Supply chain / Risk intelligence · Deep dive

Prewave

Vienna spin-off from TU Wien that turned a PhD on multilingual social-media signals into an AI supply-chain risk platform tuned to the EU's due-diligence laws — €63M Series B in June 2024 led by Hedosophia, 200+ enterprise customers including BMW, Hilti, Kärcher and Lufthansa, and a business model whose gravity depends on how heavily Brussels and Berlin actually enforce CSDDD after the 2025 Omnibus delay.

emerging

The question that decides it: **Prewave's business model rests on a regulatory wager. The February 2025 EU Sustainability Omnibus pushed CSDDD's transposition to July 2027 and its application to July 2029, cut scope to companies with >5,000 employees and >€1.5B turnover, and reduced deep-tier obligations to a triggered ('plausible information') model. Germany suspended LkSG reporting on 1 October 2025 and is unwinding the law into the CSDDD timeline. If enforcement stays soft and the deep-tier obligation stays optional, does a monitoring platform priced against a mandatory tier-N due-diligence workflow still earn its ARR — or does the buyer default to the cheaper 'good enough' module inside Sedex, EcoVadis or the existing SAP Ariba / Coupa / Ivalua supplier-risk seat they already pay for?**

My take ★★ Very interesting ★ Interesting − Maybe ✗ Not interesting

Snapshot

Prewave is Vienna’s answer to the enterprise supply-chain-risk category — an AI platform that monitors publicly available media, filings and web sources in more than 50 languages, resolves the signals against a customer’s supplier graph, and produces continuous risk alerts and audit-ready evidence for European due-diligence regulations. Founded in 2017 as a TU Wien spin-off by Harald Nitschinger (CEO) and Lisa Smith (CTO, whose PhD is the technical DNA), the company has raised ~€100M across four rounds, culminating in a €63M Series B led by Hedosophia in June 2024. It counts 200-plus enterprise customers including BMW, Hilti, Kärcher, Lufthansa, Toyota, Ferrari, Porsche, Siemens and PwC, and has priced itself as the reference tool for German LkSG and EU CSDDD workflows. The company is now the largest pure-play European supply-chain-risk vendor by revenue and headcount — and also the vendor most exposed to the EU’s own decision, taken in early 2025, to slow the very regulations that seeded its growth.

Founding story

Prewave is not a repurposed enterprise-software play; it is a piece of academic AI that walked out of TU Wien and got monetised. Nitschinger and Smith met in 2002 at HTL Spengergasse, a specialised technical high school in Vienna’s fifth district. Smith went on to a PhD at TU Wien’s Institute for Software Technology and Interactive Systems, starting supply-chain-risk work in 2012 in what was then a very unfashionable corner of business informatics. Her thesis was concrete: sit in Indonesia, watch a port strike or civil unrest unfold in real time, and check whether the same signal appeared earlier in Indonesian-language Twitter, Facebook and local news than in the Western trade press. It did — and no European procurement team was reading Bahasa Indonesia. Back in Vienna, she built the first prototype of what became Prewave’s multilingual NLP stack.

The founders decided to commercialise in September 2016 and formally launched Prewave in 2017 as a TU Wien spin-off, first backed by the university’s own innovation programme and Austria’s Gründungsfonds. Speedinvest and xista science ventures wrote the institutional seed cheque in 2020. Nitschinger’s own contribution to the founder story is unglamorous but load-bearing: he handled the enterprise sales motion, the CSDDD/LkSG positioning and the transition from a Vienna research shop into a company that now sells into Munich, Stuttgart and increasingly London and New York. Ventech and KOMPAS co-led a €11M Series A in September 2022. Creandum led an €18M Series A+ in May 2023. Hedosophia — the London growth firm best known for its late-stage bets in consumer marketplaces — led the €63M Series B on 25 June 2024, in a round that also brought every prior institutional investor back on the cap table.

How it works

The technical spine has three layers. First, the ingestion layer: Prewave crawls a very broad set of publicly accessible sources — news, regulator filings, court databases, NGO reports, corporate registries, social media, video captions, sanctions and denied-party lists — in more than 50 languages and local dialects. Company materials cite over four million data points a day and 150-plus risk categories across ESG, geopolitical, financial, cyber, disruption and human-rights signals. The differentiator versus English-first competitors is that a factory dispute in Bahasa, a Turkish port strike, a Guangdong labour protest or a Brazilian environmental fine gets recognised in its native language rather than picked up days later by an English trade wire.

