All Solutions Release Notes

Read the release notes for all solutions in this release.

AI Governance

AI Governance - May 15, 2026 - 202605.1.0 (Spring Release)

General Availability

AI Agents Inventory

Create records to understand, document, and govern agent behavior as it operates in production environments, while keeping clear separation between business intent, operational systems, and technical components. This additional AI Governance inventory object helps organizations standardize intake, reduce approval time, and curb configuration drift.

For more information, see Managing AI Agents in AI Governance. This feature is related to the following ideas: AI-I-58, AI-I-6.

Amazon Bedrock AI Model & Agent Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models and agents in your Amazon Bedrock accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

Databricks Unity Catalog AI Models, Agents, and Datasets Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models, agents, and datasets in your Databricks accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

GCP Vertex AI Model and Agent Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models and agents in your Google Cloud accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

SageMaker AI Model Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models in your SageMaker accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

Azure Foundry Model and Agent Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models and agents in your Azure Foundry accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

Add Org Visibility/Hierarchy Support to Relationship Questions

Leverage inventory records in parent organizations for users in child organization levels in order to conduct assessments with relationship questions. This enhancement streamlines governance by sharing central models or inventories so that business respondents can answer assessments that require relationship questions.

New Public Preview Features

AI Policy Manager & Seeded AI Policies

Automatically detect AI policy violations across platforms to provide AI governance teams with actionable steps to ensure governance and compliance throughout an AI Agent lifecycle. This policy orchestration experience allows users to create custom policies for unique scenarios and support guardrail enforcement and detection.

To compliment AI policy management, seeded AI policies are also available to flag and provide enforceable steps on guardrails. This reduces the time to value for customers getting started with AI Policies and provides a template for them to use when defining their own custom AI Policies in OneTrust.

For more information, see AI Policies Feature Guide.

Guardrail Detection & Enforcement

Automatically enforce responsible AI policies on violating agents and models across AI development platforms. This enhancement to AI policies provides consistent guardrail visibility and enforcement measures in the OneTrust Platform.

For more information, see AI Policy Enforcement Guide.

Custom Notifications for Assessment Templates

Send customized, trigger-based automated email messages from a new global Notifications tab on the Assessment templates screen. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

Configure approver-only sections on assessments automatically using template rules or inventory-based values. These enhancements mean users can launch assessments with approver-only sections directly from the self-service portal.

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

Opt-out of automatically scanning your three most recent assessments, plus add more files, more file types, and bigger files to your uploads. These enhancements improve the performance and accuracy of the AI Doc Scanner.

For more information, see Leveraging AI Auto-responses for Assessments.

Existing Public Preview Features

Automated AI Discovery

Continuously scan, detect, and catalog AI models and agents across your AWS-native ecosystem. This seamless integration experience enables real-time visibility into your organization's AI landscape, mapping relationships between models, training data, and business processes to strengthen risk management and compliance. By eliminating manual tracking, teams can focus on innovation while maintaining comprehensive oversight of their AI systems through automated discovery and continuous monitoring.

For more information, see Automated AI Discovery: Amazon SageMaker Integration for AI Governance Models

Automated AI Discovery

Discover and catalog AI models, notebooks, and experiments across Google Cloud while maintaining centralized governance controls. This seamless integration experience enables real-time visibility into your organization's AI landscape, mapping relationships between models, training data, and business processes to strengthen risk management and compliance. By eliminating manual tracking, teams can focus on innovation while maintaining comprehensive oversight of their AI systems through automated discovery and continuous monitoring.

For more information, see Automated AI Discovery: Google Vertex Integration for AI Governance Models.

Metadata for Datasets

|Available with Solution Packaging Only

Improve data use governance functions by automating dataset evaluation and surfacing metadata that clarifies data quality, sensitivity, and readiness. This accelerates access request reviews, ensures responsible data usage, and helps teams build AI models on compliant, trustworthy datasets, which enhances both accuracy and oversight.

Export Inventory Records to Column Report

Create a report of all records of a specific inventory and the columns eligible for bulk import, or the current saved view of an inventory screen including applied filters. This provides you with two flexible reporting methods to gather comprehensive insights into inventory records.

For more information, see Exporting AI Inventory Records.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: AI Governance. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Standard / Control Framework Changes

South Korea AI Basic Act Framework Added

South Korea’s Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust establishes a national legal framework for AI governance, transparency, safety, and trust. Effective January 22, 2026 as a matter of law, it introduces core obligations relating to AI transparency, safety measures for certain advanced AI systems, responsibilities for providers of high-impact AI, human rights impact assessment, and the appointment of a local representative for certain foreign AI business operators. It also includes separate obligations for synthetic content disclosure and public-sector procurement prioritization in certain cases.

We’ve streamlined South Korea AI Basic Act compliance by offering the framework on our platform—featuring controls, implementation guidance, evidence tasks, policies, and risks aligned to the law’s requirements for AI business operators, including those providing high-impact AI and certain foreign AI business operators. The framework is designed to help organizations operationalize governance, transparency, risk management, and accountability for AI systems in scope under the Act.

Note:

The South Korea AI Basic Act Framework will be available on the OneTrust platform effective May 18, 2026.

For more information, see Supported Control Frameworks.

Things to Know

As of OneTrust 202605.1.0, OneTrust has upgraded all environments to the new AI Governance Services, which provide improved permission granularity, expanded inventory support, foundations for agent governance, and a more unified management experience through the Inventory Manager. For more information, seeAI Governance Services Upgrade Notice.

