All Solutions Release Notes

General Availability

Databricks AI Governance and Security Framework

Embed governance directly into AI development workflows to automatically align controls across related frameworks, track compliance continuously, and apply consistent, measurable guardrails across AI systems built in Databricks and beyond. This powerful enhancement allows customers using Databricks to pursue compliance and best practices the Databricks ecosystem for secure and responsible AI development.

Risk Aggregation for Related Records

Enable systemic risk visibility across linked inventory objects in AI Governance. When enabled, parent objects (such as AI Systems or Projects) inherit risks from related child entities (such as Models or Datasets), allowing organizations to automate comprehensive risk views.

For more information, see Risk Aggregation for Related AI Records. This feature is related to the following idea: PDGI-I-1706

AI Governance Relationship Questions

Enable respondents to add multiple relationships in an AI Governance questionnaire. This enhancement allows respondents to provide all required context and information about AI activities in their organization when completing an assessment.

For more information, see Launching Assessments for AI Governance

New Public Preview Features

AI Governance Inventory Global/Local Functionality

|Available with Solution Packaging Only

Establish standardized global records for AI systems, models, and datasets while maintaining contextual, local records across business units, use cases, and lifecycle stages. This capability lets teams track AI asset evolution through a clear audit trail, enforce standardized attributes at the global level, and manage jurisdiction-specific or use case-specific requirements at the local level.

For more information, see AI Governance Global/Local Feature Guide. This feature is related to the following ideas: AI-I-31, PDGI-I-1416

Amazon Bedrock AI Model & Agent Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models and agents in your Amazon Bedrock accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

Databricks Unity Catalog AI Models, Agents, and Datasets Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models, agents, and datasets in your Databricks accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

GCP Vertex AI Model and Agent Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models and agents in your Google Cloud accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

SageMaker AI Model Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models in your SageMaker accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

Azure Foundry Model and Agent Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models and agents in your Azure Foundry accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

Existing Public Preview Features

Automated AI Discovery

Continuously scan, detect, and catalog AI models and agents across your AWS-native ecosystem. This seamless integration experience enables real-time visibility into your organization's AI landscape, mapping relationships between models, training data, and business processes to strengthen risk management and compliance. By eliminating manual tracking, teams can focus on innovation while maintaining comprehensive oversight of their AI systems through automated discovery and continuous monitoring.

For more information, see Automated AI Discovery: Amazon SageMaker Integration for AI Governance Models

Automated AI Discovery

Discover and catalog AI models, notebooks, and experiments across Google Cloud while maintaining centralized governance controls. This seamless integration experience enables real-time visibility into your organization's AI landscape, mapping relationships between models, training data, and business processes to strengthen risk management and compliance. By eliminating manual tracking, teams can focus on innovation while maintaining comprehensive oversight of their AI systems through automated discovery and continuous monitoring.

For more information, see Automated AI Discovery: Google Vertex Integration for AI Governance Models.

Metadata for Datasets

|Available with Solution Packaging Only

Improve data use governance functions by automating dataset evaluation and surfacing metadata that clarifies data quality, sensitivity, and readiness. This accelerates access request reviews, ensures responsible data usage, and helps teams build AI models on compliant, trustworthy datasets, which enhances both accuracy and oversight.

Export Inventory Records to Column Report

Create a report of all records of a specific inventory and the columns eligible for bulk import, or the current saved view of an inventory screen including applied filters. This provides you with two flexible reporting methods to gather comprehensive insights into inventory records.

For more information, see Exporting AI Inventory Records.

Things to Know

Use of the same attribute in multiple actions is now supported in AI Governance workflow stage rules. Previously once an attribute was used in an action within a stage rule, it was no longer available for other stage rules.

System attributes now indicate if theResponse typeis Single select or Multi select so users clearly understand if one or more options can be selected. This is available in the list screen view and details view of the attribute.

Introduced a new column calledList typefor users to more easily find Single select and Multi select options for User and Location lists. This column is also available as a filter option.

Added related entity support in AI Governance column reports to report the following objects:

• Assessment Summary

• Assets

• Vendors

• Entities

• Projects

• Models

• Datasets

• AI Systems

Note:

Support for Risks and Controls will be available in an upcoming release.

AI Auto-Responses for Assessments

Automatically fill out assessments based on past assessments or scanned documents with the AI auto-responses for assessments feature set, which includes AI Doc Scanner and AI Inventory Analysis.

This change was introduced in the Winter release and communicated for Assessment Automation in the release notes, but it also applies to AI Governance and has been retroactively added to the release notes. Restrictions apply for some AI Governance inventory.

For more information, see Leveraging AI Auto-Responses for Assessments.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Enhanced CMP Reporting Data Model

|Available with Solution Packaging Only

Leverage an enhanced Insights dashboard for Cookie Consent to view more comprehensive analytics for interaction rates consent types, including improved calculation methodologies, new columns in the Measures folder, and a new Opt-out signals tab. This enhanced dashboard replaces the legacy Cookie Consent dashboard, which is now fully deprecated.

Note:

As of the OneTrust 202602.1.0 release, users without solution packaging can access the dashboard but will not have access to some features.

This feature is related to the following ideas:

• OT-I-8135

• OT-I-14076

• OT-I-9356

• OT-I-10892

For more information, see Insights Cookie Consent Dashboards (Solution Packaging).

New CMP Templates

Leverage the following new templates to configure your CMP with settings and text relevant to regional privacy statutes.

• Maryland Online Data Privacy Act (MODPA)

• Oregon Consumer Privacy Act (OCPA)

• UK General Data Protection Regulation (UK GDPR)

• Virginia Consumer Data Protection Act (CDPA)

For more information, see Adding, Editing, and Managing Cookie Consent Templates.

Customizable Framework Selection for Compliance Assistant

|Available with Solution Packaging Only

Activate or deactivate frameworks and their compliance checks when leveraging CMP Compliance Assistant. This enhancement provides greater control over which regulatory frameworks and criteria you evaluate your CMP against.

For more information, see Leveraging CMP Compliance Assistant.

Updated TC Strings and Renamed Template for IAB TCF 2.3

Leverage new IAB TCF 2.3 strings and a renamed IAB TCF 2.3 template when configuring your CMP for IAB TCF. These updates allow your configurations to correspond to TCF version 2.3 and its updated specifications. Specifically, the previously optional disclosedVendors segment is now mandatory in every TC string.

For more information, see IAB TCF 2.3 FAQ and Adding, Editing, and Managing Cookie Consent Templates.

Fixed

• The Connecticut Privacy Act (CTDPA) template has been enhanced with updated bundle group names and descriptions and banner description.