Second, the resolution layer: each customer connects its supplier master data — ERP records, purchase orders, factory names, subsidiaries — and Prewave ties it into an entity-resolved graph. On top of tier-1 data, the platform runs a “sub-tier discovery” workflow that cascades invitations to a customer’s own suppliers to declare their suppliers (a Sourcemap-style mechanic), enriches the graph with public trade and corporate-registry data, and infers relationships from co-mentions and shared shipments. Prewave says it monitors ~250,000 direct and indirect suppliers across the customer base.

Third, the alert and workflow layer: when a signal hits a threshold, the platform surfaces a scored, dated event tied to the affected supplier and location, provides source links and a summary, and (per Prewave marketing) delivers high-impact events inside 60 minutes. Customers triage in a case-management UI, assign remediation, and export the audit trail into their LkSG reporting or CSDDD due-diligence file. The workflow is deliberately shaped for a compliance officer defending a filing, not just a procurement analyst watching a dashboard — that framing is the company’s most durable product decision.

Product and business overview

Prewave sells modules on top of a shared graph. Risk Monitoring is the base product — real-time news / social / regulator ingestion and alerting across 150+ risk categories. ESG Risk adds human-rights, labour, environmental and governance-specific taxonomies and evidence workflows. Sustainability Compliance is the CSDDD / LkSG / CSRD-adjacent module that packages evidence, remediation plans and reporting outputs for regulators and boards. Cyber Risk and Financial Risk add discipline-specific signal sets (cyber-incident news, financial distress and insolvency filings) and are typically sold as add-ons rather than standalone. Tier-N Discovery is the sub-tier mapping cascade. Supplier Assessments delivers questionnaire and self-declaration workflows against SAQ-style templates. Newer modules announced through 2024-2026 include a supplier newsletter product for two-way communication and various AI copilots for automating first-draft due-diligence write-ups.

The go-to-market is a classic land-and-expand: land on the most acute regulatory pain (usually LkSG for a German industrial or CSDDD for a large EU multinational), then cross-sell cyber, financial and sub-tier modules into the same account. Named enterprise customers include BMW, Hilti, Kärcher, Lufthansa, Toyota, Ferrari, Dr Oetker, Porsche, Volkswagen, Siemens, Lear Corporation, Magna International, KTM, AbInBev, and PwC (as both customer and channel partner). Public-sector accounts are growing but not the core of the business today.

Business model and pricing

Prewave is quote-only enterprise SaaS. There is no public rate card, and prices we have observed anecdotally in RFPs land in a wide band. The dominant pricing axes are: number of suppliers monitored (tier-1 plus tier-n), which modules are switched on, number of seats and depth of language / geographic coverage. Rule-of-thumb enterprise contracts sit in the €80-250K/year range for a European industrial with a few thousand monitored tier-1 suppliers and two-to-three modules; the largest deals (an OEM with tens of thousands of suppliers across the full stack) reach into low seven figures. Public-sector work is contract-lumpy and does not smooth into ARR.

With ~200-plus customers and getLatka’s third-party ARR estimate around $43.9M for 2025, back-of-the-envelope average contract value implies mid-six-figure enterprise ACVs — consistent with the customer profile but a number to treat with caution, since Prewave has not disclosed revenue and getLatka’s numbers are frequently drawn from headcount and hiring proxies rather than filings.

Traction over time

The publicly datable series looks roughly like this. In May 2023, when Creandum led the Series A+, Prewave publicly disclosed “over 100” enterprise customers and headcount in the low-60s. In June 2024, at the Series B, the company cited “over 200 companies” including Lufthansa, Toyota, Ferrari and Dr Oetker; headcount at that point was in the ~130-150 range per LinkedIn and Tracxn. By mid-2026, headcount had grown to roughly 200-230 across Vienna, London and New York offices per Tracxn / LeadIQ / Revelio, with the company continuing to hire despite the regulatory softening. getLatka’s $43.9M ARR estimate for 2025 — if directionally right — implies roughly 3-4x growth off the Series A+ base, a plausible but unverified trajectory.

