All Solutions Release Notes

Existing Public Preview Features

Automated AI Discovery

Continuously scan, detect, and catalog AI models and agents across your AWS-native ecosystem. This seamless integration experience enables real-time visibility into your organization's AI landscape, mapping relationships between models, training data, and business processes to strengthen risk management and compliance. By eliminating manual tracking, teams can focus on innovation while maintaining comprehensive oversight of their AI systems through automated discovery and continuous monitoring.

For more information, see Automated AI Discovery: Amazon SageMaker Integration for AI Governance Models

Automated AI Discovery

Discover and catalog AI models, notebooks, and experiments across Google Cloud while maintaining centralized governance controls. This seamless integration experience enables real-time visibility into your organization's AI landscape, mapping relationships between models, training data, and business processes to strengthen risk management and compliance. By eliminating manual tracking, teams can focus on innovation while maintaining comprehensive oversight of their AI systems through automated discovery and continuous monitoring.

For more information, see Automated AI Discovery: Google Vertex Integration for AI Governance Models.

Metadata for Datasets

|Available with Solution Packaging Only

Improve data use governance functions by automating dataset evaluation and surfacing metadata that clarifies data quality, sensitivity, and readiness. This accelerates access request reviews, ensures responsible data usage, and helps teams build AI models on compliant, trustworthy datasets, which enhances both accuracy and oversight.

Risk Aggregation for Related Records

Enable systemic risk visibility across linked inventory objects in AI Governance. When enabled, parent objects (such as AI Systems or Projects) inherit risks from related child entities (such as Models or Datasets), allowing organizations to automate comprehensive risk views.

For more information, see Risk Aggregation for Related AI Records.

Export Inventory Records to Column Report

Create a report of all records of a specific inventory and the columns eligible for bulk import, or the current saved view of an inventory screen including applied filters. This provides you with two flexible reporting methods to gather comprehensive insights into inventory records.

For more information, see Exporting AI Inventory Records.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Subdomain Management for the Web CMP

Enable the Manage consent separately from root domain setting on the Add website screen when configuring a scan, or on the Publish pane when publishing scripts. This setting allows you to manage consent separately from the root domain, which enables you to record users’ preferences at the subdomain level instead of the root domain level for improved accuracy.

For more information, see Scanning a Website and Publishing and Implementing Cookie Consent Scripts.

This feature is related to the following ideas:

• OT-I-10670

• OT-I-4731

• PDGI-I-1720

• OT-I-9573

Fixed

• Resolved an issue that prevented the two-step opt-in confirmation modal from displaying when the consent model was configured as Opt-In.

• Resolved an issue that prevented the CMP from falling back to the correct base language when leveraging regional translation variants.

• Resolved an issue that prevented users from scrolling through the preference center after accessing the vendor list more than once.

• Resolved an issue that caused the OptanonAlertBoxClosed date to reset upon page reload when the consent model was configured as Implied Consent.

• Resolved an issue that caused the IAB 2.2 template to display some text in Serbian with Serbian Cyrillic lettering when configured in Bosnian.

• Resolved an issue that caused the IAB 2.2 template to display some text in English when configured in Icelandic.

• Resolved an issue that caused the Date published column on the Scripts screen to intermittently display in languages other than English.

Existing Public Preview Features

Enhanced Auto-Blocking Interface

Leverage an improved Auto-Blocking experience, featuring a redesigned safe list, block list, and match list. The enhanced Auto-Block tab is designed for a quicker and easier user experience when reviewing and blocking URLs.

For more information, see OneTrust Cookie Auto-Blocking (Enhanced Interface).

Banner SEO Configuration

Deploy your banner script with header (<h>) tags replaced as paragraph (<p>) tags for improved search engine optimization.

For more information, see Publishing and Implementing Cookie Consent Scripts, or contact OneTrust Support or your account representative.

Support for Multi-Language Privacy Policy Links

Configure privacy policy links in multiple languages on the Dynamic Links section of the Website Details screen. This feature enables you to offer privacy policy links and information in each language relevant to your business needs.

For more information, see Configuring Domain Branding.

