TISAX defines three Assessment Levels (AL) depending on the sensitivity of the information and the degree of protection required. Choosing the right level is crucial — and it’s usually determined by the needs of your client.

AL1 – Basic Protection

• Self-assessment (no external audit)
• For companies handling non-critical or publicly available information
• Rarely accepted by OEMs for sensitive projects

AL2 – High Protection

• External audit required
• For companies accessing confidential data, such as design files or operational data
• Most common level requested by automotive partners

AL3 – Very High Protection

• External audit with deeper controls and stricter validation
• Required when handling prototypes, classified technical data, or data critical to national security
• Applies to select suppliers in advanced R&D or pre-production environments

Choosing the right level isn’t about guessing — it’s about understanding the expectations of your partners. That’s where working with an experienced IT advisor can make all the difference.