O

OneTrust

AI is shipped and confirmed in the contract, as a layer on a product that works without it. The core is registry and workflow software: a data map, consent banners and preference centers, data subject request automation, vendor and third party inventories, assessment templates for more than fifty standards, and policy approval workflows, all of which work without any model. Where AI appears, it speeds up an existing step, as when an AI assisted risk assessment produces a summary and findings that go to human approval.

OneTrust sells AI governance as a subject, keeping registers of a customer's models, agents and datasets and controlling them at runtime, which is the product managing someone else's AI rather than being AI. The Master Terms answer whether AI is used in the services with a plain yes.

Accuracy is neither loudly claimed nor measured, and the document that would answer it is available only on request. The AI assisted assessment on the home page produces a risk summary and graded findings on personal data processing, model accuracy and transparency, which a compliance officer will act on, and no accuracy rate, benchmark, test set or failure mode is published. The product does not retrieve legal authority, so source links and citator checks are not the point; the risk is a wrong risk rating, not a fabricated citation.

The Master Terms say the AI Systems Transparency Report is available on request, and its contents could not be read. Checked the home page, trust center, pricing and packaging page and contracting explainer.

A review point is drawn with named roles, and the rest of the control structure is incomplete. The AI use case workflow on the home page runs intake, then AI risk assessment, then a review and approve stage with three pending reviewers, Privacy, Security and Legal, then continuous monitoring with real time oversight and alerts. That puts a human gate after the machine output and says who holds it. The AI Governance package adds configurable approvals, attestations and evaluation gates before production, and runtime controls on prompts, outputs, data access and allowed AI actions.

Nothing says what the assessment does unattended, when it defers, or what happens when it is wrong, and nothing describes how OneTrust's own models behave, as distinct from the gates it sells.

A named customer, a named individual and real figures are published, with no dates. The GOL customer story quotes Bruna Boccini, Head of Compliance and Data Protection Officer at the airline, who says vendor approval fell from almost thirty days to between five and zero, and request completion from fourteen or fifteen days to a few minutes, across seven billion identifiers and thousands of data flows and vendors. A commissioned Forrester Total Economic Impact study reports a 227 percent three year return and a seven month payback, with a documented method.

Logos include Adobe, Samsung, Pfizer, Walgreens, Aetna, Atlassian, Maersk and Bristol Myers Squibb, and the vendor claims more than 14,000 customers, including more than half the Fortune 500. No customer story or study found carries a date, and the GOL figures are the interviewee's own account rather than a measured study.

Published commitments are substantive and contractual, and training is not addressed. A buyer can read before signing: an openly published Data Processing Addendum with version history; a purpose limit under which personal data is processed only for the purposes in the agreement and never bought or sold; customer ownership of all data input; tenant separation in a logically separated cloud database with one production environment per customer; ISO 27701 certification; and deletion or export at any time during the term and for sixty days after.

Nothing found says whether customer content is used to train or improve models, a notable silence for a company selling AI governance. Nothing covers third party model providers. Privilege and work product are never mentioned, though the platform is sold to privacy counsel and its workflow assigns a legal reviewer.

Nothing found addresses the line between an information tool and legal advice, on a product that produces compliance judgments for professionals. The platform assigns risk ratings, generates assessments against the EU AI Act, GDPR and US state privacy laws, and routes them to a reviewer named Legal. In place of an advice position, the Master Terms warrant that the services will materially conform to the OneTrust User Guide during the term.

No statement says outputs are not legal advice, OneTrust is not a law firm, no professional relationship arises, or users should seek advice on their own facts, and no jurisdiction limit or supervision and competence discussion appears. The Master Terms PDF and the Legal and Compliance Information page were not opened and may contain a disclaimer. Read: the home page, trust center, pricing page and contracting explainer.

A real governance framework is published, without results. The trust center says OneTrust's AI governance program is run by an interdisciplinary AI Governance Committee, supported by governance processes across the organization and the AI lifecycle, an internal AI use policy and employee training. That names an accountable body, a lifecycle scope and two instruments, backed by a Responsible AI section, a published Journey to AI Governance toolkit and an AI Systems Transparency Report.

No individual is named as accountable; the committee is identified only by function. Nothing is disclosed on uneven output, with no bias evaluation, testing regime or result on any public page, a notable gap for a vendor that sells bias and drift monitoring to others. The AI Systems Transparency Report is available on request, not published, and was not read.

Retention, deletion, access control, subprocessors and incident practice are all published and specific. Retention is set by the customer, with built in data minimization including automatic deletion and retention periods that OneTrust encourages customers to shorten. Customers may delete or export their data in a structured, machine readable format at any time during the term and for up to sixty days after, after which remaining data is destroyed.

Access is managed by the customer, with ISO 27001, 27017 and 27701 certification and security duties set out in Appendix 1 of the published DPA. Subprocessor changes carry thirty days' notice and a right to object on reasonable data protection grounds, remedied by an alternative or termination of the affected subscription. Incidents are notified without undue delay, with updates and cooperation on the customer's own reporting.