Enhanced State Support for the Global Privacy Platform

The Global Privacy Platform (GPP) settings now support consent strings for the following US states:

• Delaware

• Iowa

• Nebraska

• New Hampshire

• New Jersey

• Tennessee

For more information, see Configuring Global Privacy Platform Settings.

Bulk Export APIs

The following APIs are now available for use to create and cancel bulk exports and retrieve their status, progress, download details, and credit details. These APIs enable users to extract large volumes of cookie receipts at once with a limit of six bulk exports per month.

• Create Bulk Export API

• Get List of Bulk Exports API

• Get Bulk Export Status API

• Cancel Bulk Export API

• Get Bulk Export Download Details API

• Get Bulk Export Credit Details API

• Get List of Bulk Export Download Details API

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

Always Inactive Consent State

Leverage the new Always Inactive consent state to allow users to display tracking technologies that are present but not enabled on their websites. This consent state enables you to notify your end users that a tracking technology is deployed but not active.

For more information, see Cookie Consent Models and Configuring Geolocation Rules.

Enable Global Privacy Platform on TCF 2.2 Templates

Enable the Global Privacy Platform setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Platform (GPP) and populate the IAB TCF EU section of the GPP string.

For more information, see Configuring the Global Privacy Platform Settings.

Vendor Identification, Categorization, and Consent

Vendor Identification, Categorization, and Consent enables you to categorize any vendor services on your website and provide detailed consent options to your visitors. This feature streamlines vendor disclosure and consent by detecting known services and linking them to tracking technologies. Leverage Vendor Service Identification, Categorization, and Consent to perform the following actions:

• Identify known vendor services when scanning your websites.

• Categorize the vendor services active on your websites.

• Link tracking technologies to identified vendor services.

• Allow end users to configure consent for vendor services on the Preference Center.

• Capture records of consent at the vendor service level.

• Configure IAB templates to capture and disclose vendor service information.

• View source URLs for tag initiators on the Initiators tab of the Scan Results screen.

For more information, see Vendor Identification, Categorization, and Consent Feature Guide.

Legitimate Interest Configuration for Reject All on IAB Templates

Implement a Reject All button on your Preference Center and Cookie Banner that prevents objection to legitimate interest. This enhancement improves compatibility with Google Limited Ads.

For more information, see Customizing the Preference Center Template.

Server-Side Rendering

Server-side rendering is now available for Cookie Banner HTML and CSS.

For more information, see Server-Side Rendering: Performance and Availability.

Things to Know

TheOverviewtab for each domain in theJob Queuesection ofCompliance Assistantnow displaysPages successfully monitoredto indicate the number of pages on the site that have been reviewed.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Enhanced Mobile App Scanning for iOS

Analyze SDKs using Info.plist files for more comprehensive scans. This enhancement improves the accuracy of SDK detection.

Fixed Admin

• Resolved an issue that displayed a field for the Vendor list title in the template preview on the Template details screen for mobile preference centers that did not require the field.

Fixed iOS

• Resolved an issue that prevented some translated descriptions added to SDKs from remaining intact when the Enable SDKpedia Translations setting was disabled.

Fixed Android

• Resolved an issue that cleared the TC string value in sharedPreferences after users saved their consent until the application was relaunched.

• Resolved an issue that prevented some translated descriptions added to SDKs from remaining intact when the Enable SDKpedia Translations setting was disabled.

Existing Public Preview Features

Consent Management Platform APIs

The following APIs are now available for use with retrieving interface attributes needed to display the Banner and Preference Center, retrieving a list of active IAB and Google Vendors to display on the Preference Center, and logging consent when an end user interacts with a Banner or Preference Center. These APIs enable you to easily access data for Banner and Preference Center implementations, disclose vendor information to end users, and capture end user consent.

• Get Banner Data API

• Get Preference Center Data API

• Get IAB and Google Vendors API

• Log Consent API

• Get Universal Consent Purposes API

Roku Support for Unified Consent Profile for Known Users

Leverage the new Unified Consent Profile for Known Users functionality to connect data subjects' CMP preferences with Universal Consent & Preference Management profiles by enabling the Create data subject profiles for known users setting on the Geolocation Rules tab. You can also easily trigger integration workflows to send CMP preferences to downstream systems, and efficiently manage your preferences in a unique Preference Center, centralizing all of them in one single profile.

