AI Document Scanner FAQ

Learn more about our AI Document Scanner feature currently available for assessments in , Data & AI Governance, Tech Risk & Compliance, and Third-Party Risk Management. For related resources, see the following:

What file types can I upload?

You can upload the following file types: .bmp, .csv, .doc, .docx, .heif, .html, .jpeg, .jpg, .md, .pdf, .png, .ppt, .pptx, .tiff, .txt, .xls, .xlsx.

Note:

PDF file security validation may block individual files based on their content. If a PDF cannot be uploaded, check its contents for potential security issues or contact OneTrust Support for assistance.

Do you use any uploaded data or files to train an AI model?

No training models are used for this feature. Any data or file uploaded to your assessment remains in the tenant, and is not used for training.

How many files can I upload to an assessment?

You can upload a maximum of 50 files to an assessment. This limit is cumulative across the assessment, not per upload. If you upload files, generate responses, and later upload more files, they all count toward the same 50-file limit.

How big of a file can I upload?

You can upload up to 64MB per file.

What question types are supported?

AI Document Scanner can generate responses for the following question types:

  • Yes/no

  • Text box

  • Single-select and multi-select (MCQ)

  • Inventory attribute

  • Personal data attribute

If I use AI Document Scanner on an assessment where questions have already been answered, will this impact those questions?

No. AI Document Scanner generates responses only for questions that are still unanswered. It skips any question that has already been answered by any means, whether entered manually, answered by a previous scan, or answered by an earlier auto-response, and does not overwrite existing answers.

Because of this, subsequent uploads only affect unanswered questions. For example, if you upload 10 files and the scanner answers a set of questions, any later upload is used only to answer the questions that remain unanswered. (As a reminder, the 50-file limit is cumulative across the assessment, so later uploads draw from the same total.)

Are AI responses visible in reporting?

Yes. AI-generated responses are included in any reports you export.

If multiple documents are uploaded, how is the justification handled? Does the AI combine all responses into one justification?

Relevant justification is pulled from all uploaded documents based on how closely each relates to the question in the assessment. The AI response is provided as a single justification for the question.

Does the tool look for gaps or deviations in controls called out in the SOC2 report, and does it consider these items in the AI justifications?

Gaps and deviations will be provided in justification if explicitly mentioned in the document.

For example, if the document contains the phrase: "We have no data centers located in the EMEA region" and the question in the assessment is: "Are data security protocols followed for data centers in EMEA?", then the response would be: "Not Applicable".

However, if the phrase mentioned above was not in the document, the response would not infer the absence to answer the question as "Not Applicable". It would leave the question unanswered.

What is the availability of AI Document Scanner, and what costs are associated with it?

AI Document Scanner is under General Availability for customers with solution packaging only. It is available in (Base and Suite), Data and AI Governance, Tech Risk and Compliance, and Third-Party Risk Management (Base and Suite).

For pricing-related inquiries, please contact your associated account executive.

Do the response rates differ each time I use this feature on a questionnaire?

The response rate may differ after each use. The variation for each questionnaire depends on the AI model type. A small percentage of variance can occur based on the deployed model type, and this variance is expected.

Where can I get more details on the model that this feature is based on?

See our AI Transparency Report for more information.

Do you use machine learning capabilities with this enhancement?

OneTrust does not incorporate any machine learning capabilities for this feature. Since we do not train a model for this, accuracy improvement is dependent on improvement of the model.

Do you have plans to move towards a model that does train using customer documents and data?

No, OneTrust does not have any current plans for models that are trained on customer documents and data.

Can I take an exported PDF assessment and upload it to answer questions on another assessment?

Yes. AI Document Scanner supports this.

What models are you currently using?

AI Document Scanner currently uses Azure OpenAI gpt-4.1-mini and Azure OpenAI GPT-5. For more information, see our AI Transparency Report.

Can this feature answer questions that are hidden behind conditional logic?

Yes, this is supported.

If I upload multiple documents, and the answer to a question can be found in more than one document, are multiple documents shown in the "Source Document" section?

Yes. The Source Document section shows multiple documents, and pages within those documents that were used for inference.

Does AI Document Scanning support password-protected PDF files?

No. Any file that is password-protected will not be able to use this feature. However, a PDF with other restrictions (for example, copy protection) can still be used. For instance, if you open the OneTrust SOC 2 file and try to copy text from a page on your laptop, the copy action may be blocked, but the file can still be used by the AI to generate answers to a questionnaire.