TISAX Label Validity: Planning Your Next Assessment

An expired TISAX label can create a gap in the assurance customers expect across the automotive industry, putting supply chain trust under pressure. TISAX label validity is up to three years, but maintaining that status requires a new assessment, not an automatic renewal.

Your team needs time to confirm scope, review security controls, address weaknesses, and complete the assessment process. Leaving those activities until the expiry date puts contractual commitments under avoidable pressure.

Start with the validity rules, then build a reassessment plan around your organisation's risks and customer requirements.

Understanding TISAX label validity

TISAX means Trusted Information Security Assessment Exchange. Managed by the ENX Association, it enables organisations in the automotive industry to assess information security and share results with authorised business partners.

Although often called TISAX certification, it is an assessment and exchange framework, not a conventional certification scheme. AKRUP's guide to the TISAX framework explains its role in protecting confidential automotive information.

When the three-year period begins

According to the ENX participant handbook, the maximum validity period is three years from the date of the final assessment report.

Use the recorded validity dates for your assessment when setting renewal deadlines. Don't calculate expiry using your registration date, consultancy engagement date, or an assumed report-issue date.

The three-year period is a maximum. Significant changes to the assessment scope may affect continued validity, so the date alone doesn't establish whether an existing result remains appropriate.

What a valid label covers

A label relates to defined assessment objectives within a registered scope of assessment. It doesn't provide unrestricted assurance across every company, location, system, or service in a group.

Procurement and compliance teams should check the relevant objectives, scope, and expiry together. A customer may require particular labels for particular activities.

Keep those requirements in a central register with a named owner. This makes customer obligations visible alongside the technical assessment schedule.

Temporary TISAX labels have different rules

A temporary TISAX label can provide limited assurance while an organisation completes corrective actions. It isn't an extension of an expiring permanent label.

The ENX TISAX FAQs explain the applicable conditions and deadline. These rules matter when an assessment identifies weaknesses close to a customer's required completion date.

When a temporary label is possible

An assessment report with an overall result of "minor non-conform" and a corrective action plan may support a temporary label.

A minor non-conformity doesn't automatically qualify. Eligibility depends on the assessment outcome and whether the plan meets the applicable conditions.

Each action should identify the weakness, responsible owner, completion date, and evidence needed to demonstrate resolution. Your audit provider evaluates the plan and later checks its implementation.

A promised purchase or revised policy alone may not demonstrate that a control is operating effectively.

The nine-month deadline

Temporary labels expire when the non-conformities are resolved or, at the latest, nine months after the initial assessment's closing meeting. They cannot be renewed.

  The nine-month limit runs from the initial assessment closing meeting, not the date a temporary label becomes available.  

Plan remediation against that fixed deadline. Allow time for implementation, evidence collection, and the follow-up assessment.

If your customer needs uninterrupted permanent status, don't treat a temporary label as an accepted substitute. Confirm its acceptability with that customer.

Renewal requires a new assessment process

TISAX labels don't renew automatically. Your organisation must register a new assessment scope, even when its boundaries are identical to the previous scope.

The ENX assessment process guidance sets out registration, assessment and result exchange. Existing documentation can support preparation, but previous success doesn't replace reassessment. This isn't simply an annual surveillance audit.

The practical sequence is:

1. Confirm customer requirements and register the new scope in the ENX Portal.

2. Update your self-assessment against the applicable VDA-ISA catalog.

3. Engage an ENX-approved audit provider and complete the required assessment activities.

4. Resolve findings and complete any necessary follow-up assessment.

5. Share the new results with relevant partners through the portal.

The VDA-ISA catalog provides the criteria for evaluating information security maturity. Additional requirements can apply to data protection and prototype protection, depending on the assessment objectives.

Assessment depth also matters. AL2 involves verification suited to its assurance requirements, while AL3 requires more extensive examination. Confirm the applicable assessment level and arrangements with your provider, rather than assuming every reassessment follows the same format.

Your new result must be available and shared when customers need it. Completing an audit meeting alone doesn't meet that business requirement.

A practical timeline for reassessment planning

Begin planning around 12 months before expiry. This is a practical recommendation, not an ENX-mandated preparation period.

A mature organisation with a stable scope may need less preparation. Multiple sites, changed customer requirements or unresolved control weaknesses justify more time. A readiness gap assessment of information security controls can help identify risks early.

Use this schedule as a planning baseline.

Time before expiry	Recommended activity
12 months	Confirm expiry, customer objectives, scope, ownership, and budget.
9 months	Review the applicable ISA requirements and select an audit provider.
6 months	Complete internal audit, management review, and priority remediation.
3 to 6 months	Undertake the external assessment with time reserved for follow-up.
Before expiry	Complete outstanding actions, verify new label dates, and share results.

The priority is completion before expiry, with a realistic allowance for findings. Booking the assessment before expiry doesn't guarantee uninterrupted label coverage.

Agree milestones with your provider early. Assessment availability, evidence quality and corrective actions can all affect completion. Assign a security officer or another named owner to coordinate actions, and track findings in a corrective action plan with owners, evidence and completion dates.

For organisations with substantial weaknesses, an assessment three months before expiry may leave insufficient time. Bring the external assessment forward when the readiness review identifies that risk.

Record dependencies as well as dates. HR may need to supply training records; IT may need to complete access reviews; facilities teams may need to improve physical security.

Report progress to management against those deliverables. A calendar reminder without accountable owners won't provide a dependable renewal plan.

Scope changes and multi-site organisations

Review your scope throughout the validity period, not just when preparing for renewal. New premises, acquisitions, outsourcing arrangements, or changes to sensitive information handling can affect assessment coverage.

