All Solutions Release Notes

General Availability

AI Governance Inventory Global/Local Functionality

|Available with Solution Packaging Only

Establish standardized global records for AI systems, models, and datasets while maintaining contextual, local records across business units, use cases, and lifecycle stages. This capability lets teams track AI asset evolution through a clear audit trail, enforce standardized attributes at the global level, and manage jurisdiction-specific or use case-specific requirements at the local level.

For more information, see AI Governance Global/Local Feature Guide. This feature is related to the following ideas: AI-I-31, PDGI-I-1416

Existing Public Preview Features

Amazon Bedrock AI Model & Agent Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models and agents in your Amazon Bedrock accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

Databricks Unity Catalog AI Models, Agents, and Datasets Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models, agents, and datasets in your Databricks accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

GCP Vertex AI Model and Agent Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models and agents in your Google Cloud accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

SageMaker AI Model Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models in your SageMaker accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

Azure Foundry Model and Agent Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models and agents in your Azure Foundry accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

Automated AI Discovery

Continuously scan, detect, and catalog AI models and agents across your AWS-native ecosystem. This seamless integration experience enables real-time visibility into your organization's AI landscape, mapping relationships between models, training data, and business processes to strengthen risk management and compliance. By eliminating manual tracking, teams can focus on innovation while maintaining comprehensive oversight of their AI systems through automated discovery and continuous monitoring.

For more information, see Automated AI Discovery: Amazon SageMaker Integration for AI Governance Models

Automated AI Discovery

Discover and catalog AI models, notebooks, and experiments across Google Cloud while maintaining centralized governance controls. This seamless integration experience enables real-time visibility into your organization's AI landscape, mapping relationships between models, training data, and business processes to strengthen risk management and compliance. By eliminating manual tracking, teams can focus on innovation while maintaining comprehensive oversight of their AI systems through automated discovery and continuous monitoring.

For more information, see Automated AI Discovery: Google Vertex Integration for AI Governance Models.

Metadata for Datasets

|Available with Solution Packaging Only

Improve data use governance functions by automating dataset evaluation and surfacing metadata that clarifies data quality, sensitivity, and readiness. This accelerates access request reviews, ensures responsible data usage, and helps teams build AI models on compliant, trustworthy datasets, which enhances both accuracy and oversight.

Export Inventory Records to Column Report

Create a report of all records of a specific inventory and the columns eligible for bulk import, or the current saved view of an inventory screen including applied filters. This provides you with two flexible reporting methods to gather comprehensive insights into inventory records.

For more information, see Exporting AI Inventory Records.

Things to Know

OneTrust is planning to upgrade all environments to the new AI Governance Services, which provide improved permission granularity, expanded inventory support, foundations for agent governance, and a more unified management experience through the Inventory Manager. For more information and rollout schedules, seeAI Governance Services Upgrade Notice.

OneTrust is planning to unify the export output of AI Governance inventories to standardize values forSystem usersattributes. This change will replace the user's display name (e.g. John Smith) in favor of their email address (e.g. john.smith@onetrust.com) across all inventory types. Currently the platform has mixed behavior across the available inventory times, leading to import failures where the schema expects email address for these user fields.

Tenants will be automatically updated with this enhancement in the OneTrust 202604.2.0 release.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Table Enhancements for Scripts

Tables and table functionalities on the Scripts screen have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, and clearer row actions. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Tracking Technology Deletion on Opt‑Out

Automatically delete tracking technologies when users opt out of a given category. This enhancement deletes tracking technologies after users opt out to better support enforcement and compliance directives.

New Get List of Applications API

Added the new Get List of Applications API that allows you to retrieve a paginated list of applications with optional filtering capabilities. This API enables programmatic access to application data to support CMP deployments at scale through public, API‑driven workflows.

Fixed

• Resolved an issue that prevented the Compliance assistant from returning scans for some enabled frameworks.

• Resolved an issue that copied the production script instead of the test script when the test script was copied from the Website details screen.

Existing Public Preview Features

Enhanced Auto-Blocking Interface

Leverage an improved Auto-Blocking experience, featuring a redesigned safe list, block list, and match list. The enhanced Auto-Block tab is designed for a quicker and easier user experience when reviewing and blocking URLs.

For more information, see OneTrust Cookie Auto-Blocking (Enhanced Interface).

