Automotive Compliance: TISAX®, NIS2 & Data Protection for Suppliers
Your OEM and Tier 1 customers are asking for evidence regarding information security, data protection and the use of AI. We help you organise these requirements and meet them reliably, using both software and personal service.
For suppliers and service providers in the automotive sector. So your team can focus on development and series production, rather than the next security questionnaire.
What compliance obligations do automotive suppliers have?
Legal obligations and customer requirements are not the same thing. This overview will help you get your bearings.
Automotive suppliers process personal data and must protect it in accordance with the GDPR. Depending on the size and nature of the business, requirements such as information security (NIS2), AI regulations and whistleblower protection may also apply. What matters is what specifically applies to your company.
TISAX® requirements are generally not a legal obligation, but rather a customer requirement. OEM and Tier 1 customers frequently make this a contractual condition. The same applies in a similar way to ISO 27001.
Your day-to-day in the supply chain
Your customers want to know that their development data, access credentials and processes are in safe hands. These questions don't just arise during an audit; they come up right from the start of the project.
Four topics. One clear path for your automotive business.
You get software and personal service combined. We identify what you need and support you with the implementation in your day-to-day operations.
Data Protection & GDPR
Processing customer and development data responsibly.
- External Data Protection Officer
- Record of processing activities, Data processing agreements and TOMs
- DPIA and Data breach management
- Training and support with data subject requests
A DPO is generally required if at least 20 people are constantly involved in automated data processing (§ 38 BDSG). Other legal triggers may also apply.
Information security
We help you understand OEM and corporate requirements and build robust evidence.
- Preparation for an assessment according to TISAX®andISO 27001 requirements
- Security processes and documentation build
- Prepare for customer questionnaires and OEM audits in a structured way
- NIS2 requirements classify within the supply chain
ISO 27001 and TISAX are common customer requirements. NIS2 can be relevant directly or via customer contracts – the extent to which you are affected must be assessed.
AI governance
Use AI consciously in engineering and everyday project work.
- AI training for your team and suitable AI policy
- AI applications and classify their risks
- Data protection assessment when using AI tools
- Manage approvals and responsibilities transparently
Obligations depend on the role and the specific AI application. Competence and transparency are assessed separately.
Whistleblower protection
Internal reporting channel with a clear process.
- Internal Set up an external reporting channel and operate
- Receive and process reports confidentially
- Manage deadlines and follow-up measures in a structured manner
- Document case handling in a transparent way
Companies with generally 50 or more employees are required to set up an internal reporting channel (Section 12 of the Whistleblower Protection Act). Special legal cases must be taken into account.
TISAX® at a glance
TISAX® (Trusted Information Security Assessment Exchange) is the information security standard for the automotive industry. It is based on the VDA ISA questionnaire, and the process is managed by the ENX Association. The result is a label in the ENX portal that your clients can view.
There are three assessment levels: AL1 is a pure self-assessment and does not result in a label. AL2 is a plausibility check by an ENX-approved audit provider, and AL3 is an on-site audit for the highest level of protection.
Your client determines which level applies.
AL1 - Self-assessment
Purely a self-assessment. Does not result in a label.
No label
AL2 - Plausibility check
Audit by an ENX-approved audit provider.
Label in the ENX portal
AL3 - On-site audit
For the highest level of protection.
Label in the ENX portal
From the initial consultation through to ongoing operations in the automotive industry.
Not just another folder gathering dust. But a structured path that your agency can follow.
Compliance that matters to you and works in practice
We create bespoke service packages tailored to your company size, processes, and goals. Together, we implement data protection, information security, whistleblower protection, and AI governance in a way that is legally compliant, clear, and practical for your day-to-day operations.
What does your OEM require, and what is mandatory?
FAQ: Frequently asked questions about automotive compliance
TISAX® requirements are based on the VDA ISA catalogue. This is built upon ISO 27001 and incorporates additional automotive-specific requirements, such as those for prototype protection and data protection (ISMS Lite). While an ISMS compliant with ISO 27001 provides a solid foundation, it does not replace the need for a targeted assessment against TISAX® requirements.
Ultimately, that is determined by your customer. Many manufacturers and suppliers require a valid TISAX® (VamiSec) label. You can find details of the required evidence in your customer enquiries and contracts. Please clarify this first.
TISAX® requirements are not a legal obligation. In practice, however, they are frequently requested by OEMs and Tier 1 customers. Your customer determines whether an assessment is required and which assessment level applies. There is no label for AL1; only AL2 and AL3 result in a label within the ENX portal (secjur).
The manufacture of motor vehicles, trailers and semi-trailers is one of the sectors covered by the NIS2 Directive (CloudSoul). Whether your company is directly affected depends on its size and activities. As a general guide, this applies to companies with at least 50 employees or an annual turnover and annual balance sheet total of at least 10 million euros each. Regardless of this, customers often pass NIS2 requirements on to suppliers via contracts. These supply chain requirements should be distinguished from direct regulatory obligations.
Begin by taking stock: what are your client's requirements, and how do you measure up against the VDA ISA catalogue? Next, close any gaps in your policies, process descriptions, and evidence such as log files and screenshots (secjur). Define responsibilities and organise your documentation so that you can retrieve it quickly whenever requested.
If you process personal data on behalf of a client or engage service providers who have access to data, a data processing agreement under Article 28 of the GDPR is generally required. In addition, you will need a record of processing activities and appropriate technical and organisational measures (TOMs). Whether you are acting as a data processor or a controller must be assessed for each specific activity.
The most important factors are ensuring sufficient AI literacy among employees (Article 4 of the AI Act) and, where applicable, meeting transparency obligations (Article 50 of the AI Act). Not every use of an AI tool makes your company a provider of a high-risk AI system. Furthermore, you must clarify internal approvals, data protection, and the handling of customer information.
