OneTrust Third-Party Risk Agent Feature Guide

Leverage Third-Party Risk Agent in Copilot to accelerate vendor onboarding by generating deep research when an assessment is launched.

The agent gathers current, evidence-based vendor information and uses it to support inherent risk assessments, helping teams start with stronger context instead of relying on pre-generated research that may be limited or outdated.

Because it works with both standard and custom assessment templates, it extends automation across more onboarding workflows while keeping assessments aligned to each organization’s risk program.

Deep Research is an AI-driven vendor intelligence process that creates a structured third-party risk profile using publicly available information and questions from the assessment template you select.

Deep Research combines two components:

• Core research across predefined third-party risk domains, including company overview, security and compliance, governance and ESG, regulatory exposure, operational risk, AI governance, and public incidents or adverse events.

• Assessment-specific FAQ responses generated from the questions in the selected assessment template.

The resulting report is attached to the assessment and supports the assessment completion workflow by providing information for document scanning and AI-generated responses. Review all generated responses before you submit the assessment.

Trusted Information sources

The agent is instructed to use:

• Academic papers

• Official company websites and publications

• Regulatory filings

• Reputable mainstream news sources

When information is identified through a secondary aggregator, the agent attempts to trace the finding to the original source when possible.

Excluded Information Sources

The agent is instructed not to use:

• Dark web sources

• Non-verifiable forums

• Rumor-based sites

• Social media

Information collected

Deep Research attempts to gather information about the vendor, including:

• AI governance disclosures

• Company background

• Compliance posture

• ESG and governance disclosures

• Executive leadership

• Financial and business continuity risks

• Geographic presence

• Incident response practices

• Litigation and regulatory actions

• Operational disruptions

• Privacy practices

• Products and services

• Publicly disclosed breaches

• Security controls

Which questions can AI answer?

The agent attempts to populate assessment questions when sufficient evidence is available from one or more of the following sources:

• Deep Research findings

• Publicly available sources

• Uploaded documents

Generated answers are assigned a confidence level based on the available evidence:

Confidence level	Score Range	Description
High	80% or higher	Evidence is verified through official sources.
Medium	50% to 80%	Credible evidence is available, but the source may be less direct.
Low Note: Low-confidence answers are automatically filtered and are not included in the Deep Research report. The agent does not make a risk decision on your behalf; review, confirm, or edit generated responses before submitting the assessment.	Below 50%	Evidence is uncertain or insufficient.

Conflicting or insufficient evidence

When evidence is conflicting, incomplete, or potentially incorrect, use the confidence level and available source references to evaluate the generated answer. Evidence quality influences confidence scores, and generated answers include citations or source references when available.

The agent uses a human-in-the-loop model by default. Review, confirm, or edit generated responses before submitting the assessment. The agent does not autonomously approve vendor risk decisions.

If a processing step fails, retry from the last successful step. Retrying resumes the workflow but does not replace human review: confirm the vendor and assessment details before approving the launch, and review, confirm, or edit generated responses before submitting the assessment.

Low-confidence answers are automatically filtered and are not included in the Deep Research report. If the available evidence is insufficient, the agent may not generate an answer. Review the available source information, provide additional documents, or answer the question manually when needed.

Audit and data handling

The Deep Research report is attached to the assessment and stored on the third-party record's Documents tab. It is used as an input to the assessment-completion workflow.

The agent records activity to support traceability, including assessment-level and question-level activity, source-to-answer relationships, user accept, edit, or reject actions, AI actions, and the user identity and timestamp associated with those actions.

Before you begin, please ensure the following prerequisites are met:

Licensing

: Your organization must be subscribed to either the TPRM or TPM Suite Solution SKUs.

Enable Features

: Several specific features must be enabled for your account. Please contact OneTrust Support to ensure these are active.

Template Configuration

: at least one assessment template must be enabled with theAI Auto-Responsessetting.

User role

: You must be aSite adminor have a role enabled withThird-Party Risk Agent full execution accesscomposite permission. Please note that view permission will only grant access to view the agent. Subsequently, the agent can ONLY perform actions that that specific user can perform by virtue of their role.