Banner SEO Configuration

Deploy your banner script with header (<h>) tags replaced as paragraph (<p>) tags for improved search engine optimization.

For more information, see Publishing and Implementing Cookie Consent Scripts, or contact OneTrust Support or your account representative.

Support for Multi-Language Privacy Policy Links

Configure privacy policy links in multiple languages on the Dynamic Links section of the Website Details screen. This feature enables you to offer privacy policy links and information in each language relevant to your business needs.

For more information, see Configuring Domain Branding.

Enhanced State Support for the Global Privacy Platform

The Global Privacy Platform (GPP) settings now support consent strings for the following US states:

• Delaware

• Iowa

• Nebraska

• New Hampshire

• New Jersey

• Tennessee

For more information, see Configuring Global Privacy Platform Settings.

Bulk Export APIs

The following APIs are now available for use to create and cancel bulk exports and retrieve their status, progress, download details, and credit details. These APIs enable users to extract large volumes of cookie receipts at once with a limit of six bulk exports per month.

• Create Bulk Export API

• Get List of Bulk Exports API

• Get Bulk Export Status API

• Cancel Bulk Export API

• Get Bulk Export Download Details API

• Get Bulk Export Credit Details API

• Get List of Bulk Export Download Details API

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

Always Inactive Consent State

Leverage the new Always Inactive consent state to allow users to display tracking technologies that are present but not enabled on their websites. This consent state enables you to notify your end users that a tracking technology is deployed but not active.

For more information, see Cookie Consent Models and Configuring Geolocation Rules.

Enable Global Privacy Platform on TCF 2.2 Templates

Enable the Global Privacy Platform setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Platform (GPP) and populate the IAB TCF EU section of the GPP string.

For more information, see Configuring the Global Privacy Platform Settings.

Vendor Identification, Categorization, and Consent

Vendor Identification, Categorization, and Consent enables you to categorize any vendor services on your website and provide detailed consent options to your visitors. This feature streamlines vendor disclosure and consent by detecting known services and linking them to tracking technologies. Leverage Vendor Service Identification, Categorization, and Consent to perform the following actions:

• Identify known vendor services when scanning your websites.

• Categorize the vendor services active on your websites.

• Link tracking technologies to identified vendor services.

• Allow end users to configure consent for vendor services on the Preference Center.

• Capture records of consent at the vendor service level.

• Configure IAB templates to capture and disclose vendor service information.

• View source URLs for tag initiators on the Initiators tab of the Scan Results screen.

For more information, see Vendor Identification, Categorization, and Consent Feature Guide.

Legitimate Interest Configuration for Reject All on IAB Templates

Implement a Reject All button on your Preference Center and Cookie Banner that prevents objection to legitimate interest. This enhancement improves compatibility with Google Limited Ads.

For more information, see Customizing the Preference Center Template.

Server-Side Rendering

Server-side rendering is now available for Cookie Banner HTML and CSS.

For more information, see Server-Side Rendering: Performance and Availability.

Accessibility Conformance

• The “List of Partners" link is now correctly identified by screen readers as a link instead of a button (WCAG-A 4.1.2: Name, Role, Value).

• Unnecessary heading levels have been removed from <tablist> elements on the preference center (WCAG-A 4.1.2: Name, Role, Value).

• The elements <fieldset> and <legend> have been added to the preference center to improve screen reader navigability of the cookie list filters (WCAG-A 3.3.2: Labels or Instructions).

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed Android

• Resolved an issue that caused some apps to quit unexpectedly upon launch.

• Resolved an issue that prevented users from accessing the preference center if Google Play Services were disabled or unavailable on the Android device.

Fixed iOS

• Resolved an issue that caused the SDK to log the consent for App Tracking Transparency (ATT) prompts separately from cookie purposes, creating duplicate consent receipts.

Fixed APIs

• Resolved an issue that prevented the Log Consent API from responding successfully if the interactionType body parameter was set to ATT_CONFIRM.

New Public Preview Features

Enhancements to Consent Management Platform APIs

Updated the errors object of all CMP API responses to include ERROR_CODE_UNSUPPORTED_VERSION as a response for the code parameter and The published version is not supported. Please publish a newer version as a response for the message parameter. This enhancement adds error handling to address issues when the published version is not supported.

