# Trilateral Research - **Type:** Software product - **Website:** https://trilateralresearch.com - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) Trilateral GRC Suite is software you run to keep UK GDPR records, DPIAs and EU AI Act work in one place, marketed to regulators and public bodies. ## Trilateral Research scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 4/5 The product page describes a continuous structured record of governance activity with audit trails on incidents, and reports exportable in bulk CSV or individually as DOC for regulator requests. ### Qualifications of the people who do the work: 3/5 Names CEO Kush Wadhwa and discloses Cyber Essentials Plus certification, but no SOC 2 or ISO 27001 certification is shown for the vendor's own systems. ### What it publishes about fees: 1/5 No prices, ranges or tier names are published anywhere on the reviewed pages; licensing is fixed annual but the figure is undisclosed. ### Knowledge of your sector: 3/5 Markets to regulators and institutions generally and references public-sector and research-body work, but no named sector-specific product modules beyond the general GRC suite were found. ### Independence from what it sells: 2/5 Cyber Essentials Plus is an independently assessed scheme, but headline claims like being EU AI Act ready are self-declared marketing language with no named independent auditor. ### Who carries the risk if the advice is wrong: 1/5 No liability cap, indemnification clause or SLA/uptime commitment is published on any of the site pages reviewed. ## Sources for Trilateral Research Every line carries the page it was read on and the date it was checked. - Trilateral Research Ltd is registered with Companies House and shown as an active company. - Source: https://find-and-update.company-information.service.gov.uk/company/08698690 - Checked: 2026-07-17 - Trilateral GRC Suite's published scope covers records of processing activities, DPIAs, AI governance (EU AI Act, ISO/IEC 42001, NIST AI RMF), a risk register, policy management and incident/breach management. - Source: https://trilateralresearch.com/trilateral-grc-suite - Checked: 2026-07-17 - Pricing is not published; the vendor describes a fixed annual licence agreed after a discovery call, with no figures or tiers shown on the site. - Source: https://trilateralresearch.com/trilateral-grc-suite - Checked: 2026-07-17 - Trilateral Research discloses Crown Commercial Service (CCS) supplier status and states its GRC Suite is used by '30+ European regulators and institutions', though no gov.uk AI Assurance directory listing was found for the company. - Source: https://trilateralresearch.com/trilateral-grc-suite - Checked: 2026-07-17 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Not published - Credentials: Published - Independent accreditation: Published - Client results: Not published - How it uses AI: Published ## Strengths - Single platform covers data protection (GDPR/UK GDPR) and AI governance (EU AI Act, ISO 42001, NIST AI RMF) together rather than as separate tools - Product page describes a continuous audit trail on incidents plus bulk CSV/DOC evidence export for regulator requests - Crown Commercial Service supplier status simplifies procurement for UK public-sector buyers ## Things to check Each one carries the factual basis it rests on. - No published price list means buyers cannot compare cost without booking a sales call. - Basis: trilateralresearch.com/trilateral-grc-suite states pricing is a fixed annual licence discussed on a discovery call, with no figures shown. - No independently audited security certification such as SOC 2 or ISO 27001 is disclosed for the vendor itself, only the lighter-touch Cyber Essentials Plus scheme. - Basis: trilateralresearch.com homepage lists Cyber Essentials Plus and AWS Public Sector Partner status but shows no SOC 2 or ISO 27001 badge for Trilateral Research as a company. - Named client case studies for the GRC Suite product itself are not published; the '30+ European regulators and institutions' figure is an aggregate claim, not broken out by name. - Basis: trilateralresearch.com/trilateral-grc-suite presents the client count without linked named case studies for the software product. ## Where this firm appears - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [Does the EU AI Act apply to a UK firm?](https://theassurancedesk.com/best/eu-ai-act-exposed) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.