In the automotive industry, TISAX is the entry ticket. Anyone working with prototype data, design documents or vehicle software has to prove that information is protected. Generative AI raises new questions: where does the data go? Who can see it? Does the model learn from it?
The three core questions
1. Which data goes into which model? Not all information needs the same protection. Proper data classification decides whether a cloud model is enough or whether you need a solution in your own infrastructure.
2. Where is it processed and stored? Data centre location, retention of prompts and responses, use for training - these points need to be settled contractually and technically.
3. Who has access? Access rights to AI tools should follow the same rules as access rights to the data processed in them.
Checklist for adoption
- Add AI tools to the ISMS asset inventory
- Define which data classes are allowed per tool
- Assess vendors, including training and retention terms
- Enable logging of usage and access
- Train employees - concretely, with examples from their own work
- Handle exceptions and incidents through the existing process
Our view
We work within SII Group’s TISAX assessed processes and build for clients with high protection needs. Our experience: GenAI and TISAX are not mutually exclusive. They simply require treating AI like any other IT system - with classification, control and accountability.