• Resolved an issue that prevented the CMP from correctly detecting the browser language when the Enable language detection on scripts setting was enabled for the CMP scripts and the browser language was set to Traditional Chinese (ZH-HANT).

• Resolved an issue that prevented the scanner from successfully detecting cookies on scanned pages.

• Resolved an issue that prevented the scanner from successfully completing scans if a form submission triggered a page reload on a scanned webpage.

• Resolved an issue that caused the scanner to incorrectly identify patterns in some cookies if the cookie name contained "aw ".

• Resolved an issue that prevented CMP Compliance Assistant frameworks settings from remaining enabled when no issues were detected.

• Cookie descriptions have been updated to display correct translations when configured in regional variants of Hindi.

• Resolved an issue that prevented users from saving changes to templates when the Risk Accepted setting for HTML sanitization was enabled in Global Settings.

Existing Public Preview Features

Enhanced Auto-Blocking Interface

Leverage an improved Auto-Blocking experience, featuring a redesigned safe list, block list, and match list. The enhanced Auto-Block tab is designed for a quicker and easier user experience when reviewing and blocking URLs.

For more information, see OneTrust Cookie Auto-Blocking (Enhanced Interface).

Banner SEO Configuration

Deploy your banner script with header (<h>) tags replaced as paragraph (<p>) tags for improved search engine optimization.

For more information, see Publishing and Implementing Cookie Consent Scripts, or contact OneTrust Support or your account representative.

Support for Multi-Language Privacy Policy Links

Configure privacy policy links in multiple languages on the Dynamic Links section of the Website Details screen. This feature enables you to offer privacy policy links and information in each language relevant to your business needs.

For more information, see Configuring Domain Branding.

Enhanced State Support for the Global Privacy Platform

The Global Privacy Platform (GPP) settings now support consent strings for the following US states:

• Delaware

• Iowa

• Nebraska

• New Hampshire

• New Jersey

• Tennessee

For more information, see Configuring Global Privacy Platform Settings.

Bulk Export APIs

The following APIs are now available for use to create and cancel bulk exports and retrieve their status, progress, download details, and credit details. These APIs enable users to extract large volumes of cookie receipts at once with a limit of six bulk exports per month.

• Create Bulk Export API

• Get List of Bulk Exports API

• Get Bulk Export Status API

• Cancel Bulk Export API

• Get Bulk Export Download Details API

• Get Bulk Export Credit Details API

• Get List of Bulk Export Download Details API

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

Always Inactive Consent State

Leverage the new Always Inactive consent state to allow users to display tracking technologies that are present but not enabled on their websites. This consent state enables you to notify your end users that a tracking technology is deployed but not active.

For more information, see Cookie Consent Models and Configuring Geolocation Rules.

Enable Global Privacy Platform on TCF 2.2 Templates

Enable the Global Privacy Platform setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Platform (GPP) and populate the IAB TCF EU section of the GPP string.

For more information, see Configuring the Global Privacy Platform Settings.

Vendor Identification, Categorization, and Consent

Vendor Identification, Categorization, and Consent enables you to categorize any vendor services on your website and provide detailed consent options to your visitors. This feature streamlines vendor disclosure and consent by detecting known services and linking them to tracking technologies. Leverage Vendor Service Identification, Categorization, and Consent to perform the following actions:

• Identify known vendor services when scanning your websites.

• Categorize the vendor services active on your websites.

• Link tracking technologies to identified vendor services.

• Allow end users to configure consent for vendor services on the Preference Center.

• Capture records of consent at the vendor service level.

• Configure IAB templates to capture and disclose vendor service information.

• View source URLs for tag initiators on the Initiators tab of the Scan Results screen.

For more information, see Vendor Identification, Categorization, and Consent Feature Guide.

Legitimate Interest Configuration for Reject All on IAB Templates

Implement a Reject All button on your Preference Center and Cookie Banner that prevents objection to legitimate interest. This enhancement improves compatibility with Google Limited Ads.

For more information, see Customizing the Preference Center Template.

Server-Side Rendering

Server-side rendering is now available for Cookie Banner HTML and CSS.

For more information, see Server-Side Rendering: Performance and Availability.

Accessibility Conformance

• Text in the banner now displays with a minimum font size of 16px (WCAG-A 1.1.4: Resize Text).

Things to Know

New columns have been added to theMeasuresfolder for theCookies Summarydata table. These metrics support a more accurate consent experience and reduce signal loss. The following columns are now available:

CMP Banner Accept All Rate PercentageThe percentage of users who accepted all consent options from the banner.

CMP Banner Close Rate PercentageThe percentage of users who closed the banner without further interaction.

CMP Banner Continue with Close Rate PercentageThe percentage of users who continued to the site after closing the banner.

CMP Banner Continue without Accepting Rate PercentageThe percentage of users who continued to the site without accepting the banner.

CMP Banner Reject All Rate PercentageThe percentage of users who rejected all consent options from the banner.

CMP Interaction Rate PercentageThe percentage of users who interacted with the banner or preference center.

CMP Preference Center Accept All Rate PercentageThe percentage of preference center users who accepted all consent options.

CMP Preference Center Confirm Rate PercentageThe percentage of preference center users who confirmed their consent selections.

CMP Preference Center Reject All Rate Percentage

The percentage of preference center uses who rejected all consent options.

CMP True Opt-in Rate Percentage

The percentage of users who provided at least partial consent.

TheJob queueon theCompliance Assistantscreen no longer limits the list of scans to seven days and can be configured to display any previously completed scans.

Translations for IAB-seeded illustrations, the banner description, and the preference center description are now available when leveraging IAB TCF templates inAlbanian,Norwegian, andSerbian (Latin).

The_OT_smcookie has been added to support operational service measurement, platform reliability, and usage metering for CMP deployments.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability - Admin

Updated TC Strings and Renamed Template for IAB TCF 2.3

Leverage new IAB TCF 2.3 strings and a renamed IAB TCF 2.3 template when configuring your CMP for IAB TCF. These updates allow your configurations to correspond to TCF version 2.3 and its updated specifications. Specifically, the previously optional disclosedVendors segment is now mandatory in every TC string.

For more information, see IAB TCF 2.3 FAQ and Adding, Editing, and Managing Cookie Consent Templates.

General Availability - iOS

Privacy Manifest Scanning

|Available with Solution Packaging Only

Audit privacy manifest files when scanning mobile applications. This enhancement implements a new scan step to validate declarations of data types in your app's Privacy Manifest file against the Privacy Manifest files in SDK dependencies, allowing you to review data use of an app’s SDK dependencies and match your own data type declarations to those declarations. When this feature is enabled, a new Data types being collected section displays on the Overview tab of the Scan Results screen.

For more information, see Viewing and Categorizing Mobile App Consent Scan Results.