Note:

Dedicated cloud environments will be upgraded separately. Please contact OneTrust for information.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Consent & Preferences

Cookie Consent - May 15, 2026 - 202605.1.0 (Spring Release)

General Availability

Table Enhancements for Websites

Tables and table functionalities on the Websites screen have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, and clearer row actions. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Tenant-Level Cookie Patterns

Identify and isolate cookies patterns per tenant during cookie categorization. This enhancement enables you to log and detect tenant-level patterns for more accurate cookie categorization.

For more information, see Managing and Categorizing Cookies and SDKs. This feature is related to the following ideas: OT-I-10538, CS-I-19.

Fixed

Resolved an issue that prevented users from navigating backward using keyboards when Age Gate prompts displayed on a website.
Resolved an issue that allowed users to close the banner without interaction when the Require banner interaction setting was enabled within the template.
Resolved an issue that prevented users from successfully downloading previously deployed production scripts from the History tab of the Scripts screen.
Resolved an issue that produced a syntax error in scripts after downloading scripts for local hosting.

New Public Preview Features

Enhanced Tracking Technologies Interface

Leverage the new Tracking technologies interface to log and categorize tracking technologies on your websites or SDKs. This feature improves the existing Tracking technologies interface and enhances insight into your websites' or apps' tracking technologies by linking them to known vendors and hosts.

For more information, see Managing Tracking Technologies. This feature is related to the following ideas: CONTENT-I-81, PDGI-I-1592, CSC-I-9, PDGI-I-1739, OT-I-14035.

Note:

This feature was previously available as Vendor Identification, Categorization, and Consent.

CMP Governance through Ownership

Automatically define default owners for your websites and applications when configuring scans. This enhancement enables you to configure users within OneTrust who are notified of updates to the CMP configuration on specific websites and are responsible for managing these changes.

For more information, see Scanning a Website. This feature is related to the following ideas: CONTENT-I-320, OT-I-6353, PDGI-I-899, PDGI-I-1505, CSC-I-125.

Email Completion Notifications for Compliance Assistant

|Available with Solution Packaging Only

Receive email notifications for completed Compliance Assistant scans. This enhancement notifies compliance assistant scan owners via email that the scan has completed.

For more information, see Leveraging CMP Compliance Assistant.

Website Scan Observability

Access the new scanner Job queue to review scan statuses and start times for each of your scanned domains. This feature provides a higher degree of insight into each of your scans, enabling you to more easily monitor scan progress and diagnose failures.

For more information, see Scanning a Website. This feature is related to the following ideas: OT-I-514, OT-I-4946, OT-I-12712, OT-I-15978, PDGI-I-595.

Existing Public Preview Features

Enhanced Auto-Blocking Interface

Leverage an improved Auto-Blocking experience, featuring a redesigned safe list, block list, and match list. The enhanced Auto-Block tab is designed for a quicker and easier user experience when reviewing and blocking URLs.

For more information, see OneTrust Cookie Auto-Blocking (Enhanced Interface).

Banner SEO Configuration

Deploy your banner script with header (<h>) tags replaced as paragraph (<p>) tags for improved search engine optimization.

For more information, see Publishing and Implementing Cookie Consent Scripts, or contact OneTrust Support or your account representative.

Support for Multi-Language Privacy Policy Links

Configure privacy policy links in multiple languages on the Dynamic Links section of the Website Details screen. This feature enables you to offer privacy policy links and information in each language relevant to your business needs.

For more information, see Configuring Domain Branding.

Enhanced State Support for the Global Privacy Platform

The Global Privacy Platform (GPP) settings now support consent strings for the following US states:

Delaware
Iowa
Nebraska
New Hampshire
New Jersey
Tennessee

For more information, see Configuring Global Privacy Platform Settings.

Bulk Export APIs

The following APIs are now available for use to create and cancel bulk exports and retrieve their status, progress, download details, and credit details. These APIs enable users to extract large volumes of cookie receipts at once with a limit of six bulk exports per month.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

Always Inactive Consent State

Leverage the new Always Inactive consent state to allow users to display tracking technologies that are present but not enabled on their websites. This consent state enables you to notify your end users that a tracking technology is deployed but not active.

For more information, see Cookie Consent Models and Configuring Geolocation Rules.

Enable Global Privacy Platform on TCF 2.2 Templates

Enable the Global Privacy Platform setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Platform (GPP) and populate the IAB TCF EU section of the GPP string.

For more information, see Configuring the Global Privacy Platform Settings.

Legitimate Interest Configuration for Reject All on IAB Templates

Implement a Reject All button on your Preference Center and Cookie Banner that prevents objection to legitimate interest. This enhancement improves compatibility with Google Limited Ads.

For more information, see Customizing the Preference Center Template.

Server-Side Rendering

Server-side rendering is now available for Cookie Banner HTML and CSS.

For more information, see Server-Side Rendering: Performance and Availability.

Accessibility Conformance

Accurate ARIA roles are now applied to consent controls on the preference center that correspond to the control style (e.g., toggle, checkbox) configured for the template.
The Cookie settings button on the preference center now includes the attribute aria-haspopup="dialog" to programmatically indicate that the button opens a dialog (WCAG-A 4.1.2: Name, Role, Value).

