Outsight Secures TISAX Certification

Frequently Asked Questions

• What is TISAX and how does it differ from ISO 27001?

  TISAX (Trusted Information Security Assessment Exchange) is an automotive-industry-specific security framework launched in 2017 by the German Association of the Automotive Industry alongside Audi, Daimler, and Volkswagen. It builds on the ISO 27001 standard but adds requirements specific to automotive supply-chain data, such as protection of vehicle design data and prototype information. Where ISO 27001 applies broadly across industries, TISAX certification results are shared within a closed exchange platform accessible only to automotive industry participants, removing the need for each OEM to conduct its own supplier audit. Outsight, which deploys its Motional Digital Twin technology inside BMW and other automotive manufacturing facilities, has obtained TISAX certification, reflecting the information-security standards required to operate within that supply chain.

• Why do automotive OEMs require TISAX from software vendors, not just ISO 27001?

  ISO 27001 is a general-purpose information security baseline. Automotive OEMs handle data categories that fall outside its scope: pre-production vehicle geometry, unreleased powertrain specifications, and prototype test data. TISAX's VDA ISA catalog includes controls tailored to those asset classes. Because major manufacturers co-authored the framework, TISAX certification functions as a mutually recognized proof of compliance within the supply chain, cutting redundant bilateral audits that would otherwise fall on every vendor entering the ecosystem. Outsight, which deploys its SHIFT platform across BMW and Stellantis facilities, holds TISAX certification precisely to meet this supply-chain requirement and operate within those environments under a commonly recognized security standard.

• What are the TISAX assessment levels and how is the right one chosen?

  The TISAX framework defines assessment levels tied to data sensitivity rather than company size. An organization selects its target level based on the classification of information it handles and the expectations of its automotive partners. The VDA ISA catalog structures requirements into three core modules with mandatory and recommended controls. Protection demands escalate at higher levels, which cover "high" and "very high" sensitivity categories such as prototype data. The appropriate level is therefore driven by the contractual context with the OEM or Tier-1 partner, not by a self-determined internal threshold. Outsight, which deploys its SHIFT platform across automotive manufacturers including BMW and Stellantis, recently obtained TISAX certification, confirming that its information security practices meet the requirements set by those partners.

• Does TISAX certification cover GDPR compliance automatically?

  TISAX is not a GDPR compliance framework, but the controls it requires overlap significantly with GDPR's technical and organizational security measures. Implementing TISAX-level data protection, access controls, and risk management processes reduces residual GDPR exposure because the underlying security posture addresses many of the same obligations. Outsight's TISAX certification reflects this alignment: the standard's rigorous requirements around data handling and access governance reinforce the privacy-by-design principles already built into its LiDAR-based platform, which captures shape and motion rather than faces or biometric data. Companies still need separate legal and contractual GDPR mechanisms, including data processing agreements and records of processing activities, but TISAX provides a solid technical foundation that auditors and regulators recognize as meaningful evidence of security maturity.

• How does TISAX differ from SOC 2 for a B2B software vendor?

  SOC 2 is a US-originated audit standard focused on how a software service provider controls and protects customer data across five trust principles: security, availability, processing integrity, confidentiality, and privacy. It is sector-agnostic. TISAX is sector-specific: it is the accepted standard within the European automotive supply chain, and its results are shared through a closed VDA-operated exchange rather than a public audit report. A vendor supplying software to both US enterprise clients and European automotive manufacturers typically needs both, as neither credential substitutes for the other in its respective domain. Outsight, which holds TISAX certification alongside deployments at automotive manufacturers such as BMW, illustrates how a Physical AI software vendor operating across industries must align with the distinct compliance frameworks each sector requires.

• Who carries out a TISAX audit and can a company self-certify?

  TISAX does not allow self-certification. Assessments must be conducted by an accredited external auditor approved by the ENX Association, the body that governs the exchange. TÜV Rheinland, TÜV SÜD, and a handful of other accredited providers are authorized to perform assessments. The auditor evaluates the organization against the VDA ISA catalog requirements at the chosen assessment level, and results are published in the TISAX portal for sharing with automotive partners rather than released as a public certificate. Outsight completed this process through an accredited external auditor to obtain its TISAX certification, a requirement that reflects the information security standards expected by automotive manufacturers such as the BMW facilities where Outsight's SHIFT platform is deployed.

• When was TISAX certification obtained, and why does it matter for the automotive sector?

