NIS2 for Automotive Suppliers: TISAX® and the BSIG Together

Manufacturers of vehicles and vehicle parts are listed in Annex 2 of the BSI Act (BSIG). With at least 50 employees, or turnover and balance sheet each above €10 million, a supplier is an important entity under NIS2. An ISMS for TISAX® supplies much of the evidence that § 30 BSIG requires. The label itself does not prove NIS2 compliance: TISAX® checks neither registration with the BSI, nor reporting deadlines, nor management duties, and only the assessed sites.

When NIS2 applies to an automotive supplier

What counts is the NACE division of your activity, not your customers' industry. Supplying an OEM alone does not bring you into scope.

An injection moulder in division 22 is not in scope through that activity, even if all its customers build cars. A supplier of wiring harnesses or control units can fall under division 26, 27 or 29. In Germany, NACE corresponds to the WZ 2008 classification; if yours is unclear, have it checked.

• Annex 2 means "important" at most. Even a supplier with 3,000 employees is an important entity, unless it also carries out an Annex 1 activity or operates a critical facility.
• Groups. Figures of partner and linked enterprises count unless the company is independent of them (§ 28(4)). A plant with 40 employees can therefore be in scope as part of a larger group.
• IT services for customers. Running IT systems for customers can make you a managed services provider (Annex 1 no. 6.1.10). Annex 1 activities can lead to "essential" status.

Check your own case with the NIS2 scope check. Counting rules are explained in does NIS2 apply to your company.

What your TISAX® ISMS already supplies

VDA® ISA and § 30 BSIG share the same core: risk-based security with documented measures. Start with the current self-assessment, its records and open findings. The table shows where the evidence usually sits in the ISA and what you should check in addition for NIS2.

As with ISO® 27001, the BSIG names multi-factor authentication and secured emergency communication more explicitly than the catalogue. Prototype protection and data protection have no direct counterpart in § 30. The ISA 2027 tightens supplier requirements and adds crisis management, which brings it closer to § 30. Review all ten areas, not just these examples: the ten NIS2 measures under § 30 BSIG.

What TISAX® does not check

• Scope. A TISAX® assessment covers the assessed sites. NIS2 applies to the whole entity. A label is valid for three years; the NIS2 duties apply continuously.
• Registration (§ 33). No later than three months after you first or once again count as an entity, through the BSI portal. Changes within two weeks. Missing registration can be fined up to €500,000 (§ 65).
• Reporting to the BSI (§ 32). Early warning within 24 hours and notification within 72 hours of becoming aware of a significant incident, final report no later than one month after the notification. If the incident is still ongoing, a progress report is due instead. See NIS2 incident reporting.
• Management (§ 38). Management must implement the measures, oversee them and attend training regularly. See NIS2 management training.

Example: one record, two uses

A vehicle-parts manufacturer (NACE 29) with 180 employees has one assessed plant and a separate logistics site. It is an important entity. The ISB reuses the existing recovery plan, adds the logistics systems and tests whether production restarts when their connection fails. The test record names systems, recovery target, actual result, owner and corrective actions. The same record serves the ISA self-assessment and the § 30 gap review.

The order that works

1. Classify: NACE division, size, group. Document the reasoning.
2. Register with the BSI if you are in scope and have not done so.
3. Extend the incident procedure: "significant under the BSIG?", BSI deadlines, weekend cover.
4. Close the scope gap: sites and functions outside the TISAX® scope need the § 30 measures too.
5. Train management and record attendance.

In Valiido, VDA® ISA and NIS2 run as frameworks in one ISMS with shared records and incident deadlines. You submit registration and reports yourself, and AuditMagic checks against ISO® 27001 and TISAX®, not against NIS2. Already working on TISAX®? Start with Valiido for TISAX®.

Frequently Asked Questions

Can an automotive supplier be an essential entity?

Not through Annex 2 alone. It can become essential if it also carries out an Annex 1 activity, such as running IT for customers as a managed services provider at the thresholds for essential entities, or if it operates a critical facility.

Our OEM asks for NIS2 evidence, but we are not in scope. What now?

Your customer has to secure its supply chain under § 30(2) no. 4 BSIG and passes requirements on by contract. You do not register, but you should be able to show documented measures. Share only the relevant evidence, not your complete ISMS; the BSIG does not require that.