Before an AI BDC for car dealerships works your leads, get three answers in writing: what it can read and change in your CRM and DMS, whose consent covers every text it sends, and who owns the conversations it keeps.
Last updated: October 21, 2026
The AI idea from a dealer that I keep coming back to this year didn’t involve a robot talking to a single customer. Erik Nachbahr, who founded Helion Technologies, told the story during a DealersEdge webinar on AI governance. A customer of ours wanted AI to go through the inbound calls and emails to their BDC on a regular schedule, flag the dropped calls, the missed calls, and the overhandled ones, read the customer sentiment, and report back. That’s it. No chatbot.
“So that would be agentic AI,” Erik said, “where you’ve got an AI basically following a process and doing a workflow and going out and doing things on its own schedule or schedule you set.”
I like that example because it starts with the BDC’s actual problem, which is leads that fall through the cracks, instead of starting with the product. Most of what gets pitched to dealers as an “AI BDC” is the other kind of tool. It answers the internet lead at 10:40 on a Sunday night, texts the customer back, books the appointment, and writes the whole conversation into your CRM. That can work. Sometimes it works well. I’ve watched a lot of lead-handling technology get sold to dealers, first as a salesman on the floor in the late ’90s and then for five years selling CRM to stores, and the question that mattered was never whether the software could send a message. It was what the software was allowed to touch once you turned it on.
That’s still the question. This post is the short list I’d want answered before an AI agent works a single lead at your store, and it’s the same list we use when we look at these tools through our managed AI for dealerships program. It isn’t a vendor ranking. It’s what to ask whichever vendor you’re already talking to.
The software is the easy part. Access is the decision.
What an AI BDC for Car Dealerships Actually Does
An AI BDC is software that does business development center work on its own: it responds to sales and service leads by text, email, or phone, qualifies the customer, books appointments, and logs the conversation in the dealership’s CRM, usually around the clock and without a person on each message.
That’s the version that talks to your customers. The version Erik described talks to nobody. It watches your people. Same label, different job. Both get called AI BDC tools, and both are AI agents, meaning software that takes several steps by itself instead of answering one prompt. They raise different questions, though, so it helps to see them next to each other.
| AI that works the leads | AI that watches the BDC | |
|---|---|---|
| What it does | Answers leads, follows up, books appointments | Reviews calls, emails, and CRM notes, then flags problems |
| Who it talks to | Your customers | Your managers |
| What it needs from the CRM | Read and write on leads, contacts, and appointments | Read access to activity, notes, and call records |
| Biggest legal exposure | Texting consent and what it promises customers | Recordings, and employee monitoring |
| First question to ask | What can it change without a person? | Who sees the report, and what happens next? |
Dealers are clearly buying both. Cox Automotive’s AI in Auto Retail Tracker found that 82% of dealers use AI, and coordinating customer follow-up is tied for the most common use, at 40%. That’s BDC work by another name. The same tracker found accuracy concerns tied with ROI as the top barrier, at 45% each in its May 2026 survey of 483 dealers.
Accuracy is a BDC problem before it’s an AI problem.
Question 1: What Can It Read, and What Can It Change?
Say a lead comes in from your website at 9:15 on a Saturday night. The AI agent texts the customer, learns she’s shopping a used SUV with a trade, books a test drive for Monday at 11, assigns the lead to a salesperson, and updates the CRM. Four writes before anybody at the store wakes up. Nice work, honestly. Every one of them is fine if the agent is set up right, and every one of them is a mess if it isn’t.
So start with the access list, and ask for it on paper. Not “it integrates with your CRM.” That’s a brochure line, and it tells you nothing. Can the agent merge duplicate customer records? Mark a lead lost? Pull a deal jacket out of the DMS?
- Which fields can it read? A lead agent needs the lead source, the vehicle of interest, the customer’s name and contact details, and the appointment calendar. It has no business reading credit applications or F&I menus.
- Which fields can it change? Can it delete anything at all? Ask that one twice.