Market analysis

The industry backdrop is where Prewave’s story becomes complicated. The intellectual case for the category is straightforward: forced-labour law in the US (UFLPA, effective 21 June 2022; CBP detained 6,636 shipments in H1 2025 alone), the German Supply Chain Act (LkSG, in force 1 January 2023 for the largest employers and expanded 1 January 2024), and the EU Corporate Sustainability Due Diligence Directive (adopted 24 May 2024) created a coordinated regulatory forcing function for multi-tier supply-chain due diligence and continuous monitoring. Analyst-house TAM estimates for supply-chain-risk-management software ranged from ~$5B in 2024 rising toward $15-25B by 2030 across Gartner and Frost & Sullivan write-ups.

Then the political winds reversed. On 26 February 2025, the European Commission tabled a “Sustainability Omnibus” bundle that dramatically de-scoped and delayed CSDDD. The April 2025 “Stop the Clock” directive pushed transposition to 26 July 2027 and application to 26 July 2029, and cut in-scope companies to those with more than 5,000 employees and €1.5B in turnover. Deep-tier (“beyond tier-1”) diligence became triggered, not mandatory. Germany then followed suit: on 3 September 2025 the Federal Government announced it would phase out LkSG in favour of CSDDD, and on 1 October 2025 BAFA stopped reviewing LkSG due-diligence reports. UFLPA enforcement, meanwhile, dropped sharply in the second half of 2025 — CBP stopped only 14 UFLPA shipments in July 2025, per CBP’s own data. Prewave’s tailwind did not disappear, but the compounding of it visibly slowed in the exact quarters Series B growth was supposed to accelerate.

Competitive intel

The competitor set breaks into four tiers. Pure-play SCRM incumbents: Everstream Analytics (the ex-DHL Resilience360 lineage, strong on logistics and weather), Interos (US unicorn with Federal/DoD depth but growth wobbles), Resilinc (750+ enterprise customers, EventWatchAI multi-tier). DACH-native peers: IntegrityNext (Munich, €100M from EQT March 2023, 600+ customers, closest look-alike), Sphera (Blackstone-owned, bought Munich’s riskmethods October 2022, 1.1M monitored suppliers). ESG ratings and audit networks: EcoVadis (100,000+ rated suppliers, CVC-backed, priced as the ratings layer) and Sedex (85,000+ member companies, SMETA audit protocol, the cheap “good enough” answer for social/labour reporting if enforcement stays soft). Plus specialists: Sourcemap ($55M raised, tier-N BOM cascade), Craft.co (supplier data enrichment), Achilles / NavIQ (prequalification networks in energy/utilities), Kharon and Sayari (entity-resolution and sanctions).

The most consequential competitive vector is the fourth tier — the suite bundle. SAP Ariba Supplier Risk swapped its country-risk source to Moody’s Analytics in the November 2025 release and shipped Joule agents across supplier management. Coupa Compose has 20+ persona-based agents including a Risk Sentinel. Ivalua’s IVA Studio (2026) pipes supplier-risk telemetry directly into an existing source-to-pay contract. If any of the three ships a serviceable due-diligence workflow bundled into a renewal at zero incremental price, Prewave has to justify its ARR line on differential quality — non-English signal depth, evidence-quality for an actual regulatory filing, and speed of the risk feed — rather than mere presence. That is a defensible position but it is a harder sale than “you have to buy us because the law says so.” Big Four channels (PwC in Germany especially) are simultaneously a distribution advantage today and a potential competitive threat as Deloitte, KPMG and PwC stand up their own agentic-AI SCRM practices.

