An AI vendor risk assessment for a dealership lists every vendor whose product runs AI on your data, what customer data each one can read or write, who approved that access, and when it gets checked again.
Last updated: October 28, 2026
We had a client whose IT person was working on an AI project, consolidating data from a few systems, and they called our team with a simple request. “I need admin to do this AI thing.” We asked what, exactly, and the answer turned into a meeting. They were about to launch an AI tool with network-wide administrative access, tied into Microsoft 365 and everything else in the building. Network-wide. For one project.
Think about what that tool could answer. What are all the executives making? What are all the pay plans? Every file the admin account could open, the AI could open too, for anybody who knew how to ask. Nobody was being reckless. They were trying to get a project done.
That one got a meeting before it got a launch. Most of the AI reaching into dealership data doesn’t come through an IT person asking permission, though. It shows up as a new feature inside a vendor you approved years ago, or a marketing tool somebody connected with one click. I said it in a DealersEdge webinar earlier this month and I’ll say it again here: “So now we’re taking that data out of these vendors, these vetted vendors that are supposed to secure the data and now the dealer is becoming responsible.”
That’s the job of an AI vendor risk assessment. It’s a piece of the managed AI work we do for dealerships, and it answers one question across every vendor you pay: who can reach your customer data, and through what door?
The AI Came In Through Vendors You Already Approved
Most dealers I talk to think of AI as the thing staff do in ChatGPT. That’s part of it. The bigger part is already wired into the software you run. Cox Automotive’s AI in Auto Retail Tracker, published in August 2026 from surveys of 504 dealers in Q1 and 483 in Q2, found that 82% of dealers use AI today. Its tracker page says dealers most often use a mix of standalone tools like ChatGPT, Gemini, and Grok alongside AI built into the dealership software they already use.
Here’s the number that worries me. In the Q1 wave, 63% of dealers said they trust AI embedded in their dealership tools more than standalone AI. I get why. The CRM vendor passed your review once, so the new AI feature feels pre-approved. It isn’t. The review you did three years ago looked at a product that didn’t send your customer records to a language model, didn’t keep prompts, and didn’t have a model provider sitting behind it as a subcontractor.
New feature, old paperwork. That gap is where customer data walks out.
Verizon’s 2025 Data Breach Investigations Report, which looked at 12,195 confirmed breaches, found that third-party involvement in breaches doubled to 30%. That figure covers every industry, not just car dealers. Still. A dealership runs on vendors, so the math isn’t hard. Every one of them that adds AI adds a new path to the same customer file.
Trust in a vendor isn’t a review of the vendor.
What an AI Vendor Risk Assessment Covers
An AI vendor risk assessment is a review of every outside product that uses AI on dealership data. For each one, it records what customer data the AI can read or change, the access it holds, how long the vendor keeps that data, whether the data trains a model, who approved it, and when it gets reviewed again.
It’s a cross-vendor review. It isn’t a how-to for one connection. If you’re wiring a chat tool straight into your DMS, our guide to connecting generative AI to your DMS without exposing customer data covers that project step by step. This is the wider view: the whole list, side by side, so you can see where the same customer record is exposed five different ways.
Start with the categories. This is roughly what turns up on a typical store’s vendor list.
| Vendor type | Customer data it can usually reach | How it gets in | First thing to ask |
|---|---|---|---|
| CRM add-ons and AI features | Leads, contact history, deal notes, sometimes credit app status | Built-in feature or marketplace app with an API key | Does any of it go to an outside model provider? |
| Website chat | Names, phone numbers, trade details, whatever a shopper types | Script on your site, lead feed into the CRM | How long are transcripts kept? |
| AI phone agents | Call recordings, transcripts, appointments, and service history | Phone system integration plus CRM or DMS write access | Can it write to the customer record, or only read? |
| Marketing and email tools | Customer lists, purchase history, service due dates | Nightly data feed or exported spreadsheet | Is our list used to train or tune anything? |
| DMS marketplace apps | Deal jackets, repair orders, F&I products, payment history | Approved integration through the DMS provider | Which fields does the integration actually pull? |
| Apps connected to Microsoft 365 | Mailboxes, shared drives, calendars, Teams chats | OAuth consent, often granted by one user clicking Accept | Whose mailbox can it read, just one or everyone’s? |
| AI tools staff picked on their own | Anything pasted or uploaded | Personal account, browser extension, desktop app | Did anyone approve it at all? |
That last row is shadow AI, and it’s a policy problem before it’s a vendor problem. Our dealership AI use policy template handles it. Mailbox assistants get their own treatment in our piece on what AI email assistants can read, send and leak. The other rows are vendors with contracts, and contracts are something you can actually manage.