This enhancement provides a comprehensive view of data subjects empowering you with more control over the data captured across both modules, resulting in a more streamlined and tailored user experience.

For more information, see Connecting CMP preferences with Universal Consent & Preference Management Profiles.

Configure Button Layout for the Banner

Configure the positioning of buttons on your mobile and CTV banners within the Button Sets section of the Template Details screen. This enhancement allows you to specify the positioning of buttons on your banners for a more customized experience.

• iOS

• Android

For more information, see Customizing the Mobile App Consent Banner Template and Customizing the Mobile App Consent Preference Center Template.

Enhanced Branding Settings for Mobile and CTV SDKs

Configure detailed branding settings for your mobile SDKs on the Branding tab of the Mobile App Details and CTV App Details screen, respectively. This enhancement enables you to configure more specific branding settings for each of your mobile and CTV applications.

For more information, see Configuring Mobile and CTV App Branding.

Validation for Cross-Device Consent Receipts

Enable the Require Authentication for known users setting when leveraging Cross-Device Consent to require validation on your consent receipts. This enhancement allows you to more reliably collect consent from known users.

For more information, see Configuring Geolocation Rules.

Note:

This enhancement is only available to users with the Consent Rate Optimization (CRO) add-on package. Contact OneTrust Support or your account representative to enable this functionality.

To learn more, see Maximize Opt-Ins with Consent Rate Optimization.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

This feature is available for the following platforms:

• iOS

• Android

• Apple TV

• Android TV

Enable Global Privacy Protocol on TCF 2.2 Templates

Enable the Global Privacy Protocol setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Protocol (GPP) and populate the IAB TCF EU section of the GPP string.

This feature is available for the following platforms:

• Android

• Android TV

• Apple TV

• HTML5

• iOS

• Roku

• Unity

• Xamarin

For more information, see Configuring the Global Privacy Protocol Settings.

New Reject All Button Configuration

Enable the updated Reject All button configuration on the Preference Center template. This new configuration ensures that legitimate interest is not impacted for customers using Google Ads.

For more information, see Customizing the Mobile App Consent Preference Center Template.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Users with the Privacy Notice Author role can no longer bypass approvals or advance a notice to the next workflow stage when an approval stage is set to All Approvers.

Existing Public Preview Features

Privacy Notice Insights Dashboard

Utilize highly customizable reporting and analytic capabilities using the new Privacy Notice Insights Dashboard to analyze data captured across Privacy Notice Management. This dashboard can be used to view key metrics related to privacy notices, workflows, and notice expiration details.

For more information, see Insights Privacy Notice Management Dashboard.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Table Enhancements for Standard Purposes, Cookie Purposes, and Purpose Preferences

Various tables and table functionalities within Universal Consent & Preference Management have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, and clearer row actions. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

Tables have been updated on the following tabs within the Purposes screen:

• Standard purposes

• Cookie purposes

• Purposes preferences

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Enable Captcha for Trust Center Authentication

Enable the Verify users with Captcha setting on the Authentication tab in the Trust Center builder to require end users to complete a Captcha security test when logging in. This enhancement provides an extra layer of authentication for improved security.

For more information, see Configuring Authentication for Trust Center.

Trust Center Support for Implicit Consent and Hard Opt-Out

The Trust Center has been improved to support implicit consent and hard opt-out when users configure their consent preferences. Users can now configure hard opt-out on individual purposes. This enhancement is designed to support feature parity between UCPM and the Trust Center.

For more information, see About Implicit Consent and Overriding Data Subject Consent Using Hard Opt-Out.

Fixed

• Resolved an issue that caused some data subject merges to lose records of notices.

• Resolved an issue that prevented the Get List of Data Subject Tokens V4 API from returning the token of parent data subjects created simultaneously with child data subjects.

• Resolved an issue that prevented users from configuring filters on the Retention Policy screen with the filter criteria defined as Retention status.

Existing Public Preview Features

CMP Consent Context

Added support to our existing data hierarchy to allow CMP consent users to provide consent for a purpose multiple times when using consent groups. When using consent groups with the unified profile feature, the CMP will use the same data subject for different consent groups, eliminating the need to create additional profiles.