History and evolution

• 2012-2016: Lisa Smith’s PhD research at TU Wien on multilingual social-media signals as supply-chain risk indicators.
• September 2016: Smith and Nitschinger decide to commercialise the research.
• 2017: Prewave founded as a TU Wien spin-off in Vienna.
• 2020: Institutional seed round led by Speedinvest and xista science ventures.
• January 2023: LkSG comes into force for German companies with 3,000+ employees.
• May 2023: Series A+ of €18M led by Creandum; Prewave publicly discloses 100+ enterprise customers.
• January 2024: LkSG expanded to companies with 1,000+ employees; German procurement teams accelerate SCRM RFPs.
• May 2024: CSDDD formally adopted by the EU.
• June 25 2024: Series B of €63M led by Hedosophia; 200+ customers disclosed.
• February 2025: European Commission’s “Sustainability Omnibus” proposes major delays and scope cuts to CSDDD and CSRD.
• April 2025: EU Parliament votes “Stop the Clock”; CSDDD transposition delayed to July 2027, application to July 2029.
• 3 September 2025: German Federal Government announces LkSG will be wound down in favour of CSDDD.
• 1 October 2025: BAFA stops reviewing LkSG due-diligence reports; enforcement suspended except for grave human-rights violations.
• 2026: Company scales product into cyber, financial and sub-tier modules against a softer regulatory backdrop.

What people say

The case for. Prewave’s reference book is genuinely strong for a Series B European vendor. Hilti, BMW, Kärcher, Lufthansa, Porsche, Siemens, Toyota, Ferrari and PwC are all named in company and press materials. Reviews on Gartner Peer Insights (13+ reviews across 2024-2026) and G2 emphasise real-time multi-tier visibility, the depth of non-English media coverage, and the audit-trail quality for LkSG filings; one G2 reviewer describes Prewave as “a strong, high value partner…transforming supplier risk management from a reactive process into a proactive, centralised approach.” PwC Germany actively channels Prewave into LkSG advisory engagements — an unusual endorsement for a growth-stage vendor.

The complaints. The most consistent negative theme across Gartner and third-party review sites is alert noise: reviewers describe the volume of daily signals as high, with meaningful triage burden and complaints that the composite risk score conflates severity and volume in ways that dilute action. Related themes include integration burden with ERP and supplier-master systems on go-live, gaps in coverage outside the EU-centric core (a few reviews cite thinner Latin America and sub-Saharan Africa depth relative to marketing claims), and pricing that is high enough for mid-market companies to be a real objection when the regulatory forcing function is soft. Prewave’s own product roadmap explicitly targets several of these — an AI copilot for triaging alerts, better risk scoring — but they are current, not hypothetical, complaints.

Outlook: the open question

The answer conditions are visible. Bull case: CSDDD enforcement lands hard in 2027-2029, individual EU member states pull their own supply-chain laws forward again, US UFLPA enforcement reaccelerates under sustained political attention, and Prewave uses the €63M to lock in the top-200 European multinationals with multi-module contracts that reset the moat from “we sell the LkSG evidence file” to “we own the customer’s supplier graph and remediation workflow.” In that world, Prewave becomes the Salesforce of European supply-chain compliance and either goes public around 2028-2029 or gets acquired by a Big Four, an S&P Global, or a Blackstone-owned suite consolidator. Bear case: EU enforcement stays soft, buyers default to the “good enough” Sedex or EcoVadis rating and the SAP Ariba / Coupa / Ivalua module already in the renewal, and Prewave stays a healthy €80-120M ARR European business that never earns a US-scale multiple because the regulatory forcing function it was priced against never fully arrived. The question resolves when a top-25 European industrial either signs (or fails to sign) a full-stack Prewave renewal after taking a hard look at an in-suite alternative in 2026-2027.

How to attack it

A new entrant’s cleanest wedge is not to rebuild Prewave — it is to skip the enterprise-sales motion and productise CSDDD for the mid-market. The Omnibus took the very largest EU companies (>5,000 employees, >€1.5B turnover) squarely into CSDDD and left everyone else with residual national obligations, but the mid-market — the 2,000-5,000-employee industrial in Baden-Württemberg or northern Italy — still has customers, banks and Big Four auditors pushing due-diligence obligations downstream regardless of whether the law formally requires it. A self-serve, credit-card-onboarding, template-driven CSDDD-Lite platform priced at €18-40K/year, delivered in ninety days with pre-built connectors to SAP Business One, Microsoft Dynamics and SAP Ariba, and with an AI copilot that drafts the annual due-diligence report from event data — that product does not exist today at scale, and Prewave’s enterprise contract structure and quote-only pricing cannot ship it without cannibalising its own ACV.