For more information, see OneTrust AI Platform: Agent Permissions.

You must be a Site admin to perform these actions.

1. Click the gear icon in the upper right-hand corner to access Global Settings.

2. On the Global Settings menu, select AI management > AI features. The AI features screen appears.

3. Enable the following features:

   • Ask Copilot > Third-Party Risk Management Agent

   • Recommendations > Auto-responses for assessments

   
   
   

This use case is best suited for guided, conversational assessment launches where a user wants to confirm inputs, review recommendations, and approve actions before deep research and auto-responses run. This is ideal for ad hoc assessments, first-time onboarding, or any scenario where human review and flexibility are important.

1. Click the Ask Copilot button in the header, which is available on any screen in the application. The Copilot side pane appears.

   
   
   

2. Click the Menu icon in the top left on the side pane.

   
   
   

3. Select the Third-Party Risk Agent from the list to start a new chat.

   
   
   

4. Use the text field to request what you need from the agent. To demonstrate the use case, we will be asking to onboard a new vendor and conduct deep research to launch an assessment.

   
   
   

5. The agent will produce a public URL to the vendor's site. Review and confirm the name and URL before approving the vendor as a third party.

   
   
   

6. The agent will suggest an active assessment from your templates with AI Auto-Responses configured. You can modify this selection and other fields as necessary.

   Important:

   The agent filters for eligible vendor assessment templates and allows you to select the template to use for Deep Research. The suggested template is based on the assessment most commonly selected by the user.

   Deep Research generates assessment-specific FAQ responses from the questions in the selected template. Because templates contain different questions, the information gathered and the resulting answer coverage depend on the template you select.

   Only templates with AI Auto-Responses set to Suggested or Autocomplete are eligible for the agent. For more information, see Leveraging AI Auto-Responses for Assessments.

   
   
   

7. After the agent suggests an assessment template and you modify the selection or other fields as needed, upload any supporting vendor documents before you approve the request. Document upload is optional; Deep Research runs whether or not additional documents are uploaded.

   Note:

   You can upload up to 50 files, with a maximum size of 64 MB per file. Supported file formats are:

   • .pdf

   • .doc and .docx

   • .ppt and .pttx

   • .txt

   • .csv

   • .xls and .xlsx

8. When ready, click the Approve button to launch the assessment. The agent may take a few minutes to complete this task.

   Note:

   Templates approaching 3,000 questions can require excessive processing time and may exceed workflow timeouts. For best results, use appropriately scoped assessment templates. Performance testing has primarily covered templates containing approximately 300–400 questions.

9. When completed, the agent will notify that the assessment was successfully launch. It will begin scanning the uploaded files as well as trusted public sources to find answers for your respondents. An email and in-app notification will be sent when the assessment is ready with AI suggestions.

   
   
   

10. Click the Assessment link to navigate to the launched assessment. A modal will appear to show the agent is still processing the request.

    
    
    

11. When completed, the modal will update that auto-responses have been generated for related inventory questions using information either gathered from deep research online or from the provided file.

    
    
    

12. You can confirm auto-responses were generated by the agent by locating an inventory question that are marked with View AI source. It will include the specific text used to justify the response, providing full transparency.

    
    
    

13. OneTrust recommends you review, confirm, or modify as necessary prior to submission. You can now manually answer any remaining questions or upload additional documents to help the agent answer outstanding questions. 

14. When ready, click the Submit button.

Failure and retry behavior

The agent may be unable to complete a request when:

• An exceptionally large assessment template causes a timeout.

• Assessment creation fails.

• Deep Research generation or attachment fails.

• The agent is unavailable or incorrectly configured.

• No published template with the AI Auto-Responses setting enabled.

• The vendor cannot be connected to a source system.

• The vendor cannot be validated.

When a failure occurs, use the retry option to resume from the last successful step. If the request continues to fail, verify the vendor information, assessment-template eligibility, feature configuration, and file uploads before contacting OneTrust Support.

No Assessment Access in Copilot

If you receive the above error message, check the following:

• Verify that at least one assessment template has the AI Auto-Responses setting enabled.

• Confirm that Copilot and the required AI features are enabled under Global Settings.