OneTrust
Governance, risk, and compliance platform
Our team's first AI feature. No time to test it before launch. Every decision came down to one question: will users trust this enough to act on it?
Role
Product designer. I owned the design decisions on our team’s first AI feature.
Outcome
Shipped on time. I moved teams before usage data came in.
POLICY AI
CONTEXT
Policy and compliance managers need to know exactly where their data is and what’s happening to it. Missing a gap has real consequences. Today that means cross-referencing by hand across the platform, which is easy to get wrong and hard to feel confident about.
We weren’t starting from neutral ground. Inconsistency across the platform meant many users already didn’t fully trust it. This was also our team’s first AI initiative, on a tight deadline, with no time to test with real users.
The ask was to use AI to find policy gaps faster. Getting people to trust it was harder. If users don’t trust what the AI surfaces, they won’t use it. If they act on a recommendation without understanding it or questioning it, that’s a problem in compliance.
THE PROBLEM
With no testing, I worked from existing research and what I knew about this user base. A user opens a policy, picks a framework, and runs the analysis. Recommendations surface for controls, risks, and issues, and the user reviews each one before adding it. The AI also generates a report they can share with stakeholders.
APPROACH
Every result comes with an explanation of what the AI found, so users can evaluate it themselves.
Analysis only runs when the user starts it. I pushed back on running it in the background. In compliance, trust requires consent and transparency.
The original design stacked AI recommendations on top of the existing control library. It felt overwhelming, so I split them into two tabs.
DESIGN DECISIONS
AI report: Results come with the reasoning behind them.
Analyze policy: Runs only when the user asks.
After: Recommended and related controls in separate tabs.
Before: Two tables stacked on one page
We shipped without any user testing. I moved to another team before I saw people use it, so I don’t have usage data. Whether the decisions were enough is something I still think about.
OUTCOME
Introducing AI is a UX and trust problem. It comes down to accountability: who is responsible for acting on a recommendation, and whether they feel confident enough to. That’s the lens I bring to any AI project now. Next time I also want a way to track outcomes after I’ve moved on.