Things to Know

TheRegionselection menu on theGeolocation rule group detailsscreen now differentiates countries and states with similar names. This feature is related to the following ideas:CSC-I-144,OT-I-5039.

Audience Logic now supports websites with Content Security Policies (CSPs) enabled.

For more information, see Configuring Audience Logic Using Geolocation Rules.

TheDefine the Order of Buttons on the CMPfeature, previously announced in202508.1.0 (Summer Release), is now available for web CMPs.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Mobile & OTT/CTV App Consent - May 15, 2026 - 202605.1.0 (Spring Release)

General Availability - iOS

Auto-Repair Privacy Manifest

Automatically detect and resolve discrepancies in your iOS privacy manifest after scanning mobile apps. This feature enables you to review mismatches in your privacy manifest and resolve data accuracy issues.

For more information, see Viewing and Categorizing Mobile App Consent Scan Results.

Fixed Admin

Resolved an issue that added new Google vendors automatically even when the Add New Vendors as Inactive setting was enabled for a vendor list.

Fixed Android

Resolved an issue that caused the Global Privacy Protocol (GPP) string to record inconsistent values for some categories for users in Colorado.
Resolved an issue that prevented the SDK from immediately returning the correct consent values when end users leveraged Cross-Device Consent.
Privacy policy link text no longer overlaps with title or description text in the banner, regardless of the banner height or font size.
The banner title no longer displays as truncated, regardless of banner height, font size, or configured alignment.
Resolved an issue that returned inconsistent consent data for vendors after end users configured their preferences on the preference center.

Fixed iOS

Privacy policy link text no longer overlaps with title or description text in the banner, regardless of the banner height or font size.
The banner title no longer displays as truncated, regardless of banner height, font size, or configured alignment.

Fixed HTML5

Resolved an issue that prevented consent toggles from displaying successfully on the preference center.

Existing Public Preview Features

Consent Management Platform APIs

The following APIs are now available for use with retrieving interface attributes needed to display the Banner and Preference Center, retrieving a list of active IAB and Google Vendors to display on the Preference Center, and logging consent when an end user interacts with a Banner or Preference Center. These APIs enable you to easily access data for Banner and Preference Center implementations, disclose vendor information to end users, and capture end user consent.

Roku Support for Unified Consent Profile for Known Users

Leverage the new Unified Consent Profile for Known Users functionality to connect data subjects' CMP preferences with Universal Consent & Preference Management profiles by enabling the Create data subject profiles for known users setting on the Geolocation Rules tab. You can also easily trigger integration workflows to send CMP preferences to downstream systems, and efficiently manage your preferences in a unique Preference Center, centralizing all of them in one single profile.

This enhancement provides a comprehensive view of data subjects empowering you with more control over the data captured across both modules, resulting in a more streamlined and tailored user experience.

For more information, see Connecting CMP preferences with Universal Consent & Preference Management Profiles.

Configure Button Layout for the Banner

Configure the positioning of buttons on your mobile and CTV banners within the Button Sets section of the Template Details screen. This enhancement allows you to specify the positioning of buttons on your banners for a more customized experience.

iOS
Android

For more information, see Customizing the Mobile App Consent Banner Template and Customizing the Mobile App Consent Preference Center Template.

Enhanced Branding Settings for Mobile and CTV SDKs

Configure detailed branding settings for your mobile SDKs on the Branding tab of the Mobile App Details and CTV App Details screen, respectively. This enhancement enables you to configure more specific branding settings for each of your mobile and CTV applications.

For more information, see Configuring Mobile and CTV App Branding.

Validation for Cross-Device Consent Receipts

Enable the Require Authentication for known users setting when leveraging Cross-Device Consent to require validation on your consent receipts. This enhancement allows you to more reliably collect consent from known users.

For more information, see Configuring Geolocation Rules.

Note:

This enhancement is only available to users with the Consent Rate Optimization (CRO) add-on package. Contact OneTrust Support or your account representative to enable this functionality.

To learn more, see Maximize Opt-Ins with Consent Rate Optimization.

Authenticated Consent for New and Existing Users

This feature is available for the following platforms:

iOS
Android
Apple TV
Android TV

Enable Global Privacy Protocol on TCF 2.2 Templates

Enable the Global Privacy Protocol setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Protocol (GPP) and populate the IAB TCF EU section of the GPP string.

This feature is available for the following platforms:

Android
Android TV
Apple TV
HTML5
iOS
Roku
Unity
Xamarin

For more information, see Configuring the Global Privacy Protocol Settings.

New Reject All Button Configuration

Enable the updated Reject All button configuration on the Preference Center template. This new configuration ensures that legitimate interest is not impacted for customers using Google Ads.

For more information, see Customizing the Mobile App Consent Preference Center Template.

Things to Know

Translated metadata for known Android and iOS SDKs, including SDK descriptions, now automatically displays in the language selected in theLanguagefield on theSDK detailsscreen.

For more information, see...

Beginning with OneTrust 202605.1.0, our build system for iOS and tvOS has been upgraded to Xcode 26. Xcode 26 supports iOS/tvOS versions 15 and above. As a result, OneTrust no longer supports iOS/tvOS versions 12, 13, and 14.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Universal Consent & Preference Management - May 15, 2026 - 202605.1.0 (Spring Release)

General Availability

Bulk Export Consent Receipts and Data Subjects

Export consent receipts and data subject profiles in bulk leveraging the new Bulk export tab on the Universal Consent & Preference Management menu. This enhancement enables you to more easily create and download Excel reports with records of consent receipts and data subjects to improve record keeping and integration.