General Availability - Android TV

Improved CTV Preference Center, SDK List, and Vendor List Interface

Display an enhanced interface for the Preference Center, SDK List, and Vendor List when on CTV SDKs. This enhancement provides the following updates for end user experience, localization, and accessibility:

• Buttons that appear in more easily navigable places.

• Logos that display in more intuitive locations and are consistent with branding configurations.

• Improved navigation when the CMP is configured in right-to-left languages.

• Focus that detects and reads logos when accessed with assistive technology.

General Availability - Apple TV

Improved CTV Preference Center, SDK List, and Vendor List Interface

Display an enhanced interface for the Preference Center, SDK List, and Vendor List when on CTV SDKs. This enhancement provides the following updates for end user experience, localization, and accessibility:

• Buttons that appear in more easily navigable places.

• Logos that display in more intuitive locations and are consistent with branding configurations.

• Improved navigation when the CMP is configured in right-to-left languages.

• Focus that detects and reads logos when accessed with assistive technology.

Fixed Android

• Resolved an issue that prevented the banner from closing successfully after interacting with App Tracking Transparency (ATT) prompts.

• Resolved an issue that prevented some scans of Android App Bundle (.aab) files from completing successfully.

Fixed iOS

• Resolved an issue that prevented some users' App Tracking Transparency (ATT) preferences from being accurately recorded when using iOS version 26.1.

Fixed Android TV

• Resolved an issue that caused the vendor list to appear multiple times on the preference center when end users accessed the vendor list.

Fixed Apple TV

• Resolved an issue that caused toggles for subgroup categories in bundle groups to display on the preference center when the Show subgroups setting was disabled on the template.

Fixed MAUI

• Resolved an issue that caused errors to display that incorrectly indicated multi-profile consent was disabled when users switched accounts on the same device.

New Public Preview Features

New Parameters for Get Preference Center Data API

Updated the Get Preference Center Data API response to include the purposesHeader and vendorsTypeHeader parameters within the general object of the pcUIData object of the response to communicate the localized headings configured for the Purposes and Vendors sections to SDKs. This enhancement allows you to mirror the exact mobile and CTV copy that admins set in OneTrust without hardcoding translations, keeping the on-device preference center consistent with the published experience.

Legitimate Interest Configuration for Reject All for CMP APIs

Leverage the rejectAllButtonBehavior parameter within the appConfig object of the response when calling the following CMP APIs to configure objection to legitimate interest when rejecting all purposes.

• Get Banner Data API

• Log Consent API

• Get Preference Center Data API

• Get IAB and Google Vendors API

This enhancement improves compatibility with Google Limited Ads and feature parity with the CMP platform.

New Parameters to Support Layout Specifications

Updated the Get Preference Center Data API response to include the layout parameter within the general object of the pcUIdata object of the response. This parameter allows you to retrieve information on layout configurations in your CMP. This enhancement also creates parity between the CMP APIs and the admin interface when configuring CMPs for CTV applications.

Updated Vendor Disclosure Parameters

The IABTCF_VendorsDisclosed and IABGPP_TCFEU2_VendorsDisclosed parameters within the storageKeys object of the following API's responses have been renamed to IABTCF_DisclosedVendors and IABGPP_TCFEU2_DisclosedVendors, respectively. These changes were made to accurately reflect IAB specifications. Customers that parse these parameters within the response should update their existing integrations to use the new parameter names.

• Get Banner Data API

• Log Consent API

• Get Preference Center Data API

Enhanced Error Handling for CMP APIs

Updated the following APIs to include the warnings object of the response that contains the code and message parameters. This enhancement adds a warning message in the response when the SDK version does not match the published version and enables the CMP APIs to fall back to the latest published version.

• Get Banner Data API

• Get Preference Center Data API

• Get Universal Consent Purposes API

• Get IAB and Google Vendors API

Existing Public Preview Features

Consent Management Platform APIs

The following APIs are now available for use with retrieving interface attributes needed to display the Banner and Preference Center, retrieving a list of active IAB and Google Vendors to display on the Preference Center, and logging consent when an end user interacts with a Banner or Preference Center. These APIs enable you to easily access data for Banner and Preference Center implementations, disclose vendor information to end users, and capture end user consent.

• Get Banner Data API

• Get Preference Center Data API

• Get IAB and Google Vendors API

• Log Consent API

• Get Universal Consent Purposes API

Roku Support for Unified Consent Profile for Known Users

Leverage the new Unified Consent Profile for Known Users functionality to connect data subjects' CMP preferences with Universal Consent & Preference Management profiles by enabling the Create data subject profiles for known users setting on the Geolocation Rules tab. You can also easily trigger integration workflows to send CMP preferences to downstream systems, and efficiently manage your preferences in a unique Preference Center, centralizing all of them in one single profile.

This enhancement provides a comprehensive view of data subjects empowering you with more control over the data captured across both modules, resulting in a more streamlined and tailored user experience.

For more information, see Connecting CMP preferences with Universal Consent & Preference Management Profiles.

Configure Button Layout for the Banner

Configure the positioning of buttons on your mobile and CTV banners within the Button Sets section of the Template Details screen. This enhancement allows you to specify the positioning of buttons on your banners for a more customized experience.

• iOS

• Android

For more information, see Customizing the Mobile App Consent Banner Template and Customizing the Mobile App Consent Preference Center Template.

Enhanced Branding Settings for Mobile and CTV SDKs

Configure detailed branding settings for your mobile SDKs on the Branding tab of the Mobile App Details and CTV App Details screen, respectively. This enhancement enables you to configure more specific branding settings for each of your mobile and CTV applications.

For more information, see Configuring Mobile and CTV App Branding.

Validation for Cross-Device Consent Receipts

Enable the Require Authentication for known users setting when leveraging Cross-Device Consent to require validation on your consent receipts. This enhancement allows you to more reliably collect consent from known users.

For more information, see Configuring Geolocation Rules.

Note:

This enhancement is only available to users with the Consent Rate Optimization (CRO) add-on package. Contact OneTrust Support or your account representative to enable this functionality.

To learn more, see Maximize Opt-Ins with Consent Rate Optimization.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

This feature is available for the following platforms:

• iOS

• Android

• Apple TV

• Android TV

Enable Global Privacy Protocol on TCF 2.2 Templates

Enable the Global Privacy Protocol setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Protocol (GPP) and populate the IAB TCF EU section of the GPP string.

This feature is available for the following platforms:

• Android

• Android TV

• Apple TV

• HTML5

• iOS

• Roku

• Unity

• Xamarin

For more information, see Configuring the Global Privacy Protocol Settings.

