TISAX for Automotive Suppliers

Why OEMs Require TISAX

A customer wants to share confidential drawings, engineering data or prototypes and requests evidence of information security before the contract starts. TISAX may be a contractual condition. Establish whether a label is required, which assessment objectives apply and when the result is needed from the actual customer request.

TISAX (Trusted Information Security Assessment Exchange) is the assessment and results-exchange mechanism operated by ENX. It uses the ISA catalogue, often called VDA ISA. “TISAX certification” is common wording, but the process produces assessment results and labels. Our automotive compliance guide explains how it relates to ISO 26262, ISO/SAE 21434 and broader requirements.

AL1, AL2, or AL3: Which Assessment Level Do You Need?

The assessment level describes the depth of assessment. Required assessment objectives determine it; being a Tier 1, Tier 2 or Tier 3 supplier does not establish a universal level.

• AL1: Self-assessment without assessment by a TISAX audit provider. It supports internal orientation and does not produce an assessment result shared through TISAX.
• AL2: A plausibility check of the self-assessment by an approved provider using appropriate evidence and interviews.
• AL3: A more extensive assessment including evaluation of implementation on site.

Agree assessment objectives, the required level and results sharing with the requesting customer. Current process rules and ISA versions are available in the ENX participant handbook.

Scoping for Tier 1 vs. Tier 2 vs. Tier 3

Identify the sites, processes, information and supporting systems within the assessment. A small software supplier may handle highly sensitive information, while a larger manufacturer may have a differently scoped contract. Service and protection needs matter more than the tier alone.

• Information security: Which confidential information is processed, and how important are availability and access protection?
• Prototype protection: Are prototypes or sensitive development information handled within the relevant scope?
• Data protection: Which personal data and processing on behalf of customers fall within scope?

Connect owners, assets and providers to that scope. Maintained IT asset management makes dependencies and safeguards traceable.

Common Pitfalls in the Initial Assessment

• Unclear scope: Sites, services or important supporting systems are missing. Agree the boundaries before detailed implementation.
• Incomplete ISMS documentation: A policy exists, but its approval, owner or review date is unclear. Keep these details with the document.
• Missing asset inventory: Cloud services, maintenance access or test benches are overlooked. Review actual workflows with the teams involved.
• Insufficient awareness: Rules are stored but not communicated. Connect training and acknowledgements to relevant roles.
• Underestimated physical security: Protected areas and access rules need to work in practice. A procedure alone does not demonstrate implementation.

Which TISAX Software Makes OEM Documentation Easier?

Answer three questions: which requirement applies, which measure addresses it and where is the current evidence? Kopexa separates controls or requirements from measures and connects them with ownership and evidence.

An access review may address relevant TISAX, ISO 27001 and customer-framework requirements. Your team completes the shared measure once; Kopexa automatically reflects its implementation status in the linked controls. You can create or upload custom frameworks and standards. Additional requirements are added deliberately rather than copying all existing work.

This keeps documentation traceable for customer questions and the audit provider. An existing ISMS is your starting point. The automotive industry solution shows how Kopexa supports everyday supplier work.

Costs and Timeline

Separate four cost categories:

• ENX registration: Check current charges and your intended assessment scope with ENX.
• Audit provider: Request a quote based on assessment objectives, level and sites. Follow-up work may create additional effort.
• Internal work: Plan capacity across ISMS, IT, business teams and evidence owners. An existing management system materially affects the effort.
• Software and consulting: Kopexa starts at EUR 249 per month. Software supports management and evidence; consulting can complement interpretation and implementation.

Kopexa reports around 60% less manual administration from customer projects compared with Excel, SharePoint and email workflows. This includes duplicate maintenance and evidence retrieval. Time to a TISAX label also depends on starting conditions and assessment work. The TISAX costs and process guide covers budget planning.

No Label = No OEM Contract?

If a customer explicitly requires an appropriate TISAX result, missing or insufficient evidence may prevent a contract. This is a specific procurement and contractual question, rather than a universal statutory TISAX obligation for every automotive company.

Clarify the required result, deadline and intended recipients early. Track outstanding measures and dates so assessment preparation becomes part of customer-project planning rather than a surprise before approval.

Next Steps

• TISAX Content Hub for assessment levels, VDA ISA and checklists.
• Supplier compliance in the supply chain for providers and subcontractors.
• TISAX software comparison for software selection.
• Automotive compliance explained for information security, vehicle standards and ESG.