For more information, see Bulk Exporting Consent Records. This feature is related to the following ideas: CONSENT-I-58, OT-I-16208, CONSENT-I-49.

Opt-out Source Tracking

Leverage the ot_source query parameter on embedded web forms, hosted web forms, and the Trust Center to view the source of user opt-outs in consent receipts. This enhancement improves visibility into user opt-outs by allowing you to track which collection points lead to user opt-outs.

For more information, see Tracking Opt-Out Sources with Query Parameters. This feature is related to the following ideas: CNA-I-32, CD-I-51.

Custom Font for Hosted Web Forms

Add custom fonts to hosted web forms on the Brand section of the Branding tab. This enhancement allows you to customize hosted web form typeface without leveraging custom CSS.

For more information, see Customizing Branding for OneTrust Hosted Web Form Collection Points. This feature is related to the following ideas: UCPMXP-I-31.

Fixed

Resolved an issue that prevented users from closing embedded web form modals after submitting email addresses.
Resolved an issue that prevented list text from displaying correctly on hosted web forms.
The Get Preference Center Root Schema API path has been updated to include /schema that was mistakenly missing from the path. The corrected path is now: GET /api/consentmanager/v2/preferencecenters/{preferencecenterid}/schema.

New Public Preview Features

Unsubscribe/Subscribe Sections for the Trust Center

Add an Unsubscribe / pause section and Subscribe section to Trust Center pages that contain Consent preferences sections to allow end users to easily disable or enable purposes and preferences. You can also provide a survey to allow users to document their reasons for unsubscribing and a Pause button so users can disable notifications without unsubscribing.

For more information, see Adding Consent Preferences and Data Element Sections to the Trust Center. This feature is related to the following ideas: CSC-I-160, OT-I-1667, UCPMXP-I-14.

Existing Public Preview Features

CMP Consent Context: Added support to our existing data hierarchy to allow CMP consent users to provide consent for a purpose multiple times when using consent groups. When using consent groups with the unified profile feature, the CMP will use the same data subject for different consent groups, eliminating the need to create additional profiles.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Universal Consent & Preference Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Data Use Governance

Data Catalog - May 15, 2026 - 202605.1.0 (Spring Release)

Existing Public Preview Features

Policy Enforcement for Snowflake and Databricks

|Available with Solution Packaging Only

Scan and classify data without relying on the limited classification capabilities provided by cloud platforms to enable automated and consistent application of policy actions across Snowflake and Databricks environments. This robust functionality supports the orchestration of masking and row filtering policies to configure access and visibility privileges to sensitive data tables in these systems.

For more information, see the following:

This feature is related to the following ideas: INT-I-34, GOVIDEA-I-24, DPOL-I-3, GOVIDEA-I-16.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Data Discovery - May 15, 2026 - 202605.1.0 (Spring Release)

Existing Public Preview Features

Script Management

Run common maintenance and troubleshooting scripts directly from the platform in the new Administration tab. This reduces the need for command line interface (CLI) access or coordination with support by providing an effective and easy way to execute critical scripts.

For more information, see Script Management for Worker Nodes.

Note:

Originally introduced under General Availability in OneTrust 202504.1.0. This has been changed to Public Preview in OneTrust 202505.1.0.

Duplicate File Detection

Identify duplicate and redundant files with AI-driven analysis based on key risk attributes (classification, shared access) and make decisions on whether to retain or remove duplicates. This enhancement helps you reduce redundant data, decrease attack surface, and improve security posture with savings on cloud storage costs.

For more information, see Reviewing Scanned Files.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Platform Capabilities

Dashboards & Reporting - May 15, 2026 - 202605.1.0 (Spring Release)

Fixed

Resolved an issue that prevented processing activity PDF reports from generating when exported from the Inventory details screen.
Resolved an issue that caused the Stage filter applied to an exception report to display a different value when the report was reopened.
Resolved an issue that caused large report exports without filters to remain in an open state for extended periods.

Existing Public Preview Features

Conversational Analytics Insights Chatbot

|Available with Solution Packaging Only

Ask natural-language questions about your Insights data using the Copilot chatbot in the OneTrust Platform when the Conversational analytics setting is enabled in Global Settings. This feature reduces the manual effort required to create reports and dashboards by generating summaries, tables, and visualizations using existing out-of-the-box reporting data. The Copilot chatbot supports analysis for the following objects:

AI Governance inventories:
- AI systems
- Datasets
- Models
- Projects
Assessments
CMP time series
Consent time series
Contracts
Controls / Control implementations
Engagements
Incidents
Inventories:
- Assets
- Entities
- Processing activities
- Vendors
Issues
Privacy requests and subtasks
Risks

Note:

This feature does not currently support consent data subject details.

For more information, see Using Conversational Analytics Insights Chatbot.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Global Data Manager - May 15, 2026 - 202605.1.0 (Spring Release)

Things to Know

Following the OneTrust Spring '26 Release, OneTrust is conducting a data migration to populate the new Purpose of Processing attribute with customer's historical (Legacy) data across the platform. Customers should contact OneTrust to opt into the migration. For more information, see our myOneTrust Community post.

