"TISAX" shows up on trust centre pages across the automotive supply chain, usually next to a line reading "TISAX certified" or "TISAX assessed". The term is a shorthand that hides a more useful set of facts. TISAX is not a certification scheme in the ISO sense, it is a structured assessment and exchange mechanism run by the ENX Association, built on the VDA Information Security Assessment catalogue used across the German and wider European automotive industry. There is no public certificate PDF to download and no central register you can search by company name the way you can search the FedRAMP Marketplace. What exists instead is a result stored inside the ENX participant portal, tied to a specific site and a specific scope, that the assessed company chooses to share with specific business partners on request. This article sets out what AL1, AL2 and AL3 actually assess, how the ENX sharing model works, and why a buyer checking a vendor's TISAX claim needs to request a share rather than ask for a certificate.
What TISAX actually is
TISAX stands for Trusted Information Security Assessment Exchange. It was created around a catalogue published by the German Association of the Automotive Industry, VDA, and it is operated by the ENX Association, which accredits the audit providers that carry out assessments and runs the portal where results are stored and shared. The idea behind it is straightforward. A parts supplier that works with a dozen car makers would otherwise face a dozen separate security audits, one from each customer. TISAX lets that supplier complete one assessment against a shared set of controls and then make the result available to any partner that asks for it, instead of repeating the exercise for every relationship. The current list of vendors in the CertReports index with recorded TISAX evidence sits at TISAX: vendors with public evidence.
TISAX results are valid for three years. Participants can start a reassessment before expiry to keep their label current without a gap in coverage.
Each TISAX result is tied to one or more locations and one or more assessment objectives, commonly information security, protection of prototype parts and vehicles, and handling of personal data. A company with five manufacturing sites might hold five separate labels, each covering a different scope, and each assessed at a different level depending on what that specific site handles and what its customers require.
The three assessment levels, AL1 to AL3
The assessment level describes how the result was reached, not how good the vendor's security is in absolute terms. It is set per assessment objective by whichever partner is requesting the result, based on how sensitive the information or parts involved are.
| Level | How it is assessed | Typical use |
|---|---|---|
| AL1 | Self-assessment completed by the organisation itself. No external auditor reviews the evidence. | Low protection needs, early or low-risk supplier relationships. |
| AL2 | Remote assessment by an ENX-accredited audit provider, including document review and interview, without a site visit. | Normal to high protection needs. The level most commonly requested by vehicle manufacturers. |
| AL3 | On-site assessment by an accredited audit provider, including a physical visit to the location. | High and very high protection needs, such as prototype parts or highly sensitive data. |
TISAX assessment levels as defined in the VDA ISA catalogue operated by ENX.
A supplier handling ordinary engineering documents might only need AL2 for the information security objective, while the same supplier handling an unreleased prototype at a different site might need AL3 for the prototype protection objective. That is why a single "TISAX certified" badge on a trust centre page tells a buyer almost nothing on its own. It does not say which objective was assessed, which level was reached, or which of the vendor's locations the result actually covers.
Assessment level is not the same as maturity level
Alongside the assessment level, every control area in the VDA ISA catalogue is scored on a maturity scale from 1 to 5, borrowed from established process assessment models. Maturity level 1 means a control exists in an ad hoc way. Level 3, described as established, is the typical target expected by vehicle manufacturers. Levels 4 and 5 describe quantitatively managed and continuously improving processes that few suppliers reach across every control. A label combines both axes. An AL2 result with maturity level 3 across the catalogue is a materially different claim to an AL2 result where several controls only reached maturity level 1. Trust centre text almost never mentions maturity level, it just states the assessment level, which is the more flattering half of the picture.
The ENX participant model: how sharing actually works
TISAX results are not published. They sit inside the ENX participant portal as a record tied to the assessed company's participant ID and scope ID, and the only way a business partner sees the content of that record is by requesting it and having the assessed company approve the share. That request and approval cycle is the actual verification mechanism, and it replaces the downloadable certificate a buyer might expect from an ISO 27001 audit.
- 1
Assessment
The vendor engages an ENX-accredited audit provider, completes the VDA ISA questionnaire for the relevant objectives, and the provider assesses evidence at the agreed level: AL1 self-reported, AL2 remote, or AL3 on-site.
- 2
Labelling
ENX issues a label covering the specific scope, objectives, assessment level and maturity scores, tied to the participant's TISAX ID and a Scope ID for that location.
- 3
Portal registration
The buyer or manufacturer creates its own ENX participant account and locates the vendor's record using the Scope ID or company name inside the portal.
- 4
Share request
The buyer sends a share request specifying which objectives it needs to see. The vendor must actively approve the request before any detail becomes visible to the buyer.
- 5
Review
Once approved, the buyer sees the live status: assessment level achieved, maturity scores, validity window and the exact locations in scope, rather than a static document that could be years out of date.
Why a trust centre claim is not proof
This is where most vendor security reviews go wrong. A company's public trust centre or marketing page will often state "TISAX certified" next to a logo, sometimes linking to a PDF summary the vendor produced itself. None of that is verifiable by a buyer unless it includes the TISAX ID or Scope ID needed to find the record in the portal, and even then the buyer still has to send a share request and wait for approval before seeing the actual scope, level and validity date. The pattern is the same one covered in how to read a trust centre: a badge is a claim, not evidence, and the only way to close the gap is to go to the primary source, in this case the ENX portal rather than a downloadable file.
- 3
- Assessment levels defined by ENX
- AL1, AL2 and AL3, scaled to the protection need of each assessment objective in the VDA ISA catalogue.
