Compliance Automation - May 15, 2026 - 202605.1.0 (Spring Release)

General Availability

Evidence Interval Workflows

Enable and modify the newly seeded Default evidence task interval workflow and Evidence task interval workflow with review to help leverage evidence approval workflows for more critical evidence. This enhancement introduces a structured set of stages to track the lifecycle of evidence, while also supporting notifications and task creation to keep teams informed and on track.

Note:

The Evidence Task Approval Bypass permission is required to allow evidence task assignees to bypass approval stages and send an evidence task interval to be collected.

For more information, see Managing Evidence Interval Workflows.

New Public Preview Features

Stage & Workflow Rules for Seeded Evidence Interval Workflows

Add stage and workflow rules to the seeded evidence interval workflows to automatically send notifications, change evidence task stages, and change workflows. This enhancement allows organizations to tailor workflows and approval paths to match their evidence review processes and customize existing seeded workflows for greater flexibility.

For more information, see Adding Stage Rules to Evidence Interval Workflows and Adding Workflow Rules to Evidence Interval Workflows.

Permissions

For users with access to Compliance Automation, the Processing activities, Assets, Vendors, and Entities items on the navigation menu will now be visible to these users by default regardless of whether they have permission to view those inventories. However, users will not be able to view inventory information on those respective screens without the necessary permissions.
Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Compliance Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Standard / Control Framework Changes

Saudi Arabia Personal Data Protection Law (PDPL) Framework Added

The Saudi Arabia Personal Data Protection Law (PDPL) establishes a comprehensive legal framework governing the processing of personal data within the Kingdom of Saudi Arabia. It applies to organizations that process personal data of individuals residing in Saudi Arabia, regardless of where the processing entity is located, and introduces requirements focused on transparency, purpose limitation, data subject rights, and accountability.

We’ve made implementing PDPL easy by offering the framework on our platform and ensuring users can leverage overlap with other privacy frameworks available in the platform. The platform includes survey questions to help define scope, bringing together relevant policies, controls, control implementation guidance, and evidence tasks (including guidance) to support compliance with PDPL requirements.

For more information, see Supported Control Frameworks.

South Korea AI Basic Act Framework Added

South Korea’s Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust establishes a national legal framework for AI governance, transparency, safety, and trust. Effective January 22, 2026 as a matter of law, it introduces core obligations relating to AI transparency, safety measures for certain advanced AI systems, responsibilities for providers of high-impact AI, human rights impact assessment, and the appointment of a local representative for certain foreign AI business operators. It also includes separate obligations for synthetic content disclosure and public-sector procurement prioritization in certain cases.

We’ve streamlined South Korea AI Basic Act compliance by offering the framework on our platform—featuring controls, implementation guidance, evidence tasks, policies, and risks aligned to the law’s requirements for AI business operators, including those providing high-impact AI and certain foreign AI business operators. The framework is designed to help organizations operationalize governance, transparency, risk management, and accountability for AI systems in scope under the Act.

Note:

The South Korea AI Basic Act Framework will be available on the OneTrust platform effective May 18, 2026.