Managed AI

AI Readiness Assessment for Dealerships

Your staff already uses AI. Before it gets connected to your mailboxes, your shared drives or your customer files, find out what it would be able to reach and who answers for it.

Request a Complimentary Assessment →

IT security consultant and dealership general manager reviewing a printed user access list with a highlighter at a desk in a glass-walled office beside the showroom

An AI readiness assessment for dealerships checks which AI tools your staff already uses, what customer data those tools can reach, how your Microsoft 365 permissions are set and whether you have a written AI policy.

Last updated: October 14, 2026

AI tools already in use

Customer data those tools can reach

Microsoft 365 tenant and user rights

Where AI would store customer data

AI policy, training and a plan

One written readiness report

AI is already in your stores. The question is what it can reach.

Cox Automotive’s AI in Auto Retail Tracker, published in August 2026, found that 82% of dealers already use AI, and only 22% of the dealers using it say it has grown sales or revenue so far. The risk lives there. A service advisor pastes repair order notes into a personal chat account, a BDC rep drafts lead replies in another one, and somebody in the office asks for administrator rights so they can try out a new AI tool. Nobody planned any of it. It just showed up.

The assessment is the first step of Managed AI for dealerships, the fifth pillar of what Helion Technologies does next to managed IT, cybersecurity, compliance and Tekion enablement, all run by one team. You request it through the complimentary IT and cybersecurity assessment, which already looks at AI tool usage. We’ve worked only with automotive and heavy truck dealerships since 1997, so we look at AI the way we look at everything else in a store, starting with what it touches and who can switch it off. Then we ask who answers for it.

There’s no pitch. We show you what AI could reach today, in writing, and then you decide.

From the field

What We Find When We Look at Dealership AI

Erik Nachbahr, Helion’s founder and a CISSP, put it plainly in an October 2026 webinar on AI governance for dealerships. “I have visibility into the stores that employ about 35,000 dealership employees,” he said, and what he sees across those stores is a readiness problem far more often than a tool problem. Those are his words, not ours.

The assessment is built to find the gaps on the right. Each quote comes from that talk, with the minute mark beside it so you can hear it in his own voice.

IT engineer checking a printed checklist on a clipboard in front of an open network equipment rack in a dealership back-office closet

Hear it from Erik

The readiness part of the talk starts at 14:27 in the AI governance webinar on YouTube. The full video and transcript are on our AI governance page.

Five gaps we keep finding Erik Nachbahr, October 2026

14:55 A capable system on weak security

“You are bringing in a very capable system into a system that has limited security.” That’s the whole problem. AI doesn’t so much create new holes as find the ones that are already there, much faster than a person could, and it works with whatever access it’s been handed.

AI inherits the holes you already have.

15:04 Everyday users with admin rights

“We’re still seeing a lot of dealership employees that have administrative rights for everyday users.” It happens a lot. A new hire’s account gets copied from someone else’s and the permissions come along for the ride. Connect an AI tool through an account like that and it can read whatever the account can, including mailboxes and shared folders that belong to other people.

AI sees what the user sees.

15:27 No AI security training

“We’re not seeing dealers doing anything with AI security training.” Plenty of stores train people to spot phishing and spam. That’s a start. Very few have told the sales floor that pasting a customer’s credit application into a free chat account hands it to a company the dealership has no contract with.

Phishing training isn’t AI training.

15:43 Systems that aren’t ready for customer data

“We’re seeing systems that aren’t ready to host PII.” One dealership asked for a computer to run an in-house AI build and wanted it set up in an office closet. Erik called it “very 2008.” The customer information sitting in that box would be the same information the FTC Safeguards Rule already expects you to protect.

A box in a closet isn’t a plan.

40:17 No plan at all

“We’re seeing dealers going into AI without a plan at all.” Ask what the goal is and the honest answer is often that everyone else seems to be doing it. Then the tools pile up. Soon there’s a shared login or two, and nobody can say which one is holding customer data.

Start with the goal, then the tool.

The checklist

What the AI Readiness Assessment Reviews

We review six areas. They tend to fail together. Few stores have everything in the right-hand column on day one. That’s normal. What matters is knowing which column you’re in before you connect anything new. For an outside yardstick, NIST’s AI Risk Management Framework starts in the same place, with governance and an inventory of the AI systems in use.

Area	What we look at	Not ready yet	Ready
AI tools in use	Which tools each department runs, who signed up for them and whether the accounts are personal or owned by the dealership	Personal accounts on dealership workstations, or one login shared across the sales floor	Dealership-owned accounts only, from a list of approved tools
Customer data exposure	What customer and employee data people paste, upload or export, including DMS and CRM pulls saved to local PCs	Deal files and customer lists in free chat tools and in spreadsheets on desktops	Customer data stays in systems with a security contract and an audit trail
Microsoft 365 tenant	Sharing settings, guest access, multi-factor authentication and which AI features and connected apps are switched on	AI features and connected apps turned on with nobody checking what they can open	Each connected app approved on purpose, and every sign-in protected by multi-factor authentication
User rights	Who holds administrator rights and how new accounts get set up when someone is hired	Everyday users with admin rights, and new accounts copied from old ones	Each person reaches only what their job needs, reviewed on a schedule
Where data would live	Any plan to host an AI build, store exported data or connect AI to the DMS or CRM	A machine in a closet, or exported data that nobody owns	A private, controlled environment where AI can read the data but can’t take it anywhere
Policy, training and plan	A written AI use policy, staff sign-off, AI-specific security training and a stated goal	No policy, phishing training only and no goal beyond keeping up	A signed policy, AI security training and a goal leadership has agreed on