Existing Public Preview Features

Consent Management Platform APIs

The following APIs are now available for use with retrieving interface attributes needed to display the Banner and Preference Center, retrieving a list of active IAB and Google Vendors to display on the Preference Center, and logging consent when an end user interacts with a Banner or Preference Center. These APIs enable you to easily access data for Banner and Preference Center implementations, disclose vendor information to end users, and capture end user consent.

• Get Banner Data API

• Get Preference Center Data API

• Get IAB and Google Vendors API

• Log Consent API

• Get Universal Consent Purposes API

Roku Support for Unified Consent Profile for Known Users

Leverage the new Unified Consent Profile for Known Users functionality to connect data subjects' CMP preferences with Universal Consent & Preference Management profiles by enabling the Create data subject profiles for known users setting on the Geolocation Rules tab. You can also easily trigger integration workflows to send CMP preferences to downstream systems, and efficiently manage your preferences in a unique Preference Center, centralizing all of them in one single profile.

This enhancement provides a comprehensive view of data subjects empowering you with more control over the data captured across both modules, resulting in a more streamlined and tailored user experience.

For more information, see Connecting CMP preferences with Universal Consent & Preference Management Profiles.

Configure Button Layout for the Banner

Configure the positioning of buttons on your mobile and CTV banners within the Button Sets section of the Template Details screen. This enhancement allows you to specify the positioning of buttons on your banners for a more customized experience.

• iOS

• Android

For more information, see Customizing the Mobile App Consent Banner Template and Customizing the Mobile App Consent Preference Center Template.

Enhanced Branding Settings for Mobile and CTV SDKs

Configure detailed branding settings for your mobile SDKs on the Branding tab of the Mobile App Details and CTV App Details screen, respectively. This enhancement enables you to configure more specific branding settings for each of your mobile and CTV applications.

For more information, see Configuring Mobile and CTV App Branding.

Validation for Cross-Device Consent Receipts

Enable the Require Authentication for known users setting when leveraging Cross-Device Consent to require validation on your consent receipts. This enhancement allows you to more reliably collect consent from known users.

For more information, see Configuring Geolocation Rules.

Note:

This enhancement is only available to users with the Consent Rate Optimization (CRO) add-on package. Contact OneTrust Support or your account representative to enable this functionality.

To learn more, see Maximize Opt-Ins with Consent Rate Optimization.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

This feature is available for the following platforms:

• iOS

• Android

• Apple TV

• Android TV

Enable Global Privacy Protocol on TCF 2.2 Templates

Enable the Global Privacy Protocol setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Protocol (GPP) and populate the IAB TCF EU section of the GPP string.

This feature is available for the following platforms:

• Android

• Android TV

• Apple TV

• HTML5

• iOS

• Roku

• Unity

• Xamarin

For more information, see Configuring the Global Privacy Protocol Settings.

New Reject All Button Configuration

Enable the updated Reject All button configuration on the Preference Center template. This new configuration ensures that legitimate interest is not impacted for customers using Google Ads.

For more information, see Customizing the Mobile App Consent Preference Center Template.

Things to Know

The iOS SDK has been improved to more reliably load using cached or offline data, as needed. This enhancement enables the SDK to successfully load under slow or unavailable network conditions and ensures consent can be consistently captured.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Background Color for Hosted Web Forms

Configure the background color or image of hosted web forms from the Brand section of the Branding tab. This enhancement allows you to customize hosted web forms without leveraging custom CSS.

For more information, see Customizing Branding for OneTrust Hosted Web Form Collection Points

Fixed

• Resolved an issue that prevented consent bulk imports from uploading successfully due to date formatting errors.

• Resolved an issue that prevented the Fire integration events for not given transactions setting from disabling after its parent setting, Enable transactions for consent withheld, was disabled.

• Resolved an issue that incorrectly recorded changes to the Time of day field when the Allow consent confirmation retries setting was enabled.

Existing Public Preview Features

CMP Consent Context

Added support to our existing data hierarchy to allow CMP consent users to provide consent for a purpose multiple times when using consent groups. When using consent groups with the unified profile feature, the CMP will use the same data subject for different consent groups, eliminating the need to create additional profiles.

Things to Know

TheCreate Consent Receipts APInow notifies users with validation warning messages when invalid email addresses or mobile numbers are used as identifiers.

Enable theLock field if pre-filledsetting on form fields for hosted and embedded web forms to make fields with content read-only to end users.

