Direct answer: ENX states officially that it cannot estimate the overall timeline, because it depends on company size, assessment objectives and how prepared the information-security management system is. What you can control is the order of the process: registration, assessment and exchange, three steps in which preparation before the assessment takes the most time and is the part the company itself can control most.
The three steps and what the company controls
- Registration: register as a participant on the ENX portal, accept the terms, define the assessment scope and objectives. ENX usually sends the confirmation and scope excerpt within three working days.
- Assessment: complete the self-assessment against VDA ISA and close the gaps → obtain a quote from an ENX-approved audit provider and sign → initial assessment → if there are non-conformities, submit a corrective action plan and undergo follow-up assessment.
Version note: VDA published VDA ISA2027 on 1 July 2026; assessments commissioned from 1 January 2027 use the new version, and a new version is now published every year; assessments commissioned before then still follow ISA 6.0.3. Labels are valid for three years from the closing meeting of the assessment, with no surveillance audits in between, and a full re-assessment is required at expiry. Companies that will commission an assessment early next year should prepare against the new version.
- Exchange: after passing, obtain the labels and share them with customers on the ENX platform. Results are valid for three years, after which the process must be run again.
What cannot be compressed: the quality of the self-assessment decides whether the initial assessment passes, and non-conformities can only be closed after corrective action and follow-up assessment; the audit provider's schedule is also outside the company's control. In addition, ENX rules that once the scope excerpt has been sent to the audit provider, the assessment scope can only be changed through the audit provider.
How TISAX relates to the CRA
They are different in nature. TISAX is the automotive OEMs' information-security requirement for suppliers; the CRA is an EU product regulation. Under Article 2 of the CRA, vehicles type-approved under (EU) 2019/2144 and their dedicated systems and components are outside the CRA, and the Commission has additionally excluded L-category vehicles such as motorcycles under (EU) 2025/1535. However, automotive digital products sold on their own remain within the CRA, for example aftermarket devices, diagnostic tools, fleet-management hardware, charging equipment, and chip modules and software sold separately into the supply chain. Automotive suppliers often need TISAX (a customer requirement) and the CRA (a legal obligation) at the same time; the evidence for both can share one management system rather than being built twice.
AI in the automotive supply chain: TISAX, ISO 42001 and the AI Act
Automotive suppliers increasingly use AI tools for design, testing and documentation. As long as those tools process customers' confidential or prototype data, the processing is within the information-security scope assessed under TISAX, and the use of AI tools must be controlled. ISO 42001 adds governance of AI use: approval of use cases, data classification, assessment and records of AI service providers, sharing one management system with the VDA ISA controls. If a supplier also sells automotive digital products with AI functions on their own, both the CRA and the AI Act must be considered. ISO 42001 and AI Act budget and timeline
Winners' view
The delivery date given by the customer is usually shorter than the preparation time actually needed. The most effective approach is to confirm the labels the customer requires first, count back the time for self-assessment and remediation, and secure the audit provider's slot early, rather than asking for quotes only once preparation is complete.
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.