New Reject All Button Configuration

Enable the updated Reject All button configuration on the Preference Center template. This new configuration ensures that legitimate interest is not impacted for customers using Google Ads.

For more information, see Customizing the Mobile App Consent Preference Center Template.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Things to Know

Use of the same attribute in multiple actions is now supported in Privacy Notice workflow stage rules. Previously once an attribute was used in an action within a stage rule, it was no longer available for other stage rules.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Intelligent Rules for the Trust Center

Tailor your Trust Center to dynamically display content most relevant to your end users based on configured rules. This enhancement allows you to define conditions and actions that personalize content based on your data subjects' profile, interaction type, and session context.

This feature is related to the following ideas: OT-I-16837

For more information, see Configuring Intelligent Rules for the Trust Center.

Consent Acknowledgement Emails for Trust Center

Send email notifications to confirm an end user's change in preferences after interacting with the Trust Center by enabling the Send acknowledgment email setting. This feature allows you to provide end users with emailed receipts of their consent preferences.

For more information, see Configuring Settings for a Trust Center.

Enhanced Trust Center Customization

Trust Center branding has been improved to create a more customized and user-friendly experience when end users access your Trust Center. The following enhancements are now available:

• The Trust Center can now be configured to display an optional logo and login instructions when users log in

• Updated autosave messages now display on the Trust Center to indicate when end user configurations have been automatically saved.

• Font colors for components (buttons, switches, toggles) are automatically calculated to maximize contrast and correspond to your branding configurations.

• Configurable OneTrust default icons for Trust Center pages that correspond to branding colors.

For more information, see Configuring Authentication for a Trust Center, Configuring Branding for a Trust Center, and Customizing the Appearance of a Trust Center, and Creating a Trust Center.

Hosted Web Form Enhancements

The Branding and Builder tabs for hosted web forms have been improved to provide additional branding and configuration options. This enhancement allows you to further customize hosted web forms without leveraging custom CSS.

For more information, see Customizing Branding for OneTrust Hosted Web Form Collection Points.

Bulk Edit & Delete Data Subjects

Perform bulk actions on data subjects based on your specified criteria using the new DATA_SUBJECTS_BULK_ACTIONS export type that is now supported across all Bulk Export APIs. The following parameters were also added to support this new export type:

• The actionType parameter was added to the Create Bulk Export API to support the following actions: DELETE used for deleting data subjects and REMOVE_TEST_FLAG used for removing test flags from data subjects used for testing purposes.

• The testDataSubject parameter was added to the Create Bulk Export API to filter data subjects by the test flag.

With this enhancement, the exported file will now contain the actionType value that was selected when the Create Bulk Export API was called. You can then review the records within the exported file and import it into the OneTrust Platform using the new Consent data subjects bulk actions import template, enabling you to quickly update large volumes of data subject records.

This feature is related to the following ideas: OT-I-16433

For more information, see Bulk Importing Consent Records.

New Create Job API

Added the new Create Job API to create jobs for completing data subject bulk actions initiated from the Create Bulk Export API, such as deleting data subjects and removing test flags from data subjects used for testing purposes. With this API, you can automate the import of the exported file without having to manually review and import the records.

Fixed

• Resolved an issue that produced errors when valid values were added to the sort parameter when calling the following V4 APIs:

  • Get List of Data Subjects API

  • Get Optimized List of Data Subjects API

  • Get List of All Purpose Details by Data Subject API

  • Get List of All Purpose Details for All Data Subjects API

  • Get Optimized List of All Purpose Details for All Data Subjects API

  • Get Data Subject Details API

• Resolved an issue that prevented receipts from displaying on the Receipts tab of the Data subject details screen when consent had been previously withdrawn for a data subject.

• Resolved issue that prevented custom preference options from being stored correctly on the data subject when an end-user made updates through the preference center.

• Resolved an issue that displayed incorrect language codes for some languages in the Language field on the Receipt summary pane of a transaction.

• Resolved an issue that prevented magic link tokens from functioning correctly when logging into the preference center.

• Resolved an issue that caused purposes to expire after the Expire purposes setting was disabled for a purpose.

• Resolved an issue that prevented some purpose attributes from populating on the Receipt details screen.

• Resolved an issue that prevented some embedded trust centers from loading correctly due to translation issues.

Existing Public Preview Features

CMP Consent Context

Added support to our existing data hierarchy to allow CMP consent users to provide consent for a purpose multiple times when using consent groups. When using consent groups with the unified profile feature, the CMP will use the same data subject for different consent groups, eliminating the need to create additional profiles.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Universal Consent & Preference Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

TheCollection pointslist screen can now be filtered by alert status to display collections points that have associated alerts.

OriginalandEnhancedpreference center types have been formally deprecated forUniversal Consent & Preference Managementand are no longer available for use. These preference center types will be deactivated in 202608.1.0 (Summer Release).

New hosted web forms no longer support custom CSS. Existing hosted web forms and any copies you make will continue to support custom CSS until 202605.1.0 (Spring Release).

Purpose description dropdowns now feature explanatory subtitles.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

New Public Preview Features

Policy Enforcement for Snowflake and Databricks

|Available with Solution Packaging Only

Scan and classify data without relying on the limited classification capabilities provided by cloud platforms to enable automated and consistent application of policy actions across Snowflake and Databricks environments. This robust functionality supports the orchestration of masking and row filtering policies to configure access and visibility privileges to sensitive data tables in these systems.

This feature is related to the following ideas: INT-I-34, GOVIDEA-I-24, DPOL-I-3, GOVIDEA-I-16. For more information, see the following:

• Masking Policies for Databricks

• Masking Policies for Snowflake

• Row Filtering Policies for Databricks

• Row Filtering Policies for Snowflake

Existing Public Preview Features

Data Governance Insights Dashboard

Utilize highly customizable reporting and analytic capabilities using the Data Governance Insights Dashboard to analyze data captured across Data Catalog. This dashboard can be used to view essential information about your data assets, manage your data and associated metadata in response, and enact policies and procedures necessary for proper data governance.

For more information, see Insights Data Governance Dashboard.

Access Intelligence Insights Dashboard

Now enabled for every Data Catalog customer, data governance managers can now utilize highly customizable reporting and analytic capabilities using the Access Intelligence Insights Dashboard that collects data captured by Data Catalog and Data Discovery. This dashboard can be used to understand what sensitive data you have and how it is shared across the company so admins can quickly identify data-related risks present in your data ecosystem.

For more information, see Insights Access Intelligence Dashboard.

Note:

This dashboard is available by default only for Data Catalog customers.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Existing Public Preview Features

Script Management

Run common maintenance and troubleshooting scripts directly from the platform in the new Administration tab. This reduces the need for command line interface (CLI) access or coordination with support by providing an effective and easy way to execute critical scripts.

