All Solutions Release Notes

Read the release notes for all solutions in this release.

AI Governance

AI Governance - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

GenAI Component Intelligence for AI Models

Create and enrich AI model records by using the Model library with information from commonly used third-party AI models. This gives teams a continuously updated technical context to understand model behavior, assess suitability and risk, and start governance workflows without manual research.

For more information, see Creating and Managing AI Models.

AI Log Analyzer Enhancements and Support for Databricks

Leverage AI Log Analyzer on Databricks to scan inference table data for model and agent endpoints and detect PII in prompts and responses. The inference table used by each endpoint is identified without requiring any user input. This feature gives you greater visibility into where sensitive data is exposed in your AI interactions and helps you identify and reduce privacy risk across your AI workloads.

Additionally, the following metrics have been introduced for Databricks and Amazon Bedrock:

PII categories prompts - view each detected PII category and its count in prompts.
PII categories response - view each detected PII category and its count in responses.
Total PII prompts - track the overall number of prompts that contain PII.
Total PII response - track the overall number of responses that contain PII.

For more information, see OneTrust AI Log Analyzer.

Observability Enhancements: Enriched Discovery

Gain deeper visibility into your AI agents with enriched discovery that captures additional metadata, including instructions, created-by and last-updated-by details for AWS Bedrock agents, and linked identity for AgentCore agents. This enhancement helps you trace who is responsible for each agent, the identity it runs under, and how it is configured to behave.

Additionally, AI Guard metrics on the agent details page are now standardized to show data from the 24 hours since the last sync.

For more information, see Observability Usage of AI Governance Agents & Models and Collected AI Attributes.

AI Guard Agent Reconciliation

Prevent duplicate agent records in your AI inventory by reconciling agents that are created by AI Guard with agents created through assessments or discovered by the lightweight worker node. This gives you a single, accurate record for each agent, so your agent inventory stays accurate.

For more information, see OneTrust AI Guard SDK Guide.

Microsoft Copilot Studio Agent Detection

Automatically scan Microsoft Copilot Studio environments to detect agents and capture key metadata such as ownership, environment, model bindings, connected channels, and authentication settings. This creates a searchable inventory of Copilot Studio agents and their configurations in OneTrust, helping teams support governance, risk assessment, and audit readiness.

For more information, see AI Automation Feature Guide.

AI Policy - Automated Actions for Sending Assessments

Configure automated actions for AI policies to automatically send assessments when AI models, systems, or agents violate policies. This enhancement helps governance teams reduce manual monitoring, streamline governance workflows, and speed up remediation by triggering assessments based on policy compliance outcomes.

For more information, see AI Policy Enforcement Guide.

AI Policy - Automated Actions for Sending Emails

Configure automated actions for AI policies to automatically send email notifications when AI models, systems, or agents violate policies. This enhancement helps governance teams reduce manual monitoring, keep stakeholders informed, and respond more quickly to issues.

For more information, see AI Policy Enforcement Guide.

AI Policies Condition Expansion

Create more precise compliance rules by combining condition blocks with OR logic, in addition to AND, and by using user type attributes, such as business owner or record admin, as condition input. This enhancement helps policy owners broaden policy coverage and reduce manual workarounds for complex governance requirements.

For more information, see AI Policies Feature Guide.

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by adding more granular control over who can access specific records and what actions they can perform. Rather than granting access to all records within a solution, ABAC uses assignments and attributes to determine which records a user can access and what permissions they have on those records, helping organizations implement least-privileged access more effectively.

At General Availability, ABAC Phase 1: Foundations adds reporting across all object types, record-level admin access rules across all supported object types (with the option to leave the record admin attribute empty), and system assignments that are enabled for all supported objects, so users can start sharing records right away, even before you create custom assignments.

All supported objects across AI Governance have feature parity within the context of ABAC Phase 1 capabilities, excluding assessments, and ABAC is enabled in all tenants regardless of packaging and pricing.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC Phase 1: Foundations is rolling to General Availability incrementally by environment from November 2026 through March 2027. The rollout is per environment and is not part of the standard release process, and dates are subject to change. Additional capabilities and object support will be introduced in future releases through ABAC Phase 2: Dynamic Access.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for AI Governance.

Mention Users in Comments with Attribute-Based Access Control (ABAC)

In AI Governance, mentioning other users in comments is now available for everyone when they have the access ability to comment. Permissions are checked throughout, including after an assignment changes.

Unified Table Experience in Attribute Manager

Attribute Manager in AI Governance now offers a unified, standardized table experience with paginated, resizable tables and consistent search, sort, and filter behavior. This replaces inconsistent filtering, sorting, and table behavior across Attribute Manager experiences, making configuration faster, easier, and more reliable for Site Admins and managers who configure objects, attributes, and assessments, and reducing the risk of misinterpreting data.

These enhancements will be available for the following AI Governance objects:

AI Agent
AI Systems
Datasets
Models
Projects

Standardized Attribute Export

Attribute exports in AI Governance now include additional columns for standardization and have support for exporting specific columns and their attribute values. This provides administrators consistent, reliable data for audits, reporting, and governance reviews.

These enhancements will be available for the following AI Governance objects:

AI Agent
AI Systems
Datasets
Models
Projects

Text Field Character Limit

Text fields in the AI Governance Attribute Manager now support up to 10,000 characters. This establishes a consistent data model that lets customers reliably capture detailed, long-form input across all downstream experiences, replacing a limit of about 1,000 characters.

These enhancements will be available for the following AI Governance objects:

AI Agent
AI Systems
Datasets
Models
Projects

Standard Table Experience and Customize Option Order for Attribute Options

The attribute options table in the AI Governance Attribute Manager now uses the standard OneTrust table, providing a consistent, standardized table experience. The new Reorder options experience makes it easier to customize the order of attribute options. A Customize option order setting now appears above the options list in place of the checkbox and drag handle on each row, and the Search options field remains in the same place. Adopting the standard table simplifies maintaining attribute options and supports future maintenance.

These enhancements will be available for the following AI Governance objects:

AI Agent
AI Systems
Datasets
Models
Projects

AI Governance Workflows: Reorder Trigger Groups and HTML Sanitization Checks

In AI Governance workflows, administrators can now reorder trigger groups to control the sequence in which rules run. HTML sanitization checks now also apply when creating rules with Create Task or actions, helping keep task and notification content safe. These updates make workflow automation more predictable and easier to manage.

This enhancement is available for AI Governance workflows on the following objects:

AI Agents
AI Systems
Models
Projects

Project Risk Assessments

Create Projects from the Inventory menu to track risks across your organization with a consolidated view of associated risks in the Risks tab. This feature brings together direct and indirect risks from linked inventories, assessments, and template rules into a single aggregated project-level risk score to help teams gain a more holistic understanding of risks.

For more information, see Managing Projects in AI Governance.

Fixed

Resolved an issue that caused the Projects screen to display as a blank page when navigating to it from the Inventory manager.
Resolved an issue that prevented AI systems belonging to sibling organizations from displaying on the AI systems screen when assigned to users via Attribute-Based Access Control (ABAC).
Resolved an issue that prevented risk levels from appearing when configuring the Risk level condition for project-type automation rules.
Resolved an issue that prevented users from bulk deleting AI agents.
Resolved an issue that prevented users from decreasing column widths on the AI systems screen.
Resolved an issue that prevented users from deleting stages in cloned AI System workflows.
Resolved an issue that prevented the Create Object API from reusing a model name after the existing model was renamed.
Resolved an issue that prevented users from approving AI Governance assessments when approval updated linked records.
Resolved an issue that prevented attributes and related entity details from displaying in PDF reports exported from the AI system details screen.

New Public Preview Features

Attribute Visibility Rules for AI Governance Inventory: Configure Attribute visibility rules to hide selected attributes for specific organizations and their child organizations across AI systems, models, agents, and datasets. This enhancement gives each organization a focused inventory view and reduces unintended data exposure during governance and audit activities.
For more information, see Attribute Visibility Rules in AI Governance.
AI Policies - Visibility in Program Governance: View applicable AI policies and take actions directly from the AI agent or model details page by using the new AI policies tab. The tab lists the active policies that apply to the selected agent or model, shows the evaluation status against each policy, and provides the actions available for that status. This enhancement gives governance teams a clear view of their compliance obligations in the context where they work, without switching to the separate policy management view.
For more information, see AI Policies Feature Guide.

Existing Public Preview Features

AI Policy - Automated Actions for Flagging Risks: Configure automated actions for AI policies to automatically flag risks when AI models, systems, or agents violate policies. This enhancement helps governance teams reduce manual monitoring, streamline governance workflows, and respond more quickly to issues by triggering actions based on policy compliance outcomes.
For more information, see AI Policy Enforcement Guide.

Standard / Control Framework Changes

New Colorado Automated Decision-Making Technology Framework Added

Colorado Automated Decision-Making Technology (Colorado Senate Bill 26-189) establishes requirements for developers and deployers of automated decision-making technology (ADMT) that materially influences consequential decisions, such as decisions about employment, housing, lending, insurance, and health care. The law applies to covered consequential decisions made on or after January 1, 2027.

We've made implementing Colorado's ADMT requirements easy by offering a framework on the OneTrust platform with controls, implementation guidance, and mapped evidence tasks. The framework covers developer documentation, consumer notices, recordkeeping, data access and correction, and human review. It also addresses related Colorado provisions for conversational AI services and misleading AI claims about psychotherapy.

Scoping survey questions help users identify relevant controls based on their role, organization type, and activities. Control guidance identifies applicable dates and explains how to implement the requirements.

For more information, see Supported Control Frameworks.

New Canada OSFI E-23 Model Risk Management Framework Added

Guideline OSFI E-23 Model Risk Management (2027) **sets out supervisory expectations for how federally regulated financial institutions manage model risk. It covers traditional, AI, and machine learning models and calls for oversight proportionate to the risks they pose. The guideline takes effect on May 1, 2027.

We've made implementing OSFI E-23 easy by offering a framework on the OneTrust platform with controls, implementation guidance, and mapped evidence tasks. The framework covers model governance, inventory and risk ratings, independent review, deployment, monitoring, and retirement.

Selecting the framework in the scoping survey brings the full control set into scope. Institutions can use the guidance and evidence tasks to assess their practices and document how they manage model risk throughout the lifecycle.

For more information, see Supported Control Frameworks.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: AI Governance. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Consent & Preferences

Cookie Consent - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

Global Opt-Out Flow | Available with Solution Packaging Only

Enable end users to opt out of a purpose across all of their linked devices, services, and accounts at once using the Global opt-out settings in your preference center template. This feature enables your end users to opt out of a purpose associated with their account and automatically submits a DSR request to process their opt-out from the specified purpose or purpose group. This enhancement is designed to improve your compliance with California privacy law.

For more information, see Customizing the Preference Center Template. This feature is related to the following ideas: OT-I-9627.

Website Scan Observability

Access the new scanner Job queue to review scan statuses and start times for each of your scanned domains. This feature provides a higher degree of insight into each of your scans, enabling you to more easily monitor scan progress and diagnose failures.

For more information, see Scanning a Website and Resolving Scan Check Issues. This feature is related to the following ideas: PDGI-I-595, OT-I-12712, OT-I-4946, OT-I-514, PDGI-I-641.

Telemetry.js for Real-World Tracker Detection | Available with Solution Packaging Only

Integrate Telemetry.js with the OneTrust CMP to enable continuous runtime monitoring to help identify tracking technologies that execute during real user sessions. Telemetry.js enhances web scanning by observing tracking technologies as they run on your site. This helps provide a more complete view of technologies that may not appear during a scheduled scan, such as technologies triggered after page load, during navigation, or after a user interaction.

For more information, see Cookie Consent Integration with Telemetery.js. This feature is related to the following ideas: OT-I-115, OT-I-3340, OT-I-5581, OT-I-7652, OT-I-15110.

Country-Level Re-Consent Controls

Select individual countries within a geolocation rule when enabling re-consent during publishing. This enhancement enables you to prompt only visitors from the selected countries to provide consent again, without creating separate geolocation rules. Countries that are not selected retain their existing re-consent state, and selecting the entire geolocation rule continues to apply re-consent to all countries in the rule.

For more information, see Publishing and Implementing Cookie Consent Scripts.

