TISAX labels are the outcome of the assessment, and each one comes with a fixed assessment level: Confidential, High availability, Test vehicles, Proto events and Data are assessed at level 2 (AL2); Strictly confidential, Very high availability, Proto parts, Proto vehicles and Special data at level 3 (AL3). When a customer simply tells you “we need TISAX”, the first thing to ask is which labels, because the labels determine the level, and the level determines whether the auditor works remotely or comes to your site.
Everything below is taken from the TISAX Participant Handbook from the ENX Association, which runs the scheme. If you need a general introduction to the standard, see our article on TISAX compliance.
Current labels and the level each one requires
ENX talks about “assessment objectives” and your customer will talk about “labels”. According to ENX’s own website they are almost the same thing: you choose objectives when you register and, if you pass the assessment, you receive the matching labels. There are three families: information security, prototype protection and data protection.
| Label | What it assesses | Level |
|---|---|---|
| Confidential | Information with a high protection need for confidentiality | AL2 |
| Strictly confidential | Information with a very high protection need for confidentiality | AL3 |
| High availability | High protection need for availability | AL2 |
| Very high availability | Very high protection need for availability | AL3 |
| Proto parts | Prototype parts and components | AL3 |
| Proto vehicles | Prototype vehicles | AL3 |
| Test vehicles | Testing and handling of test vehicles | AL2 |
| Proto events | Prototypes at events, presentations and photo or film shoots | AL2 |
| Data | Data protection as a processor under Article 28 of the GDPR | AL2 |
| Special data | Same as Data, with special categories of personal data | AL3 |
Two details cause a lot of confusion. First, if a contract or a purchasing template says “Info high” or “Info very high”, those are the old names. The handbook states they could only be selected until 31 March 2024; since 1 April 2024 the options are Confidential and Strictly confidential. Ask the customer to confirm which of the current labels they want.
Second, Test vehicles and Proto events have been assessed at AL2 since version 2.8 of the handbook, from 2025. They used to be AL3, so older documents and presentations still say so.
Why “the lowest one” is not enough
Higher labels include lower ones in three cases the handbook names explicitly: Strictly confidential covers Confidential, Very high availability covers High availability and Special data covers Data. And a higher level always includes the lower one, so an AL3 assessment works when another customer asks you for something at AL2. The handbook sets out no such relationship for prototypes, so do not assume Proto vehicles covers Proto parts.
The rule that shows up most on the invoice is a different one: with the standard scope, the assessment is carried out at least at the highest level of all the objectives you have selected. If you ask for Confidential, Data and a single AL3 label, the whole assessment becomes AL3.
What AL1 is and why it will not be accepted
Level 1 is a self-assessment for internal use. The ENX handbook says its results have low confidence and are not used in TISAX. It helps you see where you stand before you commission anything, but it does not produce labels you can share with a customer.
Scope: almost always standard
Scope is defined by locations: you decide which sites are included, and one scope means one report, which only comes out clean if every location passes. If one site is lagging behind, the handbook allows you to register more than one scope.
ENX offers a standard scope, predefined and not open to modification, covering all processes, procedures and resources under the responsibility of the assessed organisation at the listed locations. The handbook strongly recommends it, says it is the right choice for well over 99% of participants and warns that other participants only accept results based on it. Custom scopes exist (“custom extended”, which does receive labels, and “full custom”, which does not and is generally accepted by nobody), but they are not meant for a supplier responding to a customer request. For groups with at least three locations and a centralised management system there is also a simplified group assessment, which ENX describes in a separate document.
AL2 or AL3: what changes for you
At AL2 the audit provider checks the plausibility of your self-assessment at every location in scope, asks for evidence and interviews the people responsible, usually by video call. There is an optional variant, sometimes called “AL 2.5”, in which the auditor carries out a full remote assessment instead of the plausibility check. Formally it counts as AL2, but it is methodologically compatible with AL3: if you later need to move up a level, only the on-site activities would be left.
At AL3 the auditor carries out a full compliance verification and has to be at your premises to observe the actual conditions and processes. If on-site work is temporarily impossible, a remote video-based method can be used, but it is recorded as a minor nonconformity and requires an on-site follow-up assessment as soon as possible. If your audit provider has no auditors in your country, that means travel, expenses and dates tied to their schedule; we go into more detail in the article on TISAX in Mexico.
Temporary labels, action plan and three years
If the overall result is “minor nonconformity”, you receive temporary labels. They are valid for at most nine months after the closing meeting of the initial assessment, they cannot be renewed, and according to the ENX FAQs your customer will generally accept them on condition that you obtain the permanent labels afterwards.
Deviations are fixed through a corrective action plan. No action can take longer than nine months; any action over three months has to be justified, and any over six months requires you to show it cannot be done sooner. The follow-up assessment has to fit within those nine months from the close of the initial one.
Permanent labels are valid for three years, or less if something significant in the scope changes, such as a site relocation. The handbook advises starting the renewal at least a year before they expire.
On the catalogue: the auditor uses the VDA ISA version in force when you commission the initial assessment. According to the ENX announcement, ISA2027 applies to assessments commissioned from 1 January 2027, labels already issued remain fully valid and new catalogues will be released every summer. The announcement does not mention changes to labels or levels.
Where we would start
Ask the customer for the labels in writing, using their current names, and do not add any “just in case”. A single AL3 label turns the whole assessment into AL3, with the auditor on site. If today you are only asked for Confidential and you do not expect to handle prototypes or special category data, AL2 is the sensible choice; if you know you will need AL3 within a year, consider the full remote variant, because then only the on-site part would remain.
Before commissioning anything, do the AL1 yourself: an honest self-assessment against the catalogue that will apply to you, which will be ISA2027 if you commission in 2027. In the GlobalSuite® TISAX module that VDA ISA self-assessment is tracked control by control, alongside the locations and the labels each customer requires, the action plan with owners and dates, and the prototype protection evidence kept separate from the rest. If your management system is already built on ISO 27001, you already have much of that evidence. If you would like to see it applied to your case, get in touch.
Official sources: TISAX Participant Handbook, TISAX on the ENX website, TISAX FAQs, VDA ISA2027 announcement and VDA, information security. Content reviewed in October 2026.
