OK, for anyone else using a hosted platform, here is what Infor says: Punchout vendors are taking measures to ensure that their content is not embedded into other sites. Requisition Center has been updated so it can still launch and interact with the vendor's punchout website. As a result of these changes, Internet Explorer (IE) requires the punchout vendor website domain be added to the "Trusted Sites" list. If the vendor is not added as a trusted site, Requisition Center is not able to communicate properly and the requested vendors item(s) will not be returned to Requisition Center.
So, even if Lawson is not on-premise, you will need to add the vendors to your trusted sites.