Enhancements to Cookie Consent APIs

Updated the Cookie Consent APIs with the following enhancements:

Added the useDistinctScriptSrc request parameter to the Publish Script to Website API to generate a dedicated otSDKStub.js file for the domain. When enabled, the test script source URL changes and the script implemented on the website must be updated.
Added the isNewlyRemoved response parameter to the Get List of Added or Removed Cookies API to indicate whether a cookie was removed compared with the previous scan.
Updated the type response parameter in the Get Template Details API to support IAB Canada (IABC) display group types for purposes, stacks, features, special purposes, special features, and data categories. The following enum values are now supported: IABC_PURPOSE, IABC_STACK, IABC_FEATURE, IABC_SPL_PURPOSE, IABC_SPL_FEATURE, IABC_DATA_CATEGORY.
Updated the API documentation for the id path parameter in the Scan Application API and Get Application Scan API and the scanId path parameter in the Get Application Scan API to provide clearer guidance for retrieving application and scan identifiers.

Fixed

Resolved an issue that prevented buttons from displaying with consistent sizing and alignment across different banner layouts, unless the buttons leverage Define Order of CMP Buttons feature or custom CSS.
Resolved an issue that caused the GPP stub file size to increase significantly, impacting page performance.
Resolved an issue that prevented GPC consent states from accurately populating in Google Tag Manager (GTM) upon initial page load.
Resolved an issue that caused the following APIs to return errors or incorrect statuses for failed application scans.
Resolved an issue that caused Compliance Assistant scans to inaccurately flag findings on some sites, including "Dropping non-essential cookies by default" and "Dropping non-essential cookies despite selecting 'Reject all'".
Resolved an issue that prevented the scanner from crawling URLs behind a login when they were added as target pages during scan configuration.
Resolved an issue that caused the Publish Script to Website API to deploy the latest script version when the script version parameter was omitted.
Resolved an issue that prevented SDKs imported via bulk import from being displayed on the Tracking technologies screen.
Resolved an issue that prevented localized cookie descriptions from populating in Excel exports generated from the Tracking technologies screen.
Resolved an issue that prevented the Records count field from displaying in the Export details section of the Bulk export screen when no records were present on an export.
Resolved an issue that prevented the webform integration status from correctly updating to Integrated in the History tab of the Scripts screen after publishing a script with the Embedded webform script integration setting enabled.
Resolved an issue that incorrectly encoded special characters in purpose descriptions as HTML entities if anchor links were present and HTML sanitization was enabled.
Resolved an issue that displayed the consent sync notification on sites even when the Enable syncing notification setting was disabled on the Consent group details screen.
Resolved an issue that caused the title and description of the Sale/Sharing and Targeted Advertising Cookies category in the preference center to revert to English for all languages when changes were made to the English version.

New Public Preview Features

CMP Revamp Phase 2: Overview, Scans, Experience, and Geolocation Rules

Leverage the redesigned Overview, Scans, Experience, and Geolocation rules screens to manage website setup, scans, consent experiences, and geolocation rules in a more cohesive workflow. This enhancement builds on Phase 1 of the New CMP Experience feature to reduce the steps required for core tasks such as scheduling scans, configuring templates, and publishing. The enhancement includes a redesigned Overview tab that highlights website status, recent changes, and next steps, and a Scans screen that makes scan status, history, and results easier to understand and act on. You can enable this feature directly in Global Settings

For more information, see Enabling the New CMP Experience. This feature is related to the following ideas: OT-I-7301,CSC-I-264,PDGI-I-1856, CSC-I-214, PDGI-I-1936.

Ownership and Accepted Risk for Compliance Assistant

Assign owners to Compliance Assistant findings and mark findings as accepted risk. This enhancement improves accountability and audit readiness by enabling you to reassign findings for remediation, filter findings by status, owner, and finding type, review the ownership and status history of each finding, and export findings with owner and status details. You can also enable or disable Compliance Assistant for each website individually.

For more information, see Leveraging CMP Compliance Assistant. This feature is related to the following ideas: CS-I-105, CS-I-107, CS-I-106, CS-I-59, OT-I-3774.

Expanded State Support for the Global Privacy Platform

Generate state-specific Global Privacy Platform (GPP) strings for the following additional U.S. states:

Indiana
Kentucky
Maryland
Minnesota
Rhode Island

When a geolocation rule targets one of these states and both GPP and state-specific strings are enabled, the Web SDK generates the applicable state section based on your existing purpose and category mappings. Your vendors can read the state section using the standard GPP CMP API.

For more information, see Configuring Global Privacy Protocol Settings.

Existing Public Preview Features

New CMP Experience

Enable the New CMP Experience setting to leverage the redesigned Cookie Consent interface. This new interface streamlines multiple interfaces within Cookie Consent to create a unified experience that improves navigation and makes it easier to deploy and manage your CMP.

Note:

You can enable this preview feature using an in-app setting within Global Settings

For more information, see Enabling the New CMP Experience.

Email Completion Notifications for Compliance Assistant |Available with Solution Packaging Only

Receive email notifications for completed Compliance Assistant scans. This enhancement notifies compliance assistant scan owners via email that the scan has completed.

For more information, see Leveraging CMP Compliance Assistant.

Enhanced Auto-Blocking Interface

Leverage an improved Auto-Blocking experience, featuring a redesigned safe list, block list, and match list. The enhanced Auto-Block tab is designed for a quicker and easier user experience when reviewing and blocking URLs.

For more information, see OneTrust Cookie Auto-Blocking (Enhanced Interface).

Banner SEO Configuration

Deploy your banner script with header (<h>) tags replaced as paragraph (<p>) tags for improved search engine optimization.

For more information, see Publishing and Implementing Cookie Consent Scripts, or contact OneTrust Support or your account representative.

Support for Multi-Language Privacy Policy Links

Configure privacy policy links in multiple languages on the Dynamic Links section of the Website Details screen. This feature enables you to offer privacy policy links and information in each language relevant to your business needs.

For more information, see Configuring Domain Branding.

Enhanced State Support for the Global Privacy Platform

The Global Privacy Platform (GPP) settings now support consent strings for the following US states:

Delaware
Iowa
Nebraska
New Hampshire
New Jersey
Tennessee

For more information, see Configuring Global Privacy Platform Settings.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

Always Inactive Consent State

Leverage the new Always Inactive consent state to allow users to display tracking technologies that are present but not enabled on their websites. This consent state enables you to notify your end users that a tracking technology is deployed but not active.

For more information, see Cookie Consent Models and Configuring Geolocation Rules.

Enable Global Privacy Platform on TCF 2.4 Templates

Enable the Global Privacy Platform setting on TCF 2.4 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Platform (GPP) and populate the IAB TCF EU section of the GPP string.

For more information, see Configuring the Global Privacy Platform Settings.

Legitimate Interest Configuration for Reject All on IAB Templates

Implement a Reject All button on your Preference Center and Cookie Banner that prevents objection to legitimate interest. This enhancement improves compatibility with Google Limited Ads.

For more information, see Customizing the Preference Center Template.

Server-Side Rendering

Server-side rendering is now available for Cookie Banner HTML and CSS.

For more information, see Server-Side Rendering: Performance and Availability.

Accessibility Conformance

Focus now lands on the Email field of the Global opt-out modal during both forward and backward navigation (WCAG-AA 3.2.3: Consistent Navigation).
Keyboard focus now automatically moves to the Double Opt-In confirmation modal when the modal displays (WCAG‑A 2.1.1: Keyboard).
Resolved an issue that prevented the banner from being reachable via keyboard navigation when the Banner focus setting was disabled (WCAG‑A 2.1.1: Keyboard).
Resolved an issue that caused keyboard navigation to skip native page elements and move directly into the banner (WCAG‑A 2.1.1: Keyboard).
Screen reader ARIA labels for category filters on the preference center are now fully localized to the selected published language, including ordinal indicators such as "of".

Things to Know

Icon Performance on the CMP: The icons on the CMP have been split into functional and branding components to optimize performance and reduce page weight for sites using custom logos.
Always Send Advanced Analytics Settings on Geolocation Rules: The Advanced Analytics setting on geolocation rules now includes an Always send option, ensuring core consent proof is captured in all consent receipts regardless of category.
Consent Sources in Receipts: Consent sources are now always included in consent receipts regardless of Advanced Analytics settings.
User Agent Setting for Scans: TheScan website screen features a new User agent setting to allow users to leverage the latest version of the OneTrust user agent for enhanced scan performance.
Improved Tracking Technology Details: Tracking technology instances now include discovery metadata, including date first seen, and resource attribution information, including the resource URL that generated the discovery and the page URL where the technology was discovered.
Tracking Technologies Feature Management: The enhanced Tracking technologies interface is now managed through the Enable new experience setting in the Cookie Consent section of the Global Settings menu.
Enhanced Autoblocking Experience Feature Management: The Enhanced Autoblocking Experience is now is now managed through theEnable new experiencesetting in the Cookie Consent section of the Global Settings menu.
Source Field Localization: Selection menu options for the Source field on the Bulk import cookies modal now display localized when bulk importing cookies on the Tracking technologies screen.
IAB TCF 2.4 Standard Feature Explanation Text: The IAB TCF 2.4 standard feature explanation text is now available for all supported languages. This ensures that the mandatory standard explanation for features is displayed on the TCF 2.4 template as required by IAB policy.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Mobile & OTT/CTV App Consent - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

Consent Management Platform APIs

The following APIs are available for retrieving the interface attributes needed to display the banner and preference center, retrieving active IAB and Google vendor information, logging consent interactions, and submitting global opt-out data subject access requests. These APIs enable developers to retrieve the data required for banner and preference center experiences, disclose vendor information to end users, capture consent preferences, and support Global Opt-Out workflows across devices and services.

Consent SDK APIs for Web SDKs

Added Web SDK support across CMP APIs to provide a shared foundation for delivering consent experiences across platforms. This enhancement helps customers maintain more consistent consent behavior, scale Web SDK deployments across large website portfolios, adapt to changing privacy requirements, and support contextual and custom consent experiences. Specific details are captured within the following updates:

Web SDK Support for the Log Consent API
Web SDK Support for the Get IAB and Google Vendors API
Web SDK Support for the Get Banner Data API
Web SDK Support for the Get Preference Center Data API

For more information, refer to the cmpapi-202611.1.0 Release Notes and Changelog. This feature is related to the following ideas:

OT-I-9796, OT-I-10670, OT-I-16661.

Fixed Admin

Resolved an issue that prevented purposes from populating on the Template details screen when using the search bar in the template's Universal consent purposes tab to find and add purposes.

Fixed iOS

Resolved an issue that caused stale consent data from a previous profile to be incorrectly copied to the active profile during SDK initialization when multi-profile consent was disabled.
Resolved an issue that prevented the banner from being suppressed in web views when using authenticated consent on iOS devices.

Fixed Android TV

Resolved an issue that caused applications to become unresponsive on Android TV when viewing the vendor list on the preference center.

Fixed Apple TV

Resolved an issue that caused stale consent data from a previous profile to be incorrectly copied to the active profile during SDK initialization when multi-profile consent was disabled.

Fixed Roku

The Animation.optional field and rohttpagent.InitClientCertificates() function have been deprecated for Roku OS 16.

Existing Public Preview Features

Roku Support for Unified Consent Profile for Known Users

Leverage the new Unified Consent Profile for Known Users functionality to connect data subjects' CMP preferences with Universal Consent & Preference Management profiles by enabling the Create data subject profiles for known users setting on the Geolocation Rules tab. You can also easily trigger integration workflows to send CMP preferences to downstream systems, and efficiently manage your preferences in a unique Preference Center, centralizing all of them in one single profile.

This enhancement provides a comprehensive view of data subjects empowering you with more control over the data captured across both modules, resulting in a more streamlined and tailored user experience.

For more information, see Connecting CMP preferences with Universal Consent & Preference Management Profiles.

Configure Button Layout for the Banner

Configure the positioning of buttons on your mobile and CTV banners within the Button Sets section of the Template Details screen. This enhancement allows you to specify the positioning of buttons on your banners for a more customized experience.

iOS
Android

For more information, see Customizing the Mobile App Consent Banner Template and Customizing the Mobile App Consent Preference Center Template.

