Selecting a GRC platform is one of the more consequential technology decisions a risk or compliance team makes. The platform shapes how risks are identified, how controls are tested, how audit findings are tracked, and how regulatory obligations are demonstrated to supervisors. Get it right and it becomes infrastructure. Get it wrong and it becomes a project that consumes resources without delivering the oversight it promised.

CERRIX and Diligent both appear on shortlists for European organisations. On the surface they look similar: both cover risk, compliance, and audit in one environment, and both serve regulated industries. But they were built for different buyers, in different regulatory contexts, with different assumptions about what a GRC implementation looks like in practice.

This comparison looks at both platforms across the dimensions that tend to decide the choice: features, implementation, European regulatory fit, pricing, and total cost of ownership.

A quick overview of both platforms

CERRIX is a European GRC platform, founded in 2014 in the Netherlands and headquartered in The Hague, with a second office in Belgium. It is built for regulated organisations: financial institutions, insurers, pension funds, asset managers, audit firms, and mid-to-large enterprises under European supervision. The platform connects risk and control management, compliance, incident and third-party management, process control, GDPR, and audit in one system. Following the acquisition of Ruler, CERRIX adds AI-powered regulatory monitoring, so the chain from a regulatory change to the affected controls runs in one place. CERRIX is ISO/IEC 27001 certified, ISAE 3402 Type II verified, and FSQS-NL registered. More than 100 financial institutions in over 20 countries use CERRIX.

Diligent was founded in 1994 in New York City. Its first widely used product was a board portal, Diligent Boards, which moved board communications from paper to digital. The company has since expanded through acquisitions, including Galvanize (ACL) in 2021, into the Diligent One Platform. That platform combines board management with risk, audit, compliance, ESG reporting, and third-party risk. Diligent reports more than 25,000 organisations across 130 countries, with its customer base weighted toward large listed companies.

The differences become clearer when you move from category labels to the operational reality of implementation, adoption, and regulatory fit. CERRIX is a European GRC platform built around the frameworks that European supervisors enforce. Diligent One is a broad governance platform whose risk and compliance modules sit on a board-governance foundation. That difference runs through most of what follows.

A straightforward comparison

‍

Features comparison

Risk management

CERRIX handles risk management in one connected environment. Risk registers, control frameworks, key risk indicators, and incidents live together, built around the Three Lines model. The board sees the same data too: CERRIX includes real-time dashboards and reporting, so leadership gets a live risk view instead of a quarterly report. The point is that CERRIX serves both ends from one source of truth, the board view and the daily work of the first- and second-line owners who log evidence and test controls.

Diligent's platform now spans enterprise risk broadly, though its centre of gravity remains board-level visibility and reporting to executives and directors, in line with its board-governance origins.

The difference is who the platform is organised around. Diligent is oriented upward, to the board and audit committee. CERRIX is organised around the people running risk day to day, and reports upward from the same data.

Compliance management

CERRIX's compliance management is built around the European regulatory environment. DORA, NIS2, GDPR, ISQM, the EU AI Act, MiCA, ICFR, ISO 27001, and DNB and AFM frameworks are available out of the box, so European teams spend less time configuring and interpreting. Test once, comply to many: one control maps to multiple frameworks. With Ruler, CERRIX adds automated regulatory watch and AI-powered impact assessment, connecting a regulatory signal to the control that needs to change.

Diligent connects risk, compliance, and audit on one platform, and markets a single source of truth across those teams, so the difference is not integration. It is two other things. First, European frameworks are configurable content on a global architecture rather than pre-built European supervisory frameworks with ready-made evidence chains, so they take configuration and maintenance as technical standards evolve. Second, Diligent offers compliance monitoring, but not a dedicated European regulatory-change feed that watches sources such as DNB, AFM, ESMA, and EIOPA and links a change straight to the affected control. That regulatory monitoring layer is what Ruler adds.

The difference is who keeps the frameworks current. With Diligent, you configure and maintain them as standards evolve. With CERRIX, they arrive pre-built and stay current through Ruler's AI powered regulatory monitoring.

Internal audit

CERRIX provides internal audit as an integrated module that shares the same data as risk and compliance. An audit finding links back to the control it tests and forward to remediation, and follow-up actions are tracked as measures of improvement through to closure, so an audit moves from finding to resolution in one place. The Three Lines model stays visible throughout.

Diligent offers a board-integrated audit view. For organisations where internal audit reports directly to the board and audit committee, that reporting line is where its audit module is oriented.

Third-party risk management

Both platforms cover third-party risk. CERRIX handles outsourcing and ICT third-party risk with the European supervisory context in mind, the areas explicitly regulated under DORA and the EBA outsourcing guidelines. Assessments, contracts, and ongoing monitoring are linked to the risks and obligations they relate to, so third-party risk is part of the same chain rather than a separate silo. Diligent provides vendor lifecycle management, due-diligence workflows, and risk scoring, with third-party summaries presented to board-level stakeholders.

Regulatory watch and AI

Following the Ruler acquisition, CERRIX covers the full GRC chain. Ruler monitors regulatory change from sources such as DNB, AFM, ESMA, and EIOPA and assesses relevance and gaps, and CERRIX maps the impact to risks and controls, assigns ownership, and keeps the audit trail. Ruler is used by more than 150 financial institutions.

Beyond regulatory watch, CERRIX uses AI where it saves the team time, with human-in-the-loop validation: drafting risk descriptions, extracting risks and controls from documents, and generating samples for automated control testing. The result is a continuous loop from regulatory signal to control response, without exporting to a spreadsheet or switching tools.