For more information, see Building and Editing OneTrust Hosted Web Form Collection Points and Building and Editing OneTrust Embedded Web Form Collection Points.

Purposes withoutOrganizationsdefined will receive retroactive updates beginning in OneTrust 202604.2.0. Purposes without an organization will be automatically assigned to the root organization. One-time changes can be made to the purpose if an organization other than the root organization is applicable.

Purposes are now assigned by default to the root organization if the Organizations body parameter is omitted or left empty when using the Create Purpose API. To assign purposes to a specific organization, pass the organization's UUID in the Organizations body parameter.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Existing Public Preview Features

Policy Enforcement for Snowflake and Databricks

|Available with Solution Packaging Only

Scan and classify data without relying on the limited classification capabilities provided by cloud platforms to enable automated and consistent application of policy actions across Snowflake and Databricks environments. This robust functionality supports the orchestration of masking and row filtering policies to configure access and visibility privileges to sensitive data tables in these systems.

This feature is related to the following ideas: INT-I-34, GOVIDEA-I-24, DPOL-I-3, GOVIDEA-I-16. For more information, see the following:

• Masking Policies for Databricks

• Masking Policies for Snowflake

• Row Filtering Policies for Databricks

• Row Filtering Policies for Snowflake

Data Governance Insights Dashboard

Utilize highly customizable reporting and analytic capabilities using the Data Governance Insights Dashboard to analyze data captured across Data Catalog. This dashboard can be used to view essential information about your data assets, manage your data and associated metadata in response, and enact policies and procedures necessary for proper data governance.

For more information, see Insights Data Governance Dashboard.

Access Intelligence Insights Dashboard

Now enabled for every Data Catalog customer, data governance managers can now utilize highly customizable reporting and analytic capabilities using the Access Intelligence Insights Dashboard that collects data captured by Data Catalog and Data Discovery. This dashboard can be used to understand what sensitive data you have and how it is shared across the company so admins can quickly identify data-related risks present in your data ecosystem.

For more information, see Insights Access Intelligence Dashboard.

Note:

This dashboard is available by default only for Data Catalog customers.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Improved the performance of the Brazil CPF classifier to return an accurate number of term instances.

• Resolved an issue where incorrect values were appearing instead of the actual discovered attribute values after scanning.

• Resolved an issue that prevented custom SQL queries from executing for Databricks scans which resulted in full catalog scans instead of targeted scan results.

Existing Public Preview Features

Script Management

Run common maintenance and troubleshooting scripts directly from the platform in the new Administration tab. This reduces the need for command line interface (CLI) access or coordination with support by providing an effective and easy way to execute critical scripts.

For more information, see Script Management for Worker Nodes.

Note:

Originally introduced under General Availability in OneTrust 202504.1.0. This has been changed to Public Preview in OneTrust 202505.1.0.

Duplicate File Detection

Identify duplicate and redundant files with AI-driven analysis based on key risk attributes (classification, shared access) and make decisions on whether to retain or remove duplicates. This enhancement helps you reduce redundant data, decrease attack surface, and improve security posture with savings on cloud storage costs.

For more information, see Reviewing Scanned Files.

Data Discovery Insights Dashboard

Utilize highly customizable reporting and analytic capabilities using the Data Discovery Insights Dashboard to analyze data captured across the module. This dashboard can be used to view information about job insights, scan metrics, worker node progress, and more related to your discovery business outcomes.

For more information, see Insights Data Discovery Dashboard.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented users from sorting the Reports screen by Date created or Last modified date.

Existing Public Preview Features

Conversational Analytics Insights Chatbot

|Available with Solution Packaging Only

Ask natural-language questions about your Insights data using the Copilot chatbot in the OneTrust Platform when the Conversational analytics setting is enabled in Global Settings. This feature reduces the manual effort required to create reports and dashboards by generating summaries, tables, and visualizations using existing out-of-the-box reporting data. The Copilot chatbot supports analysis for the following objects:

• AI Governance inventories:

  • AI systems

  • Datasets

  • Models

  • Projects

• Assessments

• Contracts

• Controls / Control implementations

• Engagements

• Inventories:

  • Assets

  • Entities

  • Processing activities

  • Vendors

• Privacy requests and subtasks

• Risks

For more information, see Using Conversational Analytics Insights Chatbot.

