Legal-specific · Compliance and privacy · Medium confidence
OneTrust, LLC · OneTrust AI Governance module (not the whole OneTrust privacy/GRC suite). Privacy overview plus full notice at onetrust.com/privacy-notice. Trust Centre holds SOC 2/ISO records.
Enterprise AI-governance platform to inventory, risk-assess, approve and monitor models, agents, datasets and vendors against EU AI Act, NIST AI RMF and ISO 42001 templates.
Opens a private software assessment of OneTrust AI Governance for one task, with this profile’s questions to hand.
| Deployment | SaaS |
|---|---|
| Hosting regions | Unknown |
| Australian region | Unknown |
| Assurance | SOC 2, ISO 27001:2013, ISO 27701:2019, ISO 42001: the vendor's own page states "trust.com/glossary/nist-ai-risk-management/?external_referrer=https%3A%2F%2Fwww.google.com%2F), and ISO 42001 templates - Automate risk tiering by use case, system, component, deployment co" (https://www.onetrust.com/solutions/ai-governance, checked 2026-10-10). |
| Training on customer content | Unknown |
| Retention summary | Not numbered on the AI Governance or privacy-overview pages reviewed. Full privacy notice is a separate URL. |
| Pricing summary | Pricing page exists; figures not extracted. Packaged as scalable enterprise modules. |
| Legal content coverage | Governance templates (EU AI Act, NIST AI RMF, ISO 42001), not a licensed primary-law research corpus. |
| Australian presence | Unknown — No Australian hosting claim found on the AI Governance or privacy-overview pages. Privacy overview is controller-side website/customer-contact data. |
Define the configuration, people, information and tasks being assessed.
Public claim only
OneTrust, LLC (SOC 2 also names OneTrust Technology Limited). Scope for this record is AI Governance: inventory, risk, approvals, runtime monitoring of models/agents/vendors — not the full privacy/cookie suite.
Ask: Which AI Governance SKU and hosting tenancy are on the order, separate from Privacy Automation?
Not confirmed
Product is a cloud platform. Hosting region is not stated on the AI Governance or privacy-overview pages reviewed. Trust Centre holds security documentation (requestable).
Ask: Which cloud region holds our AI inventory and assessments, and is Australia available?
Public claim only
Discover/inventory AI systems, agents, models, datasets, vendors; EU AI Act / NIST AI RMF / ISO 42001 templates; intake/approval workflows; runtime observation, guardrails, attestations.
Ask: Which connectors discover our models, and can we disable runtime enforcement?
Public claim only
Templates named: EU AI Act, NIST AI RMF, ISO 42001. Australian AI ethics/privacy mapping is not described on the product page.
Ask: Are APPs and the Australian AI ethics framework in the template library?
Record the practical work needed to introduce and maintain the software.
Not confirmed
A pricing URL exists; amounts were not extracted. No public seat price for AI Governance alone.
Ask: Confirm module fees, user licences and term.
Public claim only
Continuous discovery across changing environments is claimed. Named DMS/IdP connectors were not listed on the product page extract.
Ask: Which systems will OneTrust scan, and do they honour source permissions?
Public claim only
Privacy overview: OneTrust companies share data to provide 24/7 support. No severity SLA on the pages reviewed.
Ask: What are severity targets and the security contact for AI Governance?
Compare complete work at the required quality, including checking and correction.
Public claim only
OneTrust named a Visionary in the 2026 Gartner Magic Quadrant for AI Governance Platforms. That is analyst placement, not a legal-output accuracy bench.
Ask: May we trial intake/risk scoring on our model register?
Public claim only
Fit is inventory, risk, approval and evidence for AI systems. It is not a substitute for legal advice on a matter. Human owners and sign-off workflows are the product model.
Ask: Who in the firm is the accountable owner for each AI system in the register?
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Not confirmed
If the inventory includes tools that process client matter data, that is a disclosure. No Australian client-consent template on pages reviewed.
Ask: What client-data fields does AI Governance ingest from connected systems?
Not confirmed
The product governs the customer’s models. Which LLM OneTrust uses inside the module (if any) is not named on the product or privacy-overview pages.
Ask: Does AI Governance send our inventory or assessments to a third-party LLM?
Not confirmed
Privacy overview: vendors perform tasks (payments, analytics, help desk, CRM, email). No dated AI-Governance-specific subprocessor list on pages reviewed.
Ask: Provide the current named list with locations for the AI Governance tenant.
Not confirmed
No no-training clause for AI Governance customer records was found on the product or privacy-overview pages. Do not infer one.
Ask: Confirm customer AI inventories, assessments and connected logs are not used to train OneTrust or third-party models.
