What is the primary objective of CE Marking?

The primary objective of CE Marking is to indicate the manufacturer's declaration that a product meets applicable EU harmonised legislation essential requirements for health, safety, and environmental protection, enabling free movement across the EEA. It applies only to products covered by specific directives like Low Voltage Directive 2014/35/EU (50–1000 V AC, 75–1500 V DC) or Radio Equipment Directive 2014/53/EU, providing presumption of conformity via OJEU-published harmonised standards.

Who is legally or professionally required to comply with CE Marking?

Manufacturers, importers, distributors, and authorised representatives are legally required to ensure CE Marking compliance for products placed on the EEA market. The manufacturer bears primary responsibility for conformity assessment, technical documentation, EU Declaration of Conformity (DoC), and affixing the mark; non-EU manufacturers must appoint an EU authorised representative or importer as contact point under Regulation (EU) 2019/1020.

Does CE Marking require an external audit or third-party certification?

CE Marking does not universally require external audit or third-party certification; it depends on product risk and applicable legislation, with many allowing manufacturer self-assessment via Module A (internal production control). Higher-risk products under directives like Pressure Equipment Directive 2014/68/EU mandate Notified Body involvement (e.g., Modules B–H); voluntary certificates from non-notified bodies hold no legal value for compliance proof.

How often should an assessment for CE Marking be performed?

CE Marking conformity assessment is performed prior to placing the product on the market and must be updated for significant changes, with technical documentation retained for at least 10 years. Ongoing post-market surveillance under Regulation (EU) 2019/1020 requires monitoring production conformity, field performance, and regulatory updates like OJEU harmonised standards amendments (e.g., Implementing Decision (EU) 2023/2723).

What are the consequences of non-compliance with CE Marking?

Non-compliance with CE Marking results in market withdrawal, sales bans, product recalls, fines, and customs seizures by national authorities. Regulation (EU) 2019/1020 empowers surveillance to demand technical files; unauthorised marking on out-of-scope products is prohibited, exposing manufacturers to liability, reputational damage, and enforcement via Safety Gate notifications.

Can CE Marking be mapped to other international frameworks?

CE Marking cannot be directly mapped as a certification to other international frameworks; it is a specific EU/EEA self-declaration tied to harmonised legislation, though harmonised standards may align with global equivalents like IEC norms. Compliance evidence (e.g., risk assessments, tests) supports mutual recognition but requires separate verification for non-EU schemes.

What is the first step to begin implementing CE Marking?

The first step to implement CE Marking is to identify all applicable harmonised EU legislation and confirm product scope via resources like Your Europe portal. Map essential requirements, determine conformity modules (self vs. Notified Body), and compile a legislation matrix before design or testing.

What is the primary objective of TISAX?

TISAX's primary objective is to standardize information security assessments and enable secure exchange of results across the automotive supply chain. Developed by the ENX Association using the VDA ISA catalog version 6.0 (and subsequent updates), it verifies protection of sensitive data like IP, prototypes, and personal information against cyber threats via CIA triad controls at three maturity levels: Basic, Significant, and Very High.

Who is legally or professionally required to comply with TISAX?

TISAX is a contractual requirement mandated by OEMs like Volkswagen and BMW for automotive ecosystem participants handling sensitive data. This includes Tier 1/Tier 2 suppliers, service providers (logistics, IT/cloud), and engineering firms processing OEM IP, prototypes, or ADAS software; scalable for SMEs to multinationals, with over 2,000 ENX portal participants as of 2026.

Does TISAX require an external audit or third-party certification?

Yes, TISAX requires assessments by ENX-accredited providers like DQS or TÜV for Significant and Very High levels, issuing labels valid for three years. AL1 is self-assessment only (no label); AL2 involves remote plausibility checks; AL3 mandates on-site audits with interviews, facility inspections, and evidence review per VDA ISA's 70+ controls across seven groups.

How often should an assessment for TISAX be performed?

