OneTrust vs TrustArc: how they compare in 2026

Artificial intelligence is present, shipped and contractually confirmed, and it is a layer on a product whose value stands entirely without it. The core is registry and workflow software: a data and activity map, consent banners and preference centres, data subject request automation, vendor and third-party inventories, assessment templates across more than fifty standards, and policy approval workflows. Remove every model and all of that continues to work, which is the distinction this axis asks about. Where AI appears it accelerates an existing step rather than constituting one, with an AI-assisted risk assessment producing a summary and key findings that then route to human approval. Worth separating two things that are easy to conflate here: OneTrust sells AI governance as a subject matter, maintaining registers of a customer's models, agents and datasets and applying runtime controls to them, and that is the product managing someone else's AI rather than the product being AI. The Master Terms confirm the vendor's own use, answering the question of whether AI is used in the services with a plain yes.

Artificial intelligence is present and peripheral by the vendor's own construction. The Terms of Use for AI Features state that use of any AI-enabled feature is strictly optional, that no customer data is processed by AI technologies unless the customer uses such a feature, and that the customer may discontinue them at any time; Table 1 lists the features as assistants, lookups, autofill, similarity search, bulk record creation, translations and summaries layered onto PrivacyCentral, Data Mapping, Assessment Manager, Cookie Consent Manager, Trust Center and Nymity Research, each of which functions as a privacy management, assessment or research product without them. Arc Intelligence reached general availability in December 2025 on a platform in operation for decades. This is the legacy-platform case the brief asks the axis to discriminate, and it does. AI Terms, legal centre index and product navigation read 6 September 2026.

Accuracy is not asserted loudly and it is not measured either, and the document that would answer it is obtainable rather than published. The AI-assisted assessment shown on the home page produces a risk summary and graded findings across personal data processing, model accuracy and transparency, which is an output a compliance officer will act on, and no accuracy rate, benchmark, test set or error mode for it was located on any public surface. Several limbs of this axis do not bite: the product does not retrieve primary legal authority, so grounding to openable sources and citator checking are not the relevant questions, and the applicable risk is a wrong risk rating rather than a fabricated citation. The AI Systems Transparency Report is the artifact that would carry this and the Master Terms describe it as available upon request, which under the gated-is-not-absent rule is the middle tier rather than an absence, but its contents could not be read on 1 September 2026. Checked the home page, the trust centre, the pricing and packaging page and the published contracting explainer.

Accuracy is disclaimed without measurement, and grounding is to a subscription corpus the reader cannot open. The AI Terms state that TrustArc takes measures designed to ensure accuracy but is not responsible for the quality, accuracy or effectiveness of AI-generated output and that every output must be reviewed, with a subject-matter expert if needed, before use; the NymityAI research chatbot answers over the Nymity library of regulatory summaries and templates, which is licensed content rather than primary law a reader can verify without a subscription. No accuracy figure, test set, evaluation or description of how answers cite their sources is published on the surfaces read. AI Terms, product navigation and trust centre privacy notice read 6 September 2026.

A review point is not merely claimed but drawn, with named roles, and the surrounding control structure is incomplete. The AI use case workflow published on the home page runs intake, then AI risk assessment, then a review and approve stage showing three pending reviewers identified as Privacy, Security and Legal, then continuous monitoring described as real-time oversight and alerts after workflow completion. That places the machine output before a human gate and says who holds it, which is more than most vendors in this lane publish. The AI Governance package reinforces it commercially, listing configurable approvals, attestations and evaluation gates before AI systems move to production, and runtime controls across prompts, outputs, data access and allowed AI actions. What is missing is the rest: nothing states what the assessment does unattended, at what confidence it defers, or what happens after it is wrong, and no statement was located about the behaviour of OneTrust's own models as distinct from the governance gates it sells.

