The OEM contract requires us to obtain and maintain a TISAX label. Which clauses should the general counsel check?
| Clause | What to check |
|---|---|
| Assessment objective and level | The level is set by the assessment objective and cannot be chosen; AL2 is usually remote, AL3 requires auditors on site |
| Sites covered | Every site in scope is assessed; are all sites the contract requires within the scope? |
| Term and renewal | The label is valid for three years from the closing meeting, with no surveillance audits, and a full reassessment is required on expiry; does the contract require completion before expiry? |
| Version | Assessments commissioned from 1 January 2027 follow VDA ISA2027; the commissioning date, not the assessment date, decides |
| Consequences of no label or expiry | Whether it is a breach and whether it affects orders in progress |
| Deadlines | Customer deadlines are often shorter than the preparation actually needs; ENX states it cannot estimate the overall timeline |
The formal assessment is carried out by an independent assessment provider, and consultants do not guarantee a label. Do not promise dates you do not control; rewrite them as obligations you can perform, such as commissioning the assessment by a given date.
Does registering for TISAX mean signing a contract? What should we read in the participation terms?
Yes. The ENX participant handbook explains that the TISAX Participant General Terms and Conditions (GTC) govern your relationship with ENX and with other participants, and are accepted at registration; ENX also states that, because of the mutuality between participants, it cannot accept additional terms. The GTC version 3.0.2 (12 July 2023) published by ENX provides:
- Governing law and forum: construed under German law, with Frankfurt am Main as the exclusive venue
- Information sharing: the auditee decides whether and how assessment information is made available to ENX or other participants
- Confidentiality: disclosed third-party assessment information is deemed confidential information
- ENX liability: ENX is liable for wilful misconduct, gross negligence, product liability and similar; liability for ordinary negligence is otherwise excluded
- Validity: assessment results are valid for a maximum of 36 months
Check which GTC version applies at registration; the legal effect of the terms on your company should be assessed by a lawyer.
Who can see the assessment results? Can we share them only with certain OEMs, and withdraw them later?
- Results are not public; the participant controls them and shares them with selected partners through the ENX portal (ENX website)
- Sharing with other participants requires the auditee's explicit consent given through TISAX (GTC section XI)
- The sharing level defines how deeply a partner can access the result (participant handbook)
- Publication and sharing cannot be revoked (participant handbook)
The general counsel's framework:
- Before sharing, confirm the recipient, sharing level and assessment scope
- If the report includes sites, systems or third-party information, judge whether it goes beyond what that customer's contract needs
- Check whether the confidentiality agreement with the OEM covers the assessment information it receives
Because sharing cannot be revoked, record each sharing decision and have it approved by the responsible manager.
When we process an OEM's personal data, how does the TISAX data protection objective relate to the GDPR Article 28 processor agreement?
- ENX participant handbook: the Data assessment objective covers data protection under GDPR Article 28 (processor); if you process personal data as a processor, you probably need this objective.
- The GDPR itself: there is no official certificate; compliance is self-demonstrated through records of processing (RoPA), DPIAs, Article 28 contracts, transfer mechanisms (SCC/BCR) and breach records.
Framework:
| Question | How it is handled |
|---|---|
| Are we processor or controller? | Decided by the actual purposes and means of processing |
| Is the processor agreement signed and complete? | The Article 28 contract; a TISAX label cannot replace it |
| Which transfer mechanism covers data moving from the EU to Taiwan? | Chosen case by case |
| Role of the TISAX label | One piece of evidence of the processor's capability |
These legal questions should be handled case by case by a lawyer.
How do confidentiality obligations for OEM prototypes and confidential information reach employees, subcontractors and AI tools?
An OEM's prototypes and confidential information belong to the OEM, and you owe confidentiality under the contract; you must be able to show that your measures meet the contract.
- Subcontractors: VDA ISA2027 tightens supplier verification (former 1.2.4 moved to 6.1.3); when a Tier 1 customer asks its suppliers for TISAX results, Tier 2 suppliers need an assessment too
- AI tools: whenever customer confidential or prototype data is processed, those processes fall within the information security scope of the TISAX assessment, so AI tool use must be controlled
- Employees: confidentiality agreements, information classification and marking, access logs. Taking the reasonable confidentiality measures under Article 2 of Taiwan's Trade Secrets Act as a reference, signing a confidentiality agreement alone is not enough to count as a reasonable measure
The general counsel's framework: the OEM contract's confidentiality clause, your employee and subcontractor contracts, and actual access records must line up.
TISAX, UN R155 and the EU CRA: which are legal obligations and which are contractual requirements?
| Requirement | Nature | What it means for a component supplier |
|---|---|---|
| TISAX | Carmakers' commercial requirement, not a legal obligation | Required through the OEM contract |
| UN R155/R156 | Whole-vehicle (carmaker) type-approval requirements | Usually required of component suppliers by the carmaker through contracts |
| EU CRA | EU product legislation | Does not apply to vehicles type-approved under (EU) 2019/2144 and their dedicated systems and components; separately sold automotive digital products remain in scope, such as aftermarket devices and diagnostic tools |
The general counsel tracks direct legal requirements separately from contractual pass-through: the first is about authorities and penalties, the second about contractual liability and delivery commitments. Whether a product is a separately sold automotive digital product must be assessed item by item.
How does Winners Consulting help a general counsel with TISAX?
- Confirm the customer's requirement first: assessment scope, objective and level, and whether ISA 6.0.3 or ISA2027 applies
- System and evidence: build the system and maturity evidence under VDA ISA, sharing organisation-level documents with ISO/SAE 21434
- Where applicable: operational requirements for prototype and data protection
- Separate fees and roles: consulting, engineering remediation and the formal assessment are priced separately; the formal assessment is carried out by the assessment provider you choose, and no label or customer qualification is guaranteed
- Who leads: VP- and director-level consultants lead the work end to end, never outsourced. Named client: Yi Fong Metal Industrial Co., Ltd. (assessed by SGS Taiwan, TISAX label obtained)
More: TISAX assessment consulting, How to choose a TISAX consultant in Taiwan, How long TISAX takes, How to choose a trade secret consultant, How to choose a GDPR consultant. Request a free mechanism diagnosis
How other roles see this service
- CEOTISAX for the CEO: European OEM orders, assessment levels, timing and investment
- CISOCISO guide to TISAX: assessment level, ISA2027 and timeline
- CTOTISAX prototype protection for CTOs: what ISA2027 changes and what to prepare
- Product managerTISAX prototype protection for product managers: will a missing label block a carmaker project?
Other services for this role
- ISO 37001 for General Counsel: agent bribery, whistleblowing investigations and contract clauses
- Trade secrets for General Counsel: what to prepare for departing employees, lawsuits and evidence preservation
- GDPR and ISO 27701 for General Counsel: processor contracts, transfers and investigations
- EU CRA for General Counsel: manufacturer liability, reporting duties and ODM contracts
- EU AI Act and ISO 42001 for General Counsel: roles, AI contracts and liability
- NIS2 for the general counsel: jurisdiction, personal liability, investigations and customer clauses
- DORA for the general counsel: negotiating Article 30 contracts, audit rights and exit
- ERM for the general counsel: putting compliance risk on the risk map and proving effectiveness
- ISO 27001 for the general counsel: security clauses, audit rights and incident liability