We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

OneTrust AI Governance review

Software product

An AI governance module within OneTrust's privacy software, which organisations license to list, risk-assess, monitor and set rules for their AI systems. It is software, not advice.

Relevant if you already use OneTrust for privacy and want AI governance in the same platform

Price Not published
Indemnity cover Published
How it uses AI Published
Facts last checked

Not published means we did not find it on the firm's own pages.

OneTrust AI Governance scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 4/5
Qualifications of the people who do the work 5/5
What it publishes about fees 1/5
Knowledge of your sector 2/5
Independence from what it sells 4/5
Who carries the risk if the advice is wrong 3/5

What OneTrust AI Governance offers, and what it publishes

The module gives you one inventory of AI models, agents and vendors, risk templates mapped to the EU AI Act, US NIST and ISO 42001, monitoring for drift, safety and personal data, and rules enforced while AI runs. It sits alongside OneTrust's privacy and third-party risk modules.

OneTrust AI Governance does not publish a price. The pricing page says cost depends on admin users and AI inventory, and offers a sales call. It publishes six AI Principles it applies to itself, and says an internal committee oversees its own AI use.

OneTrust's trust page lists ISO 27001, 27701 and 27017, SOC 2 Type II, PCI DSS, TISAX, HITRUST and ISO 9001, but not ISO 42001 for itself. It is a US company with a UK arm and a UK government G-Cloud listing for this product. We found one AI governance case study, Mews, and no separate sector modules.

Strengths

  • Broadest published list of independently issued security/compliance certifications among the vendors researched (ISO 27001, ISO 27701, ISO 27017, SOC 2 Type II, PCI DSS, TISAX, HITRUST, ISO 9001)
  • Confirmed UK Government Digital Marketplace (G-Cloud) listing specifically for the AI Governance product
  • Publishes a named set of self-applied AI Principles and discloses operating an internal AI Governance Committee overseeing its own AI use, one of the few vendors researched to make this disclosure
  • Active UK Companies House-registered entity (OneTrust Technology Limited) with a long UK operating history, registered since 2001

Things to check

  • Pricing is entirely sales-gated: the public pricing page names only the metrics pricing is based on (admin users, AI inventory size) but discloses no figures, tiers or starting price.
  • Despite marketing AI Governance for 'Financial Services, Healthcare, and Retail & E-commerce,' no distinct sector-specific product module or SKU page was found; sector targeting appears to be go-to-market positioning rather than a separately documented product line.
  • AI-Governance-specific named customer case studies are thin, only one customer (Mews) appears filtered under the 'AI Governance' topic on the public customers page, with other AI-governance quotes surfacing in press releases rather than full case studies.

Common questions

Does OneTrust publish AI Governance prices?

No. The pricing page names what drives the price, admin users and AI inventory, but shows no figures. A quote needs a sales call.

What security certifications does OneTrust hold?

Its trust page lists ISO 27001, 27701 and 27017, SOC 2 Type II, PCI DSS, TISAX, HITRUST and ISO 9001, among others, but not ISO 42001.

Does OneTrust have a UK presence?

Yes. It has an active UK company, OneTrust Technology Limited, and a UK government G-Cloud listing for AI Governance.

Evidence for each OneTrust AI Governance score

Show our working

Notes behind each thing to check

  • Pricing is entirely sales-gated: the public pricing page names only the metrics pricing is based on (admin users, AI inventory size) but discloses no figures, tiers or starting price. (https://www.onetrust.com/pricing/ shows only 'Get Pricing' / 'Schedule a quick call for a personalized quote' with no published numbers)
  • Despite marketing AI Governance for 'Financial Services, Healthcare, and Retail & E-commerce,' no distinct sector-specific product module or SKU page was found; sector targeting appears to be go-to-market positioning rather than a separately documented product line. (No dedicated sector-module page was found on onetrust.com beyond general positioning language and a KPMG alliance page, https://kpmg.com/us/en/capabilities-services/alliances/kpmg-onetrust/ai-governance.html)
  • AI-Governance-specific named customer case studies are thin, only one customer (Mews) appears filtered under the 'AI Governance' topic on the public customers page, with other AI-governance quotes surfacing in press releases rather than full case studies. (https://www.onetrust.com/customers/ surfaces Mews as the primary AI Governance-tagged case study; broader named logos (GOL Airlines, Sara Assicurazioni, MillerKnoll) are tagged to other OneTrust products)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 4/5 Product marketing states 'governance actions generate audit trails automatically, keeping evidence continuously current and regulator-ready,' with automated model cards, bills of materials and lineage reports mapped to EU AI Act/NIST templates.
Qualifications of the people who do the work 5/5 Trust page lists eight or more named, verifiable independent certifications (ISO 27001, ISO 27701, ISO 27017, SOC 2 Type II, PCI DSS, TISAX, HITRUST, ISO 9001) covering the vendor's own operations.
What it publishes about fees 1/5 Pricing page names only the metrics pricing is based on with no published figures or tiers; a personalised quote call is the only route to a price.
Knowledge of your sector 2/5 Sector targeting (financial services, healthcare, retail) is mentioned in marketing copy and a KPMG alliance page, but no distinct sector-specific product module or feature set was documented.
Independence from what it sells 4/5 Multiple named certifications (SOC 2 Type II, ISO 27001 family) are formal third-party-audited standards, though ISO 42001 for OneTrust's own AI management system specifically was not found among its self-certifications.
Who carries the risk if the advice is wrong 3/5 A downloadable Master Terms of Service document exists publicly, and secondary summaries describe a liability cap tied to amounts paid and mutual exclusion of consequential damages, but exact clause wording could not be fully extracted to verify.

Sources for OneTrust AI Governance

  • Company registration (OneTrust LLC is a US company headquartered in Atlanta, Georgia, founded in 2016 by Kabir Barday; its UK entity OneTrust Technology Limited (Companies House number 04156317) is Active, registered at 82 St John Street, London EC1M 4JN) (Companies House, checked 17 July 2026)
  • Product scope (AI Governance product provides a central AI/model/agent/vendor inventory, risk assessment templates mapped to the EU AI Act, NIST and ISO 42001, posture monitoring (drift, safety, PII detection), and runtime policy enforcement/guardrails) (onetrust.com, checked 17 July 2026)
  • Pricing disclosure (No published figures; the pricing page names only the metrics pricing is based on ('admin users and AI inventory') behind a 'Get Pricing'/'Get Customized Pricing' form, with no tiers or costs shown) (onetrust.com, checked 17 July 2026)
  • UK presence (Listed on the UK Government Digital Marketplace (G-Cloud) with a dedicated AI Governance service definition, alongside a long-standing UK Companies House registration and operational UK offices in London) (G-Cloud, checked 17 July 2026)
  • Security certifications (Trust page lists ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 27017, SOC 2 Type II, PCI DSS, TISAX, HITRUST and ISO 9001 among others; notably ISO 42001 is not listed as a self-certification, only offered as a customer-facing 'ISO 42001 readiness' capability) (onetrust.com, checked 17 July 2026)
  • AI use disclosure (Publishes six self-applied 'AI Principles' and states it operates an internal AI Governance Committee overseeing its own AI development/use, with disclosed internal uses including AI-driven document classification and an AI research chatbot) (onetrust.com, checked 17 July 2026)

ISO/IEC 27001 ISO/IEC 27701 ISO/IEC 27017 SOC 2 Type II PCI DSS HITRUST ISO 9001

Exposed to the EU AI ActSeeking ISO 42001 certificationRegulated sectorsSwitching provider

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.