A written commitment to human oversight with real review surfaces, short of the full control structure. AI Terms section 2.1 requires the customer to review and validate AI outputs and not rely on them for decision-making without human oversight, section 1.1 requires notice before any AI technology processes customer data and makes every AI feature optional and revocable on request, and the features themselves are assistive, with suggestions, lookups, autofill and an evidence analyser that a user accepts into an assessment or record. What is not published is any threshold at which the system acts without a person, any description of what executes automatically, or a stated route back after an output is wrong beyond the customer's own review. AI Terms and product navigation read 6 September 2026.

A named customer, a named individual and real figures are published, and nothing carries a date. The GOL customer story quotes Bruna Boccini, Head of Compliance and Data Protection Officer at the airline, and gives specific before-and-after numbers in her own account: vendor approval falling from almost thirty days to between five and zero, and request completion falling from fourteen or fifteen days to a few minutes, against a described estate of seven billion identifiers and thousands of data flows and vendors. A commissioned Forrester Total Economic Impact study adds a 227 per cent three-year return and a seven-month payback, which is a figure attached to a documented methodology a reader can assess. Around those sit a large named logo set including Adobe, Samsung, Pfizer, Walgreens, Aetna, Atlassian, Maersk and Bristol Myers Squibb, and a claim of more than 14,000 customers with more than half the Fortune 500. What holds this below the top band is dating: no located customer story or study carries a date, and the operational figures are the interviewee's own account rather than a measured study.

A named customer without figures, and figures without a named customer. A published case study names the New England Journal of Medicine and its data protection officer, Sean McInnis, describing a migration of a cookie consent tool and the support received, with no measured outcome; a second case study attributes figures to an unnamed Fortune 500 consumer products company: time to compliance cut by up to fifteen per cent, privacy programme operating expenses reduced by sixteen to thirty per cent, and more than three quarters of privacy processes automated, with no method stated. Nothing joins a named customer to a figure, and the AI features are not the subject of either study. Two case study PDFs read 6 September 2026; the customers index was not opened.

The published commitments are substantive and contractual, and the training question is not answered. What a buyer can read before signing: a Data Processing Addendum published openly with version history, purpose limitation providing that personal data is processed only for the limited purposes described in the agreement and that OneTrust will not buy or sell customer personal data, customer retention of ownership of all data input into the services, tenant separation with data held in a logically-separated cloud database and a single production environment per customer, ISO 27701 certification for privacy information management, and deletion or export rights exercisable at any time during the term and for sixty days after it ends. Against that, nothing located states whether customer content is used to train or improve models, which is the first question this axis asks and a conspicuous silence for a company selling AI governance; the position on third-party model providers is equally absent; and privilege and work product are never mentioned, which matters because the platform is sold to privacy counsel and the workflow assigns a legal reviewer.

Substantive published commitments on training use, third-party providers and deletion, short of the full picture on segregation and privilege. No training: AI Terms section 1.1(b), incorporated into the customer agreement, states that customer data will not be used for AI model training, model improvement or any similar purpose, and 1.1(d) that the third-party AI technologies are explicitly opted out of LLM training and used solely to generate responses for authenticated users within the TrustArc environment. Third-party providers: Table 1 names them feature by feature. Retention and deletion: the subscription agreement gives a thirty-day retrieval window after termination followed by deletion, and the AI Terms commit to ceasing AI processing promptly on request. Not located: any statement on segregation between customers or matters, since the technical and organisational measures document was not opened, and any treatment of privilege or work product. AI Terms, subscription agreement fragments and trust centre privacy notice read 6 September 2026.

Nothing located addresses the line between an information tool and legal advice, on a product that produces compliance determinations for a professional audience. The platform assigns risk ratings, generates assessments against named regimes including the EU AI Act, GDPR and US state privacy laws, and routes them to a reviewer identified as Legal, so the output is consumed as a compliance judgement. What is published in its place is a performance commitment rather than an advice-line position: the Master Terms warrant that the cloud services will materially conform to the OneTrust User Guide throughout the subscription term. No statement was located that outputs are not legal advice, that OneTrust is not a law firm, that no professional relationship arises, or that a user should take advice on their own facts, and no jurisdiction limit or supervision and competence discussion appears. **This is the row most likely to move on this record**: the Master Terms PDF itself and the Legal and Compliance Information page were not opened on 1 September 2026, and a disclaimer may sit in either, so the grade rests on the home page, trust centre, pricing page and published contracting explainer.

