Compliance Automation - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

AI Evidence Analysis Feedback on Validation Results

Provide feedback on AI evidence validation results directly within the evidence validation workflow to rate results and correct outcomes. This enhancement creates a continuous feedback loop that improves validation results and gives compliance teams greater confidence when using AI to evaluate evidence.

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by adding more granular control over who can access specific records and what actions they can perform. Rather than granting access to all records within a solution, ABAC uses assignments and attributes to determine which records a user can access and what permissions they have on those records, helping organizations implement least-privileged access more effectively.

At General Availability, ABAC Phase 1: Foundations adds reporting across all object types, record-level admin access rules across all supported object types, and system assignments that are enabled for all supported objects, so users can start sharing records right away, even before you create custom assignments.

All supported objects across Tech Risk & Compliance have feature parity within the context of ABAC Phase 1 capabilities, excluding assessments, and ABAC is enabled in all tenants regardless of packaging and pricing. Business objectives are now a supported object in ABAC Phase 1: Foundations.

Tech Risk & Compliance also includes changes to risk permissions, risk field visibility, and the Stage advancement setting in risk workflows. Review custom roles related to risk management to make sure they continue to work as intended.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC Phase 1: Foundations is rolling to General Availability incrementally by environment from November 2026 through March 2027. The rollout is per environment and is not part of the standard release process, and dates are subject to change. Additional capabilities and object support will be introduced in future releases through ABAC Phase 2: Dynamic Access.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

Mention Users in Comments with Attribute-Based Access Control (ABAC)

In Tech Risk & Compliance (TRC), mentioning other users in comments is now available for everyone when they have the access ability to comment. Permissions are checked throughout, including after an assignment changes.

Fixed

  • Resolved an issue that prevented controls selected from the Controls library from displaying in an initiative after being applied.

  • Resolved an issue that prevented controls linked to an initiative from being removed or unlinked.

  • Resolved an issue that prevented the Share option from displaying in the Context menu on the Initiatives screen.

  • Resolved an issue that caused incorrect evidence task implementation data to display on the IT & Security Risk Management dashboard.

  • Resolved an issue that prevented the Framework and Category filters from functioning correctly on the Controls tab of the Initiative screen.

  • Resolved an issue that prevented users from opening assessments in a new browser tab from assessment lists.

New Public Preview Features

Compliance Automation MCP: Insights & Evidence

Access compliance insights and submit evidence directly from your model context protocol (MCP) compatible AI assistant to review program readiness, overdue items, control ownership, and evidence status without opening OneTrust. This enhancement helps streamline compliance workflows by making OneTrust an AI-accessible system of record while ensuring users can only view or perform actions they are authorized to access, using existing OneTrust permissions.

Existing Public Preview Features

Restore Deleted Inventory Records

Restore deleted inventory items directly with the Inventory Restore Feature. Users can restore a single record or multiple records at once with bulk restore. When a record is recovered, the inventory item and supported associated data are also restored. This enhancement reduces the need for manual support intervention and helps teams recover records faster.

For more information, see Restoring Deleted Inventory Records.

Stage & Workflow Rules for Seeded Evidence Interval Workflows

Add stage and workflow rules to the seeded evidence interval workflows to automatically send notifications, change evidence task stages, and change workflows. This enhancement allows organizations to tailor workflows and approval paths to match their evidence review processes and customize existing seeded workflows for greater flexibility.

For more information, see Adding Stage Rules to Evidence Interval Workflows and Adding Workflow Rules to Evidence Interval Workflows.

Standard / Control Framework Changes

New Colorado Automated Decision-Making Technology Framework Added

Colorado Automated Decision-Making Technology (Colorado Senate Bill 26-189) establishes requirements for developers and deployers of automated decision-making technology (ADMT) that materially influences consequential decisions, such as decisions about employment, housing, lending, insurance, and health care. The law applies to covered consequential decisions made on or after January 1, 2027.

We've made implementing Colorado's ADMT requirements easy by offering a framework on the OneTrust platform with controls, implementation guidance, and mapped evidence tasks. The framework covers developer documentation, consumer notices, recordkeeping, data access and correction, and human review. It also addresses related Colorado provisions for conversational AI services and misleading AI claims about psychotherapy.

Scoping survey questions help users identify relevant controls based on their role, organization type, and activities. Control guidance identifies applicable dates and explains how to implement the requirements.

For more information, see Supported Control Frameworks.

New Canada OSFI E-23 Model Risk Management Framework Added

Guideline OSFI E-23 Model Risk Management (2027) **sets out supervisory expectations for how federally regulated financial institutions manage model risk. It covers traditional, AI, and machine learning models and calls for oversight proportionate to the risks they pose. The guideline takes effect on May 1, 2027.

We've made implementing OSFI E-23 easy by offering a framework on the OneTrust platform with controls, implementation guidance, and mapped evidence tasks. The framework covers model governance, inventory and risk ratings, independent review, deployment, monitoring, and retirement.

Selecting the framework in the scoping survey brings the full control set into scope. Institutions can use the guidance and evidence tasks to assess their practices and document how they manage model risk throughout the lifecycle.

For more information, see Supported Control Frameworks.

New NIS 2 (Sweden) Framework Added

Sweden's implementation of the NIS 2 Directive, through the Cybersecurity Act (Cybersäkerhetslag), effective January 15, 2026, establishes cybersecurity requirements for essential and important entities operating across covered sectors in Sweden. The legislation establishes requirements relating to cybersecurity risk management measures, incident reporting, supply chain security, business continuity, access control, cryptography, management responsibilities, and other measures designed to achieve a high level of cybersecurity.

We've made implementing NIS 2 (Sweden) easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring in all relevant policies, controls, control implementation guidance, and evidence tasks, including guidance, among others, to assist in meeting the requirements of NIS 2 (Sweden).

For more information, see Supported Control Frameworks.

Cyber Essentials UK v3.3 Framework Updated

Framework content has been updated to align with version 3.3 of the Cyber Essentials Requirements for IT Infrastructure. The updated requirements provide additional clarity around cloud services, passwordless authentication, scope, and software development, while continuing to address the five core technical control areas: firewalls, secure configuration, security update management, user access control, and malware protection.

For more information, see Supported Control Frameworks.

Delaware Personal Data Privacy Act (as amended) (2027) Framework Updated

Framework content has been updated to reflect amendments to the Delaware Personal Data Privacy Act (DPDPA) that take effect January 1, 2027. Updates address new and revised requirements relating to the law's applicability, sensitive data, consumer rights, third-party data disclosures, profiling, and other controller and processor obligations.

For more information, see Supported Control Frameworks.

Permissions

Things to Know

Audit History Enhancements
Audit history for stage reviews is now retained on the Workflow and approval tab for evidence collections, regardless of the workflow or stage.
Mention Users in Comments
Users can now tag other users in comments on the Evidence collection tab of the Evidence task screen.
Reminder Email Enhancements
Overdue reminder emails for evidence tasks are now suppressed for collection intervals that end before the linked initiative's observation start date.
About Known Defects
Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.