Using AI for Evidence Analysis

Important:

This feature is currently available for customers in the following environments: APP, APP-FR, APP-EU, APP-DE. AI Evidence Analysis will be available for all environments in a future release.

Leverage OneTrust AI to streamline evidence collection by analyzing uploaded files to save time and reduce the manual review of evidence. This feature delivers rapid insights to help identify gaps, prioritize critical items, and accelerate compliance workflows. AI-powered evidence analysis evaluates how well the documentation submitted for evidence collection aligns with your defined controls, evidence requirements, and guidance. The analysis will highlight which elements meet validation criteria and flag validation points that are missing or incomplete. For more information, see Managing AI Features in the OneTrust Platform.

By providing proactive recommendations, OneTrust AI empowers stakeholders to quickly adjust submissions and improve alignment with compliance expectations. This layered automation approach transforms traditional continuous control monitoring, which eliminates the need for complex integrations and configurations, making it easier to accurately assess scope and readiness across your program.

Note:

To fully utilize the AI evidence analysis feature, you must enable the following permissions for your custom roles. These permissions can be found in the evidence task implementation permission group and ensures users can trigger the analysis and access the results within the appropriate workflow.

  • View attachment analyses for evidence task intervals: Allows users to view the analysis results for an evidence task interval.

  • Create attachment analyses for evidence task interval: Allows users to initiate the analysis for an evidence task interval.

How It Works

As of the OneTrust 202510.2.0 release, evidence analysis is a manual process. In a future release, you’ll be able to embed AI-powered evidence analysis directly into automated workflows.

Establish Compliance Criteria

Automatically generate compliance criteria using details from the evidence task, control descriptions, and guidance. These criteria form the foundation for evaluating submitted evidence.

Scanning Evidence

Uploaded attachments, both text and images, are scanned to identify where compliance requirements are met or unmet.

Evidence Analysis

The system will produce a summary highlighting key validation points, identified gaps, and a remediation task list for business stakeholders. Each analysis assigns a status score (expressed as a percentage) based on the reliability, relevance, and completeness of the evidence. This score updates dynamically whenever the analysis is re-run, reflecting changes such as:

  • New or removed attachments

  • Updates to control descriptions or evidence task content

  • Adjustments to compliance criteria

Using AI-Generated Analysis

Important:

AI-generated analysis may contain inaccuracies. Review and verify all results before relying on them for decision-making.

The checks performed by this feature are limited in scope. Use of this AI feature does not guarantee compliance with any law, regulation, standard, or audit requirements. It is your sole responsibility to assess the sufficiency of your evidence and ensure compliance with all applicable legal and regulatory obligations. The information provided by this feature is for informational purposes only and does not constitute legal advice. For more information, see our AI Transparency Report.

AI models are used to generate evidence analysis scores, and a variance of approximately 0–20% may be observed. This is a natural characteristic of AI-driven semantic evaluation, as the model interprets evidence contextually rather than applying fixed, rule-based calculations. Given the complexity and variability of unstructured inputs, some degree of variation across analyses is expected.

Importantly, this level of variance remains within controlled and acceptable bounds and does not impact the overall reliability of the results. We will continue to enhance the solution by introducing more structured evaluation criteria, standardization methods, and validation checks to further improve precision and ensure greater consistency over time.

To enable record recommendations

You must enable the AI recommendations setting in Global Settings prior to using AI for evidence analysis.

  1. On the Global Settings menu, select AI management > AI features.
    The AI features screen appears.

  2. Enable the Record recommendations setting in the Recommendations section to allow AI to review controls, evidence tasks, and risks, then provide summaries, scores, and recommended fixes.
    Note:

    AI recommendations are not saved or applied without your consent.

  3. Click the Save button.

To upload attachments

To use the AI-powered evidence analysis, you must first upload one or more attachments. Attachments are required to initiate the scanning process. Without uploaded evidence, the system cannot perform validation checks or generate analysis results.

  1. On the Compliance Automation menu, select Evidence tasks.
    The Evidence tasks screen appears.
    Note:

    This can also be accessed from IT Risk Management.