- 61%
- Trust centre mentions with no Scope ID shown
- Share of pages referencing TISAX that show no Scope ID, assessment level or validity date, in the CertReports index on 2026-10-16.
- 1 in 3
- Pages with an unclear or outdated assessment level
- Pages where the stated level could not be matched to a current, in-scope result, in the CertReports index on 2026-10-16.
The same verification problem shows up everywhere
This is not unique to TISAX. Any framework whose authoritative record sits in an external registry rather than on the vendor's own page creates the same gap between a trust centre badge and the current state of play. The Data Privacy Framework works the same way: the live list is held by the US Department of Commerce, not by the vendor, so a badge or logo on a trust centre page tells you what the vendor wants you to show, not what the registry currently lists. The card below illustrates the pattern. Look at the DPF row and compare what the trust centre claims against what the primary registry actually shows, rather than taking the badge at face value.
Notion · Trust report
Collaboration · Public evidence as of 19 Oct 2026
Framework overview
CertReports state for each framework with public evidence: 11 vendor-stated, 1 expired.
DPFExpiredListing inactive
HIPAAVendor-statedBadge only, BAA not captured
SOC 2Vendor-statedType II report
GDPRVendor-statedTrust centre · 19 Oct 2026
PCI DSSVendor-statedTrust centre · 19 Oct 2026
ISO 27001Vendor-statedTrust centre · 19 Oct 2026
ISO 27701Vendor-statedTrust centre · 19 Oct 2026- SOC 3Vendor-statedTrust centre · 19 Oct 2026
ISO 27017Vendor-statedTrust centre · 19 Oct 2026
3Documents and agreements
Legal and review documents Notion publishes or offers, as of 19 Oct 2026.
- Data processing agreement · Public
- Subprocessor list · Public
- Privacy policy · Public
26Subprocessors
Named on Notion's public subprocessor list, last seen 19 Oct 2026.
How to check a TISAX claim in practice
- Ask the vendor for the TISAX ID, Scope ID and the specific assessment objective relevant to your relationship, not just the headline claim.
- Create an ENX participant account if your organisation does not already hold one, then search for the vendor's scope.
- Send a share request for the objective and location that matter to your contract, and ask the vendor to approve it promptly.
- Check the assessment level, maturity scores and validity date once the share is approved, and confirm the location in scope matches where your data or parts are actually handled.
- Record the result alongside the rest of your evidence using the same process set out in a 30-minute vendor security review using public evidence, so the check does not have to be repeated from scratch at renewal.
Common mistakes worth checking for
- A company-wide claim built on one site's assessment. TISAX results are scoped to a location, so a headquarters assessment does not automatically cover a manufacturing plant three countries away.
- An assessment level that does not match the objective in question. A vendor assessed at AL2 for information security may hold no result at all for prototype protection.
- A label shown past its validity window. TISAX results run for a fixed period before a new assessment is required, and a trust centre page is not obliged to update itself when a label lapses.
- Self-assessment presented with the same confidence as an audited result. AL1 is not reviewed by an external party, so it carries less weight than AL2 or AL3 even when the trust centre wording does not distinguish them.
Where TISAX fits in a wider vendor review
TISAX sits alongside, not instead of, the other evidence a buyer collects. A supplier handling engineering data for a car maker might also hold ISO 27001 certification or publish a SOC 2 report, and cloud providers sitting in the CSA STAR registry or verified against the FedRAMP Marketplace only prove what the underlying registry currently shows, not what a badge claims. Asking the right question up front, before a questionnaire goes out, is covered in vendor security questionnaire questions the public record already answers.
None of this makes TISAX less useful. It was built to stop the same assessment being repeated for every customer, and it does that well once a buyer understands that the proof lives in a portal, not on a webpage. The fix for a reviewer is simple: treat the claim as a prompt to request a share, not as a result in itself.
People also ask
What is tisax?
TISAX stands for Trusted Information Security Assessment Exchange. It is a scheme operated by the ENX Association, based on the VDA Information Security Assessment catalogue, that lets automotive suppliers complete one security assessment and share the result with multiple business partners instead of repeating a separate audit for each one. Results are scoped to a location and an assessment objective, and they are exchanged through the ENX portal rather than published as a public certificate.
What is tisax certification?
"TISAX certification" is the common shorthand for completing a TISAX assessment, though it is not a certificate in the ISO sense. A vendor engages an ENX-accredited audit provider, is assessed at AL1, AL2 or AL3 depending on the protection need, and receives a label covering a specific scope and maturity level. The result sits in the ENX portal and is shared with approved partners on request, rather than issued as a downloadable document.
What is tisax level 2?
TISAX level 2, usually written AL2, is a remote assessment carried out by an ENX-accredited audit provider. The provider reviews the vendor's evidence against the VDA ISA catalogue and typically conducts an interview, but does not visit the site in person. It covers normal to high protection needs and is the level most commonly requested for information security, sitting between the self-reported AL1 and the on-site AL3.
How to check tisax certification?
Ask the vendor for its TISAX participant ID or Scope ID and the specific objective relevant to your relationship. Create an account in the ENX participant portal, locate the vendor's scope, and send a share request for that objective. Once the vendor approves the request, you will see the assessment level achieved, the maturity scores and the validity date, which is the only way to confirm a trust centre claim against the authoritative record.
Solomon Amos · Founder, CertReports
Solomon builds CertReports, the public evidence index for vendor security reviews. PhD in machine learning and cybersecurity, two years embedded at HMRC digital programmes, founder of TapTax. He writes about what registries, trust centres and auditors actually publish, and how buyers can use it before the questionnaire goes out.
Read next on CertReports