A real position on tooling versus expertise, short of a drawn advice line and jurisdiction limits. AI Terms section 1.2(b) requires the customer to review all AI output before use, suggesting consultation with an internal or external subject-matter expert, and section 2.1 bars relying on outputs for decision-making without human oversight; the buyer is stated as privacy and compliance teams. The Nymity library publishes legal summaries and the research chatbot answers from them, and no located surface states whether those outputs are or are not legal advice; the subscription agreement, which a third-party summary describes as stating that use of the solutions does not guarantee compliance, could not be fetched in full because the site blocks automated retrieval, so that line is not credited. No jurisdiction limit is named. AI Terms and subscription agreement fragments read 6 September 2026.

A governance framework with real substance is published and its results are not. The trust centre states that OneTrust's AI governance programme is managed by an interdisciplinary AI Governance Committee, supported by AI governance processes across the organisation and the AI systems lifecycle, an internal AI use policy and employee training. That is an accountable body, a lifecycle scope and two named instruments rather than a list of adjectives, and it is backed by a dedicated Responsible AI section, a published Journey to AI Governance toolkit and an AI Systems Transparency Report. Two things keep it below the top band. No individual is named as accountable, the committee being identified only by function. And nothing has been disclosed about uneven output: no bias evaluation, no testing regime and no result appears on any public surface, which is a notable gap for a vendor whose own product sells bias and drift monitoring to others. The AI Systems Transparency Report is available on request rather than published, so it sits in the middle disclosure tier and its contents were not read.

Published AI-use commitments without a governance mechanism, testing regime or accountable owner. The AI Terms are substantive on data use, provider transparency, opt-out and change notice, but they say nothing about who inside TrustArc is accountable for the AI features, what is tested before a feature ships, or what has been found about uneven output; no responsible AI page, ISO 42001 or equivalent certification, or model evaluation is published on the surfaces read. The Assessment Manager product sells AI risk assessment to customers, which is governance of the customer's AI rather than TrustArc's own. AI Terms, product navigation and trust centre read 6 September 2026.

Every limb this band names is published, current and specific enough to hold the vendor to, and this is the strongest stewardship record located in the corpus. Retention is customer-configurable rather than merely stated, with services shipping built-in data minimisation functionality including auto-deletion and retention periods, and OneTrust expressly encouraging customers to configure them down. Deletion is contractual and time-bounded: customers may delete or export their data in a structured, commonly used and machine-readable format at any point during the term and for up to sixty days after termination, after which remaining data is deleted under a destruction policy. Access control runs through customer-administered user access plus ISO 27001, 27017 and 27701 certification, with the security obligations set out in Appendix 1 of the published DPA. Subprocessors are maintained on a list with a thirty-day advance notice commitment for changes and a right to object on reasonable data protection grounds, remedied by an alternative provider or termination of the affected subscription. Incident practice is stated: notification without undue delay, continuing updates on material developments, and cooperation with the customer's own reporting obligations. Encryption is given concretely at AES-256 at rest and in backup and a minimum of TLS 1.2 in transit, and the trust centre publishes a 2026 penetration test executive summary alongside disaster recovery and business continuity exercise memos. The one soft edge is that the subprocessor list itself sits on the customer portal rather than the open trust centre.

