TISAX uses three assessment levels. AL 1 only checks that you completed a self-assessment. AL 2 is a plausibility check with evidence review and an interview. AL 3 is comprehensive verification, including on-site work. A higher level includes the lower ones, and the level follows from the protection need your partner sets.
The three levels
According to the ENX Participant Handbook:
AL 1, self-assessment check. The auditor checks that a self-assessment exists. They do not review content or ask for evidence. Results carry a low trust level and are not used in TISAX itself.
AL 2, plausibility check. The auditor checks that the self-assessment is plausible, across all locations in scope. They review evidence and interview the person in charge of information security, usually by web conference. A variant, AL 2.5, uses a fully remote assessment that verifies the management system without on-site activity. It is formally evaluated as AL 2 and can be upgraded to AL 3 with the on-site portion only.
AL 3, comprehensive verification. The auditor verifies compliance with the applicable requirements, with document and evidence review, planned and unplanned interviews, observation of local conditions and on-site visits. If on-site work is temporarily impossible, a video supported method may be used, recorded as a minor non-conformity with a follow up later.
How the level is chosen
Protection needs map one to one to assessment levels. The handbook table ties objectives to levels, for example high confidentiality to AL 2, strictly confidential to AL 3, high availability to AL 2, very high availability to AL 3, and prototype parts and vehicles to AL 3. If a partner names an objective or level, follow it.
If you choose alone, the handbook recommends objectives that imply AL 3, since effort is not generally higher than AL 2 and it covers future partner requests. It also notes AL 2 is cheaper to assess but usually needs a more thorough self-assessment, so total cost depends on internal effort.
What to do first
- Ask each partner which objectives and level they require.
- Define your assessment scope, meaning locations, processes and protection needs.
- Complete the ISA self-assessment honestly.
- Pick an audit provider and ask them how they run AL 2 and AL 3.
More on the process in our post on TISAX labels and validity.
Quick check
Is AL 1 enough to satisfy a partner?
Per the handbook, AL 1 results are not used in TISAX. A partner may still request them separately.
What is AL 2.5?
A fully remote variant that is formally evaluated as AL 2 and can later be upgraded to AL 3.
Sources
Last reviewed: 19 October 2026.
