PACCAR mandates AL3. Stellantis supplier recertification deadline is September 30, 2026. VW, BMW, Audi, and Mercedes increasingly require a valid TISAX label before doing business. We scope it against the exact VDA ISA catalog your OEMs invoke.
PACCAR — TISAX AL3 for suppliers whose operations affect production continuity
Stellantis — supplier TISAX recertification by September 30, 2026
VW Group, BMW, Audi, Porsche, Mercedes — valid TISAX label increasingly a precondition of business
A label only means something once it’s visible to your OEM in the ENX portal — or it means nothing. And the timeline is unforgiving: gap assessment + remediation + evidence + assessor calendar ≈ 8–12 months. If your OEM’s audit window is coming, talk now.
Why Ambit Security
TISAX-proven. We’ve achieved TISAX compliance ourselves. We know AL2 vs AL3 cold — because we’ve cleared the bar, not just read about it.
AL2 vs AL3, scoped correctly. Under-scope = fail. Over-scope = waste. We map your exact OEM obligations first, then build the plan.
ENX-visible proof. We own the work that gets your label in front of your OEM — ISMS, VDA ISA controls, evidence, assessor coordination.
Assessor-independent. We prepare; your chosen assessor grades. The preparer and the grader stay separate.
The engagement
Obligation mapping — which OEM, which level (AL2/AL3), which VDA ISA catalog sections apply to you.
Readiness assessment — current state vs. requirement, prioritized gaps, effort and timeline. Fixed scope.
Assessor coordination — we run the prep and coordinate with your chosen assessor through to the label.
The TISAX readiness assessment
Your exact OEM obligations (level + catalog sections)
Current state vs. VDA ISA requirements
Prioritized gap list with effort estimates
A label roadmap against your OEM’s deadline
Fixed price, 2–4 weeks
Questions suppliers ask
Do I need AL2 or AL3? That’s set by your OEM — PACCAR wants AL3 for production-affecting suppliers; many others accept AL2. We map your specific obligations before scoping a single control.
What if several OEMs require different levels? We scope once to the highest applicable requirement and structure the ISMS so the lower levels are satisfied by the same evidence.
We did a self-assessment already. Self-reported checklists don’t produce an ENX-visible label. We turn the assessment into a certifiable program an assessor will actually sign off on.
Get started
8–12 month timeline. If your OEM’s audit window is coming, talk now.