Automotive standards — the compliance checklist for OEMs and suppliers

Few industries have as many rulebooks as the automotive industry. A vehicle needs type approval, its electronics have to be functionally safe and protected against attack, its software has to come out of traceable processes and its parts have to be made to consistent quality. There is a standard for each of these requirements — and vehicle manufacturers (OEMs) pass most of them on to their suppliers.

Nobody needs all of them. Which automotive standards concern a company depends on what it supplies: series parts, control units, software, engineering services, or services for which it handles a manufacturer’s confidential data. This article sorts the main standards by subject and ends with a checklist for working out your own.

Law, contract, state of the art — why automotive standards apply

The industry’s standards apply for three different reasons, and the difference decides what happens when one is missing:

• Law and type approval. UN Regulations R155 and R156 are a condition of type approval; the GDPR applies to any processing of personal data. Without them a vehicle cannot be registered, or the law is broken.
• Contract. TISAX, Automotive SPICE, IATF 16949 or a manufacturer’s group requirements such as KGAS are not laws. They are agreed in supply contracts and specifications — and without them there is no order.
• State of the art. No law prescribes ISO 26262 or ISO/SAE 21434 directly. But they describe what counts as diligent engineering — in type approval, in contracts and in a liability case.

Automotive standards at a glance

Information security: TISAX and ISO 27001

TISAX

TISAX (Trusted Information Security Assessment Exchange) is the automotive industry’s assessment and exchange mechanism for information security. It was introduced by the German Association of the Automotive Industry (VDA) and has been run by the ENX Association since 2017. It rests on the VDA ISA (Information Security Assessment) catalogue, with parts on information security, prototype protection and data protection.

TISAX concerns every company that handles a manufacturer’s confidential information — design data, prototypes, test vehicles — whatever its tier in the supply chain. An approved audit provider carries out the assessment, at assessment level 2 or 3 depending on the protection need. The result is a TISAX label, valid for three years and shared with partners through the ENX platform. It is not a certificate, even though the industry often calls it one. Assessments ordered from 2027 onwards use the new ISA 2027 catalogue.

ISO/IEC 27001

ISO/IEC 27001 is not an automotive standard but the international standard for information security management systems (ISMS). VDA ISA follows it in many questions: a company that runs an ISMS under ISO 27001 has done much of the work for TISAX — it does not replace the assessment. Outside the automotive industry, customers ask for the ISO certificate rather than the label.

Vehicle cybersecurity: UN R155, UN R156 and ISO/SAE 21434

TISAX protects a company’s information. Vehicle cybersecurity is about the product itself: the control units, interfaces and radio links through which a vehicle can be attacked.

UN R155 and UN R156

The two UNECE regulations were adopted in 2020. R155 requires the vehicle manufacturer to have a cybersecurity management system (CSMS), R156 a software update management system (SUMS). In the EU they have been mandatory for new vehicle types since July 2022 and for all newly registered vehicles since July 2024. They are addressed to the manufacturer — but its CSMS has to cover the supply chain, so the requirements reach suppliers as contract clauses.

ISO/SAE 21434

ISO/SAE 21434:2021, published jointly by ISO and SAE International, describes cybersecurity engineering across the whole life cycle of a vehicle: from concept and development through production and operation to decommissioning. At its core is threat analysis and risk assessment (TARA). An informative annex introduces cybersecurity assurance levels (CAL), which set how rigorously an item is secured.

The standard is the usual means of meeting the requirements of R155, and it is designed to work alongside ISO 26262. A second edition is in preparation; the 2021 edition is the one in force.

Functional safety: ISO 26262

ISO 26262 governs the functional safety of road vehicles with electrical and electronic systems: a fault in hardware or software must not lead to an unreasonable risk. The current 2018 edition has twelve parts and covers the life cycle from concept through development and production to decommissioning. Hazard analysis and risk assessment give each safety goal an ASIL (Automotive Safety Integrity Level) from A to D. The higher the ASIL, the stricter the requirements on methods, verification and the independence of confirmation.

Part 6 deals with software: requirements, architecture, unit design, verification and testing. For suppliers of control units and vehicle software it is usually the part the work turns on.

Two additions are gaining weight: ISO 21448 (SOTIF) for hazards that arise without a fault — when a sensor misjudges a situation, for example — and ISO/PAS 8800:2024 for safety-related systems that use artificial intelligence. A third edition of ISO 26262 is in preparation.

Development processes: Automotive SPICE and KGAS

Automotive SPICE

Automotive SPICE (Software Process Improvement and Capability dEtermination) is the industry’s process assessment model, published by VDA QMC. It assesses not the product but the processes that produce it: requirements, architecture, implementation, integration and testing, plus project, configuration and quality management. The first version appeared in 2005, based on ISO/IEC 15504. The current version 4.0 of 2023 rests on ISO/IEC 33020 and covers hardware and machine learning as well as system and software engineering.

Each assessed process receives a capability level from 0 (incomplete) to 5 (innovating). Manufacturers often require level 2 of their suppliers, and level 3 for some processes. Assessments are carried out by assessors certified under the intacs scheme.

KGAS

KGAS (Konzerngrundanforderungen Software, the group’s basic software requirements) are the Volkswagen Group’s requirements for software that affects vehicle functions. They add group-specific rules on processes, work products and metrics to Automotive SPICE and also take up functional safety and cybersecurity. They are binding on suppliers that develop control units or vehicle software for the group. Other manufacturers set comparable requirements of their own; they are found in their specifications.

Quality management: IATF 16949 and ISO 9001

IATF 16949

IATF 16949:2016 is the International Automotive Task Force’s standard for quality management systems in the automotive industry. It replaced ISO/TS 16949 in 2016 and is not a stand-alone standard: it adds the industry’s requirements to ISO 9001 — the core tools APQP, PPAP, FMEA, MSA and SPC, requirements on product safety and the manufacturers’ customer-specific requirements. It applies to sites where production or service parts are made, and only bodies recognised by the IATF may certify to it.