Enhanced Branding Settings for Mobile and CTV SDKs

Configure detailed branding settings for your mobile SDKs on the Branding tab of the Mobile App Details and CTV App Details screen, respectively. This enhancement enables you to configure more specific branding settings for each of your mobile and CTV applications.

For more information, see Configuring Mobile and CTV App Branding.

Validation for Cross-Device Consent Receipts | Available with Solution Packaging Only

Enable the Require Authentication for known users setting when leveraging Cross-Device Consent to require validation on your consent receipts. This enhancement allows you to more reliably collect consent from known users.

For more information, see Configuring Geolocation Rules.

Note:

This enhancement is only available to users with the Consent Rate Optimization (CRO) add-on package. Contact OneTrust Support or your account representative to enable this functionality.

To learn more, see Maximize Opt-Ins with Consent Rate Optimization.

Authenticated Consent for New and Existing Users

This feature is available for the following platforms:

iOS
Android
Apple TV
Android TV

Enable Global Privacy Protocol on TCF 2.4 Templates

Enable the Global Privacy Protocol setting on TCF 2.4 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Protocol (GPP) and populate the IAB TCF EU section of the GPP string.

This feature is available for the following platforms:

Android
Android TV
Apple TV
HTML5
iOS
Roku
Unity
Xamarin

For more information, see Configuring the Global Privacy Protocol Settings.

New Reject All Button Configuration

Enable the updated Reject All button configuration on the Preference Center template. This new configuration ensures that legitimate interest is not impacted for customers using Google Ads.

For more information, see Customizing the Mobile App Consent Preference Center Template.

Accessibility Conformance

The banner landing description is now announced first when the banner loads for the first time with screen readers enabled on iOS and Android. Additionally, the Close button spacing has been aligned across both platforms to ensure layout consistency (WCAG‑A 1.3.1: Info and Relationships).
Resolved an issue that prevented users from exiting the preference center using the device's back button or back gesture on Android devices (WCAG-AA 3.2.3: Consistent Navigation).

Things to Know

OneTrust iOS SDK CocoaPods Deprecation

OneTrust iOS SDK version 202611.1.0 will be the final version published through CocoaPods. This change aligns with the announcement that CocoaPods Trunk will become read-only on December 2, 2026. After this date, new pods and pod versions can no longer be published.

For more information, see CocoaPods Deprecation.

Consent Receipt Source Field and CTV Support

Consent receipts now store the Source field when the purpose IDs are empty or missing. Additionally, CTV is now supported as a valid source type for consent receipts.

Global Opt-Out Confirmation Modal on Roku

A global opt-out confirmation modal now displays on the SDK list in the preference center when an end user disables consent for an SDK linked to a parent purpose on Roku devices.

SingleSelectAriaLabel Accessibility Key

A new SingleSelectAriaLabel key has been added to application data to improve accessibility for single-choice configurations.

Improved Metadata Coverage for iOS SDKs

Metadata, including vendor, and description, is now available for over 200k iOS SDKs in the mobile app scan results.

Mobile Application Scan Timeout

Mobile application scans now automatically time out and are marked as interrupted if they remain in progress for more than 10 minutes.

Firebase SDK Detection Coverage

Android application scans now include detection coverage for Firebase SDKs.

Amplitude SDK Detection Coverage

Android application scans now include detection coverage for Amplitude SDKs.

WonderPush SDK Detection Coverage

Android application scans now include detection coverage for the WonderPush SDK.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Privacy Notice Management - November 13, 2026 - 202611.1.0 (Fall Release)

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Privacy Notice Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

Share Option Enhancements

The Share option is now the first item in the Context menu to improve accessibility for accounts with ABAC enabled. This has been updated for the following objects:

Privacy notices

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Universal Consent & Preference Management - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

One-Click Links

Create personalized one-click links that let end users subscribe to or unsubscribe from their preferences through the Trust Center. This feature brings the one-click unsubscribe experience to the Trust Center, adds one-click subscribe links, and enables you to customize the content of the landing page to support more varied subscription journeys in a brand-consistent way.

This feature is related to the following ideas: CPC-I-14, PLTI-I-794, UCPMXP-I-15, CONSENT-I-102, CONSENT-I-101.

New Data Elements API

Added the Add Data Element Option API to add a new option to a selection-type data element. New options are available for future use and do not affect existing data subjects or historical consent receipts.

Always Available Collection Point Token API

Added a new high availability Get Collection Point Token API to provide uninterrupted access to collection point tokens during maintenance periods. This API enables developers and system integrations to reliably retrieve collection point tokens without disruption during scheduled maintenance windows.

Text Field Character Limit

Text fields in the Universal Consent & Preference Management Attribute Manager now support up to 10,000 characters. This establishes a consistent data model that lets customers reliably capture detailed, long-form input across all downstream experiences, replacing a limit of about 1,000 characters.

These enhancements will be available for the following Universal Consent & Preference Management objects:

Collection Point
Purpose

Fixed

Resolved an issue that caused the Remove Consent Attachment API to return a 200 OK status without deleting the attachment from the data subject's consent record.
Resolved an issue that caused the Consent Receipt Bulk Export to include all available custom preference options instead of only the options selected by the data subject.
Resolved an issue that caused collection points in a source tenant to be incorrectly denied when the same collection point GUID was disabled in a copied tenant.
Resolved an issue that caused the Get List of All Purpose Details for All Data Subjects V4 API to intermittently return an error during pagination when requests were routed across different server pods.
Resolved an issue that prevented the Get List of Data Subjects V1 API from returning privacy notices for migrated or backfilled records.
Resolved an issue that prevented Double Opt-In schedule settings from being saved on the Double Opt-In tab of the Global Settings screen.
Resolved an issue that caused the Delete Data Subject V4 API to return an error when attempting to delete data subjects using time-to-live (TTL) settings.
Resolved an issue that prevented consent strings from displaying on the Purposes tab of the Data subject details screen.
Resolved an issue that prevented the Records count field from displaying in the Export details section of the Bulk export screen when no records were present on an export.
Resolved an issue that prevented the Receipt details pane on the Receipts screen from reappearing after being closed when a new receipt was selected.
Resolved an issue that caused bulk exports to get stuck in Preparing to download status and prevented the export from completing successfully.

Existing Public Preview Features

CMP Consent Context: Added support to our existing data hierarchy to allow CMP consent users to provide consent for a purpose multiple times when using consent groups. When using consent groups with the unified profile feature, the CMP will use the same data subject for different consent groups, eliminating the need to create additional profiles.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Data Use Governance

Data Catalog - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

Text Field Character Limit

Text fields in the Data Catalog Attribute Manager now support up to 10,000 characters. This establishes a consistent data model that lets customers reliably capture detailed, long-form input across all downstream experiences, replacing a limit of about 1,000 characters.

These enhancements will be available for the following Data Catalog objects:

Data Assets
Terms

New Public Preview Features

Unified Table Experience in Attribute Manager

Attribute Manager in Data Catalog now offers a unified, standardized table experience with paginated, resizable tables and consistent search, sort, and filter behavior. This replaces inconsistent filtering, sorting, and table behavior across Attribute Manager experiences, making configuration faster, easier, and more reliable for Site Admins and managers who configure objects, attributes, and assessments, and reducing the risk of misinterpreting data.

These enhancements will be available for the following Data Catalog objects:

Data Assets
Terms

Standardized Attribute Export

Attribute data in Data Catalog can now be exported from the Attribute Manager, giving administrators consistent, reliable data for audits, reporting, and governance reviews. Exports can include the full attribute set or only filtered results, and column selection limits each file to the relevant fields.

These enhancements will be available for the following Data Catalog objects:

Data Assets
Terms

Standard Table Experience and Customize Option Order for Attribute Options

The attribute options table in the Data Catalog Attribute Manager now uses the standard OneTrust table, providing a consistent, standardized table experience. The new Reorder options experience makes it easier to customize the order of attribute options. A Customize option order setting now appears above the options list in place of the checkbox and drag handle on each row, and the Search options field remains in the same place. Adopting the standard table simplifies maintaining attribute options and supports future maintenance.

These enhancements will be available for the following Data Catalog objects:

Data Assets
Terms

Existing Public Preview Features

Policy Enforcement for Snowflake and Databricks | Available with Solution Packaging Only

Scan and classify data without relying on the limited classification capabilities provided by cloud platforms to enable automated and consistent application of policy actions across Snowflake and Databricks environments. This robust functionality supports the orchestration of masking and row filtering policies to configure access and visibility privileges to sensitive data tables in these systems.

For more information, see the following:

This feature is related to the following ideas: INT-I-34, GOVIDEA-I-24, DPOL-I-3, GOVIDEA-I-16.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Data Discovery - November 13, 2026 - 202611.1.0 (Fall Release)

Fixed

Fixed an issue where rejected terms continued to appear in search results when rejected through the Review recommendation modal.
Resolved an issue that caused worker node upgrade failure notification emails to display unrendered template placeholders rather than the affected worker node's name.

New Public Preview Features

Continuous Discovery

Use Continuous Discovery to refresh AI inventory on a recurring schedule and optionally verify scan access before creating an AI Automation.

Continuous Scan for AWS Bedrock and Google Vertex AI

Use the configured scan schedule to refresh AI inventory for Amazon Bedrock and Google Vertex AI. OneTrust selects incremental or full scans based on event-log access and connector support, so users do not need to select a scan type or configure a separate incremental scan. This helps reduce unnecessary scanning while keeping inventory information up to date.
Verify Scan Access for AI Automations

Verify scan access to check that your credentials have the required permissions to scan Amazon Bedrock and Bedrock AgentCore, Azure Foundry, or Google Vertex before creating an AI Automation. This helps identify access issues before setup, while still allowing you to create the automation if verification fails.

Existing Public Preview Features

Script Management: Run common maintenance and troubleshooting scripts directly from the platform in the new Administration tab. This reduces the need for command line interface (CLI) access or coordination with support by providing an effective and easy way to execute critical scripts.
For more information, see Script Management for Worker Nodes.
Duplicate File Detection: Identify duplicate and redundant files with AI-driven analysis based on key risk attributes (classification, shared access) and make decisions on whether to retain or remove duplicates. This enhancement helps you reduce redundant data, decrease the attack surface, and improve your security posture, with savings on cloud storage costs.
For more information, see Reviewing Scanned Files.

Things to know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Platform Capabilities

Dashboards & Reporting - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

Attribute-Based Access Control (ABAC) Phase 1

For more information, see Attribute-Based Access Control (ABAC) User Guide. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

Fixed

Resolved an issue that prevented PDF copies of assessments from being successfully generated.
Resolved an issue that prevented stage count metric data from displaying in tables within dashboards.
Resolved an issue that caused section names to display with incorrect character encoding when bulk exporting assessment PDFs.
Resolved an issue that caused a Failed to retrieve dashboards error message to display when accessing the Dashboards list screen or combined model dashboards.
Resolved an issue that prevented search keywords from being removed when using the Contains filter on the Assessment dashboard screen.
Resolved an issue that caused the screen to jump when scrolling within the data section of an Insights dashboard.
Resolved an issue that prevented the Residual risk score and Residual risk level fields from populating in engagement report PDFs.
Resolved an issue that caused Czech special characters to display with inconsistent formatting in exported PDF files for processing activity records.
Resolved an issue that caused the Reports screen to experience slow loading times when viewing or exporting incident reports with a high volume of columns.
Resolved an issue that prevented control attributes from displaying in PDF reports when using the Risks grouped by attribute view builder.
Resolved an issue that prevented assessments shared through seeded or system assignments from displaying in assessment column and PDF reports when Attribute-Based Access Control (ABAC) was enabled.
Resolved an issue that caused inventory record values to be incorrectly masked in column and PDF reports for users with viewer assignments when ABAC was enabled.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Integrations - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

New Integration Workflow Canvas Builder

Create, understand, and manage integrations with the Canvas Builder, which introduces a modern, flowchart-style way to make automation more approachable for both technical teams and program managers. Instead of working through a primarily configuration-first experience like in the original Legacy Builder, users can now see their workflow come to life on a canvas with triggers, actions, and sequencing presented in a clear visual layout.

