TrustArc news and product updates

TrustArc's 28 October release adds an admin setting that turns off AI completion for assessment respondents who do not have a TrustArc account. Admins can also now edit responses on assessments that are Not Started, In Progress or Pending Approval.

Buyer relevance. Outside respondents, such as vendors answering a privacy questionnaire, may not be the right people to let AI answer for them. Privacy teams get a single switch for that choice.

TrustArc's Governance Suite release 2026.10.1 changes AI Control Review in PrivacyCentral so that adding, removing or replacing evidence on a control automatically starts a new AI review. The AI summary now names each evidence item it read, labels evidence it could not read as unreadable instead of implying the control needs none, and warns when a document is skipped because of its size.

Buyer relevance. Privacy and legal teams relying on AI control findings can trace each finding to a named source and see when the model lacked input, which lowers the risk of an unsupported compliance conclusion.

TrustArc's Ask Arc assistant can now carry out multistep privacy tasks from a single prompt, through conversational commands a person approves, rather than only giving guidance. Arc Intelligence now supports MCP in both directions: it can be used inside Claude, Microsoft Copilot and ChatGPT, and it can draw context from a customer's Salesforce, Atlassian and other MCP enabled systems, with every connection approved before access is granted. The release also adds drafting of records, assessments and control evaluations from a customer's existing evidence, and states that customer data is never used to train external models.

Buyer relevance. Privacy and legal teams can work in the assistant they already use while TrustArc keeps a person approving each action and each new system connection. The no training statement is the line procurement will look for before pointing it at regulated data.

TrustArc's Q3 2026 release adds Program Builder, a prioritised privacy programme plan mapped to the Nymity framework by maturity level, with owners, due dates and revalidation reminders. A Respond with Arc Intelligence option in PrivacyCentral pairs existing evidence to assessment questions and shows a confidence level and citation for each match. Assessment Manager tickets now sync to ServiceNow, Jira, Monday.com and Coupa, and iOS App Tracking Transparency opt outs are now encoded into the IAB TCF consent string.

Buyer relevance. Privacy teams answering repeat assessments can reuse evidence they already hold and check each AI match against its cited source before accepting it. The ticket sync keeps assessment work in the systems engineering and procurement already use.

The Mobile App Consent SDK now reads each region's consent model from the server and, in opt in regions, applies the configured default category consent at app start without showing a banner, while regions with GDPR in scope, opt out regions and accounts with no default category are skipped. Three new iOS APIs (setAttOptOutLevel, setShowAttOptOutWindow, setAttOptOutLockCategories) control which categories are rejected and locked when a user declines Apple's App Tracking Transparency prompt, and a new getWebCookie() function returns consent cookie values on Android, iOS, Flutter and React Native.

Buyer relevance. This changes what the SDK decides on a user's behalf without any user action, so legal teams should confirm their per region consent models and default categories match their own legal position before the new behavior takes effect in their apps.

Individual Rights Manager release 2026.09.2 adds Due Date Countdown Rules that start the data subject request deadline clock from either the Request Received Date or the Request Verified Date, set per intake form, request type and brand, with the most specific rule applied and the global setting as fallback. The same release adds a Bulk Verify action that moves multiple Unverified requests to In Progress, excluding requests that require Evident or IDology identity checks.

Buyer relevance. Privacy counsel handling access and deletion requests under different laws can encode each statute's deadline trigger in the system instead of tracking exceptions by hand, which lowers the risk of missed statutory response dates.