Substantive published policy covering most of the ground, with access control not read. Retention: the subscription agreement retains customer data for thirty days after termination for retrieval, then permits deletion except for legally required copies; the trust centre privacy notice retains personal information only as long as necessary and places data about individuals named in customer assessments under customer control. Deletion: the AI Terms commit to ceasing AI processing on request. Sub-processors: a public disclosure lists each with location, purpose and transfer mechanism, with emailed notice thirty days before any addition and a subscription to receive it, plus a separate affiliate list. Incident practice: AI Terms section 1.3 commits to prompt notice of any security incident involving AI-related processing under the agreement or DPA. Access control: the technical and organisational measures document and DPA of February 2024 exist in the legal centre and were not opened; the trust centre security page states TLS 1.2 in transit and AES-256 at rest with intrusion detection and logging. Surfaces read 6 September 2026.

What the vendor stands behind is published, specific, versioned and independently assessed, which no other record in this pull matches. The Master Terms of Service are published in full at a dedicated legal centre, currently version 5.1 effective 23 March 2026, with every prior version back to August 2020 downloadable alongside the DPA, Standard Contractual Clauses, Business Associate Agreement and product-specific supplemental terms. The liability position is stated and benchmarked rather than buried: a cap on each party's liability equal to the total annual fees paid or payable in the preceding year, which OneTrust expressly notes is broader than the more common cap tied to fees for the applicable service only, with willful misconduct and intellectual property claims carved out and uncapped. An indemnity with stated scope covers third-party IP infringement claims arising from use of the cloud services, with OneTrust controlling the defence. A warranty a buyer can invoke commits the cloud services to conform materially to the User Guide throughout the term. OneTrust also publishes a plain-language explainer, Contracting with OneTrust, setting all of this out for a reviewer, and states plainly what it will not do, refusing uncapped liability for data breach and giving its reasoning. The Master Terms carry an independent TermScout assessment rating them 70 per cent customer favourable with a perfect score against buy-side deal breakers. What is absent is anything specific to AI output being wrong and any insurance position.

A real published position on liability, short of the full picture because the subscription agreement could not be read end to end. Recovered through the search index from the subscription agreement: section 8.1 gives a TrustArc defence and indemnity for third-party claims stated to be its entire liability and the customer's exclusive remedy for such claims, with exclusions for modifications, combinations and non-compliant use; section 8.2 has the customer indemnify TrustArc for customer data and other matters; section 7.2 warrants core functionality against documentation, no material decrease during the term, malicious-code measures and diligent services. The end-user terms for partner channels cap either party's liability at fees paid for the applicable solution in the preceding twelve months. AI Terms section 2.1 provides the AI features with the same warranties and exclusions as the solutions and section 1.2(b) disclaims responsibility for the quality and accuracy of AI output. The agreement's own cap, consequential-loss exclusions and carve-outs were not readable because the site returned bot detection on fetch on 6 September 2026; that is a limit on this reading and the agreement is the rebuttal route.

Integration is plainly a real part of the offering and no individual connection could be named from the surfaces read. A dedicated Integrations page sits in the platform navigation and is described as an extensive set of integrations for adding data management to existing workflows, the Third-Party Management package refers to automating vendor assessments with ecosystem integrations, the Consent product is described as scaling through APIs to collect and enforce consent across emerging channels, and some services ship components that a customer implements on its own systems and websites such as cookie consent scripts and data discovery agents. OneTrust is additionally distributed through the Azure Marketplace, which has its own published supplemental terms. What is missing is the naming and the depth: no specific system is identified anywhere on the pages read, no API reference or developer documentation was located, and nothing describes what moves in which direction. **The Integrations page was not opened on 1 September 2026**, so this grade is rebuttable upward on one fetch and is recorded conservatively rather than assumed.

Integrations are referred to without documentation an implementer could use on the surfaces read. The subscription agreement contemplates customer-enabled Third-Party Applications with data exchange on the customer's behalf, and the Trust Center product page describes pushing documents from content systems, notifying Slack and creating ServiceNow tasks through TrustArc Integrations. No integrations page or documentation was opened, no practice, document or matter system is named in the material read, and nothing describes what syncs or in which direction for the privacy applications. Subscription agreement fragments and Trust Center product page read 6 September 2026; the integrations surface is the rebuttal route.