This release includes the following enhancements:

Canvas Builder is now on by default for new and existing workflows. The Legacy Builder setting remains available to switch back.
An Unsaved Changes prompt appears when edits to an action are abandoned, with an option to save and continue.
Improved node and canvas alignment for Do While Loop, Apply to Each, and Conditional Logic actions.

For more information, see Integration Canvas Builder Feature Guide. This feature is related to the following idea: PLTI-I-634.

Device Details Integration for Activity Logs

Record the original caller's IP address and device details in Global Activity for actions performed through Integration workflows. This allows audit records now identify the actual source system, which supports incident investigation and compliance reviews.

For more information, see OneTrust Activity Log. This feature is related to the following ideas: PLTI-I-612.

Unified Table Experience in Integrations

Tables in Integrations now offer a unified, standardized table experience with consistent search, sort, filter, and pagination behavior. This replaces inconsistent table behavior across Integration experiences, making configuration faster, easier, and more reliable for users who configure integrations, credentials, actions, and custom values, and reducing the risk of misinterpreting data.

This feature is available for the following Integration areas:

Systems
Values
Credentials
Integrations
Setup for Custom Wizards
Setup for Custom Values

Integrations UI/UX Improvements

OneTrust Integrations has been updated to improve navigation, form clarity, and in-product guidance across setup and management flows. These updates are designed to reduce the effort of setting up and managing integrations, giving admins clearer navigation and feedback, and a more consistent experience across every flow.

Credentials edit and delete actions are available on each row's Context Menu.
Workflow deactivation and credential deletion options are now less prominent to help prevent accidental selection.
Added a tooltip on the Key Pair Copy icon and hover states on selection cards.

OAuth JWT Bearer Flow for Snowflake Credentials

Configure OneTrust credentials to authenticate Snowflake integrations by exchanging a signed OAuth JSON Web Token (JWT) for an access token, with no interactive sign-in. This permits OneTrust scheduled and event-driven workflows to run unattended on token-based authentication that supports security policies restricting password-based access.

New Public Preview Features

Integration Retry Queue (DLQ) Management

Reprocess or purge selected events in the new Retry Queue, which is now hosted in the Logs tab, and replaces the existing Message Container experience. These updates are designed to give admins control over failed and pending messages, helping them recover failed events without discarding pending ones and see exactly what changed after each action. Specific updates include:

Visibility: individual events in the Retry Queue are listed in the Integration logs.
Reprocess: selected events can be reprocessed instead of the entire queue.
Context menus: individual events can be reprocessed from the Context menu.
Purge: selected events can be purged instead of the entire queue, keeping pending messages safe.
Confirmation: each action confirms what changed.

For more information, see Reprocessing Methods for Integration Workflows. This feature is related to the following idea: INT-I-93.

Existing Public Preview Features

Key Pair Rotation

Refresh expiring Snowflake key pairs directly from the credentials flow instead of replacing them manually outside of OneTrust. Expiration reminder emails help teams rotate keys on time and maintain authentication continuity during the transition to the new key pair.

For more information, see Rotating Key Pairs for Integration Credentials.

Advance Authentication Methods for Snowflake Integrations

Configure key-value pair authentication for database credentials to Snowflake. Since Snowflake is deprecating support of select credentials, this enhancement improves upon the username/password flow for a more secure approach with a private key for programmatic access that supports critical, existing integrations.

For more information, see Key-Pair Authentication for Snowflake Integration Credentials. This feature is related to the following idea: INT-I-34.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Settings & Administration - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

Attribute-Based Access Control (ABAC) Phase 1

ABAC Phase 1: Foundations is available for supported objects across AI Governance, Privacy Automation, Tech Risk & Compliance, and Third-Party Management, and introduces the following core capabilities to manage record-level access and collaboration:

Assignments: Leverage out-of-the-box or custom assignments, which are sets of permissions that define what users can do on a record. Assignments can be applied through record sharing or inherited through user attributes and workflow stages to automatically grant record-level permissions for owners, approvers, reviewers, and other users involved in the record lifecycle.
Sharing, Requesting & Managing Access: Share individual records directly with users, request access to records, review who currently has access, and modify or revoke access as needed.
Record-Level Auditing: Review audit history for record access and assignment configuration changes to understand what changed, who made the change, and when the change occurred.
Reporting: Column reports, PDF reports, and report schedules respect ABAC assignments across all object types included in ABAC Phase 1.
Record Admin Access Rules: Configure record-level admin access rules across all supported object types, and optionally leave the record admin attribute empty.
System Assignments: All system assignments are enabled for all supported objects, so users can start sharing records right away, even before you create custom assignments.

At General Availability, all supported objects have feature parity within the context of ABAC Phase 1 capabilities, excluding assessments. ABAC is enabled in all tenants regardless of packaging and pricing, and customers who used share modals in Data Mapping Automation are migrated to the new sharing experience automatically.

ABAC helps organizations manage access more precisely by aligning permissions to records and assignments rather than relying on increasingly complex role structures. This enables granular record-level access control, improves governance, and simplifies collaboration across teams and workflows. With this enhancement, administrators can reduce access-management complexity while strengthening security and accountability across the OneTrust Platform.

For more information, see Attribute-Based Access Control (ABAC) User Guide. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

OneTrust Activity Log

Gain a unified, real-time view of user and system audit events across the OneTrust Platform with the Activity logs screen to increase visibility and control, investigate issues faster, and meet compliance requirements with a complete, traceable audit trail. Through a centralized audit experience, teams can quickly search and filter audit records, monitor activity across solutions from a single location, and export audit data for broader reporting and analysis. The General Availability release includes the following additional enhancements for this feature:

Capture changes or movement on platform-level events such as domains, languages, localization edits, emails, and more.
The Activity log screen now opens with a 30-day filter applied by default, and a notification banner lets you know the filter is active so you can adjust the date range as needed. Pagination has also been improved for faster performance and load times.
Integration events are now captured in the audit record, with activity payloads and message formatting standardized across Global Activity and integration events for more consistent, traceable audit data.
Process agent actor information in all audit exports and downstream integrations so that all your work receives a consistent and complete picture of agent-initiated activity.
Captures the network context for events, such as original caller's IP address and device details for actions performed, to identify the actual source system and support incident investigation and compliance reviews.
Document download and file attachment events are recorded during exports and bulk actions to understand what actions were performed and maintain audit evidence.
Activity information is also available in the activity tabs of supported and subscribed product areas, such as users, organizations, risks, and more. In these areas, you can filter an entity's activity by event type when the option is available.
The standardized Activity Record Created event is now available for sending audit information to SIEM tools with a supported OPenAPI spec for use. The existing, renamed Activity Record Created (Legacy) event is still supported and will be deprecated in the Spring '27 Release. For more information, see Integrating OneTrust Activity Logs with External SIEM Tools.

For more information, see OneTrust Activity Log.

Copy Assignments to Sandbox

Assignments are now copied from the parent tenant to a sandbox during sandbox creation or refresh. The copy includes seeded and custom assignments, as well as user-attribute and workflow-stage approval assignment mappings. After the copy, you can create additional assignments directly in the sandbox, helping you test assignment-dependent workflows in an environment that more closely reflects the parent tenant. This enhancement applies to sandboxes created after the 202609.1.0 release. If your sandbox was created before that release, refresh it before creating assignments.

For more information, see Sandbox Management Overview.

Unified Table Experience in Attribute Manager

Attribute Manager now offers a unified, standardized table experience with paginated, resizable tables and consistent search, sort, and filter behavior. This replaces inconsistent filtering, sorting, and table behavior across Attribute Manager experiences, making configuration faster, easier, and more reliable for Site Admins and managers who configure objects, attributes, and assessments, and reducing the risk of misinterpreting data.

This enhancement will be available for the following products, refer to their release notes for impacted objects:

AI Governance
Audit Management (Public Preview)
Data Catalog (Public Preview)
Data Mapping Automation
Enterprise Policy Management
Incident Management (Public Preview)
Issues Management
IT Risk Management
Third-Party Due Diligence
Third-Party Risk Management

Standardized Attribute Export

OneTrust now provides a standardized export experience for attribute tables across any product using Attribute Manager. This gives administrators consistent, reliable data for audits, reporting, and governance reviews. Exports can include the full attribute set or only filtered results, and column selection limits each file to the relevant fields.

This enhancement will be available for the following products, refer to their release notes for impacted objects:

AI Governance
Audit Management (Public Preview)
Data Catalog (Public Preview)
Data Mapping Automation
Enterprise Policy Management
Incident Management (Public Preview)
Issues Management
IT Risk Management
Third-Party Due Diligence
Third-Party Risk Management

Text Field Character Limit

Text fields across all Attribute Managers now support up to 10,000 characters. This establishes a consistent data model that lets customers reliably capture detailed, long-form input across all downstream experiences. Previously, limits of about 1,000 characters truncated responses for complex workflows such as AI governance and legal risk assessments.

This enhancement will be available for the following products, refer to their release notes for impacted objects:

AI Governance
Audit Management
Data Catalog
Data Mapping Automation
Enterprise Policy Management
Incident Management
Issues Management
IT Risk Management
Third-Party Due Diligence
Third-Party Risk Management
Universal Consent & Preference Management

Standard Table Experience and Customize Option Order for Attribute Options

The attribute options table now uses the standard OneTrust table, providing a consistent, standardized table experience across the platform. The new Reorder options experience makes it easier to customize the order of attribute options. A Customize option order setting now appears above the options list in place of the checkbox and drag handle on each row, and the Search options field remains in the same place. Adopting the standard table simplifies maintaining attribute options and supports future maintenance.

This enhancement will be available for the following products, refer to their release notes for impacted objects:

AI Governance
Audit Management
Data Catalog (Public Preview)
Data Mapping Automation
Enterprise Policy Management
Incident Management (Public Preview)
Issues Management
IT Risk Management
Third-Party Due Diligence
Third-Party Risk Management

Reorder Workflow Trigger Groups and Check Rule Content for Unsafe HTML

Administrators can now reorder trigger groups in workflows to control the sequence in which rules run, making workflow execution more predictable. When creating rules with Create Task or Send Notification actions, HTML sanitization checks now help keep task and notification content safe. Together, these updates give administrators more consistent, manageable control over workflow automation across OneTrust products.

This enhancement is available for workflows in the following products. Refer to each product's release notes for the impacted workflows:

AI Governance
Audit Management
Enterprise Policy Management
Incident Management
IT Risk Management

Mention Users and In-App Attachment Notifications with Attribute-Based Access Control (ABAC)

Users with assignment-based access can now take part in comments and mention other users when they have the access ability to comment. They can also download eligible export attachments from in-app notifications when they are authorized. Permissions are checked throughout, including after an assignment or export permission changes, so customers get a more consistent experience without access extending beyond its intended boundaries.

This enhancement is available for all ABAC-supported objects in the following ABAC-adopted solutions:

AI Governance
Privacy Automation
Tech Risk & Compliance
Third-Party Management

New Roles APIs

Added the Get List of Roles API and Get Role API to retrieve system and custom roles available in the tenant, with the new ROLE_READ OAuth scope providing read access to these APIs. These APIs provide an authoritative way to discover and validate tenant roles, reducing reliance on manual role ID retrieval for user provisioning, access reconciliation, and other access management workflows.

Fixed

Resolved an issue that prevented the names of custom attribute options added during entity creation from displaying on the Attribute details screen.
Resolved an issue that prevented the assignment name from updating in the page title until the record was saved or activated.
Resolved an issue that caused incorrect operators to display in Project rule conditions for array-type values.
Resolved API documentation issues to properly reflect parameter requirements across various Access Management, Documents, and SCIM APIs to align with actual API behavior.
Tasks created on an issue now automatically inherit the organization of the parent issue record.
Resolved an issue that caused a 403 error to display when ABAC users attempted to delete attachments.
Resolved an issue that prevented the user list from loading when multiple organization filters were applied.
Resolved an issue that prevented email attachments from being included in notifications when using a Microsoft Exchange SMTP connection.

New Public Preview Features

Platform-Consistent Table Experience for Tasks: The Tasks table now offer the same table experience as other tables across the platform. Users get consistent behavior when moving between tables, along with core functionality such as sorting and filtering. This improves usability and interface consistency, reduces friction, and delivers the modern, reliable table experience users expect.