Things to Know

TheEnable data subject deletionsetting is now enabled by default to prevent misconfigurations when setting up retention policies.

The retention ruleData subject profile retentionhas been renamed toData subject purpose retentionfor improved accuracy.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Existing Public Preview Features

Data Governance Insights Dashboard

Utilize highly customizable reporting and analytic capabilities using the Data Governance Insights Dashboard to analyze data captured across Data Catalog. This dashboard can be used to view essential information about your data assets, manage your data and associated metadata in response, and enact policies and procedures necessary for proper data governance.

For more information, see Insights Data Governance Dashboard.

Access Intelligence Insights Dashboard

Now enabled for every Data Catalog customer, data governance managers can now utilize highly customizable reporting and analytic capabilities using the Access Intelligence Insights Dashboard that collects data captured by Data Catalog and Data Discovery. This dashboard can be used to understand what sensitive data you have and how it is shared across the company so admins can quickly identify data-related risks present in your data ecosystem.

For more information, see Insights Access Intelligence Dashboard.

Note:

This dashboard is available by default only for Data Catalog customers.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Existing Public Preview Features

Script Management

Run common maintenance and troubleshooting scripts directly from the platform in the new Administration tab. This reduces the need for command line interface (CLI) access or coordination with support by providing an effective and easy way to execute critical scripts.

For more information, see Script Management for Worker Nodes.

Note:

Originally introduced under General Availability in OneTrust 202504.1.0. This has been changed to Public Preview in OneTrust 202505.1.0.

Duplicate File Detection

Identify duplicate and redundant files with AI-driven analysis based on key risk attributes (classification, shared access) and make decisions on whether to retain or remove duplicates. This enhancement helps you reduce redundant data, decrease attack surface, and improve security posture with savings on cloud storage costs.

For more information, see Reviewing Scanned Files.

Data Discovery Insights Dashboard

Utilize highly customizable reporting and analytic capabilities using the Data Discovery Insights Dashboard to analyze data captured across the module. This dashboard can be used to view information about job insights, scan metrics, worker node progress, and more related to your discovery business outcomes.

For more information, see Insights Data Discovery Dashboard.

Things to Know

The description for theCanada Driver’s License Numberclassifier has been updated to clarify that it detects driver's license numbers issued by any Canadian province or territory. The description previously stated that the identifier is assigned to just British Columbia (B.C.) residents.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented previously entered values for disabled custom inventory attribute options from appearing on dashboards.

Existing Public Preview Features

Insights Dashboards

Utilize highly customizable reporting and analytic capabilities using Insights Dashboards that are built through Power BI by Microsoft and embedded in the OneTrust Platform to analyze data captured across various products throughout the platform. The following seeded dashboards are available under Public Preview:

• Data Governance Dashboard

• Data Discovery Dashboard

• Access Intelligence Dashboard

• Privacy Notice Management Dashboard

Expanded Custom Attributes for Privacy & GRC Insights Dashboards

Track additional metrics by adding up to 10 custom attributes to each tab on custom Insights Dashboards created using the Privacy and Governance, Risk, Compliance data sources. This enhancement provides more flexibility in customizing your Insights Dashboards, allowing you to visualize unique data points relevant to your organization’s business context.

For more information, see Using Object-Based Attribute Tables for Custom Insights Dashboards.

Insights Dashboard Updates

• Create dashboards using numerical single-select attributes to enable reporting on corresponding options and values separately. These attributes can be added to Insights Dashboards created using the AI Governance, Enterprise Policy Management, GRC, and Privacy data sources.

Things to Know

Insights as Default for Net New Customer Accounts

Starting in the OneTrust 202410.1.0 release, Insights Dashboards will be the default dashboard experience for all new OneTrust accounts. Users within new OneTrust accounts created after the respective environment is upgraded to 202410.1.0 will now see Insights Seeded Dashboards when available for a given module. Legacy dashboards will only appear for modules that do not currently have an Insights Seeded Dashboard. Existing accounts that already have access to Legacy Dashboards will not be affected by this change.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue where integration emails with right-to-left languages were appearing left-aligned.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Existing Public Preview Features

SCIM Users and Groups Integrations

Utilize the Integrations module to configure triggers and actions for SCIM Users and Groups. This feature allows users to automate their organization's processes when managing user and group information using SCIM APIs.

