An AI governance committee at a dealership is a small group of executives, chaired by the dealer principal or CFO, that approves every AI tool and project before it goes live and keeps the list of approved tools.
Last updated: October 29, 2026
Near the end of the DealersEdge webinar on dealership AI this month, an attendee asked a question that Erik Nachbahr, our founder and president, chose not to answer on the spot. How do we wipe out all the personal accounts? He said people had been asking us the same thing lately, and that I’d have some thoughts on it. I do. They just aren’t the answer anyone is hoping for.
You can’t reach into an employee’s personal ChatGPT or Gemini account and pull the dealership’s data back out. If a deal file or a customer’s credit details went into one last spring, it stays there. It’s gone. What you can do is make the personal account unnecessary, and that starts with deciding, at the executive level, who says yes to AI at your store and what they’re saying yes to.
That group is an AI governance committee. Erik put it first on his list of fixes in the webinar (the clip starts at 26:22): “The first one that I want to strongly suggest as a starting point is having an AI governance plan. And that should start with having a board.” Our overview of AI governance for dealerships covers why. This post is the how. Who sits on it, what every request has to answer, the list it keeps, where a person takes over from AI with customers, and the sign-off that goes in your handbook.
I’ve been with Helion for more than 20 years, across support, infrastructure, cybersecurity and compliance, and I hold the CISSP. When Helion asked me what’s coming that most people aren’t watching, my answer was lost productivity and higher IT costs from businesses adopting new technology quickly “without proper planning and thought.” AI is that pattern at full speed.
A committee is the planning and thought.
What an AI Governance Committee Does at a Dealership
An AI governance committee is the dealership’s standing decision group for artificial intelligence. It sets the store’s AI strategy, approves or rejects each AI tool and project, keeps the approved-tools list, decides where a person takes over from AI with customers, and makes sure every employee has signed the AI use policy.
Look at the order. Strategy and approved platforms come first, and only then do staff get a sanctioned way to use AI. Where dealer groups go wrong is skipping the first part, so somebody at the top says we need to be doing AI, an enterprise license gets bought, and dozens of separate projects start up with no defined goal, no connected data and nobody checking how any of it is secured. The spending keeps going. The results don’t.
Cox Automotive’s AI in Auto Retail Tracker, published August 11, 2026 from surveys of 504 franchise and independent dealers in the first quarter and 483 in the second, found that 82% of dealers use AI today. It also found that about 1 in 3 dealers either aren’t measuring what AI does for them or aren’t clear on how they measure it. So most stores already have AI. Far fewer have decided what it’s for.
That’s the committee’s first job.
Who Sits on the Committee
Executives. Erik was specific in the webinar that the governance body “should involve C-level in the dealership,” meaning the dealer principal or a VP, and I agree, because without that authority a committee is a suggestion box. I’d add one seat that a lot of groups forget. Somebody at the table has to understand how the systems actually work: the DMS, Microsoft 365, the CRM, who holds administrator rights and where customer data lives. A room full of executives with nobody who can answer “what can this tool reach?” ends up approving things it can’t evaluate. That achieves very little.
| Store size | Final approver | Other seats | Systems seat |
|---|---|---|---|
| Single rooftop | Dealer principal or CFO | General manager, controller | Your IT manager or managed IT provider |
| Small group, 2 to 5 rooftops | Dealer principal or CFO | One general manager, the controller, the Safeguards Rule Qualified Individual, HR | Group IT lead or managed IT provider |
| Larger dealer group | The executive the owners name, often the CFO | Heads of sales, fixed operations, F&I and HR, the Qualified Individual | IT director and security lead |
At a smaller store, the dealer principal or CFO is the approver. Full stop. A group can spread the seats around, but one person still gives the final yes, and everyone in the building should know who it is.
Keep it small. Five or six people who show up beat twelve who send a delegate.
The Four Questions Every AI Request Has to Answer
Erik described the committees some of our clients already run, and it’s the shortest governance framework I’ve heard: “So every AI initiative runs through them and they discuss what is it? Do we need it? What’s it going to do? How do we secure it? That is super smart.”