Insights Dashboards

Utilize highly customizable reporting and analytic capabilities using Insights Dashboards that are built through Power BI by Microsoft and embedded in the OneTrust Platform to analyze data captured across various products throughout the platform. The following seeded dashboards are available under Public Preview:

• Data Governance Dashboard

• Data Discovery Dashboard

• Access Intelligence Dashboard

Expanded Custom Attributes for Privacy & GRC Insights Dashboards

Track additional metrics by adding up to 10 custom attributes to each tab on custom Insights Dashboards created using the Privacy and Governance, Risk, Compliance data sources. This enhancement provides more flexibility in customizing your Insights Dashboards, allowing you to visualize unique data points relevant to your organization’s business context.

For more information, see Using Object-Based Attribute Tables for Custom Insights Dashboards.

Things to Know

Insights as Default for Net New Customer Accounts

Starting in the OneTrust 202410.1.0 release, Insights Dashboards will be the default dashboard experience for all new OneTrust accounts. Users within new OneTrust accounts created after the respective environment is upgraded to 202410.1.0 will now see Insights Seeded Dashboards when available for a given module. Legacy dashboards will only appear for modules that do not currently have an Insights Seeded Dashboard. Existing accounts that already have access to Legacy Dashboards will not be affected by this change.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Add License Column to User and Role Exports

Gain visibility into licensing with the new License column available within Users list exports and Role exports. With this enhancement, customers with solution packaging subscriptions can forecast licensing more accurately by differentiating free versus paid entitlements, design cost‑optimized roles, and improve audit and compliance readiness.

Note:

The License column within the Users list and Role exports will also be visible to customers with legacy subscriptions. Please note that the License column in the Users list export only reflects licenses derived from users' direct role assignments and does not reflect licenses derived from user group assignments at this time.

For more information, see Exporting User Reports and Importing and Exporting Roles.

Custom Attribute Value Management

Manage values for custom attributes from the Context Menu icon in the Options tab. This enhancement allows you to edit and update attribute options, including translation keys, directly in the platform.

Fixed

• Resolved an issue that caused the Email activity tab to display an incorrect sender email address for Microsoft Exchange-configured accounts instead of the configured Exchange sender address.

• Resolved an issue that caused routing rules to fail due to archived or deleted workflows in the rule, resulting in count discrepancies between list screens and the corresponding exports.

• Resolved an issue that caused task notification emails to use the language of the user who created or triggered the task instead of the default language configured for the task recipient's organization.

Existing Public Preview Features

SCIM Users and Groups Integrations

Utilize the Integrations module to configure triggers and actions for SCIM Users and Groups. This feature allows users to automate their organization's processes when managing user and group information using SCIM APIs.

For complete details on these workflow options, see Managing Custom Integration Workflows.

New Root Organization

Create a new root organization at the top of an existing organizational hierarchy using the new Set as the Root Organization check box on the Add Organization modal. This feature allows you to move an existing organizational structure, along with certain previously configured settings, under a new root organization.

For more information, see Managing Organizations.

Integrate Tasks with External Systems

Manage tasks created within the application across external systems by creating integration workflows using the following new integration events:

• Task Add Attachment

• Task Add Comment

• Task Created

• Task Deleted

• Task Remove Attachment

• Task Updated

This enhancement allows you to manage tasks across external systems, which may be helpful when addressing tasks that require a large volume of actions.

For more information, see Integrating Tasks with External Systems.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Things to Know

• Global search results are now paginated for improved viewing and navigation.

• Default collection filters are now supported in global search.

• The Email field in the membership registration flow now validates website visitors to prevent bots from access.

• The First Name and Last Name fields on the create user flow now accept spaces and hyphens as special characters.

• Georgia is now available as a Country filter option on the Experts page.

General Availability

Table Enhancements for Local Versions

Tables and table functionalities on the Local versions tab of the Inventory details screen for master records have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

Note:

Select tables across Data Mapping Automation may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

• Resolved an issue that prevented inventory data from being published to inventory reports when the SQL query exceeded the supported parameter limit.

• Resolved an issue that prevented risk results in PDF reports from matching the risk results shown on the Risk details screen.

• Resolved an issue that prevented bulk imports from importing successfully.

• Resolved an issue that prevented a vendor's Aggregated inherent risk score from updating after a risk was deleted.

