Third-Party Risk Management - May 15, 2026 - 202605.1.0 (Spring Release)

General Availability

Updated Create Contracts & Create Engagements Modals: View all attributes in the same groupings that users have configured in the Attribute Manager in the new Create Contract and Create Engagement modals. This enhancement provides an ability to quickly filter all required attributes to improve the user experience of creating new records.

Note:
As of the OneTrust 202605.1.0 release, the Contracts tab will be removed from the details pages for Assets, Processing Activities, and Entities. Any contracts related to these records can now be accessed on the Related tab of the details page. For more information, see our myOneTrust Community post.

Fixed

Resolved an issue that prevented users from adding risk rules after selecting 'Risk' from the dropdown when creating a Rule Group in Third-Party Risk Management Automation Rules.

New Public Preview Features

Third-Party Risk Agent in Copilot

Leverage our Third-Party Risk Agent in Copilot to conduct deep research to automate and accelerate the onboarding of new vendors and launch inherent risk assessments. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see OneTrust Third-Party Risk Agent Feature Guide.

Custom Notifications for Assessment Templates

Send customized, trigger-based automated email messages from a new global Notifications tab on the Assessment templates screen. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

Configure approver-only sections on assessments automatically using template rules or inventory-based values. These enhancements mean users can launch assessments with approver-only sections directly from the self-service portal.

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

Opt-out of automatically scanning your three most recent assessments, plus add more files, more file types, and bigger files to your uploads. These enhancements improve the performance and accuracy of the AI Doc Scanner.

For more information, see Leveraging AI Auto-responses for Assessments.

Existing Public Preview Features

Table Enhancements for Third-Party Risk Management: Tables and table functionalities within the Assessments tab of the Engagement overview screen has been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

Note:
Select tables across Third-Party Risk Management may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary. For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Permissions

For users with access to Third-Party Risk Management, the Processing activities, Assets, Vendors, and Entities items on the navigation menu will now be visible to these users by default regardless of whether they have permission to view those inventories. However, users will not be able to view inventory information on those respective screens without the necessary permissions.
Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Third-Party Risk Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Standard / Control Framework Changes

Saudi Arabia Personal Data Protection Law (PDPL) Framework Added

The Saudi Arabia Personal Data Protection Law (PDPL) establishes a comprehensive legal framework governing the processing of personal data within the Kingdom of Saudi Arabia. It applies to organizations that process personal data of individuals residing in Saudi Arabia, regardless of where the processing entity is located, and introduces requirements focused on transparency, purpose limitation, data subject rights, and accountability.

We’ve made implementing PDPL easy by offering the framework on our platform and ensuring users can leverage overlap with other privacy frameworks available in the platform. The platform includes survey questions to help define scope, bringing together relevant policies, controls, control implementation guidance, and evidence tasks (including guidance) to support compliance with PDPL requirements.

For more information, see Supported Control Frameworks.

South Korea AI Basic Act Framework Added

South Korea’s Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust establishes a national legal framework for AI governance, transparency, safety, and trust. Effective January 22, 2026 as a matter of law, it introduces core obligations relating to AI transparency, safety measures for certain advanced AI systems, responsibilities for providers of high-impact AI, human rights impact assessment, and the appointment of a local representative for certain foreign AI business operators. It also includes separate obligations for synthetic content disclosure and public-sector procurement prioritization in certain cases.

We’ve streamlined South Korea AI Basic Act compliance by offering the framework on our platform—featuring controls, implementation guidance, evidence tasks, policies, and risks aligned to the law’s requirements for AI business operators, including those providing high-impact AI and certain foreign AI business operators. The framework is designed to help organizations operationalize governance, transparency, risk management, and accountability for AI systems in scope under the Act.

Note:

The South Korea AI Basic Act Framework will be available on the OneTrust platform effective May 18, 2026.

For more information, see Supported Control Frameworks.

Things to Know

The number of days supported for theUpdate attributerule action in workflows has been increased from 999 days to 3650 days (10 years).

TheAttribute Managerfor Third-Party Risk Management has been updated with the following enhancements:

Added List Type and Response Type columns for Engagement and Contract attributes.
Added List Type and Response Type filters for Engagement and Contract attributes.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

News & Release Notes