TISAX assessments must be fully reperformed every three years to renew labels, with no mandatory surveillance audits. Continuous internal monitoring, quarterly reviews, and annual tabletop exercises sustain maturity; reassess scopes upon significant changes like new OEM contracts or VDA ISA updates.

What are the consequences of non-compliance with TISAX?

Non-compliance with TISAX results in contractual termination, lost OEM portal access, and revenue forfeiture up to €10-50M annually for mid-tier suppliers. ENX-partnered OEMs impose penalties to 5% of contract value, plus €20K-€100K re-audit costs, reputational damage, and supply chain disruptions from halted data sharing.

Can TISAX be mapped to other international frameworks?

Yes, TISAX maps extensively to ISO 27001/27002, with VDA ISA derived from its ISMS and Annex A controls. Automotive-specific extensions (e.g., prototype protection) enable 70-90% overlap, allowing co-audits, evidence reuse, and 20-30% efficiency gains; ENX confirms high coverage of NIS2 requirements.

What is the first step to begin implementing TISAX?

The first step is registering on the free ENX portal (enx.com) and defining the Assessment Scope and Leadership Profile (ASLP). Collaborate with OEMs to classify protection needs (Normal/High/Very High), download VDA ISA Excel for gap analysis across policy, access, operations, and conduct initial self-assessment.

Standards Comparison

CE Marking vs TISAX

CE Marking

Mandatory

1985

EU marking for product conformity to harmonised requirements

TISAX

Mandatory

2017

Automotive standard for information security assessment exchange

Quick Verdict

CE Marking declares product conformity for EEA market access, mandatory for regulated goods via self/third-party assessment. TISAX verifies automotive info security via tiered audits, demanded by OEMs for supplier trust. Both enable compliance and partnerships but target safety vs cybersecurity.

Product Safety

CE Marking

Conformité Européenne (CE) Marking

Cost

€€€€

Complexity

High

Implementation Time

6-12 months

Key Features

Manufacturer's declaration of conformity to EU essential requirements
Enables free movement across EEA single market
OJEU harmonised standards provide presumption of conformity
Risk-proportionate conformity assessment modules A-H
Requires technical file and DoC retention

Cybersecurity

TISAX

Trusted Information Security Assessment Exchange (TISAX)

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Standardized assessments shared via ENX portal
Automotive-specific prototype protection controls
Three risk-based assessment levels (AL1-AL3)
VDA ISA catalog with 70+ tailored controls
Reduces duplicate audits across OEMs

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

CE Marking Details

What It Is

CE Marking (Conformité Européenne) is the EU's mandatory conformity marking for products under harmonised legislation like the New Legislative Framework (NLF). It signifies the manufacturer's declaration that products meet essential health, safety, and environmental requirements. The risk-based approach scales scrutiny via conformity modules (A-H), from self-assessment to Notified Body verification.

Key Components

Essential requirements from directives (e.g., LVD, Machinery, RED).
Harmonised standards published in OJEU for presumption of conformity.
Technical documentation, EU Declaration of Conformity (DoC), and CE affixation.
Post-market surveillance under Regulation (EU) 2019/1020. Self-declaration for low-risk; third-party for high-risk.

Why Organizations Use It

Mandated for EEA market access, it prevents legal penalties, customs holds, and recalls. Provides single-market scale, risk management, and competitive trust. Builds stakeholder confidence through auditable compliance.

Implementation Overview

Map applicable directives, conduct risk assessments, compile technical files, issue DoC, affix CE mark. Applies to manufacturers/importers in electronics, machinery, medical devices. Varies by risk; Notified Body audits for high-risk. Typical for mid-sized firms across EU/EEA.

TISAX Details

What It Is

TISAX (Trusted Information Security Assessment Exchange) is an industry framework developed by the ENX Association and VDA for standardizing information security assessments in the automotive supply chain. Its primary purpose is to verify protection of sensitive data like IP, prototypes, and personal information against cyber threats. It uses a risk-based approach with VDA ISA catalog controls, building on ISO 27001.

