AI Governance - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

GenAI Component Intelligence for AI Models

Create and enrich AI model records by using the ​Model library​​ with information from commonly used third-party AI models. This gives teams a continuously updated technical context to understand model behavior, assess suitability and risk, and start governance workflows without manual research.

For more information, see Creating and Managing AI Models.

AI Log Analyzer Enhancements and Support for Databricks

Leverage AI Log Analyzer on Databricks to scan inference table data for model and agent endpoints and detect PII in prompts and responses. The inference table used by each endpoint is identified without requiring any user input. This feature gives you greater visibility into where sensitive data is exposed in your AI interactions and helps you identify and reduce privacy risk across your AI workloads.

Additionally, the following metrics have been introduced for Databricks and Amazon Bedrock:

• PII categories prompts - view each detected PII category and its count in prompts.
• PII categories response - view each detected PII category and its count in responses.
• Total PII prompts - track the overall number of prompts that contain PII.
• Total PII response - track the overall number of responses that contain PII.

For more information, see OneTrust AI Log Analyzer.

Observability Enhancements: Enriched Discovery

Gain deeper visibility into your AI agents with enriched discovery that captures additional metadata, including instructions, created-by and last-updated-by details for AWS Bedrock agents, and linked identity for AgentCore agents. This enhancement helps you trace who is responsible for each agent, the identity it runs under, and how it is configured to behave.

Additionally, AI Guard metrics on the agent details page are now standardized to show data from the 24 hours since the last sync.

For more information, see Observability Usage of AI Governance Agents & Models and Collected AI Attributes.

AI Guard Agent Reconciliation

Prevent duplicate agent records in your AI inventory by reconciling agents that are created by AI Guard with agents created through assessments or discovered by the lightweight worker node. This gives you a single, accurate record for each agent, so your agent inventory stays accurate.

For more information, see OneTrust AI Guard SDK Guide.

Microsoft Copilot Studio Agent Detection

Automatically scan Microsoft Copilot Studio environments to detect agents and capture key metadata such as ownership, environment, model bindings, connected channels, and authentication settings. This creates a searchable inventory of Copilot Studio agents and their configurations in OneTrust, helping teams support governance, risk assessment, and audit readiness.

For more information, see ​AI Automation Feature Guide.

AI Policy - Automated Actions for Sending Assessments

Configure automated actions for AI policies to automatically send assessments when AI models, systems, or agents violate policies. This enhancement helps governance teams reduce manual monitoring, streamline governance workflows, and speed up remediation by triggering assessments based on policy compliance outcomes.

For more information, see AI Policy Enforcement Guide.

AI Policy - Automated Actions for Sending Emails

Configure automated actions for AI policies to automatically send email notifications when AI models, systems, or agents violate policies. This enhancement helps governance teams reduce manual monitoring, keep stakeholders informed, and respond more quickly to issues.

For more information, see AI Policy Enforcement Guide.

AI Policies Condition Expansion

Create more precise compliance rules by combining condition blocks with OR logic, in addition to AND, and by using user type attributes, such as business owner or record admin, as condition input. This enhancement helps policy owners broaden policy coverage and reduce manual workarounds for complex governance requirements.

For more information, see AI Policies Feature Guide.

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by adding more granular control over who can access specific records and what actions they can perform. Rather than granting access to all records within a solution, ABAC uses assignments and attributes to determine which records a user can access and what permissions they have on those records, helping organizations implement least-privileged access more effectively.

At General Availability, ABAC Phase 1: Foundations adds reporting across all object types, record-level admin access rules across all supported object types (with the option to leave the record admin attribute empty), and system assignments that are enabled for all supported objects, so users can start sharing records right away, even before you create custom assignments.

All supported objects across AI Governance have feature parity within the context of ABAC Phase 1 capabilities, excluding assessments, and ABAC is enabled in all tenants regardless of packaging and pricing.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC Phase 1: Foundations is rolling to General Availability incrementally by environment from November 2026 through March 2027. The rollout is per environment and is not part of the standard release process, and dates are subject to change. Additional capabilities and object support will be introduced in future releases through ABAC Phase 2: Dynamic Access.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for AI Governance.

Mention Users in Comments with Attribute-Based Access Control (ABAC)

In AI Governance, mentioning other users in comments is now available for everyone when they have the access ability to comment. Permissions are checked throughout, including after an assignment changes.

Unified Table Experience in Attribute Manager

Attribute Manager in AI Governance now offers a unified, standardized table experience with paginated, resizable tables and consistent search, sort, and filter behavior. This replaces inconsistent filtering, sorting, and table behavior across Attribute Manager experiences, making configuration faster, easier, and more reliable for Site Admins and managers who configure objects, attributes, and assessments, and reducing the risk of misinterpreting data.

These enhancements will be available for the following AI Governance objects:

• AI Agent

• AI Systems

• Datasets

• Models

• Projects

Standardized Attribute Export

Attribute exports in AI Governance now include additional columns for standardization and have support for exporting specific columns and their attribute values. This provides administrators consistent, reliable data for audits, reporting, and governance reviews.