Write it down. Date it. A list in somebody’s head isn’t a list.
The Questions Every AI Vendor Has to Answer
Every vendor says your data is secure. What does that actually mean? Secure from whom, kept where, and for how long? A vendor that can’t answer in writing has answered anyway.
These are the questions we put to each vendor on the list. They don’t all carry the same weight, and some take one email while others take a call with the vendor’s security team.
- What customer data can the AI read, and what can it change? Read access to leads is one risk. Write access to the customer record, where a phone agent can update an address or a chatbot can mark a lead as dead, is a bigger one.
- What access does the integration hold? Ask for the API scopes or OAuth permissions in writing. “Full access” to mail on a Microsoft 365 app can mean every mailbox, not one.
- How long do they keep prompts, transcripts, and outputs, and does that include backups and logs?
- Is your data used to train or improve a model, theirs or anybody else’s? The FTC has warned AI model companies that they have to keep their promises not to use customer data to train or update their models, wherever those promises were made. A promise helps. A contract term is better.
- Who’s behind them? Most AI features run on a model from somebody else, which means your customer’s name and phone number may pass through a company you’ve never signed a contract with and never heard of. Ask which provider, and whether they can switch providers without telling you. Some can.
- How fast will they tell you about an incident, and who at your store gets that call?
- Who approved it on your side? A name and a date. If the answer is “the BDC manager signed up for a trial,” you’ve learned something.
The FTC Safeguards Rule already expects this kind of work from dealers. It says you oversee service providers by picking ones that can protect customer information, requiring those safeguards by contract, and “periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards” (16 CFR 314.4(f)). Our walk-through of the nine FTC Safeguards Rule requirements covers the whole rule. I’d rather you do this for a simpler reason, though. If a vendor’s AI leaks your customers’ information, your store’s name is on the letter that goes out.
Vendor answers go in the file. Verbal assurances don’t count.
Re-Review Every Quarter and Offboard on the Last Day
Vendors add AI features on their own schedule. Last quarter’s clean answer can be wrong today, because a product update turned on a feature, changed the model provider, or quietly rewrote the data terms. It happens. So the list gets a quarterly pass. Short is fine. Did anything new get connected? Did any vendor announce an AI feature? Did any permissions grow?
Then there’s the end of the contract, which is where I see the most mess. A dealer cancels a chat vendor or a marketing tool, the invoices stop, and everybody moves on. The API key still works. The OAuth grant in Microsoft 365 is still sitting there. Microsoft’s own guide to reviewing and revoking app permissions points out that revoking a permission doesn’t stop users from consenting to the app again. Somebody has to block it, not just remove it. Removing isn’t blocking.
So offboarding gets its own checklist: revoke the keys and app grants, ask the vendor in writing to delete your data and confirm it, and check that the lead feed or nightly export actually stopped. We wrote about this side of it in our piece on AI and machine identities, the logins that belong to software instead of people. They don’t quit. They don’t retire. They just keep working until someone turns them off.
A canceled contract isn’t a closed door.
Where Helion Fits
I’ll be fair to the tools here. I use AI every day, and some of these vendor features are genuinely useful to a sales floor or a service drive. The argument was never about keeping AI out. It’s about knowing which vendors can reach your customers and making sure somebody is watching. Use it. Watch it.
We support 2,000-plus dealerships and about 35,000 end users, and a vendor risk rating is part of the compliance program we run for clients, so this isn’t a side project for us or something we bolted on when AI got popular. Because we work only with dealerships, the same CRM, chat, and phone vendors come up again and again across our clients. When one of them adds AI, it isn’t news to us. If you’re still sorting out the bigger picture, our guide to AI governance for dealerships is the place to start.
Questions Dealers Ask Before the Review
We already did a vendor review for the Safeguards Rule. Doesn’t that cover AI?
Who at the dealership should own the list?
Realistically, how many AI vendors does a store have?
Can we just tell vendors to turn the AI off?
Is this the same as an AI readiness assessment?
Approval Isn’t Oversight
Go back to that IT person who asked us for admin. They weren’t doing anything wrong, and neither is the dealer who says yes to a CRM upgrade or a chat vendor’s new assistant. Each of those calls made sense on the day somebody made it. What almost nobody does is pull them all up together a year later and ask which ones can still reach a customer’s file. That’s the review. If you’d like help putting the list together, our complimentary IT and cybersecurity assessment is where we’d start.
A vendor list nobody reads is just a list of open doors.