Existing Public Preview Features

Privacy Risk Agent |Available with Solution Packaging Only

Leverage our Privacy Risk Agent in Copilot to streamline the creation of processing activities and the completion of assessments. This agent dramatically reduces the time and manual effort required to complete PIAs, improves accuracy through semantic matching and document-based autofill, and provides transparent confidence scoring, which enables Privacy Managers to complete assessments faster, more consistently, and with greater confidence.

For more information, see OneTrust Privacy Risk Assessment Feature Guide.

SCIM Users and Groups Integrations

Utilize the Integrations module to configure triggers and actions for SCIM Users and Groups. This feature allows users to automate their organization's processes when managing user and group information using SCIM APIs.

For complete details on these workflow options, see Managing Custom Integration Workflows.

New Root Organization

Create a new root organization at the top of an existing organizational hierarchy using the new Set as the Root Organization check box on the Add Organization modal. This feature allows you to move an existing organizational structure, along with certain previously configured settings, under a new root organization.

For more information, see Managing Organizations.

Integrate Tasks with External Systems

Manage tasks created within the application across external systems by creating integration workflows using the following new integration events:

Task Add Attachment
Task Add Comment
Task Created
Task Deleted
Task Remove Attachment
Task Updated

This enhancement allows you to manage tasks across external systems, which may be helpful when addressing tasks that require a large volume of actions.

For more information, see Integrating Tasks with External Systems.

Platform Enhancements

Customize Global Header Navigation

Apply your organization's branding to the Global header navigation, including the popover, using Application Branding in Global Settings. This enhancement extends your branding beyond the platform logo for a consistent experience across the platform.

For more information, see Application Branding Settings.

Improved Global Font

OneTrust has updated the font used throughout the platform to improve readability, visual consistency, and the overall user experience. This is a visual enhancement only and does not affect platform functionality or workflows.

Things to Know

AI Features on by Default for New Customers

As of the OneTrust 202611.1.0 release, AI Features in General Availability will be turned on by default for new customers outside of the EU and UK. EU, UK, and dedicated environments are not impacted and will remain on an opt-in model. This enhancement promotes visibility and usage of OneTrust AI Features for eligible environments without prior configuration.

For more information, see Managing AI Features in the OneTrust Platform.

Get Help Links to New Documentation Hub

The Get Help menu in the OneTrust platform now directs users to the Documentation hub of myOneTrust.

Global Search + ABAC

Global Search now supports searching for items based on explicitly tagged users and user groups granted access through Attribute-Based Access Control (ABAC).

Legacy Sharing vs. ABAC Sharing

OneTrust is planning to transition customers from the legacy sharing experience to Attribute-Based Access Control (ABAC) sharing for Inventory objects. ABAC provides a more consistent and scalable access model, supports Assets, Processing Activities, Entities, Vendors, and Projects, and offers more advanced access-control options.

If your tenant currently uses Legacy Share, your existing sharing configuration will continue to work until you are ready to transition. The migration is not automatic, and Legacy Share continues to take precedence for Inventory objects where both sharing models are available. Review your current sharing setup and discuss readiness with your stakeholders. If you are ready before your environment is upgraded, please contact OneTrust Support.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Trust Center - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

Trust Center Copy/Clone

Copy an existing Trust Center to create a new Trust Center with the same configuration. This feature copies supported configuration, including pages, sections, layout, content blocks, branding, translations, and access settings, so you can reuse successful Trust Center configurations instead of rebuilding them manually. This feature also ensures parity with preference center functionality.

For more information, see Copying a Trust Center. This feature is related to the following ideas: UCPMXP-I-58.

New Public Preview Features

Double Opt-In for Trust Center: Enable double opt-in in your Trust Center settings to require end users to confirm their consent choices by email. When double opt-in is enabled, consent remains in a Pending status until the end user confirms it from the confirmation email. This feature brings double opt-in parity with the Preference Center and helps you meet regional double opt-in requirements. This feature also ensures parity with preference center functionality.
For more information, see Configuring Double Opt-In for a Trust Center. This feature is related to the following ideas: UCPMXP-I-18.
Single Sign-On for Trust Center (OIDC): Authenticate Trust Center end users through your organization's identity provider using OpenID Connect (OIDC). This feature enables you to rely on your existing identity and access management (IAM) solution to determine who can log in to your Trust Center, simplifying Trust Center rollout. When single sign-on is configured, end users are automatically redirected to your identity provider to log in. This feature also ensures parity with preference center functionality.
For more information, see Configuring Single Sign-On for Trust Centers. This feature is related to the following ideas: OT-I-16924,CSC-I-157 CD-I-59.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Privacy Automation

Assessment Automation - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

New Rich Text Editor for Assessments

The new rich text editor is now available across Assessment Automation. This enhancement includes:

Full-screen mode: Expand any editor to full screen, including editors inside pop-ups, without losing your text or cursor position.
Keyboard shortcut help: A new help button that lists all keyboard shortcuts.
Code formatting in templates: Question descriptions and welcome messages can now use a Code paragraph style alongside Normal text.
Automatic links: Typing or pasting a web address turns it into a clickable link.
Cleaner pasting: Content pasted from Word, Teams or web pages keeps its text, lists, bold, and links.

You will see the new editor in the following places:

Assessment detail: Question descriptions, text answers and justifications, comments, Needs More Info requests and replies, and notes.
Templates: Question descriptions in the question builder and the welcome message.
Global Readiness: Welcome question preview.

Information Request Data in Reports

You can now access information request data directly through column reports. This enhancement streamlines tracking and analysis of requests without manual effort, and improves visibility and response times across your compliance workflows.

For more information, see Data Glossary for PIA & DPIA Automation Reports.

Lazy Loading in Multiselect Attribute Dropdown Lists

Multiselect attribute dropdown lists in assessments now use lazy loading by default. This update ensures that additional records are automatically fetched as users scroll past the initial 200 results, allowing customers with large inventories to successfully locate and select the appropriate records when answering assessment questions.

Attribute-Based Access Control (ABAC) Phase 1

At General Availability, ABAC Phase 1: Foundations adds reporting across all object types, record-level admin access rules across all supported object types, and system assignments that are enabled for all supported objects, so users can start sharing records right away, even before you create custom assignments.

All supported objects across Privacy Automation have feature parity within the context of ABAC Phase 1 capabilities, excluding assessments, and ABAC is enabled in all tenants regardless of packaging and pricing.

Note:

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Privacy Automation.

Mention Users in Comments with Attribute-Based Access Control (ABAC)

In Privacy Automation, mentioning other users in comments is now available for everyone when they have the access ability to comment. Permissions are checked throughout, including after an assignment changes.

Fixed

Resolved an issue that prevented Incident assessments based on the the PIA template from being included in assessment exports.
Resolved an issue that caused the Save button to remain disabled after resolving duplicate option errors when editing a multiple-choice question.
Resolved an issue that caused the cursor to reset to the beginning of the text box while typing responses in an assessment.
Resolved an issue that prevented the download link for PDF or Excel template exports from displaying in the Notification center for on-premises users.
Resolved an issue that allowed unauthorized users to view the user list and modify the Record admin field on an assessment.
Resolved an issue that prevented assessments from linking to selected project inventory records and caused existing links to be removed upon completion.
Resolved an issue that caused the Export Template API to omit keys with null values, such as responseCount, option, and optionId, from the response schema.
Resolved an issue that caused deleted user groups to be automatically added as section approvers when creating new assessments from a template.
Resolved an issue that prevented translated section names from displaying when viewing an assessment in a language other than English.
Resolved an issue that prevented the Third-Party Risk Agent from launching intake assessments in Copilot.
Resolved an issue that prevented update and delete requests through the Manage Assessment Question Attachments API from returning results, with users instead seeing an access denied message.

Existing Public Preview Features

Privacy Risk Agent | Available with Solution Packaging Only

For more information, see OneTrust Privacy Risk Assessment Feature Guide.

Launch Reassessments as Not Started

Configure reassessments to default to the Not Started stage upon launching. This enhancement applies to copied assessments, reassessments launched via automation rules, and reassessments launched via API.

Company Names in Email Notifications

Display your company name in assessment email notification templates using the __TenantName__ email variable when notifying users. This enhancement enables you to provide assessment notifications on behalf of your organization that reflect your tenant's name.

For more information, see Customizing Assessment Email Templates Using Dynamic Variables.

Accessibility Conformance

The rich text editor now maintains high contrast and displays visible focus indicators when Forced Colors mode is enabled (WCAG‑AA 1.4.3: Contrast (Minimum)).
Tooltip info messages on the Complete section modal of an assessment are now focusable when using a keyboard (WCAG‑A 2.1.1: Keyboard).
The View approvers popover now includes a close button and no longer remains open when navigating away from the element (WCAG‑A 2.1.1: Keyboard).

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Assessment Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Advanced attributes redacted for users with Standard-only view permissions

Users with only Standard attribute view permissions now see Advanced attributes as redacted in the assessment list view, assessment details, and side panels. Standard attributes display as before. Users with Advanced attribute view permission continue to see all attributes, with no change.

Updated Standard and Advanced attribute classification

Assessment attributes used for Attribute-Based Access Control (ABAC) have been reclassified. ID, Stage, Date submitted and Date completed are now Standard attributes.

Standard attributes: Name, ID, Template, Workflow, Organization, Primary record ID, Primary record name, Stage, Respondent, Approver, Record admin, Tags, Deadline, Date submitted, Date completed.

Advanced attributes: Result, Inherent risk score, Residual risk score, Target risk score, Open risk count, Open issue count, Open info request count, Approval stage, Pending reviews, Date deleted, Deleted by, Template version, Creator, Date created.

Template Updates

OnePIA (Full) - 7.7 Change Log

OnePIA has been updated to account for the latest amendments to the comprehensive US state privacy laws of Connecticut and Virginia. Customers interested in compliance with these frameworks are impacted by this release.

The following is the change log for this release:

Updated the logic of question 4.37.
Added new question 5.13 for Sale of consumers' precise geolocation data [US-VA, US-CT].
Created the new Geolocation Data Sale [US-CT, US-VA] rule.

Things to Know

Template Support for Engagement and Contract Question Types: Gallery templates now support Engagement and Contract question types, allowing templates containing these question types to be imported and cloned to launch assessments.
Enhanced Error Messages Across Assessment Automation: Error messages across Assessment Automation have been enhanced so that failed submissions, approvals, and web form entries now display specific, accurate, and human-readable messages. They also now display a corrective next step, ensuring you will always know what you need to do to resolve an error.
Changes to Paid Permissions: Several assessment workflow permissions, including creating, editing, and publishing workflow templates, are now classified as licensed (paid) permissions. For more information, see Subscription Management: Privacy Automation.
Improved Error Messages: Users now receive a clear access denied message when attempting to access an assessment for which they do not have permission, rather than a generic page not found error.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Data Mapping Automation - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

Project Risk Assessments

For more information, see Using the Projects Inventory.

Table Enhancements for Data Mapping Automation

Tables and table functionalities have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

Risks tab of the Projects > Inventory details screen
Documents tab of the Projects > Inventory details screen
Approvers in current stage popup on the Approval & Workflow tab of the Projects > Inventory details screen
Incidents tab of the Inventory details screen

Attribute-Based Access Control (ABAC) Phase 1

Note:

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Privacy Automation.

Mention Users in Comments with Attribute-Based Access Control (ABAC)

Unified Table Experience in Attribute Manager

Attribute Manager in Data Mapping Automation now offers a unified, standardized table experience with paginated, resizable tables and consistent search, sort, and filter behavior. This replaces inconsistent filtering, sorting, and table behavior across Attribute Manager experiences, making configuration faster, easier, and more reliable for Site Admins and managers who configure objects, attributes, and assessments, and reducing the risk of misinterpreting data.

These enhancements will be available for the following Data Mapping Automation objects:

Relationship Manager

Standardized Attribute Export

Attribute data in Data Mapping Automation can now be exported from the Attribute Manager, giving administrators consistent, reliable data for audits, reporting, and governance reviews. Exports can include the full attribute set or only filtered results, and column selection limits each file to the relevant fields.

These enhancements will be available for the following Data Mapping Automation objects:

Relationship Manager

Text Field Character Limit

Text fields in the Data Mapping Automation Attribute Manager now support up to 10,000 characters. This establishes a consistent data model that lets customers reliably capture detailed, long-form input across all downstream experiences, replacing a limit of about 1,000 characters.

