Direct answer: a TISAX budget has four parts: the ENX Association registration fee, the audit provider's assessment fee, consulting, and the company's internal effort. ENX states in the participant handbook that the registration fee is only part of the total cost, and that the assessment fee is quoted separately by the audit provider.
Four factors determine the cost
| Factor | Why it affects the budget | What to confirm first |
|---|---|---|
| Assessment objectives and assessment level | The assessment objectives decide whether AL2 or AL3 applies, and the depth of checking differs | The labels your customers require (such as confidential, prototype protection) |
| Number of sites in the assessment scope | Every site in scope is assessed; a single scope can share central processes | Which sites handle customer information |
| Information-security maturity | Preparation effort depends on the maturity of the existing management system | Whether ISO 27001 or an equivalent system already exists |
| Audit provider quotes | The company chooses an ENX-approved audit provider itself and compares quotes | Obtain at least two quotes |
AL2 versus AL3: the ENX handbook notes that AL2 has a lower assessment fee but usually requires a more complete self-assessment and documentation, so internal effort can actually be higher; AL3 is based mainly on on-site checks and is not necessarily more expensive. When comparing budgets, count the audit fee and internal effort together.
Winners' view
The common budget gap is to budget only the registration and audit fees and leave out "scope definition" and "self-assessment quality". A wrongly defined scope leads to re-assessment, and an incomplete self-assessment at AL2 turns directly into extra internal effort. Both should be completed before signing the audit contract.
How the three disciplines divide the work: process builds the information-security management system and maturity evidence against VDA ISA; technology implements access control, encryption, physical and prototype protection and other controls; legal compliance handles the personal-data obligations (GDPR) involved in the assessment objectives and whether the product is separately governed by the CRA. Doing only technical testing usually loses points on maturity scoring and documentary evidence.
How to budget the consulting fee
Consulting covers defining assessment objectives and scope, self-assessment and gap remediation against VDA ISA, preparing documents and evidence, and a rehearsal before the assessment. Quotes depend on the number of sites, the assessment level and the maturity of existing information-security management. The audit provider's assessment fee and the consulting fee are two different costs and should be budgeted separately.
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.