Vendor due diligence: Third Party Risk Obligations

Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2).

2 of the 16 named sources that could be read published a usable figure; 14 published none and are recorded as not published, never filled in; 0 could not be read (blocked, dead or unreachable) and count nowhere.

The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source for each breakdown it prices, in EUR (a source's median where its page yielded several accepted sentences for one breakdown), so a page that gives figures for several breakdowns gives one for each and N counts 2 figures, never sentences; 11 candidate sentence(s) were refused by a reviewer with the reason recorded.

The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per regime per life-cycle stage (planning, due diligence, contract, monitoring, termination) with the obligation quoted verbatim from the supervisor's own page and its effective date; the derivation is the CROSS-REGIME comparison nobody publishes - which of the fourteen regimes read here require a written agreement, a register of third parties, an exit plan, a right to audit, sub-contractor consent and breach notification, and the shortest notice each allows - plus changed-since on every re-read

11 candidate sentences on these pages were refused by a reviewer; each refusal and its reason is recorded in the review ledger.