For more information, see Script Management for Worker Nodes.

Note:

Originally introduced under General Availability in OneTrust 202504.1.0. This has been changed to Public Preview in OneTrust 202505.1.0.

Duplicate File Detection

Identify duplicate and redundant files with AI-driven analysis based on key risk attributes (classification, shared access) and make decisions on whether to retain or remove duplicates. This enhancement helps you reduce redundant data, decrease attack surface, and improve security posture with savings on cloud storage costs.

For more information, see Reviewing Scanned Files.

Data Discovery Insights Dashboard

Utilize highly customizable reporting and analytic capabilities using the Data Discovery Insights Dashboard to analyze data captured across the module. This dashboard can be used to view information about job insights, scan metrics, worker node progress, and more related to your discovery business outcomes.

For more information, see Insights Data Discovery Dashboard.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Table Enhancements for Dashboards & Reporting

Tables and table functionalities within Dashboards & Reporting have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

• Dashboards screen

• Reports screen

• Report schedules screen

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

• Resolved an issue that caused assessments exported as a PDF to display questions from an earlier version of the assessment.

• Resolved an issue that allowed users with custom roles to view issues outside their organization on the Issues Default Insights dashboard.

New Public Preview Features

Conversational Analytics Insights Chatbot

|Available with Solution Packaging Only

Ask natural-language questions about your Insights data using the Copilot chatbot in the OneTrust Platform. This feature reduces the manual effort required to create reports and dashboards by generating summaries, tables, and visualizations using existing out-of-the-box reporting data. The Copilot chatbot supports analysis for the following objects:

• AI Governance inventories:

  • AI systems

  • Datasets

  • Models

  • Projects

• Assessments

• Contracts

• Controls / Control implementations

• Engagements

• Inventories:

  • Assets

  • Entities

  • Processing activities

  • Vendors

• Privacy requests and subtasks

• Risks

For more information, see Using Conversational Analytics Insights Chatbot.

Existing Public Preview Features

Insights Dashboards

Utilize highly customizable reporting and analytic capabilities using Insights Dashboards that are built through Power BI by Microsoft and embedded in the OneTrust Platform to analyze data captured across various products throughout the platform. The following seeded dashboards are available under Public Preview:

• Data Governance Dashboard

• Data Discovery Dashboard

• Access Intelligence Dashboard

Expanded Custom Attributes for Privacy & GRC Insights Dashboards

Track additional metrics by adding up to 10 custom attributes to each tab on custom Insights Dashboards created using the Privacy and Governance, Risk, Compliance data sources. This enhancement provides more flexibility in customizing your Insights Dashboards, allowing you to visualize unique data points relevant to your organization’s business context.

For more information, see Using Object-Based Attribute Tables for Custom Insights Dashboards.

Insights Dashboard Updates

• The Risk Domain column has been added to the Attributes folder for the Inventory Risk Domain Aggregate Risk Levels and Risk data tables. These attributes enable domain-based risk aggregation to support more accurate cross-domain risk analysis and governance insights.

• New columns have been added to the Measures folder for the Cookies Summary data table. These metrics support a more accurate consent experience and reduce signal loss. The following columns are now available:

  CMP Banner Accept All Rate PercentageThe percentage of users who accepted all consent options from the banner.

  CMP Banner Close Rate PercentageThe percentage of users who closed the banner without further interaction.

  CMP Banner Continue with Close Rate PercentageThe percentage of users who continued to the site after closing the banner.

  CMP Banner Continue without Accepting Rate PercentageThe percentage of users who continued to the site without accepting the banner.

  CMP Banner Reject All Rate PercentageThe percentage of users who rejected all consent options from the banner.

  CMP Interaction Rate PercentageThe percentage of users who interacted with the banner or preference center.

  CMP Preference Center Accept All Rate PercentageThe percentage of preference center users who accepted all consent options.

  CMP Preference Center Confirm Rate PercentageThe percentage of preference center users who confirmed their consent selections.

  CMP Preference Center Reject All Rate Percentage

  The percentage of preference center uses who rejected all consent options.

  CMP True Opt-in Rate Percentage

  The percentage of users who provided at least partial consent.

Things to Know

Insights as Default for Net New Customer Accounts

Starting in the OneTrust 202410.1.0 release, Insights Dashboards will be the default dashboard experience for all new OneTrust accounts. Users within new OneTrust accounts created after the respective environment is upgraded to 202410.1.0 will now see Insights Seeded Dashboards when available for a given module. Legacy dashboards will only appear for modules that do not currently have an Insights Seeded Dashboard. Existing accounts that already have access to Legacy Dashboards will not be affected by this change.

Added related entity support in AI Governance column reports to report the following objects:

• Assessment Summary

• Assets

• Vendors

• Entities

• Projects

• Models

• Datasets

• AI Systems

Note:

Support for Risks and Controls will be available in an upcoming release.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Data Migration

Gain full oversight into all regulatory-driven data processing activities with the Legal Basis, Transfer Mechanism, and Entity Type constructs in Global Data Manager. This enhancement standardizes how these attributes are defined, collected, and represented in Data Mapping Automation.

For more information, see Global Reference Data Feature Guide.

Note:

No action is required from customers once enabled as these objects will appear across any template configured with an associated attribute. For existing customers, any custom values for these attributes will now be available as options for the given core construct.

Fixed

• Enhancements have been made to improve performance when processing complex workflow and routing rule configurations for AI systems, Models, Projects, and Issues. Validation to flag archived or deleted workflows and data, such as attributes, response options, organizations, etc., is now only applied ahead of time when a configuration contains 20 rules or fewer. When more than 20 rules are present, validation will be completed only when the rule details are expanded.

Things to Know

System attributes now indicate if theResponse typeis Single select or Multi select so users clearly understand if one or more options can be selected. This is available in the list screen view and details view of the attribute.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue where hyperlinks for custom subdomains added to Email actions were not functioning.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Flag New Permissions in the System

Manage recently added permissions introduced within the OneTrust Platform using the new Recently added permissions tab on the Roles screen within Global Settings. As new permissions are added to the platform to support new or expanded functionality, or as they are added as part of OneTrust's permission standardization changes across the platform, these permissions will now appear on a dedicated tab within the Roles screen, providing clear visibility of what permissions were added and which roles were impacted. This enhancement enables admins to quickly assess permission impact and decide how new permissions should be applied across additional custom roles in their environment.

For more information, see Managing Recently Added Permissions. This feature is related to the following idea: AXSC-I-31.

Fixed

• Resolved an issue that prevented user groups from properly filtering based on the search terms entered in the Search field on the User groups screen.