Integrations - May 15, 2026 - 202605.1.0 (Spring Release)

New Public Preview Features

AI-Powered Individual Log Error Analysis

|Available with Solution Packaging Only

Identify failed actions with AI-powered error summaries, root cause explanations, and actionable recommendations inside the log. This allows you to see exactly which workflow step failed, the type of error, and suggested next steps, which enables you to resolve issues faster and more confidently.

For more information, see Using Integration Logs.

New Integration Workflow Canvas Builder

Create, understand, and manage integrations with the new Canvas Builder, which introduces a modern, flowchart-style way to make automation more approachable for both technical teams and program managers. Instead of working through a primarily configuration-first experience like in the original Legacy Builder, users can now see their workflow come to life on a canvas with triggers, actions, and sequencing presented in a clear visual layout.

For more information, see Integration Canvas Builder Feature Guide. This feature is related to the following idea: PLTI-I-634.

Advance Authentication Methods for Snowflake Integrations

Configure key-value pair authentication for database credentials to Snowflake. Since Snowflake is deprecating support of select credentials, this enhancement improves upon the username/password flow for a more secure approach with a private key for programmatic access that supports critical, existing integrations.

For more information, see Key-Pair Authentication for Snowflake Integration Credentials. This feature is related to the following idea: INT-I-34.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Settings & Administration - May 15, 2026 - 202605.1.0 (Spring Release)

General Availability

User Login History Export to SIEM

Send user login events from the OneTrust Platform to your Security Information and Event Management (SIEM) systems with the new Login Events trigger that can now be configured by using the out-of-the-box Splunk connector or by creating a generic integration workflow to post to your desired SIEM tool. Authentication events are published for successful user login events and includes relevant context such as user information, browser and device details, and IP address. With this enhancement, organizations gain visibility into authentication activity to support centralized security monitoring.

For more information, see Integrating User Login History with External SIEM Tools.

Workflow Enhancements

Workflows across the platform have been improved to promote interactive consistency, assignment visibility, and improved collaboration with the following:

Stage rules on the Create Task action can now support 0 days as a deadline so users can be assigned tasks and complete them on the same day.
Validation for disabled or deleted users has been removed from the Create Task action so tasks can be created as intended even without assignees or collaborators.
Required tasks on stages of cloned workflows now prevent stage advancement if tasks are not completed.

Table Enhancements for Roles

Tables and table functionalities within the Roles screen in Global Settings have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

Resolved an issue that caused the OneTrust Platform to become unresponsive after users selected the Continue Session button from the Session timeout modal.

New Public Preview Features

Third-Party Risk Agent in Copilot

|Available with Solution Packaging Only

Leverage our Third-Party Risk Agent in Copilot to conduct deep research to automate and accelerate the onboarding of new vendors and launch inherent risk assessments. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see OneTrust Third-Party Risk Agent Feature Guide.

Privacy Risk Agent

|Available with Solution Packaging Only

Leverage our Privacy Risk Assessment Agent in Copilot to streamline the creation of processing activities and the completion of assessments. This agent dramatically reduces the time and manual effort required to complete PIAs, improves accuracy through semantic matching and document-based autofill, and provides transparent confidence scoring, which enables Privacy Managers to complete assessments faster, more consistently, and with greater confidence.

For more information, see OneTrust Privacy Risk Assessment Feature Guide.

Existing Public Preview Features

SCIM Users and Groups Integrations

Utilize the Integrations module to configure triggers and actions for SCIM Users and Groups. This feature allows users to automate their organization's processes when managing user and group information using SCIM APIs.

For complete details on these workflow options, see Managing Custom Integration Workflows.

New Root Organization

Create a new root organization at the top of an existing organizational hierarchy using the new Set as the Root Organization check box on the Add Organization modal. This feature allows you to move an existing organizational structure, along with certain previously configured settings, under a new root organization.

For more information, see Managing Organizations.

Integrate Tasks with External Systems

Manage tasks created within the application across external systems by creating integration workflows using the following new integration events:

Task Add Attachment
Task Add Comment
Task Created
Task Deleted
Task Remove Attachment
Task Updated

This enhancement allows you to manage tasks across external systems, which may be helpful when addressing tasks that require a large volume of actions.

For more information, see Integrating Tasks with External Systems.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Settings & Administration. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Privacy Automation

DataGuidance - May 15, 2026 - 202605.1.0 (Spring Release)

General Availability

Apple Pay Subscription Payment

Purchase DataGuidance memberships using Apple Pay for a faster and easier checkout experience without having to create a payment profile or supply credit card information. Apple Pay is supported on Chrome and Safari browsers.

For more information, see DataGuidance User Access Management.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Data Mapping Automation - May 15, 2026 - 202605.1.0 (Spring Release)

Fixed

Resolved an issue that prevented assessments from displaying the updated organization name after an organization name change.
Resolved an issue that caused the risk filter in some PDF reports to display categorical risk attributes in addition to risk attributes.
Resolved an issue that prevented bulk asset imports from completing when numerical attribute options contained special characters.
Resolved an issue that caused controls to appear multiple times in PDF reports.

New Public Preview Features

Custom Notifications for Assessment Templates

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

For more information, see Leveraging AI Auto-responses for Assessments.

Existing Public Preview Features

Enhanced Data Graph Visualizations

View relationships between projects, data sets, and models in the data graph in addition to inventory records. This enhancement provides a clear visualization of how objects relate to each other and to inventory records throughout your data map.

For more information, see Creating and Managing Contextual Relationships.

