Compliance Automation - March 13, 2026 - 202603.1.0

General Availability

New Add Document Attachments API: Added the new Add Document Attachments API to add attachments to policies, standards, procedures, and privacy notices. This API allows you to add supporting files, URLs, or related resources to policy and privacy notice management objects to streamline document management workflows.

Fixed

Resolved an issue that prevented the Control library export from displaying seeded standard/framework data after removing and re-importing the framework.
Resolved an issue that caused the Issues tab of the Inventory details screen to redirect users to the Initiative screen instead of loading the Issues tab.
Resolved an issue that prevented users from previewing evidence attachments when the attachment name ended in .docx or .xlsx.

Existing Public Preview Features

Evidence Task Review Workflow: Enable a default workflow for evidence task intervals when a reviewer is assigned. This enhancement introduces a structured set of stages to track the lifecycle of evidence, while also supporting notifications and task creation to keep teams informed and on track.

Note:
The Evidence Task Approval Bypass permission is required to allow evidence task assignees to bypass approval stages and send an evidence task interval to be collected.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Compliance Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Standard / Control Framework Changes

New ISO/IEC 27701

ISO/IEC 27701:2025 is an international standard that defines requirements and provides guidance for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS). It is intended for organizations that process personally identifiable information (PII) in the role of PII controller and/or PII processor, helping formalize privacy governance, accountability, and privacy risk management across the PII lifecycle.

The 2025 edition modernizes the standard and positions ISO/IEC 27701 as a standalone, certifiable privacy management system standard, making it suitable for organizations that want an auditable privacy program whether or not they already operate an ISO/IEC 27001-based information security management system.

We’ve made implementing ISO/IEC 27701:2025 easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring all relevant policies, controls, control implementation guidance and evidence tasks (including guidance), among others to assist in meeting the requirements of ISO/IEC 27701:2025.

Important:

The ISO/IEC 27701:2025 framework will be available on the OneTrust Platform effective March 23, 2026.

For more information, see Supported Control Frameworks.

New Colorado AI Act Framework Added

The Colorado Artificial Intelligence Act is the first comprehensive U.S. state law focused on consumer protections and accountability in the use of AI systems, with its core obligations centered on high-risk AI systems used in consequential decision-making. Effective June 30, 2026, it introduces requirements relating to reasonable care, risk management, impact assessments, transparency, consumer notices, and appeal rights, while also including broader disclosure obligations for certain AI systems that interact with consumer.

We’ve streamlined Colorado AI Act compliance by offering the full framework on our platform—featuring controls, implementation guidance, evidence tasks, policies, and risks aligned with the law’s requirements for developers, deployers, and qualifying small deployers. The framework is designed to help organizations operationalize governance for AI systems and support defensible compliance with the Act’s accountability and transparency requirements.

Important:

The Colorado AI Act Framework will be available on the OneTrust Platform effective March 20, 2026.