- Does it sign in with its own account, so the CRM activity log shows the agent’s work separately from your people’s work? If it borrows a manager’s login, you’ll never untangle who did what.
- Can you switch it off in one place, the same afternoon, without calling the vendor?
- When it hands a lead to a person, what does that person see, and how fast?
Whether your CRM is VinSolutions, Elead, DealerSocket, or the one built into your DMS, those answers live in the integration settings, and somebody at your store should read them before go-live. Cox found that 63% of dealers trust AI built into their dealership tools more than standalone AI. Fair enough. I get it. Built-in still has permissions, and the questions above don’t change because the AI came with the CRM.
This isn’t only common sense. There’s a rule behind it. Under the FTC Safeguards Rule, a dealership counts as a financial institution, and the company running your AI agent is a service provider. 16 CFR 314.4 says you pick service providers that can protect customer information, require it in the contract, and check on them from time to time. Our post on least-privilege access for AI tools goes deeper on scoping permissions down.
Give it the access a new BDC rep gets on day one. No more.
Question 2: Whose Consent Covers the Text?
This is the one that keeps dealer attorneys busy, and I’m not one, so take the specifics to yours. I know where the questions are, though. Here they are.
Texts count as calls under the Telephone Consumer Protection Act, and marketing texts sent by an automated system generally need the customer’s prior express written consent. An AI agent that follows up on a lead three times over a week is about as automated as it gets. No gray area there. The Federal Communications Commission’s December 2023 order also applied the National Do-Not-Call Registry protections to texts. NADA’s memo to dealers on that order made a point I’d underline twice: the burden of proving consent sits with the business doing the texting, which is the dealer who received the lead.
That same order tried to require one-to-one consent, so a single checkbox on a lead site couldn’t cover a dozen dealers at once. A federal appeals court struck that part down in January 2025. Some people heard that as “third-party leads are fine again.” Not so fast. Your store still has to prove consent if a customer complains, and a lead provider telling you consent exists isn’t the same as you being able to show it.
Then there’s “stop.” One word. Lots of trouble. The FCC’s rules say an opt-out made by any reasonable means has to be honored, and a broader piece, where one opt-out would also cut off unrelated messages, has been pushed back to January 31, 2027, by an FCC order issued in January 2026. In practice, the question for your AI vendor is boring. It’s also important. When a customer texts “stop” to the AI, does that reach your CRM, your BDC reps’ phones, and your service reminder system, or does it only stop the AI?
I’d ask four things here, plainly:
- Where is the consent record for each lead stored, and can the agent check it before it sends the first text?
- Which lead sources does the vendor treat as consented, and on whose say-so?
- Does an opt-out sync back to the CRM within minutes, not overnight?
- What does the agent say when a customer asks if they’re talking to a person?
The phone side of this, with AI voices and recorded calls, has its own rules, and we covered those in AI phone agents for dealerships. Texting is where a lead agent lives.
Consent is a record, not a feeling.
Question 3: Who Owns the Conversation?
Read a week of real BDC text threads. You’ll find more than appointment times. A payoff amount on the trade. A customer saying her credit isn’t great. A home address for a delivery. A spouse’s cell number. Once an AI agent is having those conversations, the transcripts are customer information, and somebody’s server is holding them.
Whose server? Under what terms? That’s the part people skip. AI vendors want data to improve their models, and that appetite sometimes shows up later as a quiet edit to the terms of service. In February 2024 the FTC warned AI companies that changing their data practices that way, through a retroactive change to terms or a privacy policy, could be unfair or deceptive (Crowell & Moring’s summary walks through it). That warning protects consumers. Your contract is what protects the store.
So before you sign, I’d want these in writing. The conversations, transcripts, and lead data belong to the dealership. They aren’t used to train a model shared with other customers unless you opt in. You can export all of it in a format your CRM can read. If you cancel, it gets deleted on a date you can verify, and the Safeguards Rule’s own disposal requirement, generally no later than two years after the information was last used for that customer, should be in the retention schedule. And you hear about any change to those terms before it takes effect, not after.