  Outsight announced in August 2024 that it had successfully obtained TISAX certification. The company presents it as an important step in its commitment to the highest standards of information security. This matters especially in the automotive sector, where data protection is critical and manufacturers share sensitive designs and technology with suppliers. TISAX is often a key requirement for collaborating with major automotive players. It builds on Outsight's earlier achievements with ISO 27001 and SOC 2.

• Who created TISAX, and in which year was the framework launched?

  TISAX, the Trusted Information Security Assessment Exchange, was launched in 2017 by the German Association of the Automotive Industry (VDA) together with Audi, Daimler and Volkswagen. It was created because automakers need assurance that their many supply chain partners protect sensitive information. Auditing each supplier individually is resource demanding and not always possible. TISAX addresses this with a shared assessment framework based on ISO 27001 with automotive-specific requirements.

• What is the VDA ISA catalog and how does it structure TISAX requirements?

  The VDA ISA catalog is the document that outlines the structure of TISAX. It divides requirements into three core modules. Each module contains mandatory (must) and recommended (should) requirements, with additional levels for organizations needing high or very high protection measures. As companies progress from basic to advanced protection, the security demands become more rigorous. Once an organisation has determined which module applies, it selects the target Assessment Level matching its security capacity or its partners' expectations.

• Why is TISAX certification important for a Roadside Automated Driving solution?

  Outsight describes TISAX certification as an essential component of its Roadside Automated Driving (RAD) solution. RAD is a specific segment of the broader Automated Valet Parking (AVP) market. In the automotive industry, manufacturers require assurance that their partners will protect sensitive information such as intellectual designs and breakthrough technology. TISAX, launched by the VDA with Audi, Daimler and Volkswagen, is often a key requirement for collaborating with major automotive players.

• Which auditor and advisory partner were used to prepare for the TISAX assessment?

  Outsight worked closely with TÜV, a trusted external auditor, for its TISAX assessment. It also collaborated with VioletX to prepare for the audit process for the automotive industry. The preparation required Outsight to tailor its compliance levels to the sensitivity of the data it manages. This ensured that every aspect of its security practices aligned with the TISAX framework. Outsight presents TISAX as a key requirement for collaborating with major automotive players.

• What does assessment exchange mean in TISAX, and how does it save suppliers time?

  TISAX stands for Trusted Information Security Assessment Exchange, and it functions as an information security assessment and sharing framework. Outsight says TISAX allows it to share its compliance status securely, saving time and costs on repetitive assessments. The framework was created because individual audits of suppliers are resource demanding and not always possible for automakers. TISAX is based on ISO 27001 with extra security standards suited exclusively to the automotive industry.

• What other security certifications are held alongside TISAX?

  TISAX builds on a series of information security achievements at Outsight. The company also holds ISO 27001 certification, has attained SOC 2 compliance, and has achieved BAST. Outsight presents TISAX as part of this broader commitment to information security. Together, these certifications underscore its dedication to delivering innovative and secure solutions across industries. TISAX adds requirements specific to the automotive industry on top of the ISO 27001 foundation.

• How is TISAX compliance tailored to the sensitivity of the data an organization manages?

  Preparing for TISAX required Outsight to tailor its compliance levels to the sensitivity of the data it manages. This follows the TISAX principle that each organization chooses its assessment parameters, so the scope and maturity assessed vary from company to company. Outsight aligned every aspect of its security practices with the framework. It worked with TÜV as external auditor and with VioletX to prepare for the audit. The result assures partners that Outsight protects their most critical data with integrity and reliability.

• What kinds of sensitive information does TISAX protect in automotive supply chains?

  TISAX is designed to give automakers assurance that partners protect sensitive information, such as intellectual designs and breakthrough technology. The creation of a single car model requires collaboration across a wide supply chain that includes numerous vendors. According to Outsight, TISAX plays a vital role in ensuring the security of sensitive information and personal data in the automotive industry. TISAX compliance also supports meeting broader data protection regulations such as GDPR.

• How does implementing TISAX controls improve security and trust with automotive partners?

  Implementing TISAX controls helps Outsight identify and mitigate risks, offering better protection against potential threats. It also showcases Outsight's commitment to strong information security to partners, suppliers and customers, strengthening trust and reputation. TISAX gives a competitive edge because it is often a key requirement for working with major automotive players. Outsight says it reinforces its position as a trusted partner for current and future clients.