Compliance Automation - December 5, 2025 - 202512.1.0

Existing Public Preview Features

AI Evidence Analysis

|Available with Solution Packaging Only

Run AI-powered analysis for files uploaded on the evidence collection pane of the Evidence tasks screen when the Record recommendations setting is enabled in Global Settings. This feature allows you to evaluate how well files submitted during evidence collection align with defined controls and evidence requirements. The analysis will provide guidance that highlights validated content and flag gaps or incomplete information.

Important:

This feature is currently available for customers in the following environments: APP, APP-FR, APP-EU, APP-DE. AI Evidence Analysis will be available for all environments in a future release.

For more information, see Using AI for Evidence Analysis.

Evidence Task Review Workflow

Enable a default workflow for evidence task intervals when a reviewer is assigned. This enhancement introduces a structured set of stages to track the lifecycle of evidence, while also supporting notifications and task creation to keep teams informed and on track.

Note:

The Evidence Task Approval Bypass permission is required to allow evidence task assignees to bypass approval stages and send an evidence task interval to be collected.

Permissions

  • The following permissions have been added to give users the ability to view, create, and manage saved views for the evidence collection calendar:

    • Create collection calender saved views

    • Edit collection calender saved views

    • Delete collection calender saved views

    • View collection calender saved views

    These permissions have been granted to the following system roles:

    • Compliance manager

    • Site admin

    • Tech Risk & Compliance Admin

    These permissions have been granted to custom roles with the following permissions:

    • Create Initiative saved views

    • Edit Initiative saved views

    • Delete Initiative saved views

    • View Initiative saved views

Standard / Framework Changes

New Indiana Consumer Data Privacy Act Framework Added

The Indiana Consumer Data Privacy Act (ICDPA), effective January 1, 2026, establishes a comprehensive framework for data privacy, ensuring that personal data of Indiana residents is managed with care and transparency. This legislation grants consumers substantial rights over their data while defining clear requirements for businesses to uphold transparency and responsible data management. 

We’ve made implementing the ICDPA easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring all relevant policies, controls, control implementation guidance and evidence tasks (including guidance), among others to assist in meeting the requirements of the ICDPA.

For more information, see Supported Control Frameworks.

California Consumer Privacy Act (CCPA as amended) 2025 Framework Updated

Framework content updated to align with the latest CPPA regulations, approved by the California Office of Administrative Law in September 2025, related to automated decision-making technology (ADMT), privacy risk assessments, and cybersecurity audits. The regulations introduce new requirements for businesses to assess and document risks associated with their data processing and cybersecurity practices, incorporate enhanced notices, and extend consumer choice mechanisms to individuals impacted by ADMT.

The updated California Consumer Privacy Act (CCPA, as amended) (2025) framework is now available on the OneTrust platform.

For more information, see Supported Control Frameworks.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.