---
title: "OneTrust AI Governance (OneTrust, LLC)"
url: "https://ailawframework.com/software/onetrust"
type: "software_profile"
site: "AI Law Framework"
id: "onetrust"
vendor: "OneTrust, LLC"
category: "Legal-specific"
segment: "Compliance and privacy"
confidence: "medium"
last_reviewed: "2026-10-10"
---

# OneTrust AI Governance (OneTrust, LLC)

> Enterprise AI-governance platform to inventory, risk-assess, approve and monitor models, agents, datasets and vendors against EU AI Act, NIST AI RMF and ISO 42001 templates.

Canonical page: https://ailawframework.com/software/onetrust  
Last reviewed: 2026-10-10

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: OneTrust AI Governance module (not the whole OneTrust privacy/GRC suite). Privacy overview plus full notice at onetrust.com/privacy-notice. Trust Centre holds SOC 2/ISO records.

## Capabilities

- Compliance monitoring
- Intake and triage
- Agentic workflows

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | Unknown |
| Australian region | Unknown |
| Assurance | SOC 2, ISO 27001:2013, ISO 27701:2019, ISO 42001: the vendor's own page states "trust.com/glossary/nist-ai-risk-management/?external_referrer=https%3A%2F%2Fwww.google.com%2F), and ISO 42001 templates - Automate risk tiering by use case, system, component, deployment co" (https://www.onetrust.com/solutions/ai-governance, checked 2026-10-10). |
| Training on customer content | Unknown |
| Retention | Not numbered on the AI Governance or privacy-overview pages reviewed. Full privacy notice is a separate URL. |
| Legal content coverage | Governance templates (EU AI Act, NIST AI RMF, ISO 42001), not a licensed primary-law research corpus. |
| Pricing | Pricing page exists; figures not extracted. Packaged as scalable enterprise modules. |
| Australian presence | Unknown. No Australian hosting claim found on the AI Governance or privacy-overview pages. Privacy overview is controller-side website/customer-contact data. |
| Website | https://www.onetrust.com/solutions/ai-governance |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| AI Governance module | Public claim only | OneTrust, LLC (SOC 2 also names OneTrust Technology Limited). Scope for this record is AI Governance: inventory, risk, approvals, runtime monitoring of models/agents/vendors — not the full privacy/cookie suite. | Which AI Governance SKU and hosting tenancy are on the order, separate from Privacy Automation? | [OneTrust — AI Governance](https://www.onetrust.com/solutions/ai-governance); [OneTrust — Privacy overview](https://www.onetrust.com/privacy) |
| SaaS; region not stated on these pages | Not confirmed | Product is a cloud platform. Hosting region is not stated on the AI Governance or privacy-overview pages reviewed. Trust Centre holds security documentation (requestable). | Which cloud region holds our AI inventory and assessments, and is Australia available? | [OneTrust — AI Governance](https://www.onetrust.com/solutions/ai-governance); [OneTrust — Trust Center](https://www.onetrust.com/trust) |
| Inventory, risk, runtime controls | Public claim only | Discover/inventory AI systems, agents, models, datasets, vendors; EU AI Act / NIST AI RMF / ISO 42001 templates; intake/approval workflows; runtime observation, guardrails, attestations. | Which connectors discover our models, and can we disable runtime enforcement? | [OneTrust — AI Governance](https://www.onetrust.com/solutions/ai-governance) |
| Governance frameworks, not AU case law | Public claim only | Templates named: EU AI Act, NIST AI RMF, ISO 42001. Australian AI ethics/privacy mapping is not described on the product page. | Are APPs and the Australian AI ethics framework in the template library? | [OneTrust — AI Governance](https://www.onetrust.com/solutions/ai-governance) |
| Enterprise packaging | Not confirmed | A pricing URL exists; amounts were not extracted. No public seat price for AI Governance alone. | Confirm module fees, user licences and term. | [OneTrust — AI Governance](https://www.onetrust.com/solutions/ai-governance) |
| Estate discovery | Public claim only | Continuous discovery across changing environments is claimed. Named DMS/IdP connectors were not listed on the product page extract. | Which systems will OneTrust scan, and do they honour source permissions? | [OneTrust — AI Governance](https://www.onetrust.com/solutions/ai-governance) |
| 24/7 via group companies | Public claim only | Privacy overview: OneTrust companies share data to provide 24/7 support. No severity SLA on the pages reviewed. | What are severity targets and the security contact for AI Governance? | [OneTrust — Privacy overview](https://www.onetrust.com/privacy) |
| Gartner MQ 2026 | Public claim only | OneTrust named a Visionary in the 2026 Gartner Magic Quadrant for AI Governance Platforms. That is analyst placement, not a legal-output accuracy bench. | May we trial intake/risk scoring on our model register? | [OneTrust — AI Governance](https://www.onetrust.com/solutions/ai-governance) |
