TISAX for the CEO: European OEM orders, assessment levels, timing and investment

A European carmaker requires TISAX. What happens if we don't do it? Is it mandatory?

TISAX is a customer requirement, not a law. It is an assessment and exchange mechanism run by ENX: an ENX-approved audit provider assesses against VDA ISA, and the result is shared with carmakers as a label on the ENX platform.

The cost of not doing it is in the orders: the service page notes that most European carmakers have made TISAX AL2 or AL3 a condition of supplier entry; facing a carmaker or tier-1 that requires TISAX, a supplier without an assessment result may be stopped at supplier qualification. ISO 27001 cannot replace TISAX.

Keep UN R155 separate: it is a whole-vehicle (carmaker) type-approval requirement, and component suppliers usually receive it from carmakers through contracts. The actual requirement is what the customer's RFQ and contract say.

Who decides between AL2 and AL3? How does it change the effort?

The level follows the assessment objective and cannot be chosen; the objective depends on the labels the customer requires, such as confidential or prototype protection.

So when comparing options, the CEO should count the audit fee and internal staff time together, not only the assessment fee. The first step is to have sales confirm the required labels and site scope with the customer.

The customer's deadline is tight. Can we make it in time for TISAX?

ENX states it cannot estimate the overall timeline, because it depends on company size, assessment objective and how ready the information security management system is. The service page lists a usual consulting period of 7–12 months or more, shorter with ISO 27001 in place.

What cannot be compressed:

• self-assessment quality decides whether the first assessment passes; nonconformities close only after corrective action and a follow-up assessment
• the audit provider's schedule is outside your control
• assessments commissioned from 1 January 2027 all use VDA ISA2027; companies commissioning early next year should prepare against the new version

What the CEO can do: confirm the labels the customer requires, work back to the self-assessment and remediation time, and book an audit provider slot early rather than asking for quotes only when ready. Labels are valid for 3 years with no surveillance audits; a full re-assessment is needed at expiry.

How should the TISAX budget be built? Which costs must not be cut?

A TISAX budget has four blocks:

1. ENX registration fee
2. Audit provider assessment fee (choose an ENX-approved provider yourself and get at least two quotes)
3. Consulting fee
4. Internal effort

Purchase and installation of access control, network and facility equipment are budgeted separately.

The most common gap is budgeting only registration and audit fees and leaving out scope definition and self-assessment quality: a wrong scope leads to re-assessment, and an incomplete self-assessment at AL2 turns directly into extra staff time. Both should be settled before signing the audit contract.

We already have ISO 27001. Do we still need TISAX? And ISO/SAE 21434?

TISAX: yes. ISO 27001 is a general standard and cannot replace TISAX, but the existing system can be reused, adding TISAX-specific requirements on top of the ISMS, which shortens the consulting period.

ISO/SAE 21434: depends on the product. TISAX assesses information security at the company's sites; 21434 governs how products are developed securely, and neither replaces the other. If you develop or supply cybersecurity-relevant automotive E/E systems, components or software, it is usually needed; the customer's RFQ and contract decide.

EU CRA: type-approved vehicles and their dedicated components are outside the CRA, but separately sold automotive digital products (such as aftermarket devices, diagnostic tools and charging equipment) are still in scope.

Who owns TISAX? Which departments need to move?

The VDA ISA questionnaire has three modules: information security, prototype protection and data protection. So TISAX is not just an IT matter:

• Assessment scope: which sites handle customer information; every site in scope is assessed
• Prototype protection: R&D, prototyping and physical control of sites
• Data protection: personal data obligations (GDPR)
• Supplier controls: documents, sites, access and supplier controls all need remediation tracking
• AI tools: using AI on customer confidential or prototype data is also within the information security scope TISAX assesses

The CEO should appoint one owner who can pull resources across departments, and give every gap an owner, evidence and a deadline. A listed company's own supplier management policy is also an item in ESG evaluation S-15; non-public companies are not bound by it but can follow it voluntarily.

How does Winners Consulting help the CEO handle TISAX?

VP- and director-level consultants lead the work end to end, never outsourced, and hold ISO 27001 lead auditor qualifications; Winners Consulting is a consultant, not a certification body.

• Scope from the customer requirement: confirm the required labels, assessment objectives, sites and applicable ISA version.
• System and on-site evidence: build the management system and maturity evidence against VDA ISA, sharing organisation-level documents with ISO/SAE 21434.
• Separate costs: consulting, engineering remediation and the formal assessment fee are kept separate so nothing is bought twice.
• Mock assessment: one rehearsal before the formal assessment to close nonconformities.
• Named client: Yi Fong Metal Industrial Co., Ltd. (TISAX assessment consulting (VDA ISA 6.0; assessed by SGS Taiwan, TISAX label obtained); full case).

Read more: TISAX assessment consulting, Choosing a TISAX consultant, TISAX timeline, TISAX budget.

Request a free mechanism diagnosis