For complete details on these workflow options, see Managing Custom Integration Workflows.

New Root Organization

Create a new root organization at the top of an existing organizational hierarchy using the new Set as the Root Organization check box on the Add Organization modal. This feature allows you to move an existing organizational structure, along with certain previously configured settings, under a new root organization.

For more information, see Managing Organizations.

Integrate Tasks with External Systems

Manage tasks created within the application across external systems by creating integration workflows using the following new integration events:

• Task Add Attachment

• Task Add Comment

• Task Created

• Task Deleted

• Task Remove Attachment

• Task Updated

This enhancement allows you to manage tasks across external systems, which may be helpful when addressing tasks that require a large volume of actions.

For more information, see Integrating Tasks with External Systems.

Things to Know

Empty State Tables

Certain actions are now disabled for tables without records to provide a consistent and intuitive experience. The following actions are disabled in an empty state:

• Filter

• Sort

• Search

• Saved views

• Export options

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Data Mapping Automation reports have been enhanced to provide faster load times and more accurate results when accessing reports.

• Documents now download consistently and in sequential order when users click the Download all button on the Documents tab of an inventory.

Existing Public Preview Features

Enhanced Data Graph Visualizations

View relationships between projects, data sets, and models in the data graph in addition to inventory records. This enhancement provides a clear visualization of how objects relate to each other and to inventory records throughout your data map.

For more information, see Creating and Managing Contextual Relationships.

Inventory Review

|Available with Solution Packaging Only

Gain essential visibility into the flow of newly added and updated inventory records so you can better investigate risks, promote compliance, and enhance efficiency concerning your data map. This review experience allows you to manage pending inventory records that are created by several methods and review inventory records with new or updated data elements.

For more information, see Inventory Review & Automation Feature Guide.

Important:

This feature was originally reported under General Availability for 202510.2.0. It has been rescheduled for General Availability in 202602.1.0 and will remain in Public Preview until that release.

Inventory Similarity Scan

|Available with Solution Packaging Only

Detect similar records in your data map for new records that have been added through various sources. Different than our duplicate asset functionality, the scan displays information about similar records within the new records to ensure users can easily find a record that is similar to the new entry.

For more information, see Inventory Similarity Scan.

Important:

This feature was originally reported under General Availability for 202510.2.0. It has been rescheduled for General Availability in 202602.1.0 and will remain in Public Preview until that release.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Data Mapping Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented users from saving changes to Incident web form settings.

• Resolved an issue that prevented users from saving attribute workflow rule conditions.

• Resolved an issue that prevented users from adding more than one workflow routing rule action.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Support for Advanced Attributes in Get Assessment API

Updated the Get Assessment API to enable users to retrieve advanced attribute questions and their responses. This enhancement allows user to obtain additional details when retrieving assessments.

Fixed

• Resolved an issue that allowed some project respondents to respond via API to questions to which they were not assigned.

• Resolved an issue that prevented some fields in assessment PDF reports from translating correctly.

• Resolved an issue that prevented exports of assessments from rendering with correct default formatting when exported as PDFs.

• Invited User functionality has been enhanced to provide more consistent performance based on user permissions.

• Resolved an issue that allowed users with inadequate permissions to be selected as approvers for approver-only sections when copying or reassessing an assessment.

• Resolved an issue that prevented some PDF assessment reports from displaying risk descriptions correctly.

• Resolved an issue that included comment replies in comment count dashboard metrics.

• Resolved an issue that briefly displayed an error message when users selected Don’t Know when replying to some assessment questions.

• Resolved an issue that prevented some assessments from loading correctly when accessed.

• Resolved an issue that prevented users from adding inventory responses to inventory-type questions when the inventory name contained a pipe character (|).

• Resolved an issue that intermittently prevented users from adding new options to object-type questions.

• Resolved an issue that prevented skip/show logic from populating correctly on questions in assessment Excel exports.

