Who, what, when, where, why: The Open Review Interoperability Standard (ORIS), announced in May 2026, reached its first public milestones in July–August 2026. On July 15, 2026 the ORIS working group published a canonical reference implementation and test harness on GitHub under an MIT-compatible license; in the last three weeks several procurement platforms and marketplaces began pilot integrations to ingest signed review feeds. This update reviews what has changed since the standard’s announcement, who is participating, concrete adoption metrics gathered by B2B Stack Weekly, and what procurement and vendor teams should do now.
Context: why ORIS still matters
B2B buyers historically struggle to reuse verified review evidence across platforms and procurement workflows. ORIS defines a JSON-LD schema and minimal API for portable review objects—encapsulating reviewer metadata, product and deployment attributes, review context, verification tiers and cryptographic provenance—so reviews can be machine-read by e‑procurement systems, RFP scorecards and TCO tools. The goal remains the same: reduce duplicate capture, raise verification standards and create auditable evidence trails for sourcing decisions.
What changed in July–August 2026
- Reference implementation released (July 15, 2026): The ORIS working group published a repository that includes: the JSON-LD schema v1.0, sample signed export payloads, a Node.js ingestion client, and a Dockerized test harness for running interoperability tests.
- Early pilots launched: Three procurement platforms—ProcureSoft, MarketSquare and VerityProc—announced pilot integrations between July 20 and August 3, enabling their enterprise customers to import ORIS-signed review feeds into RFP templates and vendor evaluation dashboards.
- Certification beta opened (Aug 5, 2026): The Open Review Foundation (the nonprofit spun out of the ORIS working group) launched a six-week certification beta for “ORIS-compliant” exporters and importers. Ten vendors registered for beta testing in the first 72 hours.
- Early metrics from our survey (July 29–Aug 2, 2026): B2B Stack Weekly surveyed 78 procurement leaders and platform product managers: 28% said they expect to require ORIS exports in RFP attachments within 12 months; 47% said they will run a pilot in the next six months; 25% said implementation cost and data governance were their top barriers.
Details: implementation realities and numbers
The reference code intentionally covers three operational areas: (1) a signed export format using JSON-LD and detached JWS signatures, (2) an API pattern for delta updates to avoid re-ingesting entire histories, and (3) a provenance chain model that supports nested attestations (self-declared → vendor-attested → procurement-verified).
Early adopters report integration costs that are modest but non-trivial. ProcureSoft’s Head of Product, Maria Chen, told B2B Stack Weekly: “Our engineering estimate to add ORIS import/export endpoints and signature verification to a typical procurement instance was roughly 240 engineer-hours. Smaller marketplaces should budget 120–200 hours depending on existing metadata hygiene.”
Verification workflows remain the most operationally complex element. VerityProc’s pilot added an SSO-based employment attestation (SAML/SCIM) for reviewer verification and a contract-value coarse-grain tier (0–$50k, $50k–$500k, >$500k) to avoid sharing sensitive contract amounts. Those trade-offs reflect immediate market preferences: 61% of surveyed buyers prefer coarse ranges rather than precise contract values for compliance reasons.
Impact: who benefits and what changes
Short-term winners are enterprise procurement teams and RFP authors. ORIS exports let buyers attach verifiable review sets to sourcing records and reduce time spent chasing vendor-supplied evidence. In our survey, procurement teams that ran pilot imports reported a 22% reduction in time to populate RFP evaluation materials during the first pilot week.
For platforms, the calculus is mixed. Marketplaces adding ORIS exports risk losing some on-site traffic if review content is consumed inside buyer tools, but early adopters see new integrations as a source of enterprise revenue—offering “verified feed” subscriptions to buyers and channel partners.
Reactions: industry voices
“Open, signed review objects change the defensibility of procurement decisions,” said Anil Gupta, Chief Procurement Officer at Atlas Health Systems, one of VerityProc’s pilot customers. “We can now store auditable review proofs in our contract repository.”
“Standards disrupt existing monetization. Platforms that sell premium placement for reviews will push back,” commented Dana Li, CEO of MarketSquare. “We’re experimenting with tiered export controls—allowing vendors to opt into enterprise-grade proofs while keeping consumer-facing summaries.”
Friction points and unresolved governance
Two implementation risks are recurring:
- Trust registry and signer identity: The working group has not yet finalized a global trust registry. The certification beta uses a short-term registry run by the Open Review Foundation, but a scalable, cross-jurisdiction trust framework (with revocation lists and key rotation policies) is expected to be coordinated with the Trust over Data Alliance later this year.
- Privacy and compliance: EU GDPR and California CPRA considerations affect reviewer identity fields. Most pilots are mapping email domains and job titles instead of storing PII; platforms need clear consent flows and retention policies.
What buyers, vendors and platforms should do now
- Buyers: Add a review provenance clause to RFP templates now (sample language provided by the Open Review Foundation) and join at least one pilot to learn how ORIS exports behave in your evaluation workflows.
- Vendors: Map your review metadata to the ORIS JSON-LD fields and prioritize adding attestation hooks (SSO/receipt verification) for higher verification tiers.
- Platforms: Run interoperability tests with the ORIS test harness, estimate engineering effort, and consider offering a certified “enterprise-grade” export tier tied to subscription revenue.
What’s next (timeline)
- Aug–Sep 2026: Certification beta completes; Open Review Foundation publishes final certification criteria.
- Q4 2026: Trust registry hardening and first public key revocation policy expected; 20+ pilot deployments aimed.
- Early 2027: Broader marketplace adoption if certification and trust-registration hurdles are cleared.
FAQ — Common questions right now
Is ORIS ready for production use?
Partially. The ORIS v1.0 schema and reference implementation are available and usable for pilots. Certification and a hardened trust registry are still in beta as of August 2026; organizations that require legal-grade audit trails should adopt ORIS within a controlled pilot before rolling it into regulated procurement processes.
How much engineering effort should a mid-market platform expect?
Based on early pilots, plan for 120–300 engineer-hours depending on data hygiene and existing audit/signature capabilities. Key tasks: mapping metadata to ORIS fields, implementing signature generation/verification, and building delta-update support.
Will ORIS expose sensitive contract data?
No—by design the schema supports coarse-grained contract-value ranges. Pilots prefer ranges (e.g., 0–$50k, $50k–$500k, >$500k) and minimize personally identifiable information. Platforms should add configurable privacy controls to comply with jurisdictional requirements.
How should vendors preserve monetization while supporting ORIS?
Vendors can offer tiered export controls: free exports with low-verification tiers and paid, enterprise-grade signed exports with procurement-ready attestations. Several marketplaces in pilots are testing subscription models for certified review feeds.
Where can I run interoperability tests?
The ORIS GitHub repository (reference implementation) and the Dockerized test harness are the starting points. Join the Open Review Foundation’s certification beta to access the short-term trust registry and participate in cross-platform interoperability runs.
Bottom line: ORIS has moved from specification to working software in six weeks. Early pilots show measurable procurement benefits and manageable engineering costs, but the medium-term outcome depends on the pace of certification adoption and the establishment of a robust trust registry. For procurement teams and platform product leaders, the immediate action is clear: run a small pilot now so you understand integration trade-offs before certification scales later this year.