TISAX Assessment Levels Explained: AL1, AL2, AL3 and the Maturity Scale

TISAX assessment levels are the three tiers of verification rigor TISAX uses to check an automotive supplier’s information security. AL 1 is a self-assessment. AL 2 adds a remote check by a third-party auditor. AL 3 requires a full on-site audit. Which one applies to you depends on how sensitive the information or prototype data you actually handle.

If a customer told you “you need AL2” or “you’re an AL3 supplier,” this guide walks through exactly what that means: what gets checked, who checks it, and how much effort each level actually takes.

If you’re still getting oriented, our overview of what TISAX and the VDA ISA standard are covers the basics first. This page assumes you already know TISAX exists and need the Assessment Level detail.

What Is a TISAX Assessment Level, and Why Are There Three?

TISAX (Trusted Information Security Assessment Exchange) is the information security assessment and result-exchange system used across the automotive supply chain. It was introduced by the VDA (Verband der Automobilindustrie, the German Association of the Automotive Industry) and is run day to day by the ENX Association, a nonprofit set up by European vehicle manufacturers and suppliers.

An Assessment Level is how much verification your self-reported answers get. Not every supplier handles the same kind of risk. A supplier storing basic contact data needs a lighter check than one holding unreleased vehicle prototypes. So TISAX scales the audit to match the stakes, using three levels defined in the TISAX Participant Handbook:

Higher levels always cover the lower ones. An AL 3 pass automatically satisfies AL 2 and AL 1 requirements too. We cover that hierarchy in detail further down.

Your Assessment Level isn’t something you choose. The OEM or business partner requesting the assessment sets it, based on what kind of information, prototype material, or personal data you’ll handle for them. Later in this guide, we break down exactly how that decision maps to specific protection-need tiers.

AL 1: Self-Assessment Only

AL 1 is the lightest level. You complete the VDA ISA questionnaire yourself and submit it. No outside auditor reviews your answers for accuracy. Nobody checks your evidence. Nobody interviews your staff.

Here’s the trade-off that catches people off guard: AL 1 results are not accepted for exchange within TISAX itself. You can complete an AL 1 self-assessment, but you can’t share a validated AL 1 label with a business partner through the TISAX platform, because there’s no independent verification behind it.

What an AL 1 self-assessment does and doesn’t involve:

• Does involve: answering every applicable VDA ISA question yourself, documenting your current security practices, submitting the completed questionnaire.
• Does not involve: a third-party auditor reviewing your evidence, an interview with your security lead, any on-site or remote verification step, a TISAX label eligible for sharing with partners.

Because of that low trust level, most suppliers use AL 1 internally, as a gap-check before a real AL 2 or AL 3 engagement, rather than as an end goal. If you want to see where your own processes stand before an auditor ever gets involved, our VDA ISA checklist lets you self-assess against the same catalogue an AL 1 review would use.

AL 2: The Plausibility Check

AL 2 is where an independent auditor actually gets involved, but the engagement stays relatively light. The TISAX Participant Handbook describes it as a plausibility check, not a full audit.

Here’s what happens at AL 2:

1. You complete your VDA ISA self-assessment first, same as AL 1.
2. An accredited third-party auditor reviews your answers and supporting evidence.
3. The auditor conducts an interview with whoever owns information security at your organization.
4. This is generally done over web conference. An on-site inspection is available on request, but it isn’t the default.

The auditor isn’t trying to catch you in a lie during an AL 2 review. They’re checking whether your answers are plausible given the evidence you provide. That’s a meaningfully lighter bar than AL 3’s on-site verification, which is why AL 2 suits suppliers handling confidential information rather than the most sensitive prototype or strictly-confidential material.

AL 2.5 is a fully-remote variant worth knowing about. It performs the same plausibility verification as standard AL 2, but does it entirely remotely, with no in-person option even on request. The upside: an AL 2.5 assessment is structured so it can later be upgraded to AL 3 without starting over. If there’s a chance your protection-need tier will climb (say, a new customer wants prototype-level assurance), ask your audit provider about running AL 2.5 instead of standard AL 2 up front.

AL 3: The Full On-Site Audit

AL 3 is the most rigorous level TISAX defines, and it’s reserved for the highest-sensitivity work: strictly confidential information, prototype parts, and similar high-stakes categories. Where AL 2 checks plausibility, AL 3 verifies it directly.

A full AL 3 audit covers:

• Document and evidence examination, the same starting point as AL 2, but reviewed in greater depth.
• Planned interviews with the specific process owners responsible for each control area, scheduled in advance.
• On-site observation of actual conditions and how processes really run day to day, not just how they’re documented.
• Unplanned interviews, conducted without advance notice, specifically to test whether daily practice matches what’s written down.