It is. Here’s how I’d make those four questions work at a dealership, on a one-page request form the person asking fills out before the meeting.
- What is it? The product, the vendor, the plan, and whether it’s a new tool or an AI feature somebody switched on inside software you already pay for. That second kind slips past people, so the form asks about it by name. Our post on AI vendor risk assessments walks through reviewing those vendors.
- Do we need it? The requester names the one task it replaces and how they’ll know in 90 days whether it worked. No answer, no meeting.
- What it’s going to do is really a question about data, and this is where AI differs from most software you’ve bought. An AI tool sees whatever it’s given access to, so connect it with an administrator account and it can answer questions about every file that account can open, pay plans included, no matter what role-based permissions you set up for people.
- And securing it means four plain answers: who gets access, whether prompts are kept, whether the vendor trains a model on your data, and who shuts it off when an employee leaves.
Why a form and a meeting instead of a quick yes in the hallway? Because of who’s usually asking. Erik again: “people that want to implement are often lackadaisical or cavalier about security, right? Nobody will notice this. It’s not a big deal. I got to get this thing rolled out.” That isn’t a character flaw. They’ve been told to get AI going, and security looks like the thing standing in the way.
The form slows them down on purpose. A little.
Make Shadow AI the First Item on the Agenda
Before the committee approves anything new, it needs to know what’s already in use. Scot McConnor on our team made this point on a recent planning call. Shadow AI, meaning staff on personal AI tools the store doesn’t know about, is the first problem a committee should own, and in his experience plenty of dealers have no idea how much their salespeople are already using AI.
Here’s where I’d push back on the usual instinct. Blocking ChatGPT on the store network feels like control. It isn’t. People have phones, and a salesperson who can draft a follow-up text in 20 seconds on a personal app will keep doing it on the lot. Blocking makes the habit invisible. It doesn’t make it stop. The better move is an approved path that’s as easy as the personal app, so nobody has a reason to go around it.
The risk is real. The FTC’s Office of Technology noted in January 2024 that people “may reveal sensitive or confidential information when using a company’s models, such as internal documents.” At a dealership, that can be a customer’s credit application pasted into a free chatbot to tidy up the formatting.
Switching off model training in a personal account doesn’t fix it either. Scot’s view, and mine, is that it’s one early step out of many. The account still isn’t the dealership’s.
So the first working meeting asks each department head one question. What AI are your people using right now, including the AI features inside tools we already have? Answers come with amnesty. You can’t approve or replace a tool you’ve never heard of.
Keep One Approved-Tools List
The committee’s main output is a list, and the rule that goes with it is short. In the webinar Erik put it this way: “if it’s not approved, you can’t use it.” That sentence goes in company policy. For every tool on the list, I’d record six things.
| Field | What goes in it | Example |
|---|---|---|
| Tool and plan | Product, vendor and license type | Microsoft 365 Copilot, business license |
| Approved use | The specific tasks, not “general use” | Drafting service follow-up emails |
| Data allowed | What may and may not go in | No credit applications, Social Security numbers or deal files |
| Who has access | Roles, never individual names | Service advisors, BDC |
| Owner | The manager accountable for its use | Fixed operations director |
| Next review | A date on the calendar | End of the quarter |
Roles, not names, in the access column. When a service advisor leaves, the access belongs to the role, and nobody has to remember to update a spreadsheet on their last day. That’s ownership built into the list itself, and it’s far easier to support.
Keep it standardized across every rooftop, too. A group where each store keeps its own approved list ends up with five lists and no standard. One list, one owner, one review date.
This is also where the committee hands staff the sanctioned tool. Helion’s managed AI service for dealerships sets up a private, managed AI chat environment with role-based access controls, adoption reporting and an audit trail of prompts and responses, which gives a committee something to approve instead of something to ban. Whatever you pick, the platform decision comes first and staff use comes second.
A short list everyone follows beats a long policy nobody reads. Every time.
