TISAX prototype protection for product managers: will a missing label block a carmaker project?

The carmaker will give us prototypes. Why TISAX prototype protection, and is it a certificate?

When a carmaker hands prototypes to a supplier, it may require a TISAX assessment scope that includes prototype protection. TISAX is a carmaker's commercial requirement, not a legal obligation, and not an ISO certificate: the VDA ISA questionnaire is set by the German Association of the Automotive Industry (VDA), the scheme is run by the ENX Association, assessments are carried out by ENX-approved audit providers, and results are shared with carmakers as assessment labels on the ENX platform, valid for up to three years.

Facing a carmaker or Tier 1 supplier that requires TISAX, a supplier that cannot present assessment results may be held back at the supplier qualification stage.

What did ISA2027 change in prototype protection? Which version applies to our project?

Prototype protection goes from 22 controls to 20, and the former five sections 8.1 to 8.5 are merged into two: 8.1 organisational requirements and 8.2 physical and environmental security.

The version is decided by the commissioning date, not the assessment date:

• Commissioned by 31 December 2026: may still be completed under ISA 6.0.3
• Commissioned from 1 January 2027: ISA2027 applies

Existing labels keep their original validity (up to three years) with no early reassessment. Where the scope includes prototype protection, the documentation structure needs remapping even if the actual measures stay the same.

What is the difference between Basic and Facilities? Can we choose AL2 or AL3?

You cannot choose; the level follows from the assessment objective. ISA2027 keeps only two prototype protection labels:

AL2 relies on plausibility checks, evidence review and interviews, usually by video; AL3 requires auditors on site for full verification. The product manager should confirm the label the customer requires before deciding which processes and sites go into scope.

How long does preparation take? Could we miss the carmaker project schedule?

As listed on the service page: depending on existing security maturity, preparation usually takes 7–12 months or more, shorter with ISO 27001; where the scope includes prototype protection and commissioning is planned for 2027 or later, allow time to rebuild documentation under ISA2027. ENX itself says it cannot estimate the overall timeline.

What cannot be compressed:

• Self-assessment quality decides whether the first assessment passes; nonconformities close only after corrective action and a follow-up assessment
• The audit provider's schedule is outside the company's control
• Once the scope summary is sent to the audit provider, scope changes go only through the audit provider

Customer deadlines are often shorter than the preparation actually needs, so confirm the label, plan backwards and book audit provider slots early.

Our Tier 1 customer wants our TISAX results. How do we share them, and which sites must be covered?

When a Tier 1 customer requires its suppliers to provide TISAX assessment results, Tier 2 suppliers also need to be assessed. After passing, the label is shared with customers on the ENX platform; the label is valid for three years with no surveillance audits in between, and a full reassessment is needed at expiry.

Scoping:

• Every site in scope is assessed; one scope can share central processes
• First confirm which sites will handle customer information
• A wrong scope leads to reassessment, so settle it before signing the audit contract

If prototype projects use AI tools, or the product itself contains software, what else applies?

Look at three things separately:

• AI tools: as long as they process customer confidential or prototype data, those processes fall within the information security management assessed by TISAX, and the use of AI tools must be controlled.
• Product cybersecurity engineering: TISAX focuses on information security management, ISO/SAE 21434 on cybersecurity engineering across the vehicle product development lifecycle; they complement rather than replace each other.
• EU CRA: type-approved vehicles and their components are outside the CRA, but separately sold automotive digital products remain in scope, such as aftermarket devices, diagnostic tools and charging equipment.

How does Winners Consulting help product managers with TISAX prototype protection?

Winners Consulting lets the customer's requirements set the scope first, then connects the system with on-site evidence:

1. Scoping and current-state diagnosis: review the information security, prototype protection and data protection modules and set the scope and target level (AL2/AL3)
2. Remediation plan and system build: including prototype and data protection practices where applicable
3. ISO/SAE 21434 integration (optional): sharing the security policy framework and risk assessment working papers
4. Mock assessment and support through the formal assessment

Winners Consulting is a consultant, not a certification body, and does not guarantee a label. Named client: Yi Fong Metal Industrial (VDA ISA 6.0, assessed by SGS Taiwan, TISAX label obtained). VP- and director-level consultants lead the work end to end, never outsourced. Read more: TISAX assessment consulting, TISAX timeline, Yi Fong case. Request a free mechanism diagnosis