These enhancements will be available for the following AI Governance objects:

• AI Agent

• AI Systems

• Datasets

• Models

• Projects

Text Field Character Limit

Text fields in the AI Governance Attribute Manager now support up to 10,000 characters. This establishes a consistent data model that lets customers reliably capture detailed, long-form input across all downstream experiences, replacing a limit of about 1,000 characters.

These enhancements will be available for the following AI Governance objects:

• AI Agent

• AI Systems

• Datasets

• Models

• Projects

Standard Table Experience and Customize Option Order for Attribute Options

The attribute options table in the AI Governance Attribute Manager now uses the standard OneTrust table, providing a consistent, standardized table experience. The new Reorder options experience makes it easier to customize the order of attribute options. A Customize option order setting now appears above the options list in place of the checkbox and drag handle on each row, and the Search options field remains in the same place. Adopting the standard table simplifies maintaining attribute options and supports future maintenance.

These enhancements will be available for the following AI Governance objects:

• AI Agent

• AI Systems

• Datasets

• Models

• Projects

AI Governance Workflows: Reorder Trigger Groups and HTML Sanitization Checks

In AI Governance workflows, administrators can now reorder trigger groups to control the sequence in which rules run. HTML sanitization checks now also apply when creating rules with Create Task or actions, helping keep task and notification content safe. These updates make workflow automation more predictable and easier to manage.

This enhancement is available for AI Governance workflows on the following objects:

• AI Agents

• AI Systems

• Models

• Projects

Project Risk Assessments

Create Projects from the Inventory menu to track risks across your organization with a consolidated view of associated risks in the Risks tab. This feature brings together direct and indirect risks from linked inventories, assessments, and template rules into a single aggregated project-level risk score to help teams gain a more holistic understanding of risks.

For more information, see Managing Projects in AI Governance.

Fixed

• Resolved an issue that caused the Projects screen to display as a blank page when navigating to it from the Inventory manager.

• Resolved an issue that prevented AI systems belonging to sibling organizations from displaying on the AI systems screen when assigned to users via Attribute-Based Access Control (ABAC).

• Resolved an issue that prevented risk levels from appearing when configuring the Risk level condition for project-type automation rules.

• Resolved an issue that prevented users from bulk deleting AI agents.

• Resolved an issue that prevented users from decreasing column widths on the AI systems screen.

• Resolved an issue that prevented users from deleting stages in cloned AI System workflows.

• Resolved an issue that prevented the Create Object API from reusing a model name after the existing model was renamed.

• Resolved an issue that prevented users from approving AI Governance assessments when approval updated linked records.

• Resolved an issue that prevented attributes and related entity details from displaying in PDF reports exported from the AI system details screen.

New Public Preview Features

Attribute Visibility Rules for AI Governance Inventory

Configure Attribute visibility rules to hide selected attributes for specific organizations and their child organizations across AI systems, models, agents, and datasets. This enhancement gives each organization a focused inventory view and reduces unintended data exposure during governance and audit activities.

For more information, see Attribute Visibility Rules in AI Governance.

AI Policies - Visibility in Program Governance

View applicable AI policies and take actions directly from the AI agent or model details page by using the new AI policies tab. The tab lists the active policies that apply to the selected agent or model, shows the evaluation status against each policy, and provides the actions available for that status. This enhancement gives governance teams a clear view of their compliance obligations in the context where they work, without switching to the separate policy management view.

For more information, see AI Policies Feature Guide.

Existing Public Preview Features

Standard / Control Framework Changes

New Colorado Automated Decision-Making Technology Framework Added

Colorado Automated Decision-Making Technology (Colorado Senate Bill 26-189) establishes requirements for developers and deployers of automated decision-making technology (ADMT) that materially influences consequential decisions, such as decisions about employment, housing, lending, insurance, and health care. The law applies to covered consequential decisions made on or after January 1, 2027.

We've made implementing Colorado's ADMT requirements easy by offering a framework on the OneTrust platform with controls, implementation guidance, and mapped evidence tasks. The framework covers developer documentation, consumer notices, recordkeeping, data access and correction, and human review. It also addresses related Colorado provisions for conversational AI services and misleading AI claims about psychotherapy.

Scoping survey questions help users identify relevant controls based on their role, organization type, and activities. Control guidance identifies applicable dates and explains how to implement the requirements.

For more information, see Supported Control Frameworks.

New Canada OSFI E-23 Model Risk Management Framework Added

Guideline OSFI E-23 Model Risk Management (2027) **sets out supervisory expectations for how federally regulated financial institutions manage model risk. It covers traditional, AI, and machine learning models and calls for oversight proportionate to the risks they pose. The guideline takes effect on May 1, 2027.

We've made implementing OSFI E-23 easy by offering a framework on the OneTrust platform with controls, implementation guidance, and mapped evidence tasks. The framework covers model governance, inventory and risk ratings, independent review, deployment, monitoring, and retirement.

Selecting the framework in the scoping survey brings the full control set into scope. Institutions can use the guidance and evidence tasks to assess their practices and document how they manage model risk throughout the lifecycle.

For more information, see Supported Control Frameworks.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: AI Governance. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.