Existing Public Preview Features

AI Inventory Record Analysis

|Available with Solution Packaging Only

Pre-populate questions on newly created assessments with AI-generated responses using the new AI Inventory Record Analysis feature.

These responses are based on data from previous, directly related assessments and inventories. This feature streamlines DPIA completion by reducing the time respondents spend on completing assessments and transferring previously entered information from PIAs.

For more information, see Leveraging AI Inventory Record Analysis and AI Document Scanning to Complete Assessments.

Launch Reassessments as Not Started

Configure reassessments to default to the Not Started stage upon launching. This enhancement applies to copied assessments, reassessments launched via automation rules, and reassessments launched via API.

Company Names in Email Notifications

Display your company name in assessment email notification templates using the __TenantName__ email variable when notifying users. This enhancement enables you to provide assessment notifications on behalf of your organization that reflect your tenant's name.

For more information, see Customizing Assessment Email Templates Using Dynamic Variables.

Accessibility Conformance

• Screen readers now correctly announce hyperlinks in the Assessment Task Reopened email notification (WCAG-A 1.3.1: Info and Relationships).

New Public Preview Features

Import and Export Web Form Translations

|Available with Solution Packaging Only

Export web form translations as Excel files to manually update translations. Once complete, you can upload the file to add the updated translations to your web form. This enhancement includes support for AI translations, which allows you to enable AI translation on fields without values when configuring your export.

For more information, see Managing Language Options for Privacy Rights.

Things to Know

End of Support Notification for Get List of Subtasks API

The Sunset Period for the Get List of Subtasks API has ended. As of January 1, 2026, this API is now deprecated. Any customers leveraging this API are encouraged to use the Get List of Subtasks by Criteria API. For more information, see OneTrust API Sunsetting & Deprecation Guidelines.

Text on theExport resultmodal has been updated to more accurately describe the file formatting of unstructured data.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Things to Know

End of Support Notification for Training APIs

The Sunset Period for the Training APIs has ended. As of December 5, 2025, these APIs are now deprecated. For more information, see OneTrust API Sunsetting & Deprecation Guidelines.

Fixed

• Resolved an issue that caused PDF report attribute values to display in more than one language.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Existing Public Preview Features

AI Evidence Analysis

|Available with Solution Packaging Only

Run AI-powered analysis for files uploaded on the evidence collection pane of the Evidence tasks screen when the Record recommendations setting is enabled in Global Settings. This feature allows you to evaluate how well files submitted during evidence collection align with defined controls and evidence requirements. The analysis will provide guidance that highlights validated content and flag gaps or incomplete information.

Important:

This feature is currently available for customers in the following environments: APP, APP-FR, APP-EU, APP-DE. AI Evidence Analysis will be available for all environments in a future release.

For more information, see Using AI for Evidence Analysis.

Evidence Task Review Workflow

Enable a default workflow for evidence task intervals when a reviewer is assigned. This enhancement introduces a structured set of stages to track the lifecycle of evidence, while also supporting notifications and task creation to keep teams informed and on track.

Note:

The Evidence Task Approval Bypass permission is required to allow evidence task assignees to bypass approval stages and send an evidence task interval to be collected.

Standard / Framework Changes

New Rhode Island Data Transparency and Privacy Protection Act Framework Added

The Rhode Island Data Transparency and Privacy Protection Act (RI-DTPPA), effective January 1, 2026, mandates transparency and customer rights regarding personal data collected by for-profit entities conducting business in Rhode Island.

We’ve made implementing the RI-DTPPA easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring all relevant controls, control implementation guidance and evidence tasks (including guidance) to help you in meeting the requirements of the RI-DTPPA.

For more information, see Supported Control Frameworks.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented users from viewing all document details when assigned as a stage approver for higher-level organizations.

• Resolved an issue that prevented users from relating new and existing risks to an exception.

• Users with the Policy Owner role can no longer bypass approvals or advance a document to the next workflow stage when an approval stage is set to All Approvers.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Issue details now load correctly when accessing an issue from the Issues tab of a control record.

• Resolved an issue that prevented users from deleting issues on the Issues register screen.