The tenancy model is stated plainly, residency is offered, and the processing question is left open. The published contracting explainer describes cloud services delivered on a shared architecture, codebase and infrastructure, with customer data held in a logically-separated cloud database and each customer receiving a single production tenant environment, with non-production environments included in some subscriptions and further environments purchasable. Residency is a customer choice: customers can select from various geographic hosting locations for their tenant environment. What changes between tiers is also addressed, with HIPAA-compliant and PCI-compliant environments available for customers with specialised requirements, backed by a published PCI attestation of compliance and a HITRUST certification. Two things hold it below the top band. The available regions are referred to collectively rather than enumerated, so a buyer cannot see the list without asking. And where processing happens is nowhere distinguished from where data is stored, which matters for the AI features specifically since no model or provider is identified.

Cloud delivery is stated with partial residency detail and the tenancy model is not addressed. The sub-processor disclosure gives a location for each processor, including Microsoft in Washington and Canada Central for logging and messaging and Mailgun in Texas for research alerts, and the AI Terms place one feature, Ask Arc, on Anthropic in the United States or Bedrock in the EU, which is a region choice stated for that feature alone; the trust centre security page names an enterprise-grade cloud hosting provider without naming it. Nothing states whether customers share infrastructure or where the platform's primary data store sits, and no residency option is described for the platform as a whole. Sub-processor disclosure, AI Terms and trust centre security page read 6 September 2026.

This is the trust centre the band describes and the first record in this pull to reach the top of this axis. Attestations are current, independent, and downloadable directly as PDFs with no form, no email capture and no NDA click-through: a SOC 2 Type II report, a second SOC 2 Type II for Certification Automation, ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 27017 and ISO 9001 certificates, and, decisively for the scope limb, **a published Statement of Applicability** setting out which controls are in scope. Industry and sector records sit alongside them: a PCI DSS attestation of compliance signed November 2025 with a third-party responsibility matrix, a HITRUST certification letter, TISAX, TX-RAMP, the Spanish ENS conformity statement, and a CAIQ v4.0.3 self-assessment lodged on the Cloud Security Alliance STAR registry. Security documentation goes beyond certificates to a 2026 penetration test executive summary, a completed standard SIG questionnaire, a security, privacy and architecture whitepaper, and disaster recovery and business continuity exercise memos, with a live system status page. Under the gated-is-not-absent tiers this is open publication rather than the self-serve request tier, which is what separates it from every other record graded on this axis so far.

Certification is real and stated on a trust centre that renders, short of a report reachable without asking. The trust centre security page states an annual assessment by a qualified external third-party auditor against the AICPA SOC 2 Type II standard, alongside TLS 1.2 in transit, AES-256 at rest, intrusion detection, logging and incident response plans; the trust centre carries privacy, security, availability and legal sections. No auditor is named, no coverage period is stated, and the report itself sits behind the trust centre's permissions, which the vendor's own Trust Center product page describes as keeping SOC 2 reports behind confidentiality requirements; no request was submitted. No ISO certification is stated on the surfaces read. Trust centre security page and Trust Center product page read 6 September 2026.

AI use is confirmed and nothing underneath it is identified publicly. The Master Terms answer the question of whether OneTrust uses artificial intelligence in the services with a plain yes, and direct the reader to the AI Systems Transparency Report, described as available upon request. No model, model family, provider or architecture is named on any public surface read on 1 September 2026, and no statement excludes a third-party foundation model either, so a customer cannot tell from published material whose model processes the assessments and documentation it generates. Where inference runs is not addressed separately from where data is stored. No commitment to notify customers when the model set changes was located, though the subprocessor change process does carry a thirty-day notice commitment and would capture a model provider engaged as a subprocessor. This sits above the bottom band because a dedicated transparency artifact exists and is obtainable rather than absent, which is the middle disclosure tier, and below the band above because nothing is actually named where a reader can see it.