These enhancements will be available for the following Data Mapping Automation objects:

Relationship Manager

Standard Table Experience and Customize Option Order for Attribute Options

The attribute options table in the Data Mapping Automation Attribute Manager now uses the standard OneTrust table, providing a consistent, standardized table experience. The new Reorder options experience makes it easier to customize the order of attribute options. A Customize option order setting now appears above the options list in place of the checkbox and drag handle on each row, and the Search options field remains in the same place. Adopting the standard table simplifies maintaining attribute options and supports future maintenance.

These enhancements will be available for the following Data Mapping Automation objects:

Relationship Manager

Fixed

Resolved an issue that caused related inventories and their attributes to be consolidated into a single section in Processing activities PDF reports.
Resolved an issue that prevented reports from displaying when inventory names contained special characters, such as apostrophes.
Resolved an issue that caused a Page not found error when navigating to the Documents or Assessments tabs of a vendor record from within Third-Party Risk Management.
Resolved an issue that prevented the Risks tab on inventory records from loading for users with attribute-based access control (ABAC) permissions.
Resolved an issue that prevented attributes from loading in assessment templates for tenants with a high volume of active Entity attributes.
Resolved an issue that prevented the bulk deletion of risks from inventory records.
Resolved an issue that prevented the Allow other checkbox from displaying in the Details tab.
Resolved an issue that prevented Projects from being exported as PDF files.
Resolved an issue that caused Relationship questions and their related attribute questions to display Question type not supported when assessment responses were exported to Excel.
Resolved an issue that caused inventory and vendor names to be incorrectly translated in the list view when the user's language was set to a non-English setting.
Resolved an issue that prevented custom workflow stage rule details from displaying correctly.

Existing Public Preview Features

Restore Deleted Inventory Records

Restore deleted inventory items directly with the Inventory Restore Feature. Users can restore a single record or multiple records at once with bulk restore. When a record is recovered, the inventory item and supported associated data are also restored. This enhancement reduces the need for manual support intervention and helps teams recover records faster.

For more information, see Restoring Deleted Inventory Records.

Enhanced Data Graph Visualizations

View relationships between projects, data sets, and models in the data graph in addition to inventory records. This enhancement provides a clear visualization of how objects relate to each other and to inventory records throughout your data map.

For more information, see Creating and Managing Contextual Relationships.

Inventory Review | Available with Solution Packaging Only

Gain essential visibility into the flow of newly added and updated inventory records so you can better investigate risks, promote compliance, and enhance efficiency concerning your data map. This review experience allows you to manage pending inventory records that are created by several methods and review inventory records with new or updated data elements.

For more information, see Inventory Review & Automation Feature Guide.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Data Mapping Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

Legacy Sharing vs. ABAC Sharing

Reorder Options Button Improvements

The Reorder options button is now available for Numerical – Single Select attributes, allowing for manual reordering of response options.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Data Subject Request (DSR) Automation - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

Manage DROP Requests with OneTrust

Leverage OneTrust's DROP support to automate DROP request intake and status reporting. This enhancement enables California-registered data brokers to automatically download hashed requests on a defined schedule and posts status updates back to DROP.

For more information, see Managing Delete Request and Opt-Out Platform (DROP) Requests and Creating a Workflow for Managing DROP Requests.

New DROP Management APIs

Added the Create Data Subject Request for DROP Record API, Update DROP Record API, and Get List of DROP Records API to create, update, and retrieve Delete Request and Opt-out Platform (DROP) requests, respectively. These APIs support California-registered data brokers in managing DROP requests for deleting or opting out data subjects permanently.

Table Enhancements for Data Subject Request (DSR) Automation

ID verification tab on the Data subject request details screen
Add connection and Existing connections screens accessed via the Subtaks tab of the Data subject request details screen
Data subject request details
Suggested redactions tab on the Data subject request details screen when viewing the Results summary screen
The following tabs on the Redaction preferences screen:
- Default classifiers
- Custom keywords
- Structured Data Redaction

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

Resolved an issue that caused the Create Request API to return a status of UN_PROCESSED instead of FAILED when a required email was missing from the request.
Resolved an issue that caused the Attachments tab on the Results summary screen to displaying in English instead of the user's language of choice.
Resolved an issue that prevented split-document merges from completing and included an earlier version of a section's redactions instead of the most recent changes.
Resolved an issue that caused the automatic page refresh on the Results summary screen to clear bulk document selections.
Resolved an issue that prevented correct file counts from displaying in the redaction tool after document splitting.
Resolved an issue that caused the redaction tool to incorrectly redact entire lines of text in PDF documents, despite the user only selecting a small section of text to redact.
Resolved an issue that prevented PST files from being successfully downloaded when they contained redacted files that had already been shared via a results summary.
Resolved an issue that caused the Include in report filter on the Attachments tab of the Results summary screen to return inaccurate results.
Resolved an issue that prevented files from being successfully downloaded on iOS devices when using the Privacy Portal.
Resolved an issue that prevented existing DROP requests from displaying on the DROP requests screen when a new request was in a processing state.

New Public Preview Features

CAPTCHA Enhancements

Protect against bot activity with the introduction of Google reCAPTCHA V3 and Cloudflare Turnstile. This enhancement offers a configurable, multi-layered defense against malicious bot activity and reduces illegitimate DSR requests.

For more information, see Managing Web Form Settings.

CSRF Token Adoption

Reduce bot and automated DSR requests by implementing Cross-Site Request Forgery (CSRF) token on each web form submission. This enhancement blocks programmatic submissions at the form layer, without adding additional friction for your users.

For more information, see Web Form FAQ.

Accessibility Conformance

The Attach file button now correctly uses a button role to ensure compatibility with assistive technologies (WCAG‑A 4.1.2: Name, Role, Value).

Things to Know

Improvements to the DROP Integration screen: The DROP Integration screen has been updated with improved descriptions, updated field labels, and new import status information to enhance the user experience.
Retry Failed DROP Events: You can now retry failed DROP events via the DROP processing history list screen for processing events that were triggered via API. Retry is available for failed download and upload events.
Improvements to the Web Form Templates Screen: Text in the Create web form button now displays on a single line, and the search bar has been moved to below the Create web form button on the Web form templates screen.
Improvements to the Skip Stage Rule Flow: Users will now be prompted via a pop-up message to refresh the page after a skip rule has been executed so the correct stage displays.
Improvements to the Add Connection pane: The Add connection pane has been updated with layout improvements to ensure that pagination and header text display correctly.
PDF Redaction Enhancements: Multi-layered PDF files are now automatically detected and flattened before redactions are applied, ensuring that redactions cover all content layers rather than only the text layer.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Incident Management - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

Enhancements to Incident Management Web Forms

Copy an existing web form within an environment, delete web forms that are no longer needed, and export or import complete web form configurations between environments or tenants. These enhancements reduce the time and effort required to manage Incident web forms. You can now reuse existing configurations instead of recreating similar forms, remove outdated forms to keep environments organized, and move web forms between environments with greater consistency.

For more information, see Copying an Incident Web Form, Deleting an Incident Web Form, and Exporting and Importing Incident Web Forms.

Enhancements to User Groups and Organization Assignments

User groups can now be configured to receive email notifications for incident workflow actions. This enhancement means user groups can now receive notifications when an incident moves to the In progress stage. Additionally, Organizations now load according to the parent-child hierarchy configured in a web form's settings. This enhancement means you no longer have to manually assign an incoming incident to the correct organization, and incidents reach the right owner automatically.

For more information, see: Adding Incident Workflow Rules.

Table Enhancements for Incident Management

Related tab of the Incident details screen
Summary tab of the Incident details screen
Jurisdictions tab of the Incident details screen
Incident types screen
Risks tab of the Incident details screen

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Text Field Character Limit

Text fields in the Incident Management Attribute Manager now support up to 10,000 characters. This establishes a consistent data model that lets customers reliably capture detailed, long-form input across all downstream experiences, replacing a limit of about 1,000 characters.

These enhancements will be available for the following Incident Management objects:

Incident

Incident Management workflows: Reorder trigger groups and HTML sanitization checks

In Incident Management workflows, administrators can now reorder trigger groups to control the sequence in which rules run. HTML sanitization checks now also apply when creating rules with Create Task or Send Notification actions, helping keep task and notification content safe. These updates make workflow automation more predictable and easier to manage.

This enhancement is available for Incident Management workflows on the following objects:

Incident

Fixed

Resolved an issue that prevented alphanumeric search values from returning expected results when searching for workflow names.
Resolved an issue that caused incorrect regulatory information to display for the Louisiana jurisdiction in Databreachpedia.
Resolved an issue that prevented workflow rules from triggering when the Assignee field was used as a condition.
Resolved an issue that caused assessment PDF exports to intermittently fail to generate.
Resolved an issue that caused incident records to be excluded from reports when filtering by a specific date range.

New Public Preview Features

Unified Table Experience in Attribute Manager

Attribute Manager in Incident Management now offers a unified, standardized table experience with paginated, resizable tables and consistent search, sort, and filter behavior. This replaces inconsistent filtering, sorting, and table behavior across Attribute Manager experiences, making configuration faster, easier, and more reliable for Site Admins and managers who configure objects, attributes, and assessments, and reducing the risk of misinterpreting data.

These enhancements will be available for the following Incident Management objects:

Incident

Standardized Attribute Export

Attribute data in Incident Management can now be exported from the Attribute Manager, giving administrators consistent, reliable data for audits, reporting, and governance reviews. Exports can include the full attribute set or only filtered results, and column selection limits each file to the relevant fields.

These enhancements will be available for the following Incident Management objects:

Incident

Standard Table Experience and Customize Option Order for Attribute Options

The attribute options table in the Incident Management Attribute Manager now uses the standard OneTrust table, providing a consistent, standardized table experience. The new Reorder options experience makes it easier to customize the order of attribute options. A Customize option order setting now appears above the options list in place of the checkbox and drag handle on each row, and the Search options field remains in the same place. Adopting the standard table simplifies maintaining attribute options and supports future maintenance.

These enhancements will be available for the following Incident Management objects:

Incident

Accessibility Conformance

Error messages now correctly display and are announced by screen readers when required multi-select fields or text areas are left blank (WCAG‑A 3.3.1: Error Identification).
Non-interactive elements no longer incorrectly receive keyboard focus (WCAG‑A 2.1.1: Keyboard).
A validation message now correctly displays when an incorrect code is entered in a CAPTCHA field (WCAG‑A 3.3.1: Error Identification).

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Incident Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

Enhanced Error Messages: Error messages across Incident Management have been enhanced so that failed submissions, approvals, and web form entries now display specific, accurate, and human-readable messages. They also now display a corrective next step, ensuring you will always know what you need to do to resolve an error.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Tech Risk and Compliance

Audit Management - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

Standard Table Experience for Attribute Options

The attribute options table in the Audit Management Attribute manager now uses the standard OneTrust table, providing a consistent, standardized table experience. Attribute options can now be reordered, and the Workflow Approval tab displays the current-stage approvers list for greater visibility. This makes maintaining attribute options easier and simplifies future maintenance.

These enhancements will be available for the following Audit Management objects:

Audit
Finding
Workpaper

Text Field Character Limit

Text fields in the Audit Management Attribute Manager now support up to 10,000 characters. This establishes a consistent data model that lets customers reliably capture detailed, long-form input across all downstream experiences, replacing a limit of about 1,000 characters.

These enhancements will be available for the following Audit Management objects:

Audit
Finding
Workpaper

Audit Management workflows: Reorder trigger groups and HTML sanitization checks

In Audit Management workflows, administrators can now reorder trigger groups to control the sequence in which rules run. HTML sanitization checks now also apply when creating rules with Create Task or Send Notification actions, helping keep task and notification content safe. These updates make workflow automation more predictable and easier to manage.

This enhancement is available for Audit Management workflows on the following objects:

Audit
Findings
Workpaper

New Public Preview Features

Unified Table Experience in Attribute Manager

Attribute Manager in Audit Management now offers a unified, standardized table experience with paginated, resizable tables and consistent search, sort, and filter behavior. This replaces inconsistent filtering, sorting, and table behavior across Attribute Manager experiences, making configuration faster, easier, and more reliable for Site Admins and managers who configure objects, attributes, and assessments, and reducing the risk of misinterpreting data.