• Resolved an issue that prevented the Vendors screen from loading when saved views were applied.

• Resolved an issue that prevented record of processing activity (ROPA) reports from loading when records had a high number of relationships.

• Filters now retain deactivated attribute options when those values exist on records, allowing users to identify and update existing records that contain inactive values.

Existing Public Preview Features

Enhanced Data Graph Visualizations

View relationships between projects, data sets, and models in the data graph in addition to inventory records. This enhancement provides a clear visualization of how objects relate to each other and to inventory records throughout your data map.

For more information, see Creating and Managing Contextual Relationships.

Inventory Review

|Available with Solution Packaging Only

Gain essential visibility into the flow of newly added and updated inventory records so you can better investigate risks, promote compliance, and enhance efficiency concerning your data map. This review experience allows you to manage pending inventory records that are created by several methods and review inventory records with new or updated data elements.

For more information, see Inventory Review & Automation Feature Guide.

Inventory Similarity Scan

|Available with Solution Packaging Only

Detect similar records in your data map for new records that have been added through various sources. Different than our duplicate asset functionality, the scan displays information about similar records within the new records to ensure users can easily find a record that is similar to the new entry.

For more information, see Inventory Similarity Scan.

Table Enhancements for Data Mapping Automation

Tables and table functionalities within Data Mapping Automation have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

• Data lineage screen

• Assessments tab of the Inventory details screen

Note:

Select tables across Data Mapping Automation may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Data Mapping Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented users from relating vendors to incident records when working with a high volume of vendors.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that caused exported PDF assessment reports to incorrectly display answer options in multiple languages.

• Resolved an issue that prevented information request emails from displaying the assessment name correctly when translated to Japanese.

• Resolved an issue that prevented users from downloading exported PDF reports from the Notification popover when some profile score attributes contained null values.

• Resolved an issue that caused backup assessments to briefly become visible to users during a template version update.

• Resolved an issue that caused risks to remain linked to an assessment after being deleted from the Risk Register.

• Resolved an issue that prevented filters from being retained when users saved a custom view on the Assessments screen.

Existing Public Preview Features

Launch Reassessments as Not Started

Configure reassessments to default to the Not Started stage upon launching. This enhancement applies to copied assessments, reassessments launched via automation rules, and reassessments launched via API.

Company Names in Email Notifications

Display your company name in assessment email notification templates using the __TenantName__ email variable when notifying users. This enhancement enables you to provide assessment notifications on behalf of your organization that reflect your tenant's name.

For more information, see Customizing Assessment Email Templates Using Dynamic Variables.

Template Updates

AI Intake Assessment Full v4.0

This release provides customers with a new section dedicated to AI system impact assessment legal requirements. This section currently features the comprehensive AI laws of South Korea (AI Basic Act) and Colorado (AI Act). AI Governance customers interested in compliance with these frameworks are impacted by this release.

In particular, the South Korean Act on the Development of Artificial Intelligence and Establishment of Trust (AI Basic Act) establishes a comprehensive national framework for the governance of artificial intelligence in South Korea, promoting innovation while ensuring trust, transparency, and the protection of fundamental rights. The Act introduces baseline obligations for AI developers and users, with enhanced requirements for high‑impact and generative AI systems, and emphasizes accountability, explainability, and user awareness across the AI lifecycle. On the other hand, the Colorado Artificial Intelligence Act creates a risk‑based regulatory framework for the use of artificial intelligence in consequential decision‑making affecting consumers in Colorado. The law focuses on preventing algorithmic discrimination by imposing duties of reasonable care, transparency, and impact assessment on developers and deployers of high‑risk AI systems, while granting individuals clear rights to notice, explanation, and human review in AI‑driven decisions.

We’ve added coverage for the AI system impact assessment requirements set out by these two laws to the AI Intake Assessment (Full) by offering dedicated questions and rules. The following is the change log for this release:

• The Welcome section text was updated.

• Updated question and description text of question 1.3.

• Updated question text of question 2.2.

• Updated question text of question 6.4.

• Added the new Affected Stakeholders attribute for question 1.5.

• Modified the name of section 4 of the EU AI Act to EU AI Act - Scope and Risk Classification.

• Modified description text of question 4.1 - EU AI Act.

• Modified question text of questions 5.1, 5.2, 5.5, and 5.6.