Inventory Review

|Available with Solution Packaging Only

Gain essential visibility into the flow of newly added and updated inventory records so you can better investigate risks, promote compliance, and enhance efficiency concerning your data map. This review experience allows you to manage pending inventory records that are created by several methods and review inventory records with new or updated data elements.

For more information, see Inventory Review & Automation Feature Guide.

Table Enhancements for Data Mapping Automation

Tables and table functionalities within Data Mapping Automation have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

Data lineage screen
Assessments tab of the Inventory details screen

Note:

Select tables across Data Mapping Automation may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Permissions

The Processing activities, Assets, Vendors/Third parties, and Entities items on the navigation menu will now be visible to users with access to the following products by default regardless of whether they have permission to view those inventories. However, users will not be able to view inventory information on those respective screens without the necessary permissions.
- Compliance Automation
- IT Risk Management
- Third-Party Due Diligence (Third parties only)
- Third-Party Risk Exchange (Third parties only)
- Third-Party Risk Management
Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Data Mapping Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Incident Management - May 15, 2026 - 202605.1.0 (Spring Release)

General Availability

Table Enhancements for Incident Management

Tables and table functionalities within Incident Management have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

Incident register
Assessments screen
Archived assessments screen
Recycle bin screen
Assessments tab of the Incident details screen
Documents tab of the Incident details screen

Note:

The OneTrust Default View now displays fewer columns than the legacy default view. This is expected behavior with the new dynamic tables. To customize your experience, use the column manager to select your preferred columns, and then save a custom view.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

Resolved an issue that prevented user groups from being saved as approvers for approval stages in incident workflows during incident creation.

New Public Preview Features

Custom Notifications for Assessment Templates

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

For more information, see Leveraging AI Auto-responses for Assessments.

Dynamic Incident Notification Assessment (DINA) Updates

DINA 1.2.0 Expanded Global Incident Notification Coverage

Assess incident notification obligations beyond personal data breaches with expanded coverage in the DINA 1.2.0. This enhancement broadens the scope of incidents covered by the DINA to include AI, cybersecurity, and non-personal data related incidents to help manage a wider range of regulatory notification requirements from a single assessment. DINA 1.2.0 includes the following updates:

EU AI Act: - Added support for AI-related incident notification obligations under the EU AI Act.
NIS2 Directive (National Implementing Laws): - Added cybersecurity and non-personal data incident notification coverage under national NIS2 Directive implementing laws for Belgium, Denmark, Germany, Italy, and Portugal, strengthening EU-wide coverage.
India: - Added preparation for India's upcoming Digital Personal Data Protection Act (DPDPA) and completed breach and cybersecurity notification coverage under the IT Act.
United States (Florida): - Updated rules under the Florida breach notification law.

Note:

The China and Saudi Arabia jurisdictions have not been updated in this release.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Assessment Automation - May 15, 2026 - 202605.1.0 (Spring Release)

Fixed

Resolved an issue that prevented information request emails from displaying the assessment name correctly in Japanese.
Resolved an issue that prevented Object-type question responses from appearing as available columns in assessment reports.
Resolved an issue that prevented German translations from displaying in incident assessment PDF reports.
Resolved an issue that prevented saved views on the Assessments screen from displaying in alphabetical order.
Resolved an issue that prevented archived assessments from displaying correctly on the Archived assessment screen when a filter was applied.
Resolved an issue that prevented users from accessing the Manage jurisdictions modal after clicking the Manage jurisdiction button while completing an assessment.
Resolved an issue that prevented filters from displaying on the Assessment screen for some users.

New Public Preview Features

Custom Notifications for Assessment Templates

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

For more information, see Leveraging AI Auto-responses for Assessments.

Privacy Risk Agent

|Available with Solution Packaging Only

For more information, see OneTrust Privacy Risk Assessment Feature Guide.

Existing Public Preview Features

Launch Reassessments as Not Started

Configure reassessments to default to the Not Started stage upon launching. This enhancement applies to copied assessments, reassessments launched via automation rules, and reassessments launched via API.

Company Names in Email Notifications

Display your company name in assessment email notification templates using the __TenantName__ email variable when notifying users. This enhancement enables you to provide assessment notifications on behalf of your organization that reflect your tenant's name.

For more information, see Customizing Assessment Email Templates Using Dynamic Variables.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Privacy Rights Automation - May 15, 2026 - 202605.1.0 (Spring Release)

General Availability

Subtask Library

Create a library of subtask templates that can be reused across multiple requests and workflows. This feature streamlines the way you can create, edit, and manage subtasks.

This feature is related to the following idea: OT-I-15383.

For more information, see Leveraging the Subtask Library.

Stage Rules for Workflows

Configure rules on workflows to conditionally change workflows or their stages. This feature streamlines your workflows by automating changes based on your specific criteria.

This feature is related to the following idea: OT-I-3727.

For more information, see Adding Rules to Workflow Stages.

Add Subtasks and Subtask Resolutions to Stage Rules for Workflows

Workflow stage rules now support subtask resolution conditions and the adding of subtask actions. This enhancement streamlines your workflows by making subtasks easier to manage.

This feature is related to the following idea: OT-I-3727.

For more information, see Adding Rules to Workflow Stages.

