On 1 July 2026 the VDA published ISA2027, the next generation of the Information Security Assessment catalogue that underpins TISAX. Most commentary has focused on which controls changed. We think the more consequential change is the calendar.
Our thesis is simple: with ISA2027, TISAX stops behaving like a periodic project and starts behaving like an annual regulatory cycle. Organisations that treat it as a one-off hurdle every three years will find themselves permanently one catalogue behind.
What has actually changed
The familiar version numbers (ISA 6.0, 6.0.3) have been replaced by a year-based name. ISA2027 takes effect for assessments commissioned from 1 January 2027, and a new edition is expected to be published each July for the following January, which means ISA2028 should appear in mid-2027.
According to assessment providers, the content is an evolution rather than a revolution:
• The information security module contains revised controls, with a number of requirements moving from “should” to “must”.
• The definition of IT service providers in scope has been broadened.
• Prototype protection has been simplified into two hierarchical levels: Basic and Facilities.
On transition, existing labels keep their validity of up to three years. The date on which an assessment is commissioned decides which catalogue applies. Assessments contracted before 1 January 2027 may still run against ISA 6, and sources point to an outer limit in early 2027 for opening initial assessments under the old catalogue. The exact dates should always be confirmed with ENX and your assessment provider.
Why the cadence matters more than the content
A TISAX label lasts up to three years. If the catalogue changes every year, a label holder will live through up to three editions during one label cycle. Each edition may move a requirement from recommendation to obligation, or widen a scope definition.
That has three consequences for decision-makers:
• Target drift. Being ready on the day of the assessment is no longer a stable position. What was sufficient at the last assessment may be below the bar at the next.
• Customer expectations move first. OEMs and Tier 1 customers tend to request the latest catalogue in their sourcing processes before the market has absorbed it.
• Ownership becomes structural. A yearly cycle cannot be carried by a project team that disbands after the assessment. It needs a named owner and a place in management review.
A global supply chain, not only a German one
TISAX originated in the German automotive industry, but its reach follows the supply chain. Tier 2 and Tier 3 suppliers in Brazil, Mexico and Argentina increasingly receive TISAX requests passed down through purchasing, often with a short lead time and a catalogue version they have not yet studied.
The broadened IT service provider definition deserves particular attention in these markets, where shared service centres, outsourced IT operations and cloud-hosted engineering data are common. Who is in scope, and who is accountable for them, is a governance question before it is a technical one.
What this means for your organisation
We do not suggest a checklist of actions here. We suggest the questions a Quality Director, CISO or Plant Manager should be able to answer today:
• Which catalogue edition will govern our next assessment, and who in the organisation can say so with certainty?
• When does our current label expire, and how does that date sit against the July publication cycle?
• Is information security managed as part of our management system, or as a project that appears before an assessment?
• Which IT service providers handle customer or prototype data, and does our scope definition reflect the broader wording?
• Which prototype protection level do our customers actually expect from us?
• Do we receive early signals of customer requirements, or do we learn about them at the point of a request?
These are questions of risk and ownership. How an organisation answers them in practice depends on its products, customers and existing systems.
Conclusion
ISA2027 is a measured update with a significant structural message: information security assurance in automotive is becoming a continuous discipline with a predictable annual tempo. Organisations that plan around the calendar will treat each July as a planning input rather than a surprise.
Ariol Automotive provides consulting and audit support to OEMs and suppliers on TISAX, ISO/SAE 21434, IATF 16949 and related requirements. Learn more about our TISAX services or read our overview of automotive cybersecurity compliance.