Existing Public Preview Features

Disable Editing of Details

Disable users from editing details on closed issues and preserve the record once the workflow is completed. This workflow configuration setting is optional during activation and is only available if the Close record setting is enabled. Users must reopen the issue record in order to edit a field.

For more information, see Managing Issue Workflows.

Risk to Issues Conversion

Convert risks to issues on the Risk Register by assigning the risk to an issues workflow and mapping existing risk attributes to the new record. This feature allows you to easily convert risks to issues when they fall outside your organization's risk criteria to help declutter your Risk Register and manage risks more effectively. You can revert conversions by restoring issues to risks on the new Converted risks screen.

For more information, see Converting Risks to Issues.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented control column reports from aligning with control implementations and related inventory data displayed in the OneTrust Platform.

• Resolved an issue that prevented the Control library attributes tile from appearing on the Attribute manager screen.

• Resolved an issue that prevented the Organization field from updating to the new name when an organization was deleted and all related control implementations with risk as the source were transferred.

• Control owners can no longer add new evidence tasks to control implementations unless the user has the Add evidence tasks permission.

• Resolved an issue that prevented users with the correct permissions from advancing a risk workflow stage as expected.

• The Category system attribute now appears when configuring skip/show logic in the Template builder.

• Resolved an issue that prevented the filter on the Risk register screen from filtering risks based on the criteria defined.

Existing Public Preview Features

AI Evidence Analysis

|Available with Solution Packaging Only

Run AI-powered analysis for files uploaded on the evidence collection pane of the Evidence tasks screen when the Record recommendations setting is enabled in Global Settings. This feature allows you to evaluate how well files submitted during evidence collection align with defined controls and evidence requirements. The analysis will provide guidance that highlights validated content and flag gaps or incomplete information.

Important:

This feature is currently available for customers in the following environments: APP, APP-FR, APP-EU, APP-DE. AI Evidence Analysis will be available for all environments in a future release.

For more information, see Using AI for Evidence Analysis.

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Shared Control Implementations on Risks

Create shared control implementations with multiple risks or a single control implementation for each risk from the Control Library and Inventory Details screens. You can also merge multiple implementations of the same library control into a single control or split a single implementation into several controls. This feature allows you to reduce the sprawl of control implementations created within your organization by removing redundant controls.

Key capabilities include:

Inventory Flexibility

Choose which inventories align to risk controls to provide greater flexibility when creating and updating risks.

Relationship Management

Add risks to existing control implementations or associate additional controls directly to risks.

Merge & Split Controls

Merge multiple implementations of the same library control sourced from a risk or split a shared control into single implementations for each risk.

For more information, see Managing Control Implementations and Managing Risks in the Risk Register.

Risk to Issues Conversion

Convert risks to issues on the Risk Register by assigning the risk to an issues workflow and mapping existing risk attributes to the new record. This feature allows you to easily convert risks to issues when they fall outside your organization’s risk criteria to help declutter your Risk Register and manage risks more effectively. You can revert conversions by restoring issues to risks on the new Converted risks screen.

For more information, see Converting Risks to Issues.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: IT Risk Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Standard / Framework Changes

New Rhode Island Data Transparency and Privacy Protection Act Framework Added

The Rhode Island Data Transparency and Privacy Protection Act (RI-DTPPA), effective January 1, 2026, mandates transparency and customer rights regarding personal data collected by for-profit entities conducting business in Rhode Island.

We’ve made implementing the RI-DTPPA easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring all relevant controls, control implementation guidance and evidence tasks (including guidance) to help you in meeting the requirements of the RI-DTPPA.

For more information, see Supported Control Frameworks.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented the Launch assessment button from working when clicked from within the Risk tab on a third-party record.

• Resolved an issue that prevented users from bulk updating vendor names.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that caused DORA report fields in tabs 01.01, 01.03, 03.02, and 07.01 to populate with incorrect values when generating a report.

• Resolved an issue that permitted users to be assigned as assessment approvers without applying settings for default approval.

Things to Know

• Third-Party Risk Management reports have been enhanced to provide faster load times when accessing reports.

• Documents now download consistently and in sequential order when users click the Download all button on the Documents tab of an inventory.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Third-Party Risk Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.