• Created a new section 7 named AI Assessment Regulatory Requirements. This section is optional and is meant to be expanded over time to amplify its regulatory coverage. Its purpose is to collate questions based on global legal requirements on AI impact/risk assessments. The following framework was added to this section:

  • South Korea AI Basic Act

  • Colorado AI Law

• New questions were added to the newly introduced section 7:

  • Question 7.1 - Scope - Applicable Law(s)

  • Question 7.2 – Guidance Text [KR]

  • Question 7.3 – High-impact AI [KR]

  • Question 7.4 – Technical and Operational Principles Analysis [KR]

  • Question 7.5 – Scenario-based Risk Analysis [KR]

  • Question 7.6 – Affected Fundamental Rights [KR]

  • Question 7.7 – Determination of Impact on Fundamental Rights [KR]

  • Question 7.8 – Mitigation Measures [KR]

  • Question 7.9 – Guidance Text [US-CO]

  • Question 7.10 – High-risk AI System [US-CO]

  • Question 7.11 – Deployer Qualification [US-CO]

  • Question 7.12 – Employee Count [US-CO]

  • Question 7.13 – Deployer's Training Data [US-CO]

  • Question 7.14 – Reasonably Foreseeable Usage [US-CO]

  • Question 7.15 – AI System Learning Data [US-CO]

  • Question 7.16 – Developer Impact Assessment Disclosure [US-CO]

  • Question 7.17 – General AI Information [US-CO]

  • Question 7.18 – Algorithmic Discrimination [US-CO]

  • Question 7.19 – Categories of Data Processed [US-CO]

  • Question 7.20 – Outputs [US-CO]

  • Question 7.21 – Customization Data [US-CO]

  • Question 7.22 – Performance Metrics [US-CO]

  • Question 7.23 – Transparency Measures [US-CO]

  • Question 7.24 – Post-deployment Monitoring & User Safeguards [US-CO]

  • Question 7.25 – Intentional and Substantial Modification(s) [US-CO]

  • Question 7.26 – Intentional and Substantial Modification(s) [US-CO]

• Conditional logic configurations have been added to account for the inclusion of the new questions.

• Updated and renamed the Create Minimal Risk rule.

• Updated and renamed the Unacceptable Risk System rule.

• Deleted the Create Unacceptable Risk rule.

• Updated the EU AI Act - High-Risk System rule.

• Updated the Conformity Assessment rule.

• Updated the EU AI Act - Fundamental Rights Impact Assessment rule.

• Updated and renamed the EU AI Act - General-Purpose AI rule.

• Updated conditional logics in question 4.7.

• Updated the conditional logics of questions in section 5.

• The risk/task rule configurations below have been added to account for the inclusion of the new questions:

  • New AI Basic Act [KR] - Confirmation of High-Impact AI risk rule

  • New AI Basic Act [KR] - Obligations of High-Impact AI Business Operators task rule

  • New AI Basic Act [KR] - High-Impact AI Impact Assessment Obligation risk rule

  • New Colorado AI Law [US-CO] - High-Risk AI System Impact Assessment Obligation task rule

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

General Availability

New Add Subtask to Request using Subtask Template API

Added the new Add Subtask to Request using Subtask Template API. This enhancement allows you to create subtasks using an existing subtask templates’ configuration via API, streamlining the process of task creation.

New Parameter for Get List of Subtasks by Criteria API

Added the ExactSystemNameMatch parameter to the Get List of Subtasks by Criteria API. When set to true, only subtasks that are an identical match to the SystemName parameter value will be returned within the response. When set to false, subtasks that are partial matches to the SystemName parameter value will be returned within the response.

Fixed

• Resolved an issue that caused an approver to be incorrectly assigned to auto‑rejected requests.

• Resolved an issue that prevented text color and highlighting changes from being saved in the Guidance text box on the Workflow details screen.

• Resolved an issue that prevented rules from being saved to web forms when the associated response template had been deleted.

Existing Public Preview Features

Subtask Library

Create a library of subtask templates that can be reused across multiple requests and workflows. This feature streamlines the way you can create, edit, and manage subtasks.

This feature is related to the following idea: OT-I-15383.

For more information, see Leveraging the Subtask Library.