Ask one more question. It sounds obvious. Can people at the vendor read your conversations, and who decides when they do?
If the answer is fuzzy, the data isn’t really yours.
The Questions on One Page
Here’s the short version, with what a good answer sounds like and what should make you slow down.
| Ask | A good answer | Slow down if you hear |
|---|---|---|
| What can it read and change in the CRM and DMS? | A written field list, read and write marked separately | “It integrates with everything” |
| Does it have its own login? | Yes, and every action shows in the activity log | “Just give us a manager’s credentials” |
| Where is the consent record for each lead? | Stored per lead, checked before the first text | “The lead provider handles consent” |
| What happens when a customer texts “stop”? | It syncs to the CRM and every texting tool you use | “Our system stops texting them” |
| Who owns the conversations? | The dealership, in the contract, with export and deletion | “We use anonymized data to improve the product” |
| Who at the store owns the agent? | One named person, with a monthly review | Silence in the room |
The Other AI BDC: The One That Watches Your Team
Go back to Erik’s example for a minute, because I think it’s where a lot of stores should start. Later in the same webinar he described it again: “I want to look at the BDC and monitor different things. I’m going to monitor the BDC calls. I’m going to monitor the software where they’re taking notes. And then I’m going to act on that, alert people, create dashboards.” No customer ever talks to that agent. It reads what already happened and tells a manager where the leads are leaking.
We’re building the same kind of agent for ourselves, pointed at our own help desk tickets instead of BDC calls, to spot an unhappy customer early enough to turn things around. It’s a good first agent. Here’s why. It reads, it reports, and a person decides what to do about it.
The questions are different, though. They’re mostly about your own people. Do your BDC reps know their calls and texts are being reviewed by software, and does your employee handbook or dealership AI use policy say so? Who sees the sentiment report, and is it coaching or discipline? Recordings carry their own state consent rules, so check those before an agent starts listening. And because this agent reads almost everything, it needs the tightest access of all: read-only, no export, nothing it can send outside the store.
It also answers a measurement gap. Cox found that about 1 in 3 dealers using AI aren’t formally measuring what it does, or aren’t sure how they would. A monitoring agent is a way to measure the BDC, including any AI working the leads.
Watch the process before you automate it.
Who at the Store Owns the Agent?
Somebody has to. Pick one. The BDC manager knows the lead process. IT knows the permissions. The GM signs the contract. In my experience, when all three think one of the others has it, nobody does. When things aren’t going the way I want them, I ask myself what I’m not doing, and with an AI agent the honest answer is usually that nobody was assigned to watch it after go-live.
Pick one owner, and put a monthly review on the calendar: a sample of conversations read by a person, the opt-out log, the access list, and anything the vendor changed. It’s an hour. That’s all. It’s also how you find the agent that’s been booking test drives on a day the store is closed.
Our guide to AI legal risks for dealerships covers what happens when an AI makes a promise to a customer, and our AI governance post has the full webinar with Erik, if you want the rest of his examples. If the same vendor also runs your website chat, our AI chatbot security checklist covers that side.
What Dealers Ask Before Turning One On
Can an AI BDC replace our BDC reps?
Our CRM vendor built the AI in. Do we still need to ask all this?
The lead site says the customer consented. Isn’t that enough?
What happens to our conversations if we cancel?
Should the AI be allowed to quote prices or payments?
Start With the Leads You Already Have
Before you add an agent, look at how your BDC handles leads today. Which ones wait until Monday, who works the overnight leads, where the consent records live, and what your CRM lets any outside tool change. Those answers decide whether an AI BDC helps you win more appointments or just sends more texts.
At Helion Technologies we work with more than 2,000 dealerships and support 35,000-plus dealership employees, with an 82-second average time to reach a live person at our help desk. We manage the technology so dealers can sell and service cars and heavy trucks, and that includes checking AI tools before they get access to the CRM and DMS. Start with a complimentary IT and cybersecurity assessment, and we’ll go through the access, the consent records, and the data terms with your team before any AI agent works your leads. The leads are yours, and so are the conversations about them.