None of this is new law. The FTC Safeguards Rule already asks every dealership to limit each user’s access to the customer information they need and to give staff security awareness training that keeps up with new risks, and the FTC’s guide for businesses spells out both. AI raises the cost of skipping them. Our continuous compliance program keeps the records that show they’re in place.

Who Runs Your AI Readiness Assessment

2,000+ Automotive and heavy truck dealerships

35,000+ Dealership employees supported daily

98% Client retention rate

1997 Working only with dealerships since

The review is run by the same team that handles managed IT, cybersecurity and FTC Safeguards compliance for those stores, and it’s led by a founder who holds the CISSP. We skip the generic questionnaire. We’ve already met the CRM export sitting on a desktop and the personal chat login shared across a sales floor. We know where to look.

What You Get at the End of the Assessment

The findings come to you in writing, addressed to the people who need to see them, so nothing gets lost in a hallway conversation. Nothing stays verbal. You’ll see which AI tools are in use, by whom and for what, which accounts and settings would let an AI tool reach further than it should, and what a governed program would look like next to the systems you already run.

Some of it is easy. A policy update or a cleanup of admin rights is often quick work for an internal IT person. The rest is a conversation about whether to bring in a governed AI workspace, and that conversation happens after you’ve read the report, never during the visit.

Read it first. Decide later.

Dealer principal and chief financial officer reading a printed bound AI readiness report together at a conference table in a dealership office

A map of AI in use

Every AI tool we find, the department using it, whether the account belongs to the person or to the dealership, and what kind of data goes into it. Multi-store groups usually find more of it than leadership expected.

That part surprises people.

A written readiness report

The gaps in user rights, Microsoft 365 settings, data storage, training and policy, what each gap would let an AI tool reach, and what a governed setup alongside your current systems would look like.

It’s yours to keep.

How the AI Readiness Assessment Runs

1
Request it
Fill in the short form on our assessment page. It’s free. There’s no cost and no obligation, and you don’t need to be shopping for a new provider to ask.
2
We review your stores
An engineer looks at your systems on-site or remotely, whichever suits you. The review is built to fit into a business day, not to tie up a week.
3
Findings arrive in writing
The report covers the AI tools in use, the data they can reach, your Microsoft 365 settings, user rights and policy, and it goes to whoever needs it.
4
You decide what’s next
Fix things in-house, keep looking, or have Helion roll out a governed AI workspace. It’s your call. On the co-managed path your own IT manager stays in charge of it.

Common Questions

Trainer holding a printed page while a service advisor, a BDC representative, a parts employee and an office manager listen around a table in a dealership training room

AI already in the stores

Bring what you know to a complimentary IT and cybersecurity assessment. We’ll show you what it can reach.

What is an AI readiness assessment for a dealership?

It’s a review of how ready your stores are to use AI safely, covering the tools already in use, the customer data they can reach, your Microsoft 365 and user permissions, and your written policy. Helion runs it as part of the complimentary IT and cybersecurity assessment, and you get the findings in writing.

Is the AI readiness assessment free?

Yes. It runs through Helion’s complimentary IT and cybersecurity assessment, which comes with no cost and no obligation. What you do with the findings, whether that’s fixing things in-house, talking to other providers or working with us, is your call to make afterward.

How long does the review take?

That depends on how many rooftops and systems you have. Bigger groups take longer. The review is built to fit into a business day rather than disrupt a week of selling and servicing cars, and it can run on-site or remotely.

Our staff already uses ChatGPT. Should we ban it first?

Not on its own. Banning it without offering something better usually just pushes it out of sight. Erik’s advice in the webinar was to move staff onto a governed company AI platform and adopt a policy that rules out personal accounts and keeps dealership data out of any AI the store doesn’t control. The assessment shows you where you’re starting from, so the policy fits what people actually do.

We only use the AI built into our DMS and CRM. Do we still need this?

Yes, because vendor AI isn’t usually where the trouble starts. A salesperson once called our help desk and asked us to sign their personal ChatGPT account in on every computer on the sales floor, so the whole team could share it. No vendor was involved. That’s the kind of thing the review finds, along with whatever an AI tool could open once it’s connected to Microsoft 365.

What happens after the assessment?

You get the report and some time to sit with it. You can fix the easy items yourselves first, the admin rights and the policy, and call us later about the rest. If you do, Helion’s Managed AI program puts a private workspace under your dealership’s own name, looked after by the team that already handles your IT, security and compliance, with your IT manager still in charge if you have one.

Your people found AI on their own. Let us show you what it can reach before it finds your customer files.