• Resolved an issue where the Search field on the Roles, Users, and User groups screen in Global Settings appeared on top of the list of organizations when expanded from the Organizations icon in the Global Header.

Existing Public Preview Features

SCIM Users and Groups Integrations

Utilize the Integrations module to configure triggers and actions for SCIM Users and Groups. This feature allows users to automate their organization's processes when managing user and group information using SCIM APIs.

For complete details on these workflow options, see Managing Custom Integration Workflows.

New Root Organization

Create a new root organization at the top of an existing organizational hierarchy using the new Set as the Root Organization check box on the Add Organization modal. This feature allows you to move an existing organizational structure, along with certain previously configured settings, under a new root organization.

For more information, see Managing Organizations.

Integrate Tasks with External Systems

Manage tasks created within the application across external systems by creating integration workflows using the following new integration events:

• Task Add Attachment

• Task Add Comment

• Task Created

• Task Deleted

• Task Remove Attachment

• Task Updated

This enhancement allows you to manage tasks across external systems, which may be helpful when addressing tasks that require a large volume of actions.

For more information, see Integrating Tasks with External Systems.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Settings & Administration. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Data Migration

Gain full oversight into all regulatory-driven data processing activities with the Legal Basis, Transfer Mechanism, and Entity Type constructs in Global Data Manager. This enhancement standardizes how these attributes are defined, collected, and represented in Data Mapping Automation.

For more information, see Global Reference Data Feature Guide.

Note:

No action is required from customers once enabled as these objects will appear across any template configured with an associated attribute. For existing customers, any custom values for these attributes will now be available as options for the given core construct.

Google BigQuery

 |Available with Solution Packaging Only

Connect to Google BigQuery to automatically discover, classify, and map data, enabling effortless population of data maps and processing records for improved governance and regulatory readiness. Users simply connect their BigQuery system and the feature automatically identifies and classifies column and field names and provides data element and data categories.

For more information, see Automated Data Element Detection Feature Guide.

Fixed

• Resolved an issue that prevented the Inherit from Master column from displaying correctly in column reports.

• Resolved an issue that prevented column reports with personal data attributes from loading successfully.

• Resolved an issue that prevented some custom role users from viewing the correct number of licenses associated with that role.

New Public Preview Features

Table Enhancements for Data Mapping Automation

Tables and table functionalities within Data Mapping Automation have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

• Assessments tab of the Inventory details screen

• Contracts tab of the Inventory details screen

• Personal data tab of the Inventory details screen

• Related tab of the Inventory details screen

• Data lineage screen

Note:

Select tables across Data Mapping Automation may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Existing Public Preview Features

Enhanced Data Graph Visualizations

View relationships between projects, data sets, and models in the data graph in addition to inventory records. This enhancement provides a clear visualization of how objects relate to each other and to inventory records throughout your data map.

For more information, see Creating and Managing Contextual Relationships.

Inventory Review

|Available with Solution Packaging Only

Gain essential visibility into the flow of newly added and updated inventory records so you can better investigate risks, promote compliance, and enhance efficiency concerning your data map. This review experience allows you to manage pending inventory records that are created by several methods and review inventory records with new or updated data elements.

For more information, see Inventory Review & Automation Feature Guide.

Inventory Similarity Scan

|Available with Solution Packaging Only

Detect similar records in your data map for new records that have been added through various sources. Different than our duplicate asset functionality, the scan displays information about similar records within the new records to ensure users can easily find a record that is similar to the new entry.

For more information, see Inventory Similarity Scan.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Data Mapping Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

TheContractstab is now available on theInventorydetails screen for all inventory types and displays all contracts associated with the corresponding record. Contracts can only be added or removed from theContractstab in theVendorinventory.

AI Auto-Responses for Assessments

Automatically fill out assessments based on past assessments or scanned documents with the AI auto-responses for assessments feature set, which includes AI Doc Scanner and AI Inventory Analysis.

This change was introduced in the Winter release and communicated for Assessment Automation in the release notes, but it also applies to Data Mapping Automation and has been retroactively added to the release notes.

For more information, see Leveraging AI Auto-Responses for Assessments.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Dynamic Incident Notification Assessment (DINA) Updates

• Breach notification logic has been updated to align with the USA SEC’s Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Personal Information rule.

• DINA content has been updated to reflect recent legislative amendments, including California Senate Bill 446, which amended §1798.82 of Title 1.81. of Part 4 of Division 3 of the California Civil Code to introduce breach notification timelines for consumers and the Attorney General.

Things to Know

Use of the same attribute in multiple actions is now supported in Incident workflow stage rules. Previously once an attribute was used in an action within a stage rule, it was no longer available for other stage rules.

TheAllow Otheroption is now visible on the attribute details page so users have clear visibility if the given attribute was configured to allow other options besides the supplied list.

AI Auto-Responses for Assessments

Automatically fill out assessments based on past assessments or scanned documents with the AI auto-responses for assessments feature set, which includes AI Doc Scanner and AI Inventory Analysis.

This change was introduced in the Winter release and communicated for Assessment Automation in the release notes, but it also applies to Incident Management and has been retroactively added to the release notes.

For more information, see Leveraging AI Auto-Responses for Assessments.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

AI Inventory Analysis

|Available with Solution Packaging Only

Pre-populate questions on newly created assessments with AI-generated responses using the new AI Inventory Analysis feature. These responses are based on data from previous, directly related assessments and inventories. This feature streamlines DPIA completion by reducing the time respondents spend on completing assessments and transferring previously entered information from PIAs.

Note:

AI Inventory Analysis is part of the AI Auto-Responses Feature Set. This feature set includes two different features that help fill out assessments faster: AI Doc Scanner and AI Inventory Analysis.

This feature is related to the following idea: AA-I-210 .

For more information, see Leveraging AI Auto-Responses for Assessments.

Fixed

• Resolved an issue that prevented some users from viewing the Select control implementations to assess screen when assessing a risk.

• Resolved an issue that caused a discrepancy between the number of assessments shown on the Assessments screen and the number shown in Assessments list exports.

• Resolved an issue that prevented some users with the Assessment Manager role from accessing assessments.

• Resolved an issue that caused links to break when adding a URL containing encoded characters to questions in templates.

Existing Public Preview Features

Launch Reassessments as Not Started

Configure reassessments to default to the Not Started stage upon launching. This enhancement applies to copied assessments, reassessments launched via automation rules, and reassessments launched via API.

Company Names in Email Notifications

Display your company name in assessment email notification templates using the __TenantName__ email variable when notifying users. This enhancement enables you to provide assessment notifications on behalf of your organization that reflect your tenant's name.

For more information, see Customizing Assessment Email Templates Using Dynamic Variables.

Accessibility Conformance

• Screen readers now correctly read out buttons on template cards on the Assessments screen (WCAG-A 2.1.1 Keyboard).