Public claim only
Privacy overview: usage/cookies for marketing and security; website analytics. Customer-tenant telemetry for AI Governance is not numbered there.
Ask: Can assessment contents appear in product analytics?
Not confirmed
Retention for AI inventory/assessment records is not numbered on the pages reviewed. Full privacy notice is a separate URL not fully extracted in this pass.
Ask: State default retention for inventories, assessments, runtime logs and backups.
Not confirmed
No public 30-day certified-deletion SLA extracted from the AI Governance or privacy-overview pages.
Ask: On exit, will you delete the AI register, runtime logs and backups and certify?
Public claim only
Privacy overview: employee access limited on a need-to-know basis; privacy/security training and confidentiality requirements; regular security testing.
Ask: Is support access to our AI register ticket-scoped and logged?
Public claim only
Product: assign ownership, lifecycle status, approval/signoff workflows. SSO/MFA not specified on the product page extract.
Ask: Is SSO/MFA/SCIM included on our AI Governance SKU?
Not confirmed
Privacy overview refers to technical/organisational measures and the full privacy notice for information security. Algorithms not on the overview page.
Ask: Confirm TLS/at-rest encryption and key custody for the AI Governance tenant.
Public claim only
Privacy overview: ISO/IEC 27001:2013 and 27701:2019 for OneTrust LLC’s IMS; SOC 2 report for OneTrust, LLC and OneTrust Technology Limited (security, confidentiality, availability). Trust Centre: download certifications. Reports not inspected. ISO 42001 is a customer template, not a OneTrust certification claim on that page. ISO 27001: the vendor's own page states "s/beyond-iso-27001-building-the-foundation-for-scalable-risk-and-ai-governance-webinar/#) # Beyond ISO 27001: Building the Foundation for Scalable Risk and AI Governance ISO 27001 has bec" (https://www.onetrust.com/resources/beyond-iso-27001-building-the-foundation-for-scalable-risk-and-ai-governance-webinar/, checked 2026-10-10). ISO 42001: the vendor's own page states "trust.com/glossary/nist-ai-risk-management/?external_referrer=https%3A%2F%2Fwww.google.com%2F), and ISO 42001 templates - Automate risk tiering by use case, system, component, deployment co" (https://www.onetrust.com/solutions/ai-governance, checked 2026-10-10). SOC 2: the vendor's own page states "Explore OneTrust certifications, audit reports, and related trust records in one place (SOC 2, ISO, and more). These documents help organizations review our security, privac" (https://www.onetrust.com/trust/, checked 2026-10-10).
Ask: Provide current SOC 2 and ISO certificates with dates and scope covering AI Governance.
Not confirmed
No public terms or DPA URL was extracted from the AI Governance or privacy-overview pages. Trust Centre holds privacy materials. Enterprise order forms likely sit behind sales.
Ask: Provide the MSA/DPA for AI Governance with APP 8 and 72-hour notice.
Public claim only
Privacy overview: sharing with OneTrust companies for 24/7 support and global marketing; vendors; possible CCPA ‘sale’/share for some website data. Customer-tenant residency not stated.
Ask: List every country of storage and support access for our AI Governance tenant.
Not confirmed
No 72-hour customer-notification SLA on the privacy-overview or AI Governance pages reviewed.
Ask: State the contractual breach-notification period.
Not confirmed
Change-notice for subprocessors or the AI Governance module was not extracted from these pages.
Ask: Will material processor or feature changes get 30 days’ written notice?
Not confirmed
Export/deletion on termination was not extracted from the AI Governance or privacy-overview pages.
Ask: What export formats exist for the AI register and evidence pack?
Public claim only
Continuous discovery of AI across changing environments is claimed. Connector list not published on the product page extract.
Ask: List every connector that can read our systems, and how we disable them.
Not confirmed
Product is governance, not legal research. Open-web browsing was not described.
Ask: Does any OneTrust agent in this module browse the open web with our data?
Public claim only
Runtime enforcement, guardrails and policy evaluation across models, data, agents and vendors are marketed. Default unattended enforcement actions are not contractually listed on the page extract.
Ask: Which runtime actions can OneTrust take on our models without a human click?
Public claim only
Configurable intake, approval, attestation and signoff; reviews routed by risk. That is the governance model — still depends on the firm using it.
Ask: Will high-risk AI systems require named legal sign-off before production?
Official pages reviewed for this profile, last reviewed 2026-10-10.
Add this product to your toolset for a particular task, or use it with a practice-area checklist. Add to your toolset Practice areas Best AI compliance and privacy tools Australia