ISO 9001

ISO 9001 is the basis of every quality management system, and so of IATF 16949 too. For engineering service providers and software houses without series production it is often the proof customers ask for. The sixth edition, ISO 9001:2026, was published in September 2026; certificates to the 2015 edition must have transitioned by 30 September 2029. When IATF 16949 follows the new edition is for the IATF to decide — ask your certification body.

Environment and occupational safety: ISO 14001 and ISO 45001

Manufacturers increasingly ask their suppliers for evidence on the environment and working conditions, in supplier requirements and sustainability ratings. ISO 14001 is the standard for environmental management systems; its new edition, ISO 14001:2026, was published in April 2026, with a transition period of 36 months. ISO 45001 describes occupational health and safety management systems; its 2018 edition is currently under revision.

Data protection: the GDPR in the connected vehicle

A connected vehicle generates personal data: location, driving behaviour, contacts from the paired phone. The GDPR is not an automotive standard, but it applies to every manufacturer, supplier and service provider that processes such data — just as it does to the data of employees, customers and partners. The European Data Protection Board has published guidelines on connected vehicles (Guidelines 01/2020). In TISAX, data protection is a part of the catalogue of its own.

The checklist: which automotive standards concern you?

Go through the questions. Each yes names a standard you should look into:

• Do you handle a manufacturer’s confidential information — design data, specifications, prototypes, test vehicles? TISAX, with prototype protection as soon as prototypes are involved.
• Do you process personal data on behalf of a manufacturer? The GDPR and the data protection part of TISAX.
• Do you develop control units, software or systems for vehicles? Automotive SPICE; for the Volkswagen Group, KGAS as well.
• Does your product have safety-related functions — braking, steering, powertrain, driver assistance? ISO 26262, and for sensors and automated driving ISO 21448 as well.
• Does your product have external interfaces — radio, diagnostics, over-the-air updates, a backend? ISO/SAE 21434 and the requirements your customer derives from UN R155 and R156.
• Are you a vehicle manufacturer, or do you apply for type approvals? UN R155 and UN R156, with CSMS and SUMS.
• Do you make production or service parts for vehicles? IATF 16949, built on ISO 9001.
• Do you supply engineering, software or services without series production? ISO 9001, often ISO/IEC 27001 as well.
• Do your customers ask for environmental data and sustainability? ISO 14001.
• Does your customer require something missing here? Read their customer-specific requirements (CSR) and the specification: they add to the standards and are often stricter.

Several yeses are the rule, not the exception: an engineering service provider for control units may need TISAX, Automotive SPICE, ISO 26262, ISO/SAE 21434 and ISO 9001 at the same time.

Where the standards overlap

The standards have different publishers and different assessors, but ask for many of the same things:

• An inventory. Sites, processes, systems, components and suppliers — TISAX and ISO 27001 ask about information assets, ISO/SAE 21434 and ISO 26262 about the items of the vehicle.
• Risk management. Risk assessment in the ISMS, TARA in ISO/SAE 21434, hazard analysis and risk assessment in ISO 26262, risks and opportunities in ISO 9001 and IATF 16949 — with different methods, often on the same objects.
• Measures with owners and deadlines. Every standard requires gaps to be closed and effectiveness to be checked.
• Supplier management. What a manufacturer requires of you, you often have to pass on to your own suppliers.
• Evidence. Documents, records and assessments that show an auditor or assessor that what is written down is what is done.

Keeping each standard in a spreadsheet of its own means maintaining the same assets, risks and evidence several times over — and by the second audit at the latest the spreadsheets no longer agree.

Automotive standards with Complaica

Complaica is compliance software in which several frameworks work on one set of data. For the automotive industry that means:

• TISAX and VDA ISA. Self-assessment per control question with maturity and target maturity level, assessment scope per site, prototype protection requests and the action plan.
• ISO/IEC 27001. The requirements and the 93 controls of Annex A; SoA and risk treatment plan as reports.
• Automotive SPICE. Process groups, capability levels and work products along development.
• ISO/SAE 21434. Threat analysis and cybersecurity evidence across the product life cycle.
• ISO 9001. Process map, quality objectives and audit programme.
• GDPR. Processing activities, legal bases and retention periods, from which the records and DPIA are generated.
• One set of data. Assets, risks, measures and evidence are maintained once and used by every framework; every status change with author and date.
• AI integration (MCP). For questions on requirements and controls. Assessment and decision stay with you.

Get to know Complaica as TISAX software

Add to that consulting from the industry’s practice — on Automotive SPICE, KGAS, TISAX, ISO/SAE 21434 and ISO 26262 — as far as you need it: gap analysis, building the management systems, preparing for assessment and audit. Labels, certificates and assessment results are issued by independent audit providers and certification bodies.

Would you like to know which standards apply to your company and where you stand? Request the free 20-minute checkup.

How to stay up to date

The industry’s standards change faster than their three-year cycles suggest: ISO 9001 and ISO 14001 appeared in new editions in 2026, ISA 2027 replaces VDA ISA 6, and work is under way on ISO 26262 and ISO/SAE 21434. Standards for road vehicles are developed in the technical committee ISO/TC 22; VDA QMC, ENX, the IATF and UNECE publish changes to their rulebooks on their own sites. Before every audit and with every new order, check which edition your customer and your assessor expect.

Conclusion

Automotive standards are not a list to be worked through in full but a selection that follows from your product, your customer and your role in the supply chain. Use the checklist to work out which standards apply to you, check in the specification which edition and which level are required — and keep what the standards have in common in one place.