• Screen readers now correctly announce when an attachment has been deleted from an Assessment (WCAG-AA 4.1.3 Status Messages).

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Assessment Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

General Availability

Import and Export Web Form Translations

Export web form translations as Excel files to manually update translations. Once complete, you can upload the file to add the updated translations to your web form. This enhancement includes support for AI translations, which allows you to enable AI translation on fields without values when configuring your export.

For more information, see Managing Language Options for Privacy Rights.

Table Enhancements for Privacy Rights Automation

Tables and table functionalities within Privacy Rights Automation have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

• Workflows screen

• Response templates screen

• Portal language under Privacy Rights Automations in Global Settings

Note:

Select tables across Privacy Rights Automation may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

• Resolved an issue that prevented some users from deleting fields in web forms that previously had a visibility rule.

• Resolved an issue that caused some documents with deleted pages to get stuck in the Review in progress stage.

Existing Public Preview Features

Stage Rules for Workflows

Configure rules on workflows to conditionally change workflows or their stages. This feature streamlines your workflows by automating changes based on your specific criteria. 

This feature is related to the following idea: OT-I-3727.

For more information, see Adding Rules to Workflow Stages.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Data Subject Request (DSR) Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Things to Know

Use of the same attribute in multiple actions is now supported in Audit, Finding, and Workpaper workflow stage rules. Previously once an attribute was used in an action within a stage rule, it was no longer available for other stage rules.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

AI Evidence Analysis

|Available with Solution Packaging Only

Run AI-powered analysis for files uploaded on the evidence collection pane of the Evidence tasks screen when the Record recommendations setting is enabled in Global Settings. This feature allows you to evaluate how well files submitted during evidence collection align with defined controls and evidence requirements. The analysis will provide guidance that highlights validated content and flag gaps or incomplete information.

Important:

This feature is currently available for customers in the following environments: APP, APP-FR, APP-EU, APP-DE. AI Evidence Analysis will be available for all environments in a future release.

For more information, see Using AI for Evidence Analysis.

Databricks AI Governance and Security Framework

Embed governance directly into AI development workflows to automatically align controls across related frameworks, track compliance continuously, and apply consistent, measurable guardrails across assets built in Databricks and beyond. Seeding Databricks AI Governance and Security Framework in OneTrust delivers:

• Out-of-the-box alignment with Databricks AI Security practices

• Standardized mappings to global frameworks (ISO, NIST, EU AI Act)

• Future extensibility for Databricks policy enforcement and evidence automation

For more information, see Creating and Managing Compliance Initiatives and Supported Control Frameworks.

Fixed

• Resolved an issue that prevented users from deleting an initiative that contained more than 2,000 evidence tasks.

• Resolved an issue that prevented users from navigating between pages on the Issues tab of the Initiative details screen.

• Resolved an issue that prevented the Initiative owner field from displaying users from the selected initiative organization.

• Resolved an issue that prevented control GUIDs from appearing when exporting the controls library.

• Resolved an issue that prevented users from accessing the evidence tasks and intervals they were assigned.

• Resolved an issue that prevented custom attributes from displaying on the Controls tab of the Initiative details screen.

Existing Public Preview Features

Evidence Task Review Workflow

Enable a default workflow for evidence task intervals when a reviewer is assigned. This enhancement introduces a structured set of stages to track the lifecycle of evidence, while also supporting notifications and task creation to keep teams informed and on track.

Note:

The Evidence Task Approval Bypass permission is required to allow evidence task assignees to bypass approval stages and send an evidence task interval to be collected.

Things to Know

Permission changes have been retroactively included inCompliance Automation202512.1.0 release notes. For more information, seePermissions Release Notes: Compliance Automation. For a complete list of products with permission updates in this release, seePermissions Release Notes Catalog.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that caused e-signatures to disappear when uploading PDF attachments in the OneTrust Builder.

• Resolved an issue that prevented published standards from exporting correctly when it included images larger than 16MB.

• Resolved an issue that prevented users from generating PDF exports of policies, standards, or procedures.

New Public Preview Features

AI-Powered Document Analysis

|Available with Solution Packaging Only

Analyze documents against a standard or framework using the new Analyze document button on the Document details screen. This AI-powered feature identifies gaps and provides recommendations to help remediate issues related to the following objects:

• Controls

• Risks

• Issues

AI-generated recommendations will appear in the Recommended section of the Related, Controls, Risks, and Issues tabs of the Document details screen. These recommendations may include relating controls, creating relationships, or linking risks and issues.

For more information, see Using AI-Powered Document Analysis. This feature is related to the following idea: OT-I-14780.

Things to Know

Use of the same attribute in multiple actions is now supported in Policy, Standard, Exception, and Procedure workflow stage rules. Previously once an attribute was used in an action within a stage rule, it was no longer available for other stage rules.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Issues Formula Attributes

Configure formula-type attributes for issues in the Attribute Manager. This enhancement allows you to define conditional formulas that calculate values based on specified criteria to support more advanced issue impact analysis.

For more information, see Managing Issue Attributes. This feature is related to the following idea: XI-I-36.

Risk to Issues Conversion

Convert risks to issues on the Risk Register by assigning the risk to an issues workflow and mapping existing risk attributes to the new record. This feature allows you to easily convert risks to issues when they fall outside your organization’s risk criteria to help declutter your Risk Register and manage risks more effectively. You can revert conversions by restoring issues to risks on the new Converted risks screen.

For more information, see Converting Risks to Issues. This feature is related to the following idea: GCIA-I-1166.

Existing Public Preview Features

Disable Editing of Details

Disable users from editing details on closed issues and preserve the record once the workflow is completed. This workflow configuration setting is optional during activation and is only available if the Close record setting is enabled. Users must reopen the issue record in order to edit a field.

For more information, see Managing Issue Workflows.

Things to Know

Use of the same attribute in multiple actions is now supported in Issue workflow stage rules. Previously once an attribute was used in an action within a stage rule, it was no longer available for other stage rules.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Shared Control Implementations on Risks

Create shared control implementations with multiple risks or a single control implementation for each risk from the Control Library and Inventory Details screens. You can also merge multiple implementations of the same library control into a single control or split a single implementation into several controls. This feature allows you to reduce the sprawl of control implementations created within your organization by removing redundant controls.

Key capabilities include:

Inventory Flexibility

Choose which inventories align to risk controls to provide greater flexibility when creating and updating risks.

Relationship Management

Add risks to existing control implementations or associate additional controls directly to risks.

Merge & Split Controls

Merge multiple implementations of the same library control sourced from a risk or split a shared control into single implementations for each risk.