The second wedge is domain-specific vertical stacks — a purpose-built cotton / cocoa / battery / semiconductor traceability product where the tier-N cascade, the origin evidence and the specific regulatory tests (UFLPA, EUDR, EU Battery Regulation) are wired in from day one. Sourcemap partly plays here but is thin outside a few verticals. A vertical stack with pre-annotated risk taxonomies, deep regional-language corpora (Xinjiang, Ghana, DRC, Bangladesh) and its own physical-testing partners would out-position a horizontal platform for the specific compliance filings that actually matter to a buyer’s board.

The exploitable weaknesses. Alert noise is a documented and recurring product complaint — Gartner and G2 reviews cite it as a top opportunity, and the fix is not trivial when you are trying to prove regulatory coverage. Coverage claims outside the EU-centric core are patchier than the marketing suggests, especially in Latin America and sub-Saharan Africa. Pricing is calibrated for a mandatory LkSG buyer that no longer exists — mid-market renewals in 2026-2027 will be under pressure. And channel dependence on Big Four cuts both ways: the very PwC, KPMG, Deloitte partners who resell Prewave today are building competing internal practices. A well-funded attacker with a $40-80M Series A could plausibly own the mid-market before Prewave finishes retooling for it.

Adjacent-segment play

The clearest adjacent-segment play is US federal enforcement and trade-defence — repackaging the same graph and multilingual signal stack for US Customs and Border Protection, HSI, OFAC-adjacent sanctions screening, and the export-controls stack. Sayari has taken this lane hard and Altana is now anchored on the CBP relationship. Prewave has the underlying capabilities but almost none of the government sales infrastructure or FedRAMP-track compliance work — the adjacency is real but capital-gated. A more accessible variant is corporate lender and insurer risk intelligence: banks writing trade finance, credit insurers writing accounts-receivable cover, and reinsurers writing supply-chain interruption cover all price the same underlying supplier-risk signal. A repackaged Prewave feed as an API into a Coface, Allianz Trade or Marsh McLennan workflow monetises the same NLP on a different buyer.

A downmarket adjacency is prosumer/individual due-diligence — a consumer or NGO product that lets journalists, investors and activists check any listed company against Prewave’s supplier-risk graph on a self-serve basis. Panjiva, ImportGenius and now Kpler serve part of this market for shipment data; nobody serves it for continuous ESG / human-rights signal. Small market, but a plausible brand-halo play. A regional adjacency is APAC-buyer versions of the platform — Japanese and Korean OEMs face equivalent pressure from their own regulators, customers and Western buyers, and a Tokyo-hosted deployment tuned to Japanese, Korean and Chinese signal depth is a natural extension of the multilingual DNA. The core wedge — multilingual NLP over supplier graph — is genuinely general; the go-to-market re-tooling to reach any of these adjacencies is the actual constraint.

Sources and further reading

• Prewave Raises €63M Series B to Revolutionise Supply Chain Risk Management with AI-Driven Superintelligence Platform — Prewave (25 June 2024)
• Vienna-based Prewave raises €63M Series B to deliver supply chain superintelligence for compliance — EU-Startups (25 June 2024)
• Prewave pulls in $20M as supply chain tech investments remain on VC radars — TechCrunch (8 May 2023)
• Prewave Gründer — Lisa Smith und Harald Nitschinger — diegruender.at (2024)
• Erfolg für Startup Prewave und das TUW-Innovation Incubation Center — TU Wien news (2023)
• EU Parliament Votes To Delay Implementation of Sustainability Reporting and Due Diligence Obligations — Skadden (April 2025)
• German Government Follows Up On Promise To Change German Supply Chain Act — Jones Day (September 2025)
• Sphera Completes Previously Announced Acquisition of riskmethods — Sphera (4 October 2022)
• EQT Growth invests EUR 100 million in IntegrityNext — EQT (23 March 2023)
• Assessing the Impact of the Uyghur Forced Labor Prevention Act After Three Years — CSIS (2025)
• Prewave Reviews & Ratings — Gartner Peer Insights (2024-2026)
• Prewave helps secure deep supply chains with AI on Google Cloud — Google Cloud Blog (2024)