TISAX prototype protection for CTOs: what ISA2027 changes and what to prepare

Is TISAX a certification, and how should a CTO describe it to customers?

Strictly speaking, no. The VDA ISA questionnaire is set by the German Association of the Automotive Industry (VDA), the mechanism is run by the ENX Association, and assessments must be performed by ENX-approved audit providers. What you obtain is an assessment label shared on the ENX platform, valid for up to three years, not an ISO certificate.

TISAX is a carmaker's commercial requirement, not a legal obligation; what the market calls "TISAX certification" is formally the assessment label. When replying to customers, state the label type, assessment level and validity.

How should the TISAX scope be set for R&D prototype parts and prototype vehicles?

VDA ISA has three modules: information security, prototype protection and data protection. To set the scope, first confirm the labels the customer requires (such as confidential or prototype protection), then decide which sites to include: every site in scope is assessed.

A wrongly set scope leads to reassessment; and under ENX rules, once the scope summary has been sent to the audit provider, it can only be changed through the audit provider. Fix the scope and assessment objectives before signing the audit contract.

What does VDA ISA2027 change in the prototype protection module, and must R&D documents be redone?

• Controls are reduced from 22 to 20; the former five sections 8.1 to 8.5 become two: 8.1 organisational requirements and 8.2 physical and environmental security
• Only two labels remain: Basic (AL2) shows processes and people for handling prototype parts and vehicles securely; Facilities (AL3) adds physical protection of the site where prototypes are kept and covers all Basic requirements
• Even if the actual measures do not change, the document structure needs to be remapped

The information security module keeps 46 controls, 44 of them revised; the 12 controls of the data protection module are the same as in ISA 6.

ISA 6.0.3 or ISA2027, and how should the R&D schedule be planned?

The deciding factor is the order date, not the assessment date:

Existing labels keep their validity, with no early reassessment. Suppliers whose labels expire in 2027 and whose scope includes prototype protection should assess early whether to order before the end of 2026. ENX states that the overall timeline cannot be predicted; preparation before the assessment takes the longest and is the part a company controls most.

AL2 or AL3: how much effort does the R&D team need to put in?

The level follows the assessment objectives and cannot be chosen freely.

• AL2: mainly plausibility checks, evidence review and interviews, usually by video. The ENX handbook notes that AL2 usually needs a more complete self-assessment and written documents, so internal effort may actually be higher.
• AL3: auditors must be on site for full verification.

The quality of the self-assessment decides whether the first assessment passes; nonconformities close only after corrective action and a follow-up assessment, and the audit provider's schedule is outside the company's control.

How can TISAX and ISO/SAE 21434 share evidence, and are AI tools used in R&D in scope?

TISAX focuses on information security management (protecting confidential supply-chain data); ISO/SAE 21434 focuses on cybersecurity engineering across the whole vehicle product development lifecycle (TARA threat analysis, CSMS). They complement rather than replace each other: organisation-level documents can be shared, while project-level TARA and verification are produced separately.

When R&D uses AI tools on customers' confidential or prototype data, those processes fall within the information security scope assessed under TISAX, and use of the AI tools must be controlled; ISO 42001 can add approval of uses, data classification and evaluation of AI service providers.

How does Winners help a CTO with TISAX?

Four stages: scoping and current-state diagnosis (setting AL2/AL3 and issuing a gap analysis), remediation plan and system building, ISO/SAE 21434 integration (optional), and mock audit with support through the formal assessment. The service page lists a typical engagement of 7–12 months or more, shorter for companies that already hold ISO 27001.

We first confirm the scope, objectives and level, and whether ISA 6.0.3 or ISA2027 applies. VP- and director-level consultants lead throughout, never outsourced; Winners is a consultant, not an issuing body. Named client: Yi Fong Metal Industrial Co., Ltd.

TISAX assessment consulting｜ISO/SAE 21434｜Choosing a TISAX consultant｜TISAX timeline｜Apply for a free mechanism diagnosis