For more information, see Managing Control Implementations and Managing Risks in the Risk Register. This feature is related to the following idea: CNTRL-I-46.

Risk to Issues Conversion

Convert risks to issues on the Risk Register by assigning the risk to an issues workflow and mapping existing risk attributes to the new record. This feature allows you to easily convert risks to issues when they fall outside your organization’s risk criteria to help declutter your Risk Register and manage risks more effectively. You can revert conversions by restoring issues to risks on the new Converted risks screen.

For more information, see Converting Risks to Issues. This feature is related to the following idea: GCIA-I-1166.

AI Evidence Analysis

|Available with Solution Packaging Only

Run AI-powered analysis for files uploaded on the evidence collection pane of the Evidence tasks screen when the Record recommendations setting is enabled in Global Settings. This feature allows you to evaluate how well files submitted during evidence collection align with defined controls and evidence requirements. The analysis will provide guidance that highlights validated content and flag gaps or incomplete information.

Important:

This feature is currently available for customers in the following environments: APP, APP-FR, APP-EU, APP-DE. AI Evidence Analysis will be available for all environments in a future release.

For more information, see Using AI for Evidence Analysis.

Fixed

• Resolved an issue that caused users to be incorrectly routed to the Assessment list screen when opening a linked assessment.

• Resolved an issue that caused assessment rules to create duplicate risks.

• Resolved an issue that prevented users from advancing the risk workflow when the stage contained required attributes.

• Resolved an issue that caused the number of related controls displayed on the Risks tab of the Inventory details screen to be incorrect.

• Resolved an issue that caused the child risks to display on the old parent risk instead of appearing on the newly assigned parent risk.

• Resolved an issue that prevented risk details from updating with the correct parent risk hierarchy level.

• Resolved an issue that caused an invalid risk message to display after the associated risk was deleted.

• The Control implementations change status permission now correctly controls access to the Change status button, and the Control change workflow permission correctly controls visibility of the Change workflow button, both available on the Control details screen.

• Resolved an issue that caused deleted controls to appear on the reassessment PDF report.

• Resolved an issue that caused evidence collection notifications to incorrectly send both before and after the collection due date.

• Resolved an issue that prevented custom attributes from appearing on the Controls tab of the Initiative details screen.

• Enhancements have been made to improve performance when processing complex workflow and routing rule configurations for issues, objectives, controls, and risks. Validation to flag archived or deleted workflows and data, such as attributes, response options, organizations, etc., is now only applied ahead of time when a configuration contains 20 rules or fewer. When more than 20 rules are present, validation will be completed only when the rule details are expanded.

Existing Public Preview Features

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: IT Risk Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

TheRisk Domaincolumn has been added to theAttributesfolder for theInventory Risk Domain Aggregate Risk LevelsandRisk datatables. These attributes enable domain-based risk aggregation to support more accurate cross-domain risk analysis and governance insights.

Use of the same attribute in multiple actions is now supported in Objective workflow stage rules. Previously once an attribute was used in an action within a stage rule, it was no longer available for other stage rules.

AI Auto-Responses for Assessments

Automatically fill out assessments based on past assessments or scanned documents with the AI auto-responses for assessments feature set, which includes AI Doc Scanner and AI Inventory Analysis.

This change was introduced in the Winter release and communicated for Assessment Automation in the release notes, but it also applies to IT & Security Risk Management and has been retroactively added to the release notes.

For more information, see Leveraging AI Auto-Responses for Assessments.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented users from adding linked entities to existing third parties.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

New Delete Contract & Delete Engagement APIs

Added the Delete Contract and Delete Engagement APIs to enable external systems and integrations to remove contracts and engagements programmatically. This enhancement allows you to manage the lifecycle of these entities through external integrations while maintaining proper authorization and data integrity.

Enhanced Contracts & Engagements Data Models

Data models for various Contracts and Engagements APIs have been enhanced to add the following new objects and parameters:

• Updated the Create Engagement API to include the vendorType object containing the id, value, and valueKey parameters within the vendor object of the request.

• Updated the Get Engagement, Create Engagement, Update Engagement, Modify Engagement, and Search Engagements APIs to include the vendorType object containing the id, value, and valueKey parameters within the vendor object of the response.

• Updated the Search Contracts and Search Engagements APIs to include the redacted parameter within the response.

• Updated the Get Contract Schema and Get Engagement Schema APIs to include the optionsByDomain and formulaByDomain parameters within the response.

• Updated the Get Contract Schema and Get Engagement Schema APIs to include the optionListUrl, optionType, permissions, and applicationUrl parameters within the optionMetadata object of the response.

These updates enhance Contracts and Engagements APIs with improved vendor type visibility, redaction awareness, and schema metadata that enable more accurate data handling and simplify downstream reporting.

Fixed

• Resolved an issue that prevented users from saving changes to contract details when the Contract cost field was set to 0.

• Resolved an issue that caused some vendor records to be stuck between workflow stages which blocked further stage progression and workflow rule execution.

• Enhancements have been made to improve performance when processing complex workflow and routing rule configurations for vendors and engagements. Validation to flag archived or deleted workflows and data, such as attributes, response options, organizations, etc., is now only applied ahead of time when a configuration contains 20 rules or fewer. When more than 20 rules are present, validation will be completed only when the rule details are expanded.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Third-Party Risk Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

The following enhancements have been made to the DORA export report's template tabs:

• The Total annual expense or estimated cost of the ICT third-party service provider (Vendor) field in Template 05.01 now dynamically calculates based on the details supplied for the Legal Entity performing the extraction. This allows organizations to report on the costs associated with ICT service providers in the value chain as an indicator of the material dependency on a service provider or value chain.

• All relevant External Legal Entities linked to an engagement are now captured in Template 01.02. This provides complete cross-entity engagement visibility and supports accurate multi-entity reporting under DORA.

• Reporting of Parent Undertaking of each vendor is now supported in Template 05.01. This improves transparency of corporate ownership structures and supports regulatory reporting requirements for DORA by allowing users to identify and report on the parent organization of any ICT third-party service provider.

• Tag and trace overarching contractual relationships in Template 02.01 for improved reporting on hierarchical contract structures. This captures the overarching contract's arrangement reference number on the attribute Overarching Contractual Arrangement Reference Number on the child or subsequent contract.

For more information, see Step 2: Define Relationships.

AI Auto-Responses for Assessments

Automatically fill out assessments based on past assessments or scanned documents with the AI auto-responses for assessments feature set, which includes AI Doc Scanner and AI Inventory Analysis.

This change was introduced in the Winter release and communicated for Assessment Automation in the release notes, but it also applies to Third-Party Risk Management and has been retroactively added to the release notes.

For more information, see Leveraging AI Auto-Responses for Assessments.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.