The most granular provider disclosure in the pull, held off A because the models themselves are not named. Table 1 of the AI Terms maps every AI-enabled feature to its AI technology and third-party provider: the Azure AI Platform from Microsoft for the Nymity research chatbot and lookups, the OpenAI API for autofill, similarity search, bulk record creation, evidence analysis, summaries and cookie research, the Gemini API from Google Cloud for translations and assisted upload, and for Ask Arc either Anthropic in the United States and Bedrock from Amazon in the EU or the OpenAI API, depending on which of the two versions of the table the page renders. Section 2.2(b) commits to thirty days' notice and a right to object before any modification that materially and adversely affects the customer, including changes to provider relationships, and section 1.1(d) states the providers are opted out of LLM training. The page carries two versions of Table 1 with different entries for Ask Arc, which is recorded as an inconsistency a buyer will see. The technology column names platforms and APIs rather than models. AI Terms read 6 September 2026.

The unit and the structure are published in more detail than anywhere else in this corpus, and no figure appears. A dedicated pricing and packaging page sets out nine named packages across five solution families, each with its key capabilities listed so the feature split between base and suite editions is visible, and, unusually, **each with its own charging meter stated explicitly**: AI Governance priced on admin users and AI inventory; the Consent Management Platform on average daily visitors aggregated across channels and properties; Universal Consent and Preference Management on total data subject profiles captured; Privacy Automation on users and privacy asset inventory; Tech Risk and Compliance on admin users and asset inventory; and Third-Party Management on admin users and third-party inventory. Published FAQs explain what a solution package is, that pricing runs on value-based usage meters, and that a tiered model applies with an account executive moving a customer up a tier when usage consistently exceeds limits. What is absent is the number: no rate, band, floor or currency appears anywhere, every package routes to a Get Pricing form, and nothing states what implementation or professional services add.

No pricing information was located on any surface read, at any level. The legal centre lists agreements and policies with no pricing document, the subscription agreement refers fees to the order, the AI Terms refer to usage limits such as daily query caps without a charge, and the supplier's pre-screen recorded no pricing page. The home page navigation was read only in excerpt, so the existence of a pricing page was not established by inventory, and this row is rebuttable on that page if one exists. Legal centre index, AI Terms, subscription agreement fragments and end-user terms fragments read 6 September 2026.

Coverage is described across three deliberate axes with substance behind each, and the boundary is left open. Solutions are organised by function into six families, by role into data, marketing, privacy, and security and risk teams, and by regulation with dedicated pages for GDPR, US privacy law and the EU AI Act plus a wider regulatory index. Practice depth is real: the Tech Risk and Compliance package cites templates and guidance across more than fifty standards, regulations and frameworks, the AI Governance package names the EU AI Act, NIST and ISO 42001 as the frameworks assessments align to, and third-party screening reaches politically exposed persons, sanctions and watchlists through Dow Jones data. The customer base spans regulated industry, retail, pharmaceutical, technology and non-profits on the published logo set. Two gaps keep it here. Nothing states where the product stops, with no statement of organisation size, data volume or the situations it does not fit. And the By Role navigation, which is where a legal buyer would look, offers privacy, security and risk, data and marketing teams and **no page for legal or counsel**, even though the product's own published workflow assigns a legal reviewer.

Segment and coverage described with substance; the boundaries are left open. The buyer is stated as privacy, legal, security and compliance teams in enterprises, with the Nymity library covering privacy regulations, legal summaries and operational templates globally and product navigation naming the EU AI Act, India's data protection law and the EU-US Data Privacy Framework among covered regimes; case studies span healthcare and publishing and consumer products, and the TRUSTe assurance programmes serve a separate certification market. What is not stated is where the product stops: no jurisdiction or regulation is named as unsupported and no law firm use is described. Product navigation, case studies and AI Terms read 6 September 2026.