| Govern AI, do not practise law | Public claim only | Fit is inventory, risk, approval and evidence for AI systems. It is not a substitute for legal advice on a matter. Human owners and sign-off workflows are the product model. | Who in the firm is the accountable owner for each AI system in the register? | [OneTrust — AI Governance](https://www.onetrust.com/solutions/ai-governance) |
| Customer AI estate may include client data | Not confirmed | If the inventory includes tools that process client matter data, that is a disclosure. No Australian client-consent template on pages reviewed. | What client-data fields does AI Governance ingest from connected systems? | [OneTrust — AI Governance](https://www.onetrust.com/solutions/ai-governance) |
| Not named for the product itself | Not confirmed | The product governs the customer’s models. Which LLM OneTrust uses inside the module (if any) is not named on the product or privacy-overview pages. | Does AI Governance send our inventory or assessments to a third-party LLM? | [OneTrust — AI Governance](https://www.onetrust.com/solutions/ai-governance); [OneTrust — Privacy overview](https://www.onetrust.com/privacy) |
| Vendors unnamed on overview | Not confirmed | Privacy overview: vendors perform tasks (payments, analytics, help desk, CRM, email). No dated AI-Governance-specific subprocessor list on pages reviewed. | Provide the current named list with locations for the AI Governance tenant. | [OneTrust — Privacy overview](https://www.onetrust.com/privacy) |
| Not stated for customer AI records | Not confirmed | No no-training clause for AI Governance customer records was found on the product or privacy-overview pages. Do not infer one. | Confirm customer AI inventories, assessments and connected logs are not used to train OneTrust or third-party models. | [OneTrust — AI Governance](https://www.onetrust.com/solutions/ai-governance); [OneTrust — Privacy overview](https://www.onetrust.com/privacy) |
| Website marketing and product improvement | Public claim only | Privacy overview: usage/cookies for marketing and security; website analytics. Customer-tenant telemetry for AI Governance is not numbered there. | Can assessment contents appear in product analytics? | [OneTrust — Privacy overview](https://www.onetrust.com/privacy) |
| Not numbered | Not confirmed | Retention for AI inventory/assessment records is not numbered on the pages reviewed. Full privacy notice is a separate URL not fully extracted in this pass. | State default retention for inventories, assessments, runtime logs and backups. | [OneTrust — Privacy overview](https://www.onetrust.com/privacy) |
| Not numbered | Not confirmed | No public 30-day certified-deletion SLA extracted from the AI Governance or privacy-overview pages. | On exit, will you delete the AI register, runtime logs and backups and certify? | [OneTrust — Privacy overview](https://www.onetrust.com/privacy) |
| Need-to-know employees | Public claim only | Privacy overview: employee access limited on a need-to-know basis; privacy/security training and confidentiality requirements; regular security testing. | Is support access to our AI register ticket-scoped and logged? | [OneTrust — Privacy overview](https://www.onetrust.com/privacy) |
| Ownership and approvals | Public claim only | Product: assign ownership, lifecycle status, approval/signoff workflows. SSO/MFA not specified on the product page extract. | Is SSO/MFA/SCIM included on our AI Governance SKU? | [OneTrust — AI Governance](https://www.onetrust.com/solutions/ai-governance) |
| Not specified on these pages | Not confirmed | Privacy overview refers to technical/organisational measures and the full privacy notice for information security. Algorithms not on the overview page. | Confirm TLS/at-rest encryption and key custody for the AI Governance tenant. | [OneTrust — Privacy overview](https://www.onetrust.com/privacy) |
| SOC 2 and ISO 27001/27701 | Public claim only | Privacy overview: ISO/IEC 27001:2013 and 27701:2019 for OneTrust LLC’s IMS; SOC 2 report for OneTrust, LLC and OneTrust Technology Limited (security, confidentiality, availability). Trust Centre: download certifications. Reports not inspected. ISO 42001 is a customer template, not a OneTrust certification claim on that page. ISO 27001: the vendor's own page states "s/beyond-iso-27001-building-the-foundation-for-scalable-risk-and-ai-governance-webinar/#) # Beyond ISO 27001: Building the Foundation for Scalable Risk and AI Governance ISO 27001 has bec" (https://www.onetrust.com/resources/beyond-iso-27001-building-the-foundation-for-scalable-risk-and-ai-governance-webinar/, checked 2026-10-10). ISO 42001: the vendor's own page states "trust.com/glossary/nist-ai-risk-management/?external_referrer=https%3A%2F%2Fwww.google.com%2F), and ISO 42001 templates - Automate risk tiering by use case, system, component, deployment