Add Subtasks and Subtask Resolution Conditions with Stage Rules for Workflows

Add a subtask and configure workflow rules with subtask resolution conditions. This enhancement streamlines your workflows by making subtasks easier to manage.

This feature is related to the following idea: OT-I-3727.

For more information, see Adding Rules to Workflow Stages.

Stage Rules for Workflows

Configure rules on workflows to conditionally change workflows or their stages. This feature streamlines your workflows by automating changes based on your specific criteria.

This feature is related to the following idea: OT-I-3727.

For more information, see Adding Rules to Workflow Stages.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Data Subject Request (DSR) Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented filters applied on the Controls tab of the Initiative screen from being retained as expected.

Existing Public Preview Features

Evidence Task Review Workflow

Enable a default workflow for evidence task intervals when a reviewer is assigned. This enhancement introduces a structured set of stages to track the lifecycle of evidence, while also supporting notifications and task creation to keep teams informed and on track.

Note:

The Evidence Task Approval Bypass permission is required to allow evidence task assignees to bypass approval stages and send an evidence task interval to be collected.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Compliance Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that caused the Number of respondents count to display inconsistently between the dashboard and attestation view.

Existing Public Preview Features

AI-Powered Document Analysis

|Available with Solution Packaging Only

Analyze documents against a standard or framework using the new Analyze document button on the Document details screen. This AI-powered feature identifies gaps and provides recommendations to help remediate issues related to the following objects:

• Controls

• Risks

• Issues

AI-generated recommendations will appear in the Recommended section of the Related, Controls, Risks, and Issues tabs of the Document details screen. These recommendations may include relating controls, creating relationships, or linking risks and issues.

For more information, see Using AI-Powered Document Analysis. This feature is related to the following idea: OT-I-14780.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Existing Public Preview Features

Issue Attribute Visibility Rules

Configure attribute visibility rules using the new Attribute visibility tab on the Issue type details screen in the Attribute Manager. This feature allows you to use conditional logic to control which fields appear when creating or editing issues to help reduce clutter and improve data accuracy.

For more information, see Creating Attribute Visibility Rules.

Disable Editing of Details

Disable users from editing details on closed issues and preserve the record once the workflow is completed. This workflow configuration setting is optional during activation and is only available if the Close record setting is enabled. Users must reopen the issue record in order to edit a field.

For more information, see Managing Issue Workflows.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Issues Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented users from filtering records on the Controls tab of the Inventory details screen.

• Resolved an issue that prevented users from editing controls when accessed via the Control library.

• Resolved an issue that prevented users from opening control implementations.

• Resolved an issue that prevented users from filtering records on the Control library list screen.

• Resolved an issue that prevented users from opening control implementations in a new browser tab.

• Resolved an issue that caused workflow stage rule notification emails for business objectives to link to an incorrect screen.

• Resolved an issue that prevented risks from being successfully imported when using the Create risks import template.

• Resolved an issue that prevented risk attributes from updating when the risk was the primary record on an assessment.

Existing Public Preview Features

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: IT Risk Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

AI systemscan now be added as target objects when creating control relationships on theInventoriestab of theControlsscreen.

For more information, see Managing AI Systems in AI Governance.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Separated Files Export for DORA ROI Report

Generate the register of information (ROI) report as a compressed file containing separate .csv files for each tab of the report. This enhancement allows you to submit unique files to specific regulators instead of sending the single, multi-tabbed export.

For more information, see Step 3: Generate and Export the DORA Report.

Fixed

• Implemented field validation to ensure that no two records share the same Nth Party value for the Identification code of the ICT third-party service provider field. This enhancement intends to preserve data uniqueness for this field throughout your inventory.

New Public Preview Features

Updated Create Contracts & Create Engagements Modals

View all attributes in the same groupings that users have configured in the Attribute Manager in the new Create Contract and Create Engagement modals. This enhancement provides an ability to quickly filter all required attributes to improve the user experience of creating new records.

Note:

As of the OneTrust 202605.1.0 release, the Contracts tab will be removed from the details pages for Assets, Processing Activities, and Entities. Any contracts related to these records can now be accessed on the Related tab of the details page. For more information, see our myOneTrust Community post.

Existing Public Preview Features

Table Enhancements for Third-Party Risk Management

Tables and table functionalities within the Assessments tab of the Engagement overview screen has been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

Note:

Select tables across Third-Party Risk Management may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary. For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.