Supplier management without a new supplier portal: how it works and where people decide 

What does supplier management without a new portal mean?

It means the supplier does not have to learn your system to work with you. Instead of receiving a portal invitation, creating an account and filling in your forms, the supplier gets an email listing what you need and replies with the documents attached. Documents that already arrive at your shared inboxes are read where they land.

The structure a portal gives you does not disappear. It moves to your side. An agent reads each reply, checks every document against your requirements, chases only what is missing, and assembles one file that a person approves. Your team sees what needs it in Microsoft Teams or Slack. Your ERP or SRM stays the system of record.

Why supplier portals create work on both sides

A portal is built for the buyer's records, not for the supplier's day. A supplier selling to twenty customers can have twenty portals, each with its own login, its own form and its own way of asking for the same certificate of insurance. The time to learn each portal, and sometimes a fee, falls on the supplier, so it only pays off with its largest customers. That is why portals work with large suppliers and stall in the long tail: the small and mid-sized suppliers, usually the majority, email the documents instead, and someone on the buyer's team uploads them on their behalf.

• Invitations go unanswered, so the buyer's team chases logins instead of documents.
• Forms get filled in to get past them, so data arrives incomplete or in the wrong field.
• Documents end up in two places: the portal, and the email where they were actually sent.
• The portal stores what was uploaded. Someone still has to read it and decide whether it meets the requirement.

None of this means portals are wrong. For high-volume, repeat suppliers who log in every week, a portal can work well. The friction is in onboarding and qualification, where each supplier interacts a handful of times and the buyer needs evidence, not just uploads.

How it works, step by step

1. The request goes out from your own mailbox

   An email from the mailbox suppliers already hear from, listing the documents for this supplier's category, country and spend, in the supplier's language. At first your team reviews and sends each draft; once you trust them, the agent sends them itself.

2. The supplier replies, with attachments

   A certificate of insurance, a W-9, a bank letter, an ISO certificate, an audit report. The supplier answers the email like any other. No account, no password, no form to learn. Documents that already arrive at shared inboxes are picked up where they land.

3. The agent reads and verifies each document

   It recognizes which document it is, from which supplier and for which requirement, in any language. Then it checks issuer, holder, limits, scope and expiry, and whether the documents agree with each other: same legal name, same tax ID, same address. It screens the entity and its owners against sanctions lists.

4. Your policy sorts the result

   Each requirement is complete, missing or out of policy. Missing items go back to the supplier in the same thread, naming exactly what is wrong. Anything above a threshold is set aside for a person.

5. A person approves

   The approver gets one pack in Teams or Slack: what was checked, against which source, what passed, what the agent is unsure about, and a recommendation. Sanctions matches and high scores always land here.

6. The supplier's status is updated

   Only after approval. Where the agent has access to your ERP or SRM, it writes the approved status and data there; otherwise your team does, from the validated file. The file, the thread and the decision stay together for the audit.

Beyond new suppliers: expiries, spend and audits

Onboarding is where the work is most visible, but much of the risk sits with suppliers you already buy from. The same policy and the same checks cover three more jobs:

• Expiries and recertification. Certificates of insurance, ISO certificates, safety records and audits expire. The agent watches every date, alerts your team before it lapses and asks the supplier for the update.
• Spend with suppliers that do not comply. Crossing each supplier's status with your POs and invoices shows how much you are buying from suppliers with a missing or expired requirement.
• Audits and action plans. The agent reads audit reports, extracts the findings with a link to the page they come from, proposes a classification for a person to approve, and tracks whether the corrective action plan is met.

For a supplier that already passed onboarding, this is what keeps the approval true a year later.

What the exchange looks like

A typical first round for a new subcontractor, as the supplier and your approver would see it:

The supplier wrote two short emails. Everything else, reading the certificate, spotting the missing endorsement and asking for exactly that, happened on the buyer's side. The decision stayed with Sam.

What policy-driven means

The agent does not decide what good looks like. Your policy does. Requirement sets by category, country and spend, minimum insurance limits, accepted certificates, risk thresholds and the points where the agent must stop and ask are written down in configuration your compliance team owns and can read. Changing a rule is a reviewed change, not a prompt, and the same rule is applied to every supplier.

That is what makes it auditable. When someone asks why a supplier was approved, the answer is the rule that applied, the evidence that met it and the person who signed off. How to write a policy so it can be applied to every document, with an example, is in the guide on applying supplier qualification policies to documents.

What stays in your ERP or SRM, and what the agent does

Starting from Excel and email

Many procurement teams run onboarding on a spreadsheet, a shared inbox and the ERP vendor master. You do not need to implement a suite first, and you do not lose what you have. The supplier experience stays the same email it is today. The agent reads the shared inboxes, files each document in the right folder and keeps the spreadsheet up to date, with a file per supplier behind every row that records each check and decision. The chasing is no longer done by hand.

Working on top of SAP Ariba, Coupa or another SRM

If you already run an SRM, it stays. It remains the vendor master and the place your other processes read from. The agent works in front of it: it handles the conversation with suppliers who will not log in, does the document checks the SRM stores but does not perform, and writes the approved result back. Nora's tools include the SAP vendor master and Coupa. Suppliers who prefer the portal can keep using it.

What the SRM keeps, what the agent does and what integration each phase needs is covered in the guide to using an AI agent on top of SAP Ariba, Coupa or another SRM. For a category-by-category view of suites, specialized tools and agents, see the supplier onboarding software comparison. To evaluate vendors on whether suppliers can skip the portal, see how to choose supplier onboarding software without a supplier portal.

Extending to Tier 2 and Tier 3 suppliers

Regulation and customers increasingly ask about the suppliers behind your suppliers: where a material was made, by whom, under what conditions. A portal rarely reaches them, because a Tier 2 supplier has no relationship with you. The practical route is through your direct supplier: ask it to declare its sub-suppliers for the products you buy, and to provide the evidence, such as origin declarations, certificates or audit reports. The agent requests, reads and tracks that evidence the same way.

That is risk-based visibility, not a full map of your supply chain. It covers the products and tiers where your policy says you need evidence, and records what the supplier could not or would not disclose. The guide to Tier 2 and Tier 3 due diligence explains how to set that scope and what to ask for, and the supplier regulation library lists the US and EU rules behind it, with their status.

Limits and dependencies

• Suppliers are reached by email. Microsoft Teams or Slack are for your own team.
• The agent needs access to the mailboxes where supplier documents arrive. Writing statuses back to the ERP or SRM needs access to it; until then, your team updates it from the validated file.
• Checks on documents are only as good as the documents. For material approval (specifications, lab results, samples), the agent covers the paperwork, not the technical validation.
• It is not a system of record, a supplier portal or a risk rating service. You keep those where you need them.
• It checks the documents a supplier provides. It does not audit a supplier's site or certify compliance.
• Your policy has to be written down. Where it is not, the pilot starts by writing it.
• A person approves every supplier and every exception. That is by design, and it does not change.

How to start

Start with a diagnostic: your requirements configured as a policy and run on a sample of your own supplier data, from email or Excel, with no integrations. It shows what is missing, what has expired and, where you share POs or invoices, the spend going to suppliers that do not comply. From there, the 8-week pilot runs in four phases: scoping the category and goal, configuring the requirement set and thresholds, running side by side with your team reviewing every pack, and reviewing results against the goal set in week one. The supplier onboarding page details each phase, and Nora's profile shows her playbook and the approval pack. To scope a pilot, book a call.

Frequently asked questions

This article is for information and is not legal advice. Practices and references are for the United States; check what applies to your contracts and your state.