Encryption is AES-256 at rest and in backup and at least TLS 1.2 in transit, and the trust center publishes a 2026 penetration test summary and disaster recovery and continuity exercise memos. The subprocessor list itself sits on the customer portal, not the open trust center.

What the vendor stands behind is published, specific, versioned and independently assessed. The Master Terms of Service are published in full in a legal center, currently version 5.1 effective 23 March 2026, with every earlier version back to August 2020 downloadable alongside the DPA, Standard Contractual Clauses, Business Associate Agreement and product terms. Each party's liability is capped at total annual fees paid or payable in the prior year, which OneTrust notes is broader than the common cap tied to fees for one service, with willful misconduct and intellectual property claims uncapped.

An indemnity covers third party IP infringement claims from use of the cloud services, with OneTrust controlling the defense. A warranty commits the services to conform materially to the User Guide for the term. A plain language explainer, Contracting with OneTrust, sets this out and explains why OneTrust refuses uncapped liability for data breach. An independent TermScout assessment rates the terms 70 percent customer favorable with a perfect score against buyer deal breakers. Nothing addresses wrong AI output, and no insurance position is stated.

Integration is clearly part of the offering, but no connection could be named from the pages read. An Integrations page sits in the platform menu, described as an extensive set of integrations for adding data management to existing workflows; Third-Party Management automates vendor assessments with ecosystem integrations; the consent product scales through APIs across channels; and some services ship components customers install themselves, such as cookie consent scripts and data discovery agents.

OneTrust is also sold through the Azure Marketplace, with its own supplemental terms. No specific system is named on the pages read, no API reference or developer documentation was found, and nothing says what moves in which direction. The Integrations page was not opened and may say more.

Tenancy is stated plainly, residency is offered, and processing location is left open. The contracting explainer describes cloud services on shared architecture, code and infrastructure, with customer data in a logically separated cloud database and each customer given a single production tenant, plus nonproduction environments in some subscriptions and more available to buy. Customers can choose from various geographic hosting locations.

HIPAA and PCI compliant environments are available for specialized needs, backed by a published PCI attestation and a HITRUST certification. The available regions are not listed, so a buyer must ask, and processing location is not distinguished from storage, which matters for the AI features since no model or provider is named.

Current, independent attestations can be downloaded directly as PDFs, with no form, email capture or NDA click: a SOC 2 Type II report, a second SOC 2 Type II for Certification Automation, ISO/IEC 27001, 27701, 27017 and ISO 9001 certificates, and a published Statement of Applicability showing which controls are in scope. Alongside them sit a PCI DSS attestation signed November 2025 with a responsibility matrix, a HITRUST certification letter, TISAX, TX-RAMP, the Spanish ENS conformity statement, and a CAIQ v4.0.3 self assessment on the Cloud Security Alliance STAR registry.

Documentation goes beyond certificates to a 2026 penetration test summary, a completed SIG questionnaire, a security, privacy and architecture whitepaper, disaster recovery and continuity exercise memos, and a live status page. All of this is openly published.

AI use is confirmed, and nothing underneath it is named publicly. The Master Terms answer whether OneTrust uses AI in the services with a plain yes and point to the AI Systems Transparency Report, available on request. No model, family, provider or architecture is named on any public page read, and nothing rules out a third party foundation model, so a customer cannot tell whose model produces its assessments and documentation.

Inference location is not separated from storage. No commitment to notify customers of model changes was found, though the subprocessor process carries thirty days' notice and would cover a model provider engaged as a subprocessor. The transparency report exists and can be requested, but nothing is named where a reader can see it.

The unit and structure are published in detail, and no figure appears. A pricing and packaging page sets out nine packages across five solution families, each with key features listed so the split between base and suite editions is visible, and each with its own charging meter: AI Governance on admin users and AI inventory; the Consent Management Platform on average daily visitors across channels and properties; Universal Consent and Preference Management on data subject profiles captured; Privacy Automation on users and privacy asset inventory; Tech Risk and Compliance on admin users and asset inventory; and Third-Party Management on admin users and third party inventory.

FAQs explain that pricing uses value based usage meters in tiers, with an account executive moving a customer up a tier when usage consistently exceeds limits. No rate, band, floor or currency appears, every package routes to a Get Pricing form, and nothing says what implementation or professional services add.

Coverage is described three ways, with substance, and the boundary is left open. Solutions are organized by function into six families, by role into data, marketing, privacy, and security and risk teams, and by regulation, with pages for GDPR, US privacy law and the EU AI Act plus a wider regulatory index. Tech Risk and Compliance cites templates across more than fifty standards and frameworks, AI Governance aligns to the EU AI Act, NIST and ISO 42001, and third party screening covers politically exposed persons, sanctions and watchlists through Dow Jones data.

Published logos span regulated industry, retail, pharmaceuticals, technology and nonprofits. Nothing says where the product stops, such as organization size, data volume or poor fit. The By Role menu, where a legal buyer would look, has no page for legal or counsel, although the product's own workflow assigns a legal reviewer.