These enhancements will be available for the following Audit Management objects:

Audit
Finding
Workpaper

Standardized Attribute Export

Attribute data in Audit Management can now be exported from the Attribute Manager, giving administrators consistent, reliable data for audits, reporting, and governance reviews. Exports can include the full attribute set or only filtered results, and column selection limits each file to the relevant fields.

These enhancements will be available for the following Audit Management objects:

Audit
Finding
Workpaper

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Compliance Automation - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

AI Evidence Analysis Feedback on Validation Results

Provide feedback on AI evidence validation results directly within the evidence validation workflow to rate results and correct outcomes. This enhancement creates a continuous feedback loop that improves validation results and gives compliance teams greater confidence when using AI to evaluate evidence.

Attribute-Based Access Control (ABAC) Phase 1

All supported objects across Tech Risk & Compliance have feature parity within the context of ABAC Phase 1 capabilities, excluding assessments, and ABAC is enabled in all tenants regardless of packaging and pricing. Business objectives are now a supported object in ABAC Phase 1: Foundations.

Tech Risk & Compliance also includes changes to risk permissions, risk field visibility, and the Stage advancement setting in risk workflows. Review custom roles related to risk management to make sure they continue to work as intended.

Note:

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

Mention Users in Comments with Attribute-Based Access Control (ABAC)

In Tech Risk & Compliance (TRC), mentioning other users in comments is now available for everyone when they have the access ability to comment. Permissions are checked throughout, including after an assignment changes.

Fixed

Resolved an issue that prevented controls selected from the Controls library from displaying in an initiative after being applied.
Resolved an issue that prevented controls linked to an initiative from being removed or unlinked.
Resolved an issue that prevented the Share option from displaying in the Context menu on the Initiatives screen.
Resolved an issue that caused incorrect evidence task implementation data to display on the IT & Security Risk Management dashboard.
Resolved an issue that prevented the Framework and Category filters from functioning correctly on the Controls tab of the Initiative screen.
Resolved an issue that prevented users from opening assessments in a new browser tab from assessment lists.

New Public Preview Features

Compliance Automation MCP: Insights & Evidence: Access compliance insights and submit evidence directly from your model context protocol (MCP) compatible AI assistant to review program readiness, overdue items, control ownership, and evidence status without opening OneTrust. This enhancement helps streamline compliance workflows by making OneTrust an AI-accessible system of record while ensuring users can only view or perform actions they are authorized to access, using existing OneTrust permissions.

Existing Public Preview Features

Restore Deleted Inventory Records

For more information, see Restoring Deleted Inventory Records.

Stage & Workflow Rules for Seeded Evidence Interval Workflows

Add stage and workflow rules to the seeded evidence interval workflows to automatically send notifications, change evidence task stages, and change workflows. This enhancement allows organizations to tailor workflows and approval paths to match their evidence review processes and customize existing seeded workflows for greater flexibility.

For more information, see Adding Stage Rules to Evidence Interval Workflows and Adding Workflow Rules to Evidence Interval Workflows.

Standard / Control Framework Changes

New Colorado Automated Decision-Making Technology Framework Added

For more information, see Supported Control Frameworks.

New Canada OSFI E-23 Model Risk Management Framework Added

For more information, see Supported Control Frameworks.

New NIS 2 (Sweden) Framework Added

Sweden's implementation of the NIS 2 Directive, through the Cybersecurity Act (Cybersäkerhetslag), effective January 15, 2026, establishes cybersecurity requirements for essential and important entities operating across covered sectors in Sweden. The legislation establishes requirements relating to cybersecurity risk management measures, incident reporting, supply chain security, business continuity, access control, cryptography, management responsibilities, and other measures designed to achieve a high level of cybersecurity.

We've made implementing NIS 2 (Sweden) easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring in all relevant policies, controls, control implementation guidance, and evidence tasks, including guidance, among others, to assist in meeting the requirements of NIS 2 (Sweden).

For more information, see Supported Control Frameworks.

Cyber Essentials UK v3.3 Framework Updated

Framework content has been updated to align with version 3.3 of the Cyber Essentials Requirements for IT Infrastructure. The updated requirements provide additional clarity around cloud services, passwordless authentication, scope, and software development, while continuing to address the five core technical control areas: firewalls, secure configuration, security update management, user access control, and malware protection.

For more information, see Supported Control Frameworks.

Delaware Personal Data Privacy Act (as amended) (2027) Framework Updated

Framework content has been updated to reflect amendments to the Delaware Personal Data Privacy Act (DPDPA) that take effect January 1, 2027. Updates address new and revised requirements relating to the law's applicability, sensitive data, consumer rights, third-party data disclosures, profiling, and other controller and processor obligations.

For more information, see Supported Control Frameworks.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Compliance Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

Audit History Enhancements: Audit history for stage reviews is now retained on the Workflow and approval tab for evidence collections, regardless of the workflow or stage.
Mention Users in Comments: Users can now tag other users in comments on the Evidence collection tab of the Evidence task screen.
Reminder Email Enhancements: Overdue reminder emails for evidence tasks are now suppressed for collection intervals that end before the linked initiative's observation start date.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Enterprise Policy Management - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

New Exceptions APIs

Added theSearch Exceptions API andGet Exception API to retrieve and search document exceptions across Tech Risk & Compliance (TRC). The EXCEPTION and EXCEPTION_READ OAuth scopes are now available to provide access to these APIs when configuring client credentials in Global Settings. These APIs provide programmatic access to exception data, reducing the need to manually export and manipulate data for reporting or third-party tools while supporting enterprise policy exception management use cases across TRC.

Attribute-Based Access Control (ABAC) Phase 1

Note:

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

Mention Users in Comments with Attribute-Based Access Control (ABAC)

Unified Table Experience in Attribute Manager

Attribute Manager in Enterprise Policy Management now offers a unified, standardized table experience with paginated, resizable tables and consistent search, sort, and filter behavior. This replaces inconsistent filtering, sorting, and table behavior across Attribute Manager experiences, making configuration faster, easier, and more reliable for Site Admins and managers who configure objects, attributes, and assessments, and reducing the risk of misinterpreting data.

These enhancements will be available for the following Enterprise Policy Management objects:

Exception
Policy
Privacy Notice
Procedure
Standard

Standardized Attribute Export

Attribute data in Enterprise Policy Management can now be exported from the Attribute Manager, giving administrators consistent, reliable data for audits, reporting, and governance reviews. Exports can include the full attribute set or only filtered results, and column selection limits each file to the relevant fields.

These enhancements will be available for the following Enterprise Policy Management objects:

Exception
Policy
Privacy Notice
Procedure
Standard

Text Field Character Limit

Text fields in the Enterprise Policy Management Attribute Manager now support up to 10,000 characters. This establishes a consistent data model that lets customers reliably capture detailed, long-form input across all downstream experiences, replacing a limit of about 1,000 characters.

These enhancements will be available for the following Enterprise Policy Management objects:

Exception
Policy
Privacy Notice
Procedure
Standard

Standard Table Experience for Attribute Options

The attribute options table in the Enterprise Policy Management Attribute Manager now uses the standard OneTrust table, providing a consistent, standardized table experience. Attribute options can now be reordered, and the Workflow Approval tab displays the current-stage approvers list for greater visibility. This makes maintaining attribute options easier and simplifies future maintenance.

These enhancements will be available for the following Enterprise Policy Management objects:

Exception
Policy
Privacy Notice
Procedure
Standard

Enterprise Policy Management workflows: Reorder trigger groups and HTML sanitization checks

In Enterprise Policy Management workflows, administrators can now reorder trigger groups to control the sequence in which rules run. HTML sanitization checks now also apply when creating rules with Create Task or Send Notification actions, helping keep task and notification content safe. These updates make workflow automation more predictable and easier to manage.

This enhancement is available for Enterprise Policy Management workflows on the following objects:

Exception
Policy
Privacy Notice
Procedure
Standard

Fixed

Resolved an issue that caused controls to display in every section of exported procedure, policy, and standard documents.
Resolved an issue that caused shared policy links to return an error when the policy name contained special characters.

Existing Public Preview Features

AI-Powered Document Analysis | Available with Solution Packaging Only

Analyze documents against a standard or framework using the new Analyze document button on the Document details screen. This AI-powered feature identifies gaps and provides recommendations to help remediate issues related to the following objects:

Controls
Risks
Issues

AI-generated recommendations will appear in the Recommended section of the Related, Controls, Risks, and Issues tabs of the Document details screen. These recommendations may include relating controls, creating relationships, or linking risks and issues.

For more information, see Using AI-Powered Document Analysis. This feature is related to the following idea: OT-I-14780.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Enterprise Policy Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

Share Option Enhancements

The Share option is now the first item listed in the Context menu to improve accessibility for accounts with ABAC enabled. This has been updated for the following list screens:

Exceptions
Policies
Procedures
Standards

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Issues Management - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

Issue Attribute Visibility Rules

Configure attribute visibility rules using the new Attribute visibility tab on the Issue type details screen in the Attribute Manager. This feature allows you to use conditional logic to control which fields appear when creating or editing issues to help reduce clutter and improve data accuracy.

For more information, see Creating Attribute Visibility Rules.

Attribute-Based Access Control (ABAC) Phase 1

Note:

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

Mention Users in Comments with Attribute-Based Access Control (ABAC)

Unified Table Experience in Attribute Manager

Attribute Manager in Issues Management now offers a unified, standardized table experience with paginated, resizable tables and consistent search, sort, and filter behavior. This replaces inconsistent filtering, sorting, and table behavior across Attribute Manager experiences, making configuration faster, easier, and more reliable for Site Admins and managers who configure objects, attributes, and assessments, and reducing the risk of misinterpreting data.

These enhancements will be available for the following Issues Management objects:

Issues

Standardized Attribute Export

Attribute data in Issues Management can now be exported from the Attribute Manager, giving administrators consistent, reliable data for audits, reporting, and governance reviews. Exports can include the full attribute set or only filtered results, and column selection limits each file to the relevant fields.

These enhancements will be available for the following Issues Management objects:

Issues

Text Field Character Limit

Text fields in the Issues Management Attribute Manager now support up to 10,000 characters. This establishes a consistent data model that lets customers reliably capture detailed, long-form input across all downstream experiences, replacing a limit of about 1,000 characters.

These enhancements will be available for the following Issues Management objects:

Issues

Standard Table Experience and Customize Option Order for Attribute Options

The attribute options table in the Issues Management Attribute Manager now uses the standard OneTrust table, providing a consistent, standardized table experience. The new Reorder options experience makes it easier to customize the order of attribute options. A Customize option order setting now appears above the options list in place of the checkbox and drag handle on each row, and the Search options field remains in the same place. Adopting the standard table simplifies maintaining attribute options and supports future maintenance.

These enhancements will be available for the following Issues Management objects:

Issues

Fixed

Resolved an issue that caused a blank screen to display when attempting to edit custom attributes for issues.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Issues Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

Attribute Description Tooltips: Tooltips now display attribute descriptions when hovering over attribute labels on the Issue details screen.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

IT Risk Management - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

Table Enhancements for Controls

Tables and table functionalities on the Risks tab of the Control details screen have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Risk Workflow Enhancements

The following enhancements have been introduced to Risk workflows to promote a consistent workflow management experience across other products on the OneTrust platform that have adopted this standardization:

Workflow list screen: Column sorting, search, activation, archival
Workflow rule actions: Advance to stage and Change workflow
Workflow rule event triggers: Attribute updated and Approval rejected. Use Approval rejected to route a risk to the stage you choose when an approver rejects it.
Routing rules: Workflow assignment upon object creation
Workflow stage rule actions: Create tasks, send notifications using system and custom templates, update attributes, generate PDF reports, and launch assessments.
Stage detail settings: Set required attributes and comments upon stage change, stage approval requirements, Stage advancement, and Close stage.
- Stage advancement - Define additional users who can advance a stage beyond those with role-based permissions.
- Close stage - Adds the Reason for Closure and Closure Note attributes to the closed stage. You can also disable detail edits for closed risks.

For more information, see Managing Risk Workflows.