Discuss material changes with your audit provider and, where appropriate, ENX. Check current guidance to understand whether a change affects the assessment or label validity.

A scope extension doesn't reset the existing validity period. Adding a location doesn't start a new three-year cycle for the original labels.

For dealer groups and multi-site suppliers, distinguish central controls from local implementation. A group access policy may be consistent, whilst visitor management, offboarding, or server-room protection varies between locations.

Maintain a site-level evidence register alongside shared ISMS documentation. Give local managers responsibility for resolving weaknesses at their premises.

AKRUP's TISAX preparation for two UK sites describes a 12-month engagement with Rudolph & Hellmann that achieved AL3 labels at both locations. This is an example of the coordination needed across management, IT, HR, and operations for multi-site readiness.

That project duration isn't a universal renewal requirement. Base your reassessment plan on existing maturity and the amount of change since the previous assessment.

Build evidence before the reassessment

An effective reassessment demonstrates that information security controls work in practice. Policies establish expectations; operational records show whether your organisation follows them.

Access controls and technical security

For access management, prepare recent user-access reviews, approval records, privileged-account inventories, and joiner, mover, and leaver evidence. Include records showing multi-factor authentication where required by your information security arrangements. Periodic reviews can also evidence multi-factor authentication coverage where relevant.

Endpoint evidence can include device inventories, protection coverage, patch reports, and documented exceptions. Show how missing protection or overdue updates are identified and addressed. Where relevant to your controls, retain penetration test findings and remediation records.

For monitoring, retain alert records, investigation tickets, escalation decisions, and closure evidence. Where relevant, continuous monitoring records can show how alerts are identified and managed. A dashboard screenshot shows a point in time; an investigation record demonstrates the response process.

These are practical evidence examples, not a universal mandatory document list. Match them to your scope, applicable requirements, and implemented controls.

Governance, people, and physical protection

For risk management, update your risk assessment and treatment plan to reflect current systems, suppliers, incidents, and business activities. Prepare internal audit findings and management review records that show decisions and follow-through. Resilience records may include disaster recovery exercises where relevant to your scope.

Training evidence should establish who received instruction and how gaps were managed. Physical security records may include visitor procedures, access authorisations, and checks at relevant sites. Where customers set specific requirements, document how these are met, including any applicable cybersecurity guideline.

Where data protection objectives apply, review the supporting privacy controls. TISAX can support alignment with UK GDPR obligations, but a label doesn't establish complete legal compliance.

Keep evidence current, traceable, and accessible to the assessment team, with a security officer coordinating ownership. Historical records should support continuity without concealing changes in ownership or operation.

Budgeting for reassessment and existing ISO 27001

Reassessment costs depend on scope, assessment objectives, organisational maturity and the work needed to correct weaknesses. There isn't a universal single-site price or guaranteed completion time.

Separate assessment charges from preparation

Build the budget around ENX charges, audit-provider fees, internal staff time, remediation and consultancy support. Include a gap assessment, plus travel and follow-up activities where applicable.

Request a written assessment quotation with clear assumptions about locations, objectives, assessment level and corrective-action reviews.

For preparation support, AKRUP lists a gap analysis/internal audit service at £3,500 and self-assessment drafting support at £1,950 within its TISAX support packages.

Those are individual consultancy services, not the total cost of achieving or maintaining a label. Confirm current prices, inclusions and applicable taxes before committing expenditure.

Use ISO 27001 without assuming equivalence

An ISO/IEC 27001-certified information security management system (ISMS) can provide useful foundations, including risk management, internal audit, management review and documented information security controls.

However, ISO/IEC 27001 certification doesn't automatically satisfy a contractual TISAX requirement. TISAX evaluates automotive assessment objectives against the VDA-ISA catalog and supports controlled result sharing.

The ENX overview of TISAX explains this industry-specific assessment and exchange model.

TISAX also doesn't follow the same annual surveillance audit model as ISO/IEC 27001 certification. Maintain controls between assessments through continuous monitoring, and review changes rather than waiting for the next formal assessment.

Key takeaways for renewal planning

Manage label validity as an ongoing business obligation.

• Permanent labels last up to three years from the end of the assessment process.

• Renewal requires a newly registered scope and reassessment; it isn't automatic.

• Temporary labels can't be renewed, and scope extensions don't extend existing validity.

Assign ownership and plan backwards from the recorded expiry date.

Frequently Asked Questions

How long is a TISAX label valid?

A TISAX label is valid for up to three years from the date of the final assessment report. Check the recorded validity dates for your assessment rather than calculating expiry from your registration date.

Does a TISAX label renew automatically?

No. Your organisation must register a new assessment scope and complete a reassessment, even if the scope is unchanged. Allow time to resolve findings and share the new results before the existing label expires.

Can a temporary TISAX label be renewed?

No. A temporary label ends when the non-conformities are resolved or, at the latest, nine months after the initial assessment's closing meeting. Plan corrective actions and follow-up assessment against that deadline.

Does extending the scope reset the label's validity period?

No. Adding a location or otherwise extending the scope doesn't reset the validity period of existing labels. Review material changes with your audit provider and check current ENX guidance.

Conclusion: protect continuity before expiry

A three-year label gives your organisation a defined assurance period. Maintaining continuous coverage requires early planning, current evidence, and enough time to resolve assessment findings.

Confirm your expiry date, review scope, and agree completion milestones well before customer requirements are at risk.

If you would like to find out more information or require any of our services please Contact Us. Complete the contact form to discuss your reassessment requirements and preparation needs.