later.
Dealbreaker
A hard requirement that immediately disqualifies an option if not met, independent of weighted scoring. Dealbreakers enforce non-negotiable constraints (EU hosting, specific certifications, data residency) and prevent weak options from winning on aggregate scores.
TCO modelling
A structured estimate of the full lifetime cost of a vendor decision, including licence, implementation, integration, operation, change management and exit cost. List price is usually 20 to 40 percent of real TCO; modelling exposes the rest.
VAIT
BaFin circular for insurance undertakings. Counterpart to BAIT in banking, derived from MaGo. Regulates IT strategy, information security, user permissions, IT projects and outsourcing.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).
AI Act Risk Categories
Four-tier classification under the EU AI Act: prohibited (Art. 5), high-risk (Annex I/III), limited risk (Art. 50 transparency), minimal risk. Classification is the first duty; it must be documented and defensible.
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.
BAIT
BaFin circular that concretises IT requirements for credit institutions. Specifies MaRisk AT 7.2 for IT strategy, information security, user permissions, project management, application development, and IT outsourcing.