AI FAQ

We define AI features as artificial intelligence (AI) deployed in our application (i.e., our online services) available to customers. AI is a broad term that includes generative AI and subfields of AI such as natural language processing and machine learning. Our AI features can be found in our Artificial Intelligence Transparency Report (AITR). 

OneTrust developed AI features because privacy teams have been given an impossible task: to maintain robust governance and move fast in an environment of constant change with limited resources. As a privacy professional, you’ve never been able to do both. Our AI-enabled features eliminate these trade-offs privacy teams have faced.

You can reference the Artificial Intelligence Transparency Report (AITR) to determine which OneTrust Solutions packages are required for each AI feature. 

Your current OneTrust subscriptions can be found in the Order Form(s) signed by your company and OneTrust. Note that AI features are available only with the current OneTrust Solutions packages. Please reach out to your OneTrust account representative with any questions on your current subscriptions, or about how to upgrade to a OneTrust Solution package from legacy OneTrust module subscriptions. For more information, see Solution Packaging & Pricing Overview.

OneTrust uses open-source and third-party proprietary models (e.g., Azure OpenAI) to provide a customized AI experience for your teams and workflows. For more details on the methodology and technology behind our AI features, see our AI Transparency Report.

To protect your privacy and ensure the security of your data, our third-party AI model providers (“AI model providers”) do not use your data for training their services. See below questions on training and storage that discuss these topics in further detail.

No, neither OneTrust nor its AI model providers use customer inputs, outputs, or any other customer data (also referred to as customer content) such as prompts or results to train their models.

Third-party AI model providers used by OneTrust do not store customer inputs and outputs beyond the temporarily processing needed to provide the AI services and to maintain their abuse and harmful content monitoring policy.

OneTrust, in some cases, may temporarily store inputs and outputs to provide AI services to that customer only – for instance, to improve response speed (e.g., for page summaries) or to enable certain features (e.g., search history). Customer inputs are stored at the tenant level and are not commingled with other customers’ data. OneTrust may review inputs and outputs and use any lessons learned to improve its services.

If you provide feedback (e.g., thumbs up or down for an AI response or fill in a free-form suggestion box), we may use this information to enhance our products. This feedback will not be used to train our AI models or those of our AI model providers.

OneTrust and its AI model providers never use customer data to train AI models. Your data is never stored or retained within an AI model beyond what is outlined in the storage FAQ above. Some AI features may temporarily reference data from your tenant—strictly with your permission—to provide specific services or responses for you only. In these cases, your data:

• Remains exclusively within your tenant;

• Is never accessible by other customers;

• Does not train the underlying AI model; and

• After generating the necessary response, your data is no longer referenced.

As always, you're in full control over whether these AI features are activated, and any AI feature that references or evaluates your customer data is strictly opt-in and turned off by default. For a breakdown of how each feature handles customer data, please refer to our AI Transparency Report.

All AI features offered to customers are presently optional, and your administrator can turn them off at any time. Your administrator can visit your AI settings page as described here to review and disable AI features according to your preferences.

Yes, all AI features are turned off by default. Each requires explicit opt-in from your account administrator to be enabled.

OneTrust fully honors your existing permissions. Users will only receive results based on the content they are authorized to access, ensuring that your access controls remain intact across the platform.

No, none of the AI features are classified as prohibited or high-risk AI systems under the EU AI Act risk classification system.

At OneTrust, we prioritize the ethical and secure use of AI in everything we do. OneTrust has a Global AI Policy in place that is applicable to all OneTrust employees and an AI Committee that meets to discuss key AI issues. We monitor regulatory changes and reassess our compliance with new regulatory requirements. We have built internal assessments to review the development of AI features prior to their release to customers.

While AI features enhance productivity, they are not a substitute for human judgment. They function best as a complementary tool within our existing workflows rather than a complete replacement. Furthermore, AI features generate responses based in part on AI model providers’ training data or proprietary OneTrust content, which means they may not have answers to every query or may be inaccurate. Additionally, there may be a lag in processing new information, limiting their ability to reflect the most up-to-date information.

OneTrust applies the same robust data handling practices (e.g. data-at-rest security protocols and data retention periods) to the processing of data in AI features as we do for all data processing in our services.

OneTrust cloud hosting for all OneTrust services, including AI features, is provided by Microsoft Azure which offers data residency in Australia, Brazil, Canada, France, Germany, India, United Kingdom, United States, Singapore, Switzerland, Japan, and United Arab Emirates. Therefore, data is hosted in the customer's region of choice.

The location of the OpenAI model to power the AI features will be the hosting location as specified in the agreement between Customer and OneTrust. However, in certain regions outside the EU (e.g., Japan, UAE, Australia, Brazil, or Canada), where the specified location is not available, OneTrust may use Azure regions outside the hosting location specified in the Customer's agreement. Please see below table that outlines where those other locations may be.