Key Components

7 control groups (e.g., Policy, Access Control, Operations) with 70+ items.
Three assessment levels: Basic (self), Significant (remote), Very High (on-site).
Modules for information security, prototype protection, data protection.
3-year labels shared via ENX portal.

Why Organizations Use It

Contractual mandates from OEMs like BMW, Volkswagen.
Risk mitigation, efficiency (reduces duplicate audits 70-90%).
Market access, revenue growth, trust in €2.5T supply chain.

Implementation Overview

Phased: preparation/gap analysis (1-3 months), remediation/tabletops (3-9 months), audit/certification (2-4 months). Targets automotive suppliers/OEMs globally; scalable for SMEs to enterprises via self-assessments or audits.

Key Differences

Aspect	CE Marking	TISAX
Scope	Product health/safety/environmental conformity	Information security in automotive supply chain
Industry	All manufacturing sectors EEA-wide	Automotive suppliers and partners primarily Europe
Nature	Mandatory product conformity declaration	Voluntary industry security assessment exchange
Testing	Self/third-party conformity assessment modules	AL1 self/AL2 remote/AL3 on-site audits
Penalties	Market withdrawal fines recalls by authorities	Contract loss OEM exclusion no legal fines

Scope

CE Marking

Product health/safety/environmental conformity

TISAX

Information security in automotive supply chain

Industry

CE Marking

All manufacturing sectors EEA-wide

TISAX

Automotive suppliers and partners primarily Europe

Nature

CE Marking

Mandatory product conformity declaration

TISAX

Voluntary industry security assessment exchange

Testing

CE Marking

Self/third-party conformity assessment modules

TISAX

AL1 self/AL2 remote/AL3 on-site audits

Penalties

CE Marking

Market withdrawal fines recalls by authorities

TISAX

Contract loss OEM exclusion no legal fines

Frequently Asked Questions

Common questions about CE Marking and TISAX

CE Marking FAQ

TISAX FAQ

You Might also be Interested in These Articles...

NIST CSF 2.0: Key Enhancements and How They Address Evolving Cyber Threats

Explore NIST CSF 2.0 updates: Govern function, supply chain security, SME playbooks for ransomware & AI threats. Boost your cyber defenses now!

HITRUST CSF MyCSF Platform Deep Dive: Automating Evidence Collection for Continuous R2 Renewal in Multi-Regulated Environments 2025

Unpack MyCSF's AI features for HITRUST CSF: automate evidence tagging, maturity scoring & monitoring for R2 renewals amid 2025 regs. CISOs in healthcare/fintech

CIS Controls v8.1 IG1 Ransomware-Resilience Sprint: A 30-60-90 Day Action Plan (With Evidence Checklist)

Tactical CIS Controls v8.1 IG1 playbook for ransomware resilience. 30-60-90 day sprint with tool-agnostic tasks, ownership & evidence checklists to prove progre

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how CE Marking and TISAX compare against other standards

Other CE Marking Comparisons

Other TISAX Comparisons

What It Is

Key Components

Essential requirements from directives (e.g., LVD, Machinery, RED).

Harmonised standards published in OJEU for presumption of conformity.

Technical documentation, EU Declaration of Conformity (DoC), and CE affixation.

Post-market surveillance under Regulation (EU) 2019/1020. Self-declaration for low-risk; third-party for high-risk.

What It Is

Aspect

CE Marking

TISAX

Scope

Product health/safety/environmental conformity

Information security in automotive supply chain

Industry

All manufacturing sectors EEA-wide

Automotive suppliers and partners primarily Europe

Nature

Mandatory product conformity declaration

Voluntary industry security assessment exchange

Testing

Self/third-party conformity assessment modules

AL1 self/AL2 remote/AL3 on-site audits

Penalties

Market withdrawal fines recalls by authorities

Contract loss OEM exclusion no legal fines