OneTrust describes assessment templates and policy mapping aligned to the EU AI Act, NIST AI RMF and ISO/IEC 42001. Scope: vendor-described governance content, not certification, legal advice or a regulatory conformity finding.
Inspect the evidence ↘GOVERNATLAS / PRODUCT DOSSIER
OneTrust AI Governance
OneTrust describes AI discovery, inventory, risk assessment, workflows and runtime governance.
THE DOCUMENTED SCOPE
What the current evidence describes.
Source-attributed capabilities and limits. Inspect the full record before drawing a conclusion.
OneTrust describes prompt and response inspection, sensitive-data detection, and guardrail actions that block, redact or escalate policy violations. Scope: functionality described on the solution page; effectiveness and coverage require deployment-specific validation.
Inspect the evidence ↘OneTrust's solution page describes discovery and inventory across AI models, data, agents and vendors, risk tiering, intake and approvals, and runtime monitoring and policy evaluation. Scope: vendor-described AI Governance capabilities; no independent performance or security testing is implied.
Inspect the evidence ↘01 / CONTEXT & SCOPE
Understand the proposition.
Define the boundary.
The decision to make
Evaluate AI governance as a cross-team decision process. Procurement may know the supplier while engineering knows the deployed model and privacy knows the data use. Test whether a single use-case record can preserve those distinct responsibilities without treating a questionnaire answer as evidence that a runtime control actually executed.
What this record does not establish
Organization-level trust statements and product-level functionality have different scopes. Connector availability and control actions need evidence for the specific AI Governance package under consideration.
1 current source · 3 published assertions
Source coverage is a research boundary, not a quality score.
Source coverage is a research boundary, not a quality score.
02 / YOUR EVALUATION
Turn interest into a useful trial.
A
A test worth running
Submit a purchased-AI application with a proposed data use, assign technical and privacy reviewers and change one supplier response after the first review. Inspect which decisions are reopened and how the system distinguishes the vendor statement from your organization's approval.
GovernAtlas editorial proposal. We have not performed this test.
B
Evidence to bring back
- Trace each review task to its accountable owner and the exact version of the supplier evidence.
- Demonstrate the proposed integration's action and failure handling, rather than relying on the presence of a connector logo.
03 / DOCUMENTED EVIDENCE
Read the claim. Inspect the basis.
Each statement retains its classification and preserved source. A vendor assertion is not an independent test result.
vendor asserted
OneTrust describes assessment templates and policy mapping aligned to the EU AI Act, NIST AI RMF and ISO/IEC 42001. Scope: vendor-described governance content, not certification, legal advice or a regulatory conformity finding.
Source, dates & preserved provenance
AI Governance ↗Authority: vendor owned
Observed 2026-10-14 · Reviewed 2026-10-14 · current until 2026-11-13
Artifact SHA-256: 7a92e6a7f72931a7b13d63bb56b25acce4e84ff3163966cc304f13a461a5f9b7
The hash identifies the preserved capture. The live source may have changed.
vendor asserted
OneTrust describes prompt and response inspection, sensitive-data detection, and guardrail actions that block, redact or escalate policy violations. Scope: functionality described on the solution page; effectiveness and coverage require deployment-specific validation.
Source, dates & preserved provenance
AI Governance ↗Authority: vendor owned
Observed 2026-10-14 · Reviewed 2026-10-14 · current until 2026-11-13
Artifact SHA-256: 7a92e6a7f72931a7b13d63bb56b25acce4e84ff3163966cc304f13a461a5f9b7
The hash identifies the preserved capture. The live source may have changed.
vendor asserted
OneTrust's solution page describes discovery and inventory across AI models, data, agents and vendors, risk tiering, intake and approvals, and runtime monitoring and policy evaluation. Scope: vendor-described AI Governance capabilities; no independent performance or security testing is implied.
Source, dates & preserved provenance
AI Governance ↗Authority: vendor owned
Observed 2026-10-14 · Reviewed 2026-10-14 · current until 2026-11-13
Artifact SHA-256: 7a92e6a7f72931a7b13d63bb56b25acce4e84ff3163966cc304f13a461a5f9b7
The hash identifies the preserved capture. The live source may have changed.
Source register
AI Governance ↗vendor owned · captured 2026-10-14
Brand asset provenance
Organization identity asset from its official website; inclusion does not imply endorsement.
Official website ↗ · Original asset ↗04 / BEFORE YOU COMMIT
Better questions.
A clearer decision.
Resolve these with the provider and your own evaluation team.
What deployment and hosting options apply to AI Governance?
Which runtime connectors and control actions are included in the proposed package?
Which organization-level trust records expressly cover this product?
Regulatory applicability requires a separate, current determination. Inclusion is not certification.
KEEP THE RECORD USEFUL
A dossier should stand up to scrutiny.
Have a source that changes this picture? Submit it for editorial review.