CERRIX also offers an LLM integration for conversational GRC, so teams can work with their risk and compliance data from an AI agent they already use, such as Claude or Microsoft Copilot. From the chat they can query the control register, take actions like linking evidence to a task and closing it, and turn control-testing results into a board-ready report. It runs on CERRIX APIs and respects existing permissions, so users only see and change what they are allowed to.

Diligent has invested in AI at the governance layer. At its Elevate 2026 event (April 2026), it announced AI Board Member, an AI advisor for directors, and an Agentic GRC Workforce of coordinated AI agents, with general availability targeted for later in 2026. This is AI aimed at board-level governance, which is a different job from monitoring European regulatory change and tying it to operational controls.

European regulatory fit

This is where the choice becomes clearest for most European buyers.

CERRIX is built around the frameworks European financial services firms, insurers, pension funds, and audit organisations are subject to. DORA, NIS2, GDPR, ISQM, MiCA, and the EU AI Act are built into the platform, not added as a configuration project. When technical standards or supervisory guidance shift, CERRIX reflects that in the product. Data is hosted on Microsoft Azure and stays in the EU.

The customer base reflects this. Stater and Blauwtrust Groep in mortgage servicing, VGZ and Menzis in health insurance, and Haier Europe did not choose CERRIX for board-portal functionality. They chose it because it fits the supervisory and audit expectations they face every day.

Diligent's design centre is board governance and listed-company compliance, with European regulatory content available inside a broader global framework. Where board management is the lead requirement, that architecture fits. Where DORA readiness, DNB reporting, or ISQM compliance are the operational priorities, getting there takes meaningful configuration.

Implementation and time to value

CERRIX runs on a predictable timeframe, typically 3 to 6 months: kick-off and requirements, configuration sessions and setup training, implementation and acceptance testing, then go-live and support. The methodology includes knowledge transfer and co-creation with your team, and it is designed so you do not need a dedicated internal IT function to manage the rollout.

Diligent's timeline varies with scope. A single module can go quickly. Full Diligent One rollouts across board, risk, audit, compliance, and ESG take longer, especially where data migration from legacy systems or custom integrations are involved. Users outside IT and technical audit report a steep learning curve, and the breadth of the platform lengthens onboarding for less experienced teams.

For organisations working toward a DORA deadline or preparing for a DNB or AFM inspection, time to value is not a secondary concern. It is the requirement.

Pricing and total cost of ownership

CERRIX uses transparent, euro-denominated pricing built around three packages, Starter, Professional, and Enterprise, each a fixed annual fee that scales with team size and the modules included. Implementation and professional services follow a fixed-price, fixed-scope approach, so total cost of ownership is easier to forecast because implementation effort and ongoing administration are contained.

Diligent does not publish standard list pricing. The platform is modular: organisations typically start with board governance, then add risk, compliance, audit, and ESG over time, with onboarding and professional services quoted separately. Cost accumulates as licences, modules, and implementation grow, which makes the total harder to forecast up front than a fixed-scope approach.

Who uses each platform

CERRIX is used by European financial institutions, insurers, pension funds, asset managers, audit organisations, and mid-to-large enterprises. References span banks (BNG Bank, NIBC), pension (PGGM), insurers (a.s.r., VGZ, Menzis), crypto and MiCA-regulated platforms (Bitvavo) and mortgage servicing (Stater, Blauwtrust Groep). These are organisations managing real regulatory obligations in a European context, from the mid-market to large financial institutions.

Diligent, by its own reporting, serves more than 25,000 organisations across 130 countries, weighted toward listed companies and large enterprises. For a publicly listed multinational with an active board-governance programme and a dedicated GRC function, that is a natural fit. For a Dutch bank or a Belgian insurer whose day-to-day work is DORA, ISQM, and DNB obligations, much of that board-governance architecture is overhead.

Common questions when comparing CERRIX and Diligent

Is Diligent available in Europe? Yes. Diligent operates in around 130 countries and has European customers. The platform supports DORA and NIS2, but as configurable content rather than out-of-the-box European supervisory frameworks. Its architecture was designed around board governance and listed-company compliance.

Is CERRIX a Diligent alternative for mid-to-large-sized European organisations? Yes. CERRIX gives you the depth of an enterprise GRC platform without a board-governance-first architecture, and it is built for the DORA, NIS2, and ISQM obligations European teams carry.

Does CERRIX cover regulatory monitoring? Yes. With Ruler, CERRIX offers regulatory watch and AI-powered impact assessment across the chain from regulatory signal to control response. Diligent offers compliance monitoring, but not an integrated European regulatory-change feed of this kind.

Which platform is better for DORA compliance? CERRIX is built for DORA and includes pre-configured frameworks, controls, and documentation support. Diligent One can be configured for DORA, which typically involves setup and professional-services effort. For a near-term DORA deadline, CERRIX offers a faster path.

The bottom line

CERRIX is built for the reality of European GRC: a predictable implementation, fixed-scope pricing, out-of-the-box alignment with the frameworks European supervisors enforce, and a partner model focused on adoption from day one. If your organisation operates in Europe, answers to DNB, AFM, or a similar supervisor, and needs a platform your team can use within a reasonable timeframe and budget, CERRIX is worth a close look.

Diligent is a mature platform. For a listed organisation with an active board-governance programme, a large audit committee, and ESG reporting alongside enterprise risk, it has a clear place.

For European financial institutions, insurers, and audit organisations, though, Diligent's architecture reflects board-governance priorities that do not map cleanly to the supervisory work they do every day. A platform built around board portals and listed-company governance is not the same as one built for daily risk management and regulatory compliance under DORA, ISQM, and DNB supervision.

Want to see how CERRIX compares to other platforms? Read our overview of the Top European GRC tools in 2026.

‍