That combination, an announced interview plus an unannounced one, is deliberate. It’s much harder to coach your team for a conversation they don’t know is coming. That’s the core of why AL 3 carries more trust than AL 2: it verifies both the paperwork and the behavior behind it.

One nuance worth flagging: temporary video-supported remote assessment has, at points, been permitted in place of the in-person visit. Even then, an on-site follow-up is still required afterward. The on-site component isn’t optional at AL 3. It’s the level’s defining feature, and the reason it takes longer and costs more auditor time than AL 2. If your organization is heading toward an AL 3 engagement, our TISAX certification process guide walks through the full timeline, start to finish.

How Your Assessment Level Gets Decided

An Assessment Level isn’t random. It comes straight from the VDA ISA’s protection-need system.

The catalogue ties its assessment objectives to three protection-need tiers: normal, high, and very high. Your business partner picks which objectives apply to your contract, based on what you’ll actually handle for them. That choice is what sets your Assessment Level, not anything you decide on your own.

Here’s how the objectives named in the TISAX Participant Handbook typically map:

Notice that “Data” objective. If you process personal data on a partner’s behalf under GDPR, that gets evaluated separately from your core information-security score, with its own label. It’s a common source of confusion: a supplier can pass their information-security objectives at one level and still need a distinct assessment for data-processing work.

If you’re not sure which objectives apply to you, don’t guess. Ask the OEM or partner who requested the assessment. That request is where your Assessment Level actually originates, and it’s the fastest way to find out if you’re looking at an AL 2 or AL 3 engagement before you talk to an audit provider.

The Maturity Scale: Level 0 Through Level 5

Your Assessment Level decides how your answers get checked. The maturity scale decides how good those answers actually need to be.

Every objective a TISAX audit covers gets scored against a six-point maturity model, Level 0 through Level 5. This scale is what separates “we wrote a policy once” from “we run this process every day and can prove it.”

Most suppliers preparing for their first audit are somewhere between Level 1 and Level 2 on several objectives. That’s normal. The work between now and your audit date is closing that gap to Level 3.

Why Maturity Level 3 Is the Pass Line

The VDA ISA splits its requirements into two categories: MUST and SHOULD. MUST requirements are mandatory. SHOULD requirements are recommended but won’t sink your assessment on their own.

Every MUST requirement in the VDA ISA has to reach at least Maturity Level 3, “Established,” before your assessment can pass.

That single rule is what makes Maturity Level 3 the real target, not a documentation checkbox. Here’s what a gap on each requirement type actually costs you:

• A gap on a MUST requirement becomes a Major Non-Conformity. It has to be fixed, commonly within a window of up to nine months, before the assessment can be finalized and a label issued.
• A gap on a SHOULD requirement becomes a Minor Non-Conformity. It gets documented in your report, but it doesn’t block you from passing.

That nine-month remediation window sounds generous until you’re the one living inside it. A supplier who starts building Level 3 processes before the audit, rather than during remediation, avoids the whole conversation.

The AL Hierarchy: Why AL 3 Covers AL 2 and AL 1

TISAX’s three Assessment Levels aren’t three separate certifications you collect one at a time. They’re nested inside each other.

Pass AL 3, and you’ve automatically satisfied the requirements of AL 2 and AL 1 too. You don’t need to run a separate, lighter assessment afterward to “also” have an AL 2 result on file. The logic is straightforward: if you passed the most rigorous on-site audit TISAX defines, you’ve clearly cleared the bar a remote plausibility check or a self-assessment would have set.

This matters most for suppliers working with multiple OEMs at different sensitivity requirements. If one customer needs AL 2 and another needs AL 3, you don’t run two separate engagements. One AL 3 assessment covers both, and the resulting label can be shared with each partner through the TISAX exchange platform.

See Where You Stand

Not sure if you’re actually looking at an AL 2 or AL 3 audit? Answer a few plain-English questions about how mature your current security processes really are, and see where you’d land on the VDA ISA maturity scale today, chapter by chapter.

Take the free 2-minute TISAX Readiness Check

Related Guides

• What Is TISAX? The VDA ISA Standard Explained for Automotive Suppliers
• The TISAX Certification Process: Step by Step
• VDA ISA Checklist: How to Self-Assess Before Your TISAX Audit

Frequently Asked Questions

Getting Your Processes Ready for the Audit

TISAX itself has to be assessed by an ENX-accredited third-party auditor. LeadingIT doesn’t perform that audit, issue TISAX labels, or determine your official Assessment Level.

What LeadingIT does is help Chicagoland automotive suppliers build the access control, patching, monitoring, and backup processes the VDA ISA actually scores, before an AL 2 or AL 3 auditor ever shows up. See our IT compliance readiness services, book a call to talk through where your processes stand today, or contact us with questions.

Want our cybersecurity insights first? Add LeadingIT as a preferred source on Google and see more of our guidance in your results.