# OneTrust AI Governance - **Type:** Software product - **Website:** https://www.onetrust.com/products/ai-governance/ - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) An AI governance module within OneTrust's privacy software, which organisations license to list, risk-assess, monitor and set rules for their AI systems. It is software, not advice. ## OneTrust AI Governance scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 4/5 Product marketing states 'governance actions generate audit trails automatically, keeping evidence continuously current and regulator-ready,' with automated model cards, bills of materials and lineage reports mapped to EU AI Act/NIST templates. ### Qualifications of the people who do the work: 5/5 Trust page lists eight or more named, verifiable independent certifications (ISO 27001, ISO 27701, ISO 27017, SOC 2 Type II, PCI DSS, TISAX, HITRUST, ISO 9001) covering the vendor's own operations. ### What it publishes about fees: 1/5 Pricing page names only the metrics pricing is based on with no published figures or tiers; a personalised quote call is the only route to a price. ### Knowledge of your sector: 2/5 Sector targeting (financial services, healthcare, retail) is mentioned in marketing copy and a KPMG alliance page, but no distinct sector-specific product module or feature set was documented. ### Independence from what it sells: 4/5 Multiple named certifications (SOC 2 Type II, ISO 27001 family) are formal third-party-audited standards, though ISO 42001 for OneTrust's own AI management system specifically was not found among its self-certifications. ### Who carries the risk if the advice is wrong: 3/5 A downloadable Master Terms of Service document exists publicly, and secondary summaries describe a liability cap tied to amounts paid and mutual exclusion of consequential damages, but exact clause wording could not be fully extracted to verify. ## Sources for OneTrust AI Governance Every line carries the page it was read on and the date it was checked. - Company registration - Source: https://find-and-update.company-information.service.gov.uk/company/04156317 - Checked: 2026-07-17 - Product scope - Source: https://www.onetrust.com/products/ai-governance/ - Checked: 2026-07-17 - Pricing disclosure - Source: https://www.onetrust.com/pricing/ - Checked: 2026-07-17 - UK presence - Source: https://assets.applytosupply.digitalmarketplace.service.gov.uk/g-cloud-14/documents/718805/830667011784880-service-definition-document-2024-05-02-1320.pdf - Checked: 2026-07-17 - Security certifications - Source: https://www.onetrust.com/trust/ - Checked: 2026-07-17 - AI use disclosure - Source: https://www.onetrust.com/about-us/responsible-ai/ - Checked: 2026-07-17 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Published - Credentials: Published - Independent accreditation: Published - Client results: Published - How it uses AI: Published ## Strengths - Broadest published list of independently issued security/compliance certifications among the vendors researched (ISO 27001, ISO 27701, ISO 27017, SOC 2 Type II, PCI DSS, TISAX, HITRUST, ISO 9001) - Confirmed UK Government Digital Marketplace (G-Cloud) listing specifically for the AI Governance product - Publishes a named set of self-applied AI Principles and discloses operating an internal AI Governance Committee overseeing its own AI use, one of the few vendors researched to make this disclosure - Active UK Companies House-registered entity (OneTrust Technology Limited) with a long UK operating history, registered since 2001 ## Things to check Each one carries the factual basis it rests on. - Pricing is entirely sales-gated: the public pricing page names only the metrics pricing is based on (admin users, AI inventory size) but discloses no figures, tiers or starting price. - Basis: https://www.onetrust.com/pricing/ shows only 'Get Pricing' / 'Schedule a quick call for a personalized quote' with no published numbers - Despite marketing AI Governance for 'Financial Services, Healthcare, and Retail & E-commerce,' no distinct sector-specific product module or SKU page was found; sector targeting appears to be go-to-market positioning rather than a separately documented product line. - Basis: No dedicated sector-module page was found on onetrust.com beyond general positioning language and a KPMG alliance page, https://kpmg.com/us/en/capabilities-services/alliances/kpmg-onetrust/ai-governance.html - AI-Governance-specific named customer case studies are thin, only one customer (Mews) appears filtered under the 'AI Governance' topic on the public customers page, with other AI-governance quotes surfacing in press releases rather than full case studies. - Basis: https://www.onetrust.com/customers/ surfaces Mews as the primary AI Governance-tagged case study; broader named logos (GOL Airlines, Sara Assicurazioni, MillerKnoll) are tagged to other OneTrust products ## Where this firm appears - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [Does the EU AI Act apply to a UK firm?](https://theassurancedesk.com/best/eu-ai-act-exposed) - [How do you change your data protection provider?](https://theassurancedesk.com/best/switching-provider) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.