  2. Open the evidence task record in which you'd like to upload attachments.
  3. On the Evidence task details screen, click the Interval name link for the interval in which you'd like to add evidence.

    The evidence collection pane appears.

  4. Click the Add attachments button.
    The Add attachment modal appears.

    Field
    Description
    Collected on

    The date you captured a screenshot, ran a report, or gathered information.

    Attachment type

    Select File. The following file types are currently supported for evidence analysis.

    • Office documents (Excel, Word, PowerPoint)

    • .csv

    • .pdf

    • Images (.jpeg, .jpg, .png, .bmp, .tiff, and .heif)

    • Text (.html and .txt)

    The OneTrust Platform supports other file types when collecting evidence. For more information about the attachment types that can be used outside of evidence analysis, see Collecting and Managing Evidence Task.

    Upload attachments

    Click the Select file button to upload file(s). The file(s) may include screenshots and other relevant documents.

    Update this interval status to collected

    Do not check this box. If the checkbox is selected, the evidence task status will be marked as Collected and you will be unable to analyze the evidence without re-opening the interval.

    Analyze file type attachments using AI

    Check this box to run the analysis as part of uploading the evidence attachment(s). If this box is not checked, you can still run the AI evidence analysis after evidence files are uploaded.

  5. Complete the required fields.
  6. Click the Add attachment button to add the file to the evidence task and analyze the evidence.

To run AI evidence analysis

Before running the AI evidence analysis, you must upload attachments. The analysis process relies on the content of these attachments to evaluate compliance and generate results.

  1. On the evidence collection pane, click the Analyze evidence button.


    Tip:

    You can click the View evidence analysis tips link to view more information about this feature. Click the name of the file to open a preview.

  2. The system uses the control description, evidence task (what to collect), and collection guidance to generate a set of criteria. Each uploaded attachment is evaluated against these criteria.
    Note:

    The processing time may vary depending on the size and content of the uploaded files. You can exit the page without interrupting the analysis process.

  3. Once the AI evidence analysis is complete, a summary will be generated with a list of requirements and bullet-point findings that reflect how well the submitted evidence aligns with the expected criteria. The summary will also include an Analysis status of sufficient or insufficient.


    The analysis status is based on how reliable, relevant, and complete attachments are. This status updates every time an analysis takes place.
    Table 1. Analysis Status

    Analysis Status

    Description

    81-100%

    Strong, recent, and verified evidence with minor gaps or uncertainties.

    51-80%

    Somewhat reliable evidence with minor gaps or uncertainties.

    0-50%

    Unreliable, outdated, or incomplete evidence requiring follow-up.

    Evidence not analyzed

    Evidence requires analysis.
  4. Click the icon next to the file name to expand the analysis findings and view a summary of each attachment, including the validation points it satisfies or does not satisfy.


To re-run AI evidence analysis

There may be instances where you must re-run the AI evidence analysis. This typically happens when:

  • Attachments are added, removed, or replaced

  • The evidence task, control descriptions, or guidance are updated

  • The initial analysis returns a result indicating the evidence is insufficient

Tip:

When a change occurs that could impact the analysis outcome, a banner will appear prompting you to re-analyze the evidence to ensure your results reflect the most current attachments. You may need to refresh the screen to see this banner.

  1. On the evidence collection pane, click the Analyze evidence button.
  2. The evidence analysis will review the evidence task, control descriptions, and guidance. This process time varies depending on the size and complexity of the uploaded files.
    Note:

    You can exit the page without interrupting the analysis process. You will receive a notification once the analysis is complete.

  3. Once the AI evidence analysis is complete, a summary will be generated with a list of requirements and bullet-point findings that reflect how well the submitted evidence aligns with the expected criteria. The summary will also include an Analysis status of sufficient or insufficient.

To delete attachments

  1. On the evidence collection pane, click the Context Menu icon next to the file you would like to delete.
  2. On the Context menu, select Delete.

    The Delete document modal appears.

  3. Click the Confirm button to delete the file.