Set the Handoff Points Before Anything Customer-Facing Goes Live
I’ll be upfront about our lane here. Chat assistants, AI phone answering and scheduling bots mostly come from your CRM and software vendors, and Helion’s AI work is internal operations, so I won’t tell you which one to buy. What the committee owns is the approval and the handoff. Who signs off before a tool talks to customers, and the exact points where a person at the dealership takes over.
Write those points down before launch. Not after the first angry review. Here’s a starting set I’d put in front of any committee:
- The customer asks for a person. That’s an immediate handoff, every time, to a named role that picks it up.
- Price, payment, trade value, credit or financing go to a salesperson or the F&I office. Our post on AI payments at car dealerships gets into who controls the transaction.
- Complaints and warranty disputes? A manager.
- If the tool can’t see live inventory or the service schedule, it hands off rather than guessing at an answer it can’t confirm.
Each approval also names who reads the transcripts and how often. If nobody reads what the bot says, nobody is governing it.
Put the Sign-Off in the Employee Handbook
When an attendee asked whether staff should sign an AI usage policy, either in the handbook or as a separate agreement, Erik didn’t hedge: “Absolutely, 100%. That should be part of your employee handbook.” He also gave the rule to start with: “no personal use of AI whatsoever in the dealership and no uploading any dealership data into any AI, right? That’s not corporate controlled.”
The committee doesn’t write the policy from scratch. Our dealership AI policy template has the wording, department by department. The committee approves it, HR puts it in the handbook, and then the committee owns three things that keep it real. New hires sign during onboarding. Everyone re-signs when the approved list changes in a way that affects their job. And signed copies are kept somewhere you can actually produce them.
That last part matters. It ties into your compliance program. Under the FTC Safeguards Rule, a dealership’s Qualified Individual reports in writing, at least annually, to the board of directors or equivalent governing body (16 CFR 314.4(i)). AI use belongs in that report now, and a committee with minutes, an approved list and signed policies gives the Qualified Individual something real to report. It turns a requirement into a program you can operate and defend.
Signatures without a list behind them don’t protect anybody.
The First Three Meetings
If you want an outside reference for the charter, the NIST AI Risk Management Framework, released in January 2023 for voluntary use, names Govern as one of its four functions alongside Map, Measure and Manage. You don’t need to adopt the whole framework to borrow its first word. Govern. Here’s how I’d run the first three meetings.
| Meeting | On the agenda | Leave with |
|---|---|---|
| 1. Charter | Chair and final approver, seats, how decisions get made, how often you meet, the AI strategy in a paragraph | A one-page charter the dealer principal signs |
| 2. Inventory | Each department reports the AI in use, personal tools and vendor features included | The shadow AI list and the open requests |
| 3. Approve | The sanctioned platform, the first approved-tools list, the policy, the customer handoff rules | List version 1, and the policy on its way into the handbook |
After that, meet monthly while requests are coming in fast, then quarterly once the list settles. Every approval gets a measure attached, so a year from now you’re not part of the 1 in 3 who can’t say what AI did for them.
Where Helion Fits
Helion manages IT for 2,000-plus dealerships, and on a client’s AI committee we can fill the systems seat, beside the dealer’s own IT manager or as the IT team. For a new committee, our AI readiness assessment for dealerships produces the starting inventory: which AI tools staff already use, what customer data those tools can reach, and whether a written policy exists. The decisions stay yours.
Before Your First Committee Meeting
We’re one rooftop. Isn’t a committee overkill?
Who wins when the GM wants a tool and IT says no?
Does the committee pick our AI chat or phone vendor?
Can our managed IT provider just run it for us?
Realistically, how often does the approved list change?
Nothing Goes Live Without a Yes
Go back to that webinar question about wiping out personal accounts. A committee doesn’t answer it head-on. It makes the question smaller every month, because staff have an approved tool, a list they can check, a policy they’ve signed and a person they know to ask. That’s simpler, more secure, and easier to support than chasing personal accounts one at a time. If you’d like to see what AI is already running in your stores before the first meeting, start with our complimentary IT and cybersecurity assessment.
Decide who says yes. Then make the yes easy to get.