Nested Table & Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Attribute-Based Access Control (ABAC) Phase 1

Note:

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

Mention Users in Comments with Attribute-Based Access Control (ABAC)

Unified Table Experience in Attribute Manager

Attribute Manager in IT Risk Management now offers a unified, standardized table experience with paginated, resizable tables and consistent search, sort, and filter behavior. This replaces inconsistent filtering, sorting, and table behavior across Attribute Manager experiences, making configuration faster, easier, and more reliable for Site Admins and managers who configure objects, attributes, and assessments, and reducing the risk of misinterpreting data.

These enhancements will be available for the following IT Risk Management objects:

Business Objective
Control
Control Library
Control Objective
Risk
Threat
Vulnerability

Standardized Attribute Export

Attribute data in IT Risk Management can now be exported from the Attribute Manager, giving administrators consistent, reliable data for audits, reporting, and governance reviews. Exports can include the full attribute set or only filtered results, and column selection limits each file to the relevant fields.

These enhancements will be available for the following IT Risk Management objects:

Business Objective
Control
Control Library
Control Objective
Risk
Threat
Vulnerability

Text Field Character Limit

Text fields in the IT Risk Management Attribute Manager now support up to 10,000 characters. This establishes a consistent data model that lets customers reliably capture detailed, long-form input across all downstream experiences, replacing a limit of about 1,000 characters.

These enhancements will be available for the following IT Risk Management objects:

Business Objective
Control
Control Library
Control Objective
Risk
Threat
Vulnerability

Standard Table Experience and Customize Option Order for Attribute Options

The attribute options table in the IT Risk Management Attribute Manager now uses the standard OneTrust table, providing a consistent, standardized table experience. The new Reorder options experience makes it easier to customize the order of attribute options. A Customize option order setting now appears above the options list in place of the checkbox and drag handle on each row, and the Search options field remains in the same place. Adopting the standard table simplifies maintaining attribute options and supports future maintenance.

These enhancements will be available for the following IT Risk Management objects:

Business Objective
Control
Control Library
Control Objective
Risk
Threat
Vulnerability

IT Risk Management workflows: Reorder trigger groups and HTML sanitization checks

In IT Risk Management workflows, administrators can now reorder trigger groups to control the sequence in which rules run. HTML sanitization checks now also apply when creating rules with Create Task or Send Notification actions, helping keep task and notification content safe. These updates make workflow automation more predictable and easier to manage.

This enhancement is available for IT Risk Management workflows on the following objects:

Controls
Issues
Objectives
Risks

Fixed

Resolved an issue that prevented the Edit modal from opening when attempting to modify options for numerical single-select issue attributes.
Resolved an issue that prevented workflow trigger rules from triggering when only the Inherent risk score (impact or probability) was updated on a risk.
Resolved an issue that incorrectly redirected users to an assessment when clicking a Risk ID from the Assessments screen.
Resolved an issue that prevented the Required attribute checkbox from displaying when editing custom attributes on the Attribute manager screen.
Resolved an issue that caused the bulk action for unlinking controls from risks to incorrectly display as Bulk delete.
Resolved an issue that caused numerical single select attribute options to display their associated labels rather than raw numerical values within assessments.
Resolved an issue that prevented control owners from uploading task attachments and incorrectly displayed the comment input to unauthorized users.
Resolved an issue that prevented users from editing numerical single-select attribute options for issues.

New Public Preview Features

AI-Powered Control Recommendations on Risks | Available with Solution Packaging Only: Review AI-powered control recommendations, implementation guidance, and mitigation rationale directly from a risk or risk template to identify relevant custom, library, or AI-generated controls. This enhancement helps accelerate risk treatment, improve control reuse and coverage, and establish more consistent and traceable relationships between risks and controls.

Existing Public Preview Features

Restore Deleted Inventory Records

For more information, see Restoring Deleted Inventory Records.

Project Risk Assessments

For more information, see Managing Projects in IT Risk Management.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of assigning a value of zero when using the formula builder. This setting helps to define how blank inputs are interpreted in the formula builder throughout the OneTrust Platform for all net new formulas.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Standard / Control Framework Changes

New Colorado Automated Decision-Making Technology Framework Added

For more information, see Supported Control Frameworks.

New Canada OSFI E-23 Model Risk Management Framework Added

For more information, see Supported Control Frameworks.

New NIS 2 (Sweden) Framework Added

For more information, see Supported Control Frameworks.

Cyber Essentials UK v3.3 Framework Updated

For more information, see Supported Control Frameworks.

Delaware Personal Data Privacy Act (as amended) (2027) Framework Updated

For more information, see Supported Control Frameworks.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: IT Risk Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

Rollup Score Type Enhancement: Custom score attributes with a Rollup score type can now be edited directly from the Context menu on the Attribute manager screen.
Inherited Risk Columns on Inventory and Project Details: The Risk tab of the Inventory details and Project details screens now includes Inherited from and Relationship type columns. These columns identify the source and nature of risks associated with the entity, such as risks propagated from linked assets to a project.
Stage Filter for Controls: A Stage filter is now available for controls, allowing users to filter and export control records based on their current workflow stage.
Attribute Description Tooltips: Tooltips now display attribute descriptions when hovering over attribute labels on the Control implementation details and Control library screens.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Third-Party Management

Third-Party Due Diligence - November 13, 2026 - 202611.1.0 (Fall Release)

New Public Preview Features

Clearer Dow Jones Monitoring Updates

Updates for the same profile are presented together. Monitoring alerts highlight new information in affected profile sections and risk tables, including text changes; review indicators show which updates need attention and which have been reviewed.

Daily Digest of Unreviewed Results

Daily digests summarize unreviewed Dow Jones screening and monitoring results for third-party and nth-party records. Seeded Dow Jones results pending review views help you find records that need attention and see the pending-result count, review type, and oldest pending-result date. A digest is sent for an inventory type only when it has pending results, for a maximum of two notifications per day.

Direct Dow Jones Risk Attribution for Nth Parties

Dow Jones screening risks for an nth party are recorded on the screened nth-party record instead of changing the related third party’s own Dow Jones risk attributes. Dedicated aggregated attributes keep nth-party risk visible from the related third-party record.

Exact-match Dow Jones Monitoring

Exact-match monitoring follows one confirmed Dow Jones profile by its profile ID, keeping future monitoring focused on the profile you verified. Applying it dismisses the other profiles in the screening results; switching back to name-based monitoring does not restore them.

Unified Table Experience in Attribute Manager

Attribute Manager in Third-Party Due Diligence now offers a unified, standardized table experience with paginated, resizable tables and consistent search, sort, and filter behavior. This replaces inconsistent filtering, sorting, and table behavior across Attribute Manager experiences, making configuration faster, easier, and more reliable for Site Admins and managers who configure objects, attributes, and assessments, and reducing the risk of misinterpreting data.

These enhancements will be available for the following Third-Party Due Diligence objects:

Nth Party

Standardized Attribute Export

Attribute data in Third-Party Due Diligence can now be exported from the Attribute Manager, giving administrators consistent, reliable data for audits, reporting, and governance reviews. Exports can include the full attribute set or only filtered results, and column selection limits each file to the relevant fields.

These enhancements will be available for the following Third-Party Due Diligence objects:

Nth Party

Text Field Character Limit

Text fields in the Attribute Manager now support up to 10,000 characters. This establishes a consistent data model that lets customers reliably capture detailed, long-form input across all downstream experiences, replacing a limit of about 1,000 characters.

These enhancements will be available for the following Third-Party Due Diligence objects:

Nth Party

Standard Table Experience and Customize Option Order for Attribute Options

The attribute options table in the Third-Party Due Diligence Attribute Manager now uses the standard OneTrust table, providing a consistent, standardized table experience. The new Reorder options experience makes it easier to customize the order of attribute options. A Customize option order setting now appears above the options list in place of the checkbox and drag handle on each row, and the Search options field remains in the same place. Adopting the standard table simplifies maintaining attribute options and supports future maintenance.

These enhancements will be available for the following Third-Party Due Diligence objects:

Nth Party (Public Preview)

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Third-Party Due Diligence. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Third-Party Risk Management - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

Attribute-Based Access Control (ABAC) Phase 1

All supported objects across Third-Party Management have feature parity within the context of ABAC Phase 1 capabilities, excluding assessments, and ABAC is enabled in all tenants regardless of packaging and pricing.

Note:

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Third-Party Management.

Mention Users in Comments with Attribute-Based Access Control (ABAC)

In Third-Party Management (TPM), mentioning other users in comments is now available for everyone when they have the access ability to comment. Permissions are checked throughout, including after an assignment changes.

Unified Table Experience in Attribute Manager

Attribute Manager in Third-Party Risk Management now offers a unified, standardized table experience with paginated, resizable tables and consistent search, sort, and filter behavior. This replaces inconsistent filtering, sorting, and table behavior across Attribute Manager experiences, making configuration faster, easier, and more reliable for Site Admins and managers who configure objects, attributes, and assessments, and reducing the risk of misinterpreting data.

These enhancements will be available for the following Third-Party Risk Management objects:

Contract
Engagements

Standardized Attribute Export

Attribute exports in Third-Party Risk Management now include additional columns for standardization. This provides administrators consistent, reliable data for audits, reporting, and governance reviews..

These enhancements will be available for the following Third-Party Risk Management objects:

Contract
Engagements

Standard Table Experience and Customize Option Order for Attribute Options

The attribute options table in the Third-Party Risk Management Attribute Manager now uses the standard OneTrust table, providing a consistent, standardized table experience. The new Reorder options experience makes it easier to customize the order of attribute options. A Customize option order setting now appears above the options list in place of the checkbox and drag handle on each row, and the Search options field remains in the same place. Adopting the standard table simplifies maintaining attribute options and supports future maintenance.

These enhancements will be available for the following Third-Party Risk Management objects:

Contract
Engagements

AI Document Summarization for Vendor Documents

From a vendor record's Documents tab, you can generate an AI-driven summary of a vendor-provided document to support review during onboarding and assessment.

AI Document Scanning for Engagements and Contracts

For supported assessment templates, AI Document Scanner can use an uploaded document to identify Engagement or Contract references, match them to existing records associated with the vendor being assessed, and populate supported object and attribute responses.

Fixed

Resolved an issue that caused the Save button to remain incorrectly disabled when editing condition values in an existing engagement workflow stage rule.
Resolved an issue that caused assessment submissions to fail with a locked error when invalid email addresses were provided for contract or engagement questions.
Resolved an issue that caused recipient identification fields to be empty in DORA ROI reports. Reports now ensure the system uses the unique identifier rather than the display label for linked entities.
Resolved an issue that prevented stage rules from running in cloned engagement workflows.
Resolved an issue in the TPRM Agent that caused an incorrect error message to display when the website attribute was disabled.
Resolved an issue that prevented the New record creation and Allow multi select options from displaying when adding engagement questions to assessment templates.

New Public Preview Features

AI Auto-Responses for Engagement and Contract Assessments: AI Inventory Analysis can reuse eligible responses from up to three completed assessments associated with the same Engagement to help complete supported non-attribute Engagement and Contract questions.
Third-Party Red Flag Monitoring: Third-Party Red Flag Monitoring identifies new HackNotice breach alerts for eligible third-party vendors connected to Exchange, creates an issue for the affected vendor, and sends email and in-app notifications to help your team review the alert.

Standard / Control Framework Changes

New Colorado Automated Decision-Making Technology Framework Added

For more information, see Supported Control Frameworks.

New Canada OSFI E-23 Model Risk Management Framework Added

For more information, see Supported Control Frameworks.

New NIS 2 (Sweden) Framework Added

For more information, see Supported Control Frameworks.

Cyber Essentials UK v3.3 Framework Updated

For more information, see Supported Control Frameworks.

Delaware Personal Data Privacy Act (as amended) (2027) Framework Updated

For more information, see Supported Control Frameworks.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Third-Party Risk Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

Assessment Bulk Imports: Contract and engagement question responses, including associated attribute-question responses, can now be populated during assessment bulk imports.
System User Attributes: System user attributes in engagement and contract details now correctly reflect the configured email display settings.
Attribute List Exports: An Export action is now available on the Engagements and Contracts attribute list screens, allowing users to perform full or filtered-view asynchronous exports.
Risk Email Recipients: Email notifications for risks now support user groups as recipients for risk owners and approvers.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.