co" (https://www.onetrust.com/solutions/ai-governance, checked 2026-10-10). SOC 2: the vendor's own page states "Explore OneTrust certifications, audit reports, and related trust records in one place (SOC 2, ISO, and more). These documents help organizations review our security, privac" (https://www.onetrust.com/trust/, checked 2026-10-10). | Provide current SOC 2 and ISO certificates with dates and scope covering AI Governance. | [OneTrust — Privacy overview](https://www.onetrust.com/privacy); [OneTrust — Trust Center](https://www.onetrust.com/trust); [ISO 27001 on the vendor's site](https://www.onetrust.com/resources/beyond-iso-27001-building-the-foundation-for-scalable-risk-and-ai-governance-webinar/); [OneTrust — AI Governance](https://www.onetrust.com/solutions/ai-governance); [SOC 2 on the vendor's site](https://www.onetrust.com/trust/) |
| No public DPA on these pages | Not confirmed | No public terms or DPA URL was extracted from the AI Governance or privacy-overview pages. Trust Centre holds privacy materials. Enterprise order forms likely sit behind sales. | Provide the MSA/DPA for AI Governance with APP 8 and 72-hour notice. | [OneTrust — AI Governance](https://www.onetrust.com/solutions/ai-governance); [OneTrust — Trust Center](https://www.onetrust.com/trust) |
| Group companies for 24/7 support | Public claim only | Privacy overview: sharing with OneTrust companies for 24/7 support and global marketing; vendors; possible CCPA ‘sale’/share for some website data. Customer-tenant residency not stated. | List every country of storage and support access for our AI Governance tenant. | [OneTrust — Privacy overview](https://www.onetrust.com/privacy) |
| Not numbered on overview | Not confirmed | No 72-hour customer-notification SLA on the privacy-overview or AI Governance pages reviewed. | State the contractual breach-notification period. | [OneTrust — Privacy overview](https://www.onetrust.com/privacy) |
| Not specified | Not confirmed | Change-notice for subprocessors or the AI Governance module was not extracted from these pages. | Will material processor or feature changes get 30 days’ written notice? | [OneTrust — Privacy overview](https://www.onetrust.com/privacy) |
| Not specified | Not confirmed | Export/deletion on termination was not extracted from the AI Governance or privacy-overview pages. | What export formats exist for the AI register and evidence pack? | [OneTrust — AI Governance](https://www.onetrust.com/solutions/ai-governance); [OneTrust — Privacy overview](https://www.onetrust.com/privacy) |
| Discovery across environments | Public claim only | Continuous discovery of AI across changing environments is claimed. Connector list not published on the product page extract. | List every connector that can read our systems, and how we disable them. | [OneTrust — AI Governance](https://www.onetrust.com/solutions/ai-governance) |
| Not a research assistant | Not confirmed | Product is governance, not legal research. Open-web browsing was not described. | Does any OneTrust agent in this module browse the open web with our data? | [OneTrust — AI Governance](https://www.onetrust.com/solutions/ai-governance) |
| Runtime enforcement claimed | Public claim only | Runtime enforcement, guardrails and policy evaluation across models, data, agents and vendors are marketed. Default unattended enforcement actions are not contractually listed on the page extract. | Which runtime actions can OneTrust take on our models without a human click? | [OneTrust — AI Governance](https://www.onetrust.com/solutions/ai-governance) |
| Approval and attestation workflows | Public claim only | Configurable intake, approval, attestation and signoff; reviews routed by risk. That is the governance model — still depends on the firm using it. | Will high-risk AI systems require named legal sign-off before production? | [OneTrust — AI Governance](https://www.onetrust.com/solutions/ai-governance) |

## Notes

T3 pass: public DPA, hosting region, subprocessors and no-training clause were not on the pages extracted. SOC 2 and ISO 27001/27701 are claimed on the privacy overview; reports not inspected. Full privacy notice is a separate URL. Scope is AI Governance only. Confidence raised from low to medium on 2026-10-10 because a security or hosting quote on the vendor's own domain was applied.

## Sources

- [OneTrust — AI Governance](https://www.onetrust.com/solutions/ai-governance) (checked 2026-09-21)
- [OneTrust — Privacy overview](https://www.onetrust.com/privacy) (checked 2026-09-21)
- [OneTrust — Trust Center](https://www.onetrust.com/trust) (checked 2026-09-21)
- [ISO 27001 on the vendor's site](https://www.onetrust.com/resources/beyond-iso-27001-building-the-foundation-for-scalable-risk-and-ai-governance-webinar/) (checked 2026-10-10)
- [SOC 2 on the vendor's site](https://www.onetrust.com/trust/) (checked 2026-10-10)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.