Fixed

Resolved an issue that prevented files uploaded through the Add Targeted Data Discovery Results Summary to Request API from being redacted when the isRedact parameter was set to true.
Resolved an issue that prevented results summaries from loading in some sandbox environments.
Resolved an issue that prevented users from sharing the results summary immediately after saving a redacted document.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Data Subject Request (DSR) Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Tech Risk and Compliance

Compliance Automation - May 15, 2026 - 202605.1.0 (Spring Release)

General Availability

Evidence Interval Workflows

Enable and modify the newly seeded Default evidence task interval workflow and Evidence task interval workflow with review to help leverage evidence approval workflows for more critical evidence. This enhancement introduces a structured set of stages to track the lifecycle of evidence, while also supporting notifications and task creation to keep teams informed and on track.

Note:

The Evidence Task Approval Bypass permission is required to allow evidence task assignees to bypass approval stages and send an evidence task interval to be collected.

For more information, see Managing Evidence Interval Workflows.

New Public Preview Features

Stage & Workflow Rules for Seeded Evidence Interval Workflows

Add stage and workflow rules to the seeded evidence interval workflows to automatically send notifications, change evidence task stages, and change workflows. This enhancement allows organizations to tailor workflows and approval paths to match their evidence review processes and customize existing seeded workflows for greater flexibility.

For more information, see Adding Stage Rules to Evidence Interval Workflows and Adding Workflow Rules to Evidence Interval Workflows.

Permissions

For users with access to Compliance Automation, the Processing activities, Assets, Vendors, and Entities items on the navigation menu will now be visible to these users by default regardless of whether they have permission to view those inventories. However, users will not be able to view inventory information on those respective screens without the necessary permissions.
Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Compliance Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Standard / Control Framework Changes

Saudi Arabia Personal Data Protection Law (PDPL) Framework Added

The Saudi Arabia Personal Data Protection Law (PDPL) establishes a comprehensive legal framework governing the processing of personal data within the Kingdom of Saudi Arabia. It applies to organizations that process personal data of individuals residing in Saudi Arabia, regardless of where the processing entity is located, and introduces requirements focused on transparency, purpose limitation, data subject rights, and accountability.

We’ve made implementing PDPL easy by offering the framework on our platform and ensuring users can leverage overlap with other privacy frameworks available in the platform. The platform includes survey questions to help define scope, bringing together relevant policies, controls, control implementation guidance, and evidence tasks (including guidance) to support compliance with PDPL requirements.

For more information, see Supported Control Frameworks.

South Korea AI Basic Act Framework Added

Note:

The South Korea AI Basic Act Framework will be available on the OneTrust platform effective May 18, 2026.

For more information, see Supported Control Frameworks.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Enterprise Policy Management - May 15, 2026 - 202605.1.0 (Spring Release)

Fixed

Resolved an issue that prevented stage rules configured to create a policy from triggering within the first stage of a workflow.

Existing Public Preview Features

AI-Powered Document Analysis

|Available with Solution Packaging Only

Analyze documents against a standard or framework using the new Analyze document button on the Document details screen. This AI-powered feature identifies gaps and provides recommendations to help remediate issues related to the following objects:

Controls
Risks
Issues

AI-generated recommendations will appear in the Recommended section of the Related, Controls, Risks, and Issues tabs of the Document details screen. These recommendations may include relating controls, creating relationships, or linking risks and issues.

For more information, see Using AI-Powered Document Analysis. This feature is related to the following idea: OT-I-14780.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Issues Management - May 15, 2026 - 202605.1.0 (Spring Release)

Existing Public Preview Features

Issue Attribute Visibility Rules

Configure attribute visibility rules using the new Attribute visibility tab on the Issue type details screen in the Attribute Manager. This feature allows you to use conditional logic to control which fields appear when creating or editing issues to help reduce clutter and improve data accuracy.

For more information, see Creating Attribute Visibility Rules.

Disable Editing of Details

Disable users from editing details on closed issues and preserve the record once the workflow is completed. This workflow configuration setting is optional during activation and is only available if the Close record setting is enabled. Users must reopen the issue record in order to edit a field.

For more information, see Managing Issue Workflows.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

IT & Security Risk Management - May 15, 2026 - 202605.1.0 (Spring Release)

General Availability

Control Enhancements

Improve control management and oversight across the OneTrust Platform with improvements to reporting, relationship coverage, and workflow behavior. Enhancements include:

Support for assess issue question types on assessments in Dashboards and Reporting.
Support for Engagements as related objects in issue column reports.
Support for stage filters in custom control workflows.
Ability to use AI Systems as target object types when creating control relationships.
Ability to update the Organization field on Control library records.

These enhancements provide clearer insights into control performance, improved visibility into relationships across objects, and a more reliable experience when managing controls at scale.

Fixed

Resolved an issue that prevented Maturity attribute options from displaying the correct translation when linking controls to an inventory.
Resolved an issue that caused errors when mapping single‑select value lists during risk‑to‑issue conversion when disabled attribute options were present.
Resolved an issue that prevented aggregate risk scores from calculating for engagements, which blocked workflow rules from progressing.
Resolved an issue that prevented invited users from submitting assessments when adding links to existing entities.
Resolved an issue that prevented Risk library records from reflecting Description field translations when modified in Global Settings.
Resolved an issue that prevented Category options from appearing for engagements when configuring formulas using formula attributes.
Resolved an issue that caused risks deleted prior to assessment archival to reappear in the Risk register after the assessment was restored.
Resolved an issue that prevented edited notification subjects from being applied when sending notifications from Business objective workflow stage rules.
Resolved an issue that caused risk fields to reload while editing a risk.
Resolved an issue that caused the inherent risk level to be set to null when moving assessment templates between tenants.

New Public Preview Features

Risk Workflow Enhancements

The following enhancements have been introduced to Risk workflows to promote a consistent workflow management experience across other products on the OneTrust Platform that have adopted this standardization:

Workflow List Screen

column sorting, search, activation, archival

Routing Rules

workflow assignment upon object creation

Workflow rules

Advance stage renamed to change stage

Available default stage actions:

Create task
Send notification
Update attribute
Generate PDF report
Launch assessment

Stage Settings:

Required attributes and comments upon stage change
Stage approval requirements

For more information, see Managing Risk Workflows.

Mark Risk Workflow Stage as Closed

Leverage the new Close stage setting in Risk workflows to set a specific stage at which the record will be closed. This enhancement allows you to close risks as part of your workflow transitions at a desired point in the workflow rather than advancing to completed. By default, the record will be closed in the last workflow stage.

For more information, see Managing Risk Workflows.

Project Risk Assessments

Create and track IT projects from the Inventory menu to view both direct project risks and indirect risks from linked inventories in the Risks tab. This feature aggregates risks from inventories into a single project-level aggregated score, providing clearer visibility and enabling more informed action.

For more information, see Managing Projects in IT Risk Management.

Custom Notifications for Assessment Templates

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

For more information, see Leveraging AI Auto-responses for Assessments.

Existing Public Preview Features

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Permissions

For users with access to IT Risk Management, the Processing activities, Assets, Vendors, and Entities items on the navigation menu will now be visible to these users by default regardless of whether they have permission to view those inventories. However, users will not be able to view inventory information on those respective screens without the necessary permissions.
Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: IT Risk Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Standard / Control Framework Changes

Saudi Arabia Personal Data Protection Law (PDPL) Framework Added

For more information, see Supported Control Frameworks.

South Korea AI Basic Act Framework Added

Note:

The South Korea AI Basic Act Framework will be available on the OneTrust platform effective May 18, 2026.

For more information, see Supported Control Frameworks.

Things to Know

The Attribute Manager for IT Risk Management has been updated with the following enhancements:
- Added List Type and Response Type columns for the Control Library, Controls, Threat, and Vulnerability attributes.
- Added Response Type filter for the Controls Library and Control attributes.
- Added List Type and Response Type filters for Threat and Vulnerability attributes.

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Third-Party Management

Third-Party Due Diligence - May 15, 2026 - 202605.1.0 (Spring Release)

Fixed

Resolved an issue that showed an incorrect count of purchased screening licenses.

Permissions

For users with access to Third-Party Due Diligence, the Third parties item on the navigation menu will now be visible to these users by default regardless of whether they have permission to view that inventory. However, users will not be able to view inventory information on that screen without the necessary permission.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Third-Party Risk Exchange - May 15, 2026 - 202605.1.0 (Spring Release)

Permissions

For users with access to Third-Party Risk Exchange, the Third parties item on the navigation menu will now be visible to these users by default regardless of whether they have permission to view that inventory. However, users will not be able to view inventory information on that screen without the necessary permission.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Third-Party Risk Management - May 15, 2026 - 202605.1.0 (Spring Release)

General Availability

Updated Create Contracts & Create Engagements Modals: View all attributes in the same groupings that users have configured in the Attribute Manager in the new Create Contract and Create Engagement modals. This enhancement provides an ability to quickly filter all required attributes to improve the user experience of creating new records.

Note:
As of the OneTrust 202605.1.0 release, the Contracts tab will be removed from the details pages for Assets, Processing Activities, and Entities. Any contracts related to these records can now be accessed on the Related tab of the details page. For more information, see our myOneTrust Community post.

Fixed

Resolved an issue that prevented users from adding risk rules after selecting 'Risk' from the dropdown when creating a Rule Group in Third-Party Risk Management Automation Rules.

New Public Preview Features

Third-Party Risk Agent in Copilot

|Available with Solution Packaging Only

For more information, see OneTrust Third-Party Risk Agent Feature Guide.

Custom Notifications for Assessment Templates

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

For more information, see Leveraging AI Auto-responses for Assessments.

Existing Public Preview Features

Table Enhancements for Third-Party Risk Management: Tables and table functionalities within the Assessments tab of the Engagement overview screen has been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

Note:
Select tables across Third-Party Risk Management may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary. For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Permissions

For users with access to Third-Party Risk Management, the Processing activities, Assets, Vendors, and Entities items on the navigation menu will now be visible to these users by default regardless of whether they have permission to view those inventories. However, users will not be able to view inventory information on those respective screens without the necessary permissions.
Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Third-Party Risk Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Standard / Control Framework Changes

Saudi Arabia Personal Data Protection Law (PDPL) Framework Added

For more information, see Supported Control Frameworks.

South Korea AI Basic Act Framework Added

Note:

The South Korea AI Basic Act Framework will be available on the OneTrust platform effective May 18, 2026.

For more information, see Supported Control Frameworks.

Things to Know

The number of days supported for theUpdate attributerule action in workflows has been increased from 999 days to 3650 days (10 years).

TheAttribute Managerfor Third-Party Risk Management has been updated with the following enhancements:

Added List Type and Response Type columns for Engagement and Contract